Running DiagnosticSource on Alerts

Last updated - 07 June, 2026

On the Alerts page, you can view alerts for the resources that have DiagnosticSource applied to them. To diagnose an issue, you can either manually run a DiagnosticSource or an active alert can trigger automated running of a DiagnosticSource.

On the Alerts page, you can select an alert and manually run a DiagnosticSource for the affected resource.

An alert can be generated based on a resource, resource group, resource property filters, LogicModule, instance, or datapoint. When an active alert matching the values specified in the Action rule is triggered, the DiagnosticSource specified in the Action rule runs automatically as per the stage defined in the Action chain. You can run a maximum of 20 automated DiagnosticSources in a minute.

When an alert is generated, only the first five matching action rules are evaluated. The evaluation is based on the update order, and the most recently updated rule is run first.

For DiagnosticSources run manually or automatically, you can view the output result and history of the diagnostic action performed on the resource.

When manually running DiagnosticSources, if the daily execution quota is exhausted, a message indicating the quota limit displays on the UI. In case of automated running of DiagnosticSources, a log entry is added to the Audit logs. For more information, see Audit Logs.

LogicMonitor handles manually run DiagnosticSources on the Alerts page and the Resources page separately. When a DiagnosticSource is triggered on the Resources page, its output and run history display only on the Resources page and not on the Alerts page. However, when a DiagnosticSource is triggered on the Alerts page, its output and run history display both on the Alerts page and Resources page for the same resource.

Requirements for Running DiagnosticSource on Alerts

To run DiagnosticSources on Alerts, you need the following:

• Enable the Enable Running Diagnostic Sources switch on the Security settings page. 
  For more information, see Security Settings.
• A LogicMonitor user with resource permissions for “Diagnostic Source” settings for the resource group.
  For more information, see Resources Role Permissions.
• A LogicMonitor user with “Manage” permission for all installed modules in My Module Toolbox.
• Install EA Collector 38.200 or later on your machine
  For more information, see Adding Collector.
• Sufficient daily contracted executions quota
• Manually created DiagnosticSource or out-of-the-box DiagnosticSource modules imported in My Module Toolbox and applied to the resources.
  For more information, see DiagnosticSource Configuration.

In addition, for automated running of DiagnosticSources, you need the following:

• Action rule and Action chain configured with DiagnosticSource specified in it
• Action rule enabled for use in My Module Toolbox
• An active alert, that is, an alert generated for less than 24 hours (after 24 hours, the alert cannot trigger automated DiagnosticSource)

Viewing Automated Run Result of DiagnosticSource on Alerts

1. In LogicMonitor, navigate to Alerts.
2. In the Search field, enter a value for alert where the resource has DiagnosticSource applied.
   LogicMonitor attempts to match values as you type.
3. Select the alert and then select the Diagnostics tab.
   A list of the latest executions of each DiagnosticSource run for the past 30 days displays.
4. Select a record.
   
   You can view the following details:
   • Date and time when the DiagnosticSource run started and ended
   • Name of the applied DiagnosticSource
   • Alert ID that triggered automated run of DiagnosticSource
   • Recent run status
   • Name of the Action rule and Action chain
   • Output details
   • Option to view output in fullscreen mode, download, and copy the output
5. You can select Refresh to view the latest run output.

Manually Running DiagnosticSource on Alerts

1. In LogicMonitor, navigate to Alerts.
2. In the Search field, enter a value for alert where the resource has DiagnosticSource applied.
   LogicMonitor attempts to match values as you type.
3. Select the alert and then select the Diagnostics tab.
   A list of the latest executions of each DiagnosticSource run for the past 30 days displays.
4. Select Run Diagnostics.
   
   On a new page, a table with a list of all the DiagnosticSources applied to the resource displays.
5. In the Actions column, select Run for the DiagnosticSource that you want to run.
   
   The system runs the DiagnosticSource and updates the execution status as In Progress.
   When the process is complete, you can view the latest output in the Overview tab.
   
   By default, the Overview tab displays the following details:
   • Name of the DiagnosticSource
   • Recent execution status
   • Date and time when the DiagnosticSource execution started and ended
   • Username of the user who triggered the running of DiagnosticSource 
   • Output details
   • Option to view output in fullscreen mode, download, and copy the output
6. Select the History tab.
7. (Optional) Select a time range.
8. Select a record to view the run history for the resource.