How does LogicMonitor know what to monitor for a device?

There are several related processes that determine which DataSources LogicMonitor uses to monitor a given device. 

1. Device properties are set

Ultimately, device properties determine whether a particular DataSource should apply to a device.  There are a couple of ways that properties are set for a device:

1. Device properties are set

The Auto Properties System

When a device is added to LogicMonitor, the Auto Properties system runs a series of basic checks to determine what kind of device it is; this information is stored in device properties, such as system.sysinfo and system.sysoid.  The series of basic checks is as follows:

  1. LogicMonitor queries a device using WMI. If the device responds, the response contains the Windows operating system version. LogicMonitor stores the version information in the system.sysinfo property.
  2. If the device doesn't respond, LogicMonitor continues to query using the following SNMP versions in the following order: Version 3, Version 2c, Version 1.  If the device responds, the SNMP version of that query is stored in the snmp.version property.  All subsequent SNMP queries then use the designated version.  Devices responding to SNMP are then queried for their sysObjectID and sysDesc OIDs. LogicMonitor records these values in the system.sysoid and system.sysinfo properties for the device.  The returned SNMP system OID is looked up in the OID to category mapping table and appropriate values are assigned to the system.categories property.


  • If there is a Windows device with an SNMP agent running, the system.sysinfo property reflects the WMI response of the operating system version, not the SNMP response.
  • If you add a device and Auto Properties discovery fails due to device configuration issues, for example, SNMPd not running, consider manually running Active Discovery to speed up the process once the issue is corrected.
  • If the issue was a LogicMonitor configuration issue, for example, the wrong SNMP community string was set in the property, LogicMonitor will automatically run the discovery when you update the property.
  • The Auto Properties subsystem also discovers other basic information about the device, including the IP addresses recorded as the system.ips property value.
  • Once the system type has been discovered, the Auto Properties system will run periodically to re-discover properties for WMI (isWindows()), SNMP (hasCategory("snmp")), XenServer (system.virtualization =~ "XenServer") and ESX systems (system.virtualization =~ "VMware")

Manually set properties

Other properties can be set on the device manually or on groups of which the device is a member.  The system.groups property is changed simply by placing a device into a group - it lists all the LogicMonitor groups of which the device is a member.

2. Device properties are compared against DataSource AppliesTo functions

The total set of properties of the device -- as set by the Auto Properties process, the OID to Category mapping process, or properties manually applied to the device or groups of which the device is a member -- are now used by the AppliesTo field of DataSources to determine which DataSources should be associated with the device.

2. Device properties are compared against Datasource Applies To functions

3. Data is collected

Once a DataSource applies to a device, instances will be discovered for the device and data collection will begin.  For single-instance DataSources, an instance will be automatically added and data collection will start immediately.

For multi-instance DataSources, further conditions must be met before data can be collected for a device:

  • If Active Discovery is enabled, the Active Discovery script of the datasource must return at least one instance for the device. For example, the Mysql- datasource checks to see if the device responds on port 3306. Any device that does not respond on port 3306 will not have any active MySQL instances monitored, even though the MySQL- datasource will be applied to all devices. Similarly, the IIS- datasource applies to all Windows systems, but will only collect data for Windows machines that are actually running IIS, as determined by Active Discovery.
  • The instances returned by Active Discovery must pass all applicable filters.  For example, the MysqlSlave- datasource will not have any active instances monitored for Mysql, even if Mysql is running, unless a column named Master_Host exists in the output of a "Show Slave Status" SQL query.
  • If Active Discovery is not enabled, an instance must be defined manually on a device.