Agent Status Alert

[oakdag]

Hi,

How can I send it as an alarm when Oneagent does not start or gets an error? Is there anyone have an idea?
By the way, host availability is not oneagent availibility.

Regards,

Oakdag

[ChadTurner · Accepted solution]

Yes this is configurable. you can set an alert via Custom event for alerting to say If data is missing alert, because that would simulate the Oneagent traffic ending or the oneagent stopped. You can also be alerted on entities being unmonitored and that is when hosts communication drops out but the host is not turned off - so the Oneagent is not talking or the communication is blocked/non existent. 

[AntonioSousa]

In cases where I need to have that information, you can go to the Process group settings for each of the OneAgent PGs, and activate availability monitoring:

[Yosi_Neuman]

Hi @AntonioSousa 

We have activated the availability monitoring on:

• OneAgent system monitoring
• OneAgent network monitoring
• OneAgent monitoring extensions 

Shout down the one agent service but no problem was opened 🙄

Tried also with OS service monitoring again with no success 😭

What are we missing here 🤔?

Thanks in advance for your inputs 

Yos 

[AntonPineiro]

Hi,

Same than you. Only working creating a metric selector event about missing data. But it has a limitation about how many you can create per environment.

Best regards

[lucas_hocker]

@AntonPineiro & @Yosi_Neuman , I'm struggling to understand this use case a bit. So the user is performing a graceful shutdown of OneAgent, i.e. intentionally. The host itself is not shutdown. And this is a condition you wish to be alerted on? Always? After some amount of time?

[AntonPineiro]

Hi,

It means, it is not powered off hosts itself. If I shutdown host, yes, I get an alert with that config.

It is more if I execute "systemctl stop oneagent.service" for stopping OneAgent service. In that case, we are not getting monitoring information and you can see a gap in metrics but no alert is triggered.

Only way is creating a metric event for some Oneagent process metric (CPU, memory...) and turning on alert me if missing data.

As a summary, it is be alerted when, for some reason, OneAgent itself is stopped / crashed and we are not monitoring host, processes... It means, be alerted when OneAgent status is no "Up".

[AntonioSousa]

@lucas_hocker,

I remember two use-cases for configuring this:

• A case where OneAgent was being shut down without justification by an administrator
• A bad interaction with an anti-virus

In my case, I don't remember it misbehaving. But the use-case was certainly there.

[Yosi_Neuman]

Hi @lucas_hocker 

The most obvious use case is when security guys delete FW rules that allows OAs communicate with AGs or cluster. 

Shutting down the OA service was just a way to try and see if the configured alert is working.

Next step will be to mark KEY HOSTs  that must be on and connected in cases of HU license shortage but first lets get alert for OA that is down. 

HTH

Yos  

[Yosi_Neuman]

IMO builtin:host.availability.state metric can help us here 

HTH

Yos 

[AntonPineiro]

Hi,

Yes, but it still has a limitation about how many you can create. It means, alert missing data require a metric-selector-based query.

Best regards

[Peter_Youssef]

hi @oakdag 
Consider the path of the deployment on either windows and Linux and installed Oneagent service name

Simple solution:

Windows 

• create OS service monitoring rule and provide the below parameters

optionally add property

Linux

• create OS service monitoring rule

add property as well

Thanks