Types of Alerts in LogicMonitor
Last updated on 13 April, 2023LogicMonitor can generate alerts on a variety of components in the platform. The following table explains the components that can trigger alerts and examples of different types of alert IDs associated with each:
| Component | Description | Alert Type | Example |
| DataSources | DataSources define the numerical data, called datapoints, that are collected through periodic polling from a Collector. An alert on a DataSource is the most common type of alert and is triggered when datapoint values that a Collector receives from a device exceed the thresholds you specify—or when there is an absence of expected data. For more information, see Datapoint Overview. | LMD DataSource Alerts | LMD112299 warn – ESXi HP320 VMware Host Performance DiskWriteLatency ID: LMD112299 Host: ESXi HP320 Datasource: VMware Host Performance |
| EventSources | EventSources watch particular files such as event log messages (IPMI, Windows, or Syslog) or SNMP traps. An alert on an EventSource is triggered when LogicMonitor receives a message for an event that matches an EventSource definition. For more information, see Creating EventSources. | LME EventSource Alerts | LME10351880 error – veeambr.windows.lab Windows System Event Log ID: LME10351880 Host: veeambr.windows.lab Eventsource: Windows System Event Log |
| LM Logs | A log alert is triggered when an incoming log event matches alert conditions configured on a log processing pipeline. For more information, see Log Alert Conditions and Log Processing Pipelines. | LML Log Alerts | LML3304916149 error – docsite-knc88 LM Logs ID: LML3304916149 Host: docsite-knc88 LogAlert: LM Logs Message: 127.0.0.1 – – [22/Mar/2021:09:36:11 +0000] “GET / HTTP/1.1” 200 12557 “-” “LogicMonitor” “-” |
| Websites | Websites are monitored to ensure their availability. An alert on a website is triggered when a specified number of checks fail at a specified number of test locations. For more information, see Website Alerts. | LMS Website Alerts | LMS91372675 warn on String Check from location Australia – Sydney ID: LMS91372675 Service: String Check Checkpoint: Australia – Sydney Datapoint: status |
| JobMonitors | JobMonitors on Windows and Linux/Unix systems can be monitored to ensure that jobs start on time, complete when expected, and exit with the proper exit code. An alert on a JobMonitor is triggered when a monitored job exits with a non-zero exit code, does not complete within a specified run time, or does not start on time. For more information, see Creating JobMonitor Definitions in LogicMonitor. | LMB JobMonitors Alerts | ID: LMB444 Host: ATX-Local-Data-Guard Batchjob: Sync Orgs for Splunk Level: warn Started on: 2017-01-16 10:30:00 GMT+02:00 Finished on: 2017-01-16 10:40:00 GMT+02:00 |
| Device Groups | Device groups are collections of strategically grouped devices. Alerts for device groups, called Cluster Alerts, are triggered based on the overall state of the group. For example, you could configure a Cluster Alert to trigger when more than five batch servers within a device group have CPU usage rates over 80%. For more information, see Cluster Alerts. | LMHC Host Cluster Alerts | ID: LMHC2 Hostgroup: LAB/SQL Cluster Servers Datasource: SQL Services- Datapoint: State Level: warn Start: 2014-12-11 21:44:59 EST Duration: 10h 8m Value: 3.00 hosts in alert Reason: > 2 |
| Collectors | Collectors are LogicMonitor applications that run on servers within your infrastructure to intelligently monitor devices. An alert on a collector (called a Collector Down Alert) is triggered when LogicMonitor has not heard from a Collector for more than five minutes. | LMA Collector unreachable | ID: LMA2 The LogicMonitor system has not received any data from Collector LAB\LMC0001 since 2015-11-16 19:38:31 EST. |
| LMF Collector failover event | ID: LMF27 The LogicMonitor system has not received any data from Collector LAB\LMC0001 since 2015-10-31 05:55:26 EDT. LogicMonitor switched all devices monitored by this collector to its backup collector LAB\LMC0002. Automatic failback will return devices back to the primary Collector ATXLAB\LMC001 when it has recovered. Failback is currently true. | ||
| LMF Collector unreachable | ID: LMF1 LAB Collector 1 (LAB\LMC0001) failed back LogicMonitor moved all devices(453,455,191) back to collector LAB\LMC0001 | ||
| ConfigSources | ConfigSources generate alerts based on config checks. Much like a datapoint and threshold in a DataSource, a config check monitors the availability of a config file, or specific contents of the file, and triggers an alert when defined criteria are met. For more information, see Creating ConfigSources. | LMD ConfigSource Alerts | ID: LMD3119 Host: Lab Cisco 3560 Configsource: IOS Configs-running-config InstanceGroup: @default Configcheck: DifferenceTest |
| Alert Throttling | Notifications can be triggered when alert rate throttling limits are reached. For more information, see Escalation Chains. | LMT Alert Throttling notice | ID: LMT10 More than 20 alerts were sent in the last 10 minutes for the escalation chain Syslog test notification. Additional alert notifications are being suppressed based on your rate limit settings. Please log in to your LogicMonitor portal for alert details. |
| Services | Services are instances across one or more monitored resources that are grouped into a logical “service”. Data can be aggregated across these instances for monitoring, visualization, and alerting at the service level. For more information on Services, see About LM Service Insight. | — | — |