What does LogicMonitor alert on?

Last updated on 13 April, 2021

There is an overall Alerts page available from the left-hand main menu that displays all alerts across your entire LogicMonitor account, as well as filtered Alerts pages (i.e. tabs) that are available from the detail pages of your various devices, cloud resources, instances, websites, services, and groups.

The following are LogicMonitor components that can be used to trigger alerts and examples of different types of alert IDs associated with each.

DataSources

DataSources define the numerical data, called datapoints, that will be collected through periodic polling from a Collector. An alert on a DataSource is the most common type of alert and is triggered when datapoint values that a Collector receives from a device exceed the threshold(s) you’ve specified—or when there is an absence of expected data. For more information, see Datapoint Overview.

Alert Type Example
LMD
DataSource Alerts
LMD112299 warn – ESXi HP320 VMware Host Performance DiskWriteLatency
ID: LMD112299
Host: ESXi HP320
Datasource: VMware Host Performance

EventSources

EventSources watch particular files such as event log messages (IPMI, Windows, or Syslog) or SNMP traps. An alert on an EventSource is triggered when LogicMonitor receives a message for an event that matches an EventSource definition. For more information, see Creating EventSources.

Alert Type Example
LME
EventSource Alerts
LME10351880 error – veeambr.windows.lab Windows System Event Log
ID: LME10351880
Host: veeambr.windows.lab
Eventsource: Windows System Event Log

LM Logs

A log alert is triggered when an incoming log even matches alert conditions configured on a log processing pipeline. For more information, see Log Alert Conditions.

Alert Type Example
LML
Log Alerts
LML3304916149 error – docsite-knc88 LM Logs
ID: LML3304916149
Host: docsite-knc88
LogAlert: LM Logs
Message: 127.0.0.1 – – [22/Mar/2021:09:36:11 +0000] “GET / HTTP/1.1” 200 12557 “-” “LogicMonitor” “-”

Websites

Websites can be monitored to ensure their availability. An alert on a website is triggered when a specified number of checks fail at a specified number of test locations. For more information, see Website Alerts.

Alert Type Example
LMS
Website Alerts
LMS91372675 warn on String Check from location Australia – Sydney
ID: LMS91372675
Service: String Check
Checkpoint: Australia – Sydney
Datapoint: status

JobMonitors

JobMonitors on Windows and Linux/Unix systems can be monitored to ensure that jobs start on time, complete when expected, and exit with the proper exit code. An alert on a JobMonitor is triggered when a monitored job exits with a non-zero exit code, doesn’t complete within a specified run time, or doesn’t start on time. For more information, see Creating JobMonitor Definitions in LogicMonitor.

Alert Type Example
LMB
JobMonitors Alerts
ID: LMB444
Host: ATX-Local-Data-Guard
Batchjob: Sync Orgs for Splunk
Level: warn
Started on: 2017-01-16 10:30:00 GMT+02:00
Finished on: 2017-01-16 10:40:00 GMT+02:00

Device Groups

Device groups are collections of strategically grouped devices. Alerts for device groups, called Cluster Alerts, are triggered based on the overall state of the group. For example, you could configure a Cluster Alert to trigger when more than five batch servers within a device group have CPU usage rates over 80%. For more information, see Cluster Alerts.

Alert Type Example
LMHC
Host Cluster Alerts
ID: LMHC2
Hostgroup: LAB/SQL Cluster Servers
Datasource: SQL Services-
Datapoint: State
Level: warn
Start: 2014-12-11 21:44:59 EST
Duration: 10h 8m
Value: 3.00 hosts in alert
Reason: > 2

Collectors

Collectors are LogicMonitor applications that run on servers within your infrastructure in order to intelligently monitor devices within your infrastructure. An alert on a collector, called a Collector Down Alert, is triggered when LogicMonitor has not heard from a Collector for more than five minutes.

Alert Type Example
LMA
Collector unreachable
ID: LMA2
The LogicMonitor system has not received any data from Collector LAB\LMC0001 since 2015-11-16 19:38:31 EST.
LMF
Collector failover event
ID: LMF27
The LogicMonitor system has not received any data from Collector LAB\LMC0001 since 2015-10-31 05:55:26 EDT. LogicMonitor switched all devices monitored by this collector to its backup collector LAB\LMC0002.
Automatic failback will return devices back to the primary Collector ATXLAB\LMC001 when it has recovered. Failback is currently true.
LMF
Collector unreachable
ID: LMF1
LAB Collector 1 (LAB\LMC0001) failed back
LogicMonitor moved all devices(453,455,191) back to collector LAB\LMC0001

ConfigSources

ConfigSources generate alerts based on config checks. Much like a datapoint and threshold in a DataSource, a config check monitors the availability of a config file, or specific contents of the file, and triggers an alert when defined criteria are met. For more information, see Creating ConfigSources.

Alert Type Example
LMD
ConfigSource Alerts
ID: LMD3119
Host: Lab Cisco 3560
Configsource: IOS Configs-running-config
InstanceGroup: @default
Configcheck: DifferenceTest

Alert Throttling

Notifications can be triggered when alert rate throttling limits are reached. For more information, see Escalation Chains.

Alert Type Example
LMT
Alert Throttling notice
ID: LMT10
More than 20 alerts were sent in the last 10 minutes for the escalation chain Syslog test notification.
Additional alert notifications are being suppressed based on your rate limit settings. Please log in to your LogicMonitor portal for alert details.

Services

Services are instances across one or more monitored resources (e.g. devices) that have been grouped into a logical “service”. Data can then be aggregated across these instances for monitoring, visualization, and alerting on this data at the service level. For more information on Services, see About LM Service Insight.

In This Article