Come join our live training webinar every other Wednesday at 11am PST and hear LogicMonitor experts explain best practices and answer common questions. We understand these are uncertain times, and we are here to help!
AppliesTo scripting is a method for selecting a set of LogicMonitor resources based on their properties. These properties may be assigned automatically via basic system information discovery or PropertySource execution, inherited from the parent resource or resource group, or they may be assigned manually. For more information, see Resource and Instance Properties.
As a proprietary LogicMonitor scripting language, AppliesTo scripting queries the resources that you have added into monitoring and returns those resources for which the expression evaluates to TRUE. AppliesTo scripting serves several purposes across LogicMonitor, including:
The majority of LogicMonitor’s out-of-the-box LogicModules feature AppliesTo expressions that require no customization. However, if you are updating/creating LogicModules, or if you are building AppliesTo expressions in other areas of the product, it’s important to understand how the scripting language operates.
Note: If you are updating an AppliesTo expression for the purpose of changing which resources a LogicModule is associated with, do so with extreme caution as all historical data collected by a LogicModule is lost upon disassociation. As best practice, always test AppliesTo scripting changes before updating the LogicModule definition, as discussed in the Building and Testing AppliesTo Statements section of this support article.
The following operators are available for use in AppliesTo expressions.
The functions true() and false() match all or no resources, respectively. As the true() function will match every resource in your portal, use sparingly, if at all, and with caution. The false() function can be useful to globally disable a LogicModule without deleting it (though be aware any historical data will be lost when a LogicModule is disassociated from a resource). The false() function can also be used with a LogicModule under development to prevent it from being applied to any resources prematurely. Neither function accepts parameters.
true()
false()
LogicMonitor maintains a number of built-in functions to identify common categories of resources. Most of these functions inspect the system.sysinfo property (which is populated via WMI (for Windows devices) or SNMP (for Linux, NetApp, Netscaler, Cisco)) and/or the system.categories property (which is most typically populated by PropertySources, although it can be populated manually). Convenience functions do not accept parameters.
system.sysinfo
system.categories
While most resource properties, whether system or custom, are string or numeric type, there are several which are array type, notably:
There are specific AppliesTo functions for working with arrays.
contains(<array>,"<string>")
This function returns TRUE if the specified string matches an array element. The match is a complete match on the search string, case insensitive. Regex is not supported.
contains(system.groups,"network") Matches groups (dynamic and static) at the root of the Resources tree named “network”, “Network”, “nEtWoRk”, and so on.
contains(system.groups,"network")
Note: The system.groups property cannot be used in AppliesTo scripting expressions that are intended to dynamically organize resources into groups. As discussed in Device Groups Overview, if you wish to create a dynamic group that is dependent on group membership, you must use the system.staticgroups property (for example, contains(system.staticgroups,"network").
system.groups
system.staticgroups
contains(system.staticgroups,"network")
contains(system.staticgroups,"Acme Corp/Prod") Matches child groups of “Acme Corp” named “Prod” or “prod”, but not those named “production”, “Prod_QA”, and so on.
contains(system.staticgroups,"Acme Corp/Prod")
Note: Only static group membership (not dynamic group membership) is queried when the system.staticgroups property is referenced.
contains(system.ips,"192.168.170.1") Matches resources with an IP address of 192.168.170.1.
contains(system.ips,"192.168.170.1")
Note: The contains() function can only be used to match the full IP address of a resource. For partial IP address or range matching, use the join() function.
contains()
join()
join(<array>,"<separator>")
This function flattens an array to a string with array elements separated by the designated separator. Required parameters are the array name (for example, system.groups) and the string separator (for example, “,”). Unlike contains(), partial match and regex are supported. When used alone it returns TRUE for resources which have any value set for the specified array property.
join(system.ips,",")=~"192.168.100." Matches resources with an IP address on the subnet 192.168.100.X. The ability to match on the partial IP address of a resource is useful for grouping devices by subnet or IP range.
join(system.ips,",")=~"192.168.100."
join(system.groups,",")=~"Prod" Matches resources in groups with names like “Prod”, “production”, “Prod1”, and so on at any level of the Resources tree.
join(system.groups,",")=~"Prod"
join(system.staticgroups,",")=~"/.*dev" Matches resources in any non-dynamic child group whose name contains “dev”, “Dev”, “DEV”, and so on.
join(system.staticgroups,",")=~"/.*dev"
!join(system.categories,",") Matches any resource for which system.categories is empty. Equivalent to !system.categories.
!join(system.categories,",")
!system.categories
hasCategory("<string>")
This function queries the system.categories property for an array element that is a complete, case insensitive match for the specified string. Regex is not supported. Returns TRUE if there is a match.
hasCategory("sonicwallfw")
The following functions operate on properties that are string or numeric type.
exists("<property value>")
This function returns TRUE if the specified value is assigned to any of the resource’s properties.
sum(x,y,z)
This function returns the sum of the numbers passed as parameters.
startsWith(<property>,"<value>")
This function returns TRUE if the property value starts with the value specified in the function. Typically the value will be a string and should be enclosed in double quotes. Partial match from the beginning of the string is supported; regex is not. It is possible to pass the value as a number, without double quotes. However, partial match is not supported for numeric values, so the match must be complete for the function to return TRUE.
startsWith(system.sysinfo,"Microsoft") Matches Windows resources.
startsWith(system.sysinfo,"Microsoft")
startsWith(system.collectorversion,"28") Matches resources monitored by Collector versions 28.xxx.
startsWith(system.collectorversion,"28")
startsWith(system.collectorversion,"28102") Matches resources monitored by Collector version 28.102. Note that this is equivalent to system.collectorversion==23102.
startsWith(system.collectorversion,"28102")
system.collectorversion==23102
sysoid
This is an alias to the system.sysoid property that removes the need to escape periods in the OID. Use with the ==, =!, =~ and !~ operators to compare resources’ system OIDs to the specified value. For a partial match, use =~ or !~. When used alone, it returns TRUE for resources which have a value set for system.sysoid.
system.sysoid
==
=!
=~
!~
sysoid!="1.3.6.1.4.1.8072.3.2.10" Matches resources with system OIDs that are not “1.3.6.1.4.1.8072.3.2.10”.
sysoid!="1.3.6.1.4.1.8072.3.2.10"
sysoid=~"8741.1" Matches resources with system OIDs containing “8741.1”.
sysoid=~"8741.1"
sysoid When no value is specified, returns TRUE for all resources which have a value set for this property.
<property name>
Any property name can be referenced as an AppliesTo function. When used alone, it returns TRUE for any resource which has a value set for the specified property. It can be used with operators for comparison purposes.
system.collectorversion>=28000 Matches resources monitored by Collectors version 28.000 and higher.
system.collectorversion>=28000
system.collectorid!=system.prefcollectorid Returns TRUE for resources not being monitored by their preferred Collector.
system.collectorid!=system.prefcollectorid
auto.serial.number=~"^C0E" Returns TRUE for resources with values for the auto.serial.number property which start with “C0E”.
auto.serial.number=~"^C0E"
auto.serial.number
getPropValue("<property name>")
If the device property name contains special characters such as “:”, “/”, “*”, “=”, or spaces, you will need to use the getPropValue("<property name>") function. We recommend not having special characters in your property names, but if it can’t be avoided, this function allows you to use the property in an AppliesTo expression.
For example, if you have a property named “SiteA:unit”, and you want to return resources with this property having values 10 to 19, you might initially try:
SiteA:unit=~"[10-19]"
However, you will receive a syntax error informing you that characters in regular expressions must be escaped. To get past the error you will need to use this expression instead:
getPropValue("SiteA:unit")=~"[10-19]"
Note the property name is enclosed in double quotes.
When getPropValue("<property name>") is used alone it returns TRUE for all resources which have a value set for the specified property.
You can define your own AppliesTo convenience functions globally, and those functions can then be called from any location within LogicMonitor that takes AppliesTo scripting as input. As discussed in User-Defined AppliesTo Functions, user-defined convenience functions are created and managed from the AppliesTo Functions page.
join(system.groups,",")=~"qa|dev"
system.sysoid=~"(.+\\.){5}8072"
All property names are referenced as unquoted strings exactly as they appear on the resource Info tab.The exception is when used as a parameter in the getPropValue("<property name>") function, where the property name must be enclosed in double quotes.
Multiple AppliesTo expressions can be grouped and linked by Boolean operators to make the AppliesTo statement as specific as is required.
isWindows() && (system.sysinfo =~ “x64” || system.sysinfo =~ “Vista”) Returns Windows resources running a 64-bit operating system or Vista.
isWindows() && (system.sysinfo =~ “x64” || system.sysinfo =~ “Vista”)
hasCategory("snmp") && !isWindows() Returns all resources with “snmp” listed as a value in the system.categories property, excluding Windows resources.
hasCategory("snmp") && !isWindows()
isLinux() && system.collectorversion>=28000 && (location=~"Austin" || join(system.groups,",")=~"dev|qa") Returns Linux resources being monitored by Collector version 28 or higher which are either located in Austin or members of a group with a name containing “dev” or “qa”.
isLinux() && system.collectorversion>=28000 && (location=~"Austin" || join(system.groups,",")=~"dev|qa")
Wherever AppliesTo scripting is accepted as input across the LogicMonitor platform, you will see an Applies To field. The Applies To field directly carries the AppliesTo statement. Accompanying this field is a wizard for more intuitive statement building and test functionality for verifying that the statement is working as intended.
Note: If you are updating an AppliesTo expression for the purpose of changing which resources a LogicModule is associated with, do so with extreme caution as all historical data collected by a LogicModule for a resource is lost upon dissociation. As best practice, always test AppliesTo scripting changes before updating the LogicModule definition.
While you can manually enter an AppliesTo statement directly into the Applies To field, you may find it more efficient to take advantage of the AppliesTo wizard for help in building statements.
Click the Wizard button to open the wizard. The AppliesTo wizard allows you to quickly generate AppliesTo statements that use any of the following criteria to determine resource association:
isCisco()
After building an AppliesTo statement using the wizard, click the Save button to save it to the Applies To field. It is strongly recommended that you test the statement (either using the Test button on the wizard or the one located directly beneath the Applies To field) before performing the final form save, as discussed in the following section.
After creating or editing an AppliesTo statement, it is strongly recommended that you test the statement before saving the form and putting the new statement into production. You can test an AppliesTo statement by clicking the Test button from the wizard or the Test AppliesTo button located directly under the Applies To field.
As shown next, the test functionality returns a simple count of resources returned by the AppliesTo statement, along with a “Show me” hyperlink that, when clicked, opens a window listing details for the matching resources.
If you are making updates to an existing AppliesTo statement, the Affected Items window also lists any resources that were included by the previous query, but would be excluded if the current query was saved and put into production.
The ability to view soon-to-be excluded resources upon statement testing is especially critical if you are making AppliesTo updates within a LogicModule definition. This is because removing the association between a LogicModule and a resource also permanently removes all historical data previously collected by that LogicModule for that resource. By testing first, you are ensuring that any dissociations (and resulting data loss) are intentional.
In This Article