Manage monitors - Legacy UI

NOTE  You must enable the Datto Continuity Integration in the New UI before you can configure this monitor. Refer to Datto Continuity Integration.

NOTE  This type of monitor does not automatically resolve alerts. Alerts must be resolved manually.

NOTE  Datto RMM only supports SNMP polling. SNMP traps are not supported.

NOTE  This type of monitor does not automatically resolve alerts. Alerts must be resolved manually.

NOTE  You need to enable the Webroot Integration first. For further information, refer to Webroot Endpoint Security Integration - Legacy UI.

NOTE  Only available at the site level, as part of a Printer Policy.

NOTE  This type of monitor does not automatically resolve alerts. Alerts must be resolved manually.

NOTE  This type of monitor does not automatically resolve alerts. Alerts must be resolved manually.

NOTE  This type of monitor does not automatically resolve alerts. Alerts must be resolved manually.

NOTE  This type of monitor does not automatically resolve alerts. Alerts must be resolved manually.

NOTE  If you select the option Any Drive and multiple drives are over the threshold, only one alert will be triggered, for one of the drives. The Agent will not alert for each drive individually.

NOTE  Any Drive Disk Usage monitor will only show value for a drive that is closest to the threshold set within the monitor. Refer to Real-Time Monitoring Status in the legacy UI and Monitors in the New UI.

NOTE  Windows operational logs have a specific syntax for Log Name and Source. To obtain the correct Log Name and Source for a specific operational log entry, run the command wevtutil qe Application-Name-Here/Operational /c:1 /f:text /rd:true on the device exhibiting a log entry you wish to search for. The output data can be used to create an Event Log monitor definition.

NOTE  The Datto RMM Agent is able to detect events logged up to 10 minutes before the Datto RMM Agent Process starts.

NOTE  You can also monitor built-in Windows backups using an Event Log monitor.

Event log alert de-duplication

• For an Event Log monitor, a total of five alerts can be raised per device within 12 hours. When the fifth alert has been reached, the trigger count will be incremented by one on the last alert. For example, when alert #6 would be raised, the trigger count on alert #5 will display 2 in the Alert Information window in the legacy UI and in the Timeline card in the New UI. The trigger count will keep rising for any subsequent alerts. To learn how to view the Alert Information window in the legacy UI, refer to View and act on alert information. To learn how to view the Timeline card in the New UI, refer to Timeline.

• If an Event Log monitor assigned to a device triggers excessively (over 100 times in 24 hours), the Global monitor alert rate limit will take effect.

NOTE  An Online Status monitor prioritizes monitor configurations with an alert threshold and auto-resolution time set to 15 minutes or less.

NOTE  If the Datto RMM Agent Service and Datto RMM Agent Process are disconnected from the platform, offline alerts are not raised for network devices and network devices are not marked as offline. Offline alerts and offline statuses will be present for network devices only if the Network Node's Agent Service is online and does not receive a ping response from the network device.

• Enter the process name. As you start typing, you will see a list of matching items to choose from.

IMPORTANT   If the process name contains one or more spaces (for example, Reference 4 Systemwide.exe) and the .exe filename extension is included in the entry for this field, the monitor will not function. As a general rule, we recommend entering the process name exactly as it automatically populates from the list of matching items to choose from (that is, without .exe).

• Specify whether an alert should be raised if the process is running or not running OR if it has reached a certain CPU or memory usage (5-100%).
• Specify how long the process should be in this state for before an alert is raised (0-60 minutes).
• Attempt to kill the process if it triggers an alert - Select this check box to stop the process if it triggers an alert as per the criteria you specified. You can only select this check box if you chose "the process is running / not running" option before.

NOTE  This guide assumes that you know the SNMP Object Identifiers (OIDs) that you want to monitor and the thresholds (values) that you want to monitor for. For some general information on SNMP terminology, refer to SNMP background information and terminology.

NOTE  Datto RMM only supports SNMP polling. SNMP traps are not supported.

Trigger Details

• SNMP OID to query: Specify the SNMP OID that you want to monitor. For example: 1.3.6.1.2.1.2.2.
• SNMP Table: Select this check box to monitor multiple tabular OID instances from a single monitor definition so that you don't have to manually create separate monitors for every potential OID (for example, for disks in an array). Each detected object instance will have an individual monitor applied that supports real-time monitoring data.
Each monitored instance will have its own alert status and treat any tickets raised in Autotask or ConnectWise PSA as separate entities if you have either of the integrations enabled.
• Identification column: This field is only editable when the SNMP table check box is selected. Enter the number of the table column that should be used to identify the instance.

EXAMPLE  In this example, the table is zero indexed so the identification column would be column 1 (highlighted).

NOTE  Not all tables are zero indexed; therefore, be mindful of your particular table index as configuration can be unique to your table.

• Value column(s): This field is only editable when the SNMP table check box is selected. Enter the number of the table column that should be monitored. Use curly brackets around the column number. For example: {10}.

EXAMPLE  In this example, the table is zero indexed so the value column would be column 10 (highlighted).

NOTE  Not all tables are zero indexed; therefore, be mindful of your particular table index as configuration can be unique to your table.

Using the examples above, the monitor configuration would look like this:

In the Value column(s) field, it is possible to specify more than one column for simple numeric calculations where operators are evaluated sequentially.

EXAMPLE  If table column 10 contains disk size in kilobytes (524288000) and table column 11 contains disk used in kilobytes (262144000), you can calculate the disk free space in gigabytes by entering the following calculation: {10}-{11}/1048576 (which would be 524288000 - 262144000 / 1048576 = 250). If you select GB in the Format Data as drop-down list further down, the output will be displayed as 250 GB.

• Data Type: Select one of the following options:

• Auto (selected by default)
• Integer
• String
• Timeticks

The monitor will try to convert the value it gets from querying the OID to the selected data type. It will then use the converted data to evaluate thresholds and format results. If the value cannot be converted successfully, it will be returned as Null.

• Save Monitor and Fetch values: Click the button to poll and return the current values for validation purposes. A hundred-second countdown will start as soon as you click the button. If any of the instances are in an alerting state, the value will be displayed in red. This button is available with or without the SNMP Table check box selected. However, it is only displayed when configuring an SNMP monitor at the device level. It is not available when configuring a monitoring policy.

NOTE  Only the first 25 instances will be retrieved for validation purposes.

NOTE  It is recommended to test the configuration at the device level before replicating the configuration in a policy.

Alert Settings

• Alert based on the SNMP result. Use any of the following qualifiers: Equal to, Not Equal, Less than, Less or equal, Greater than, Greater or equal, Contains, Starts with, Ends with, Changed. Enter a value next to the selected qualifier.
• Specify how long the device needs to be in this state for before an alert is raised (0-60 minutes).
• Alert when OID is not responding: Select this check box to have the monitor raise an alert when no response is returned for an OID that has previously returned a response. This will not alert if the OID is not valid or has never responded.
• Alert when OID is returning Null, NoSuchObject or NoSuchInstance: Select this check box to have the monitor raise an alert when Null, NoSuchObject, or NoSuchInstance is returned as a response. If the check box is not selected, these responses will be excluded from generating an alert.
• Check interval: Set the check interval (5-120 minutes).

NOTE  An SNMP monitor does not run immediately upon creation. The first run will occur at a randomly generated time between 10 seconds after creation and the defined check interval. For example, if an SNMP monitor's check interval is set to 60 seconds and the Agent selects 22 seconds as the random time between 10 seconds and the check interval, the monitor's first run will be 22 seconds after creation. The second run will be at 82 seconds as any subsequent check will occur every 60 seconds.

Transform Result

• Result Calculation (Numeric Values): Select this check box to be able to perform a calculation on the result. Once the check box is selected, you can enter a mathematical operator (+ - * /) and any integer. For example, enter *4 to multiply the result by 4. Result calculations are not used to raise alerts. Alerts are raised from the original values.
• Result Translation (Text Values): Select this check box to be able to configure a key to translate the output into a more easily understood string. Once the check box is selected, you can enter a key. For example: 1=OK,2=Bad. Result translations are not used to raise alerts. Alerts are raised from the original values.

NOTE  Result Translation can only be used to convert numerical responses to text strings. A text string cannot be translated to read a different text string.

• Display Name: Enter a display name. It will appear in the description of the monitor on the Device > Monitor > Monitors page in the legacy UI and in the Monitors card on the device summary page in the New UI.

NOTE  If the Display Name is blank when clicking the Save Monitor and Fetch values button, it will be populated with the SNMP OID to query to prevent an invalid configuration.

• Format Data as: From the drop-down list, select how you would like to format the data. The selected format will be appended to the end of the data returned by the monitor. Select any of the following formats: %, GB, MB, KB, Bytes, Days, Hours, Minutes, Seconds, Milliseconds, TimeTicks, °C, °F.

NOTE  A Software monitor cannot alert on missing software but the following ComStore components can: Monitor if Application is not installed and Software Detection Monitor. To learn how to download a component from the ComStore and how to use it, refer to ComStore - Legacy UI and Managing components - Legacy UI.

NOTE  Windows Servers need to be able to get monitors on custom WMI values.

NOTE  Result Translation can only be used to convert numerical responses to text strings. A text string cannot be translated to read a different text string.

EXAMPLE  Example - Monitor the health of your laptop's battery

NOTE  Only available at the site level, as part of a Printer Policy.

NOTE  ESXi Data Store monitor will only show the datastore that is closest to the threshold set within the monitor. Refer to Real-Time Monitoring Status in the legacy UI and Monitors in the New UI.

NOTE  No alert is raised if the status of the monitored object is Unknown.

NOTE  No alert is raised if the status of the monitored object is Unknown.

NOTE  No alert is raised if the status of the monitored object is Unknown.

NOTE  The following monitor type does not have configurable Alert Details: patch monitor.

You can choose the priority of the alert that will be raised:
• Critical - Priority 1
• High - Priority 2
• Moderate - Priority 3
• Low - Priority 4
• Information - Priority 5

In the case of a ping monitor, you can configure further Alert Details. Select any of these check boxes:
• Alert when the device is unreachable for a certain amount of time (1-120 minutes).
• Alert when a certain percentage of ping packets are lost (5-95%).
• Alert when the average roundtrip takes longer than a certain number of milliseconds.

NOTE  The packet loss configuration only alerts if the monitored device is reachable but experiences a degree of packet loss. If you look to alert for the host being completely unreachable, the Alert when host unreachable for (minutes) option needs to be configured.

NOTE  An Online Status monitor prioritizes monitor configurations with an alert threshold and auto-resolution time set to 15 minutes or less.

NOTE  The following monitor types cannot be auto-resolved: Datto Continuity monitor, patch monitor, software monitor, printer monitor, ESXi disk health monitor, ESXi fan monitor, ESXi PSU monitor.

IMPORTANT  This field is not available for ESXi monitors. Response components do not function for Online Status Monitors and Patch Monitors.

Select this check box if you want to run a component as a response to the alert, then select the required component from the drop-down menu. If the selected component has been configured with variables, you can override them here.
Variable value limit: 20,000 characters.
For a component to appear in this list, it needs to be marked as a favorite. For more information, refer to Make a component available for quick jobs.

A few notes to consider

• A response component will only fire if there is not an alert already open.

• When a component is run as a response component, its timeout setting is used. The default setting is for the response component to time out after a maximum of 60 minutes. You may wish to enter a much shorter timeout value (for example, 30 seconds) if running a simple script.

• Gui.exe will not run if started in Session 0 by a custom component script that attempts to start this process in response to an alert.

NOTE  The email field accepts the following characters:
a-z, A-Z, 0-9, @, and !#$%&'`*+-|/=?^_{}~.

NOTE  If the Email the following recipients check box is selected but the Default recipients check box is not selected, you must enter and save a name and an email address in the Additional recipients area.

• Advanced Options - Enter a string to be used as the Subject Line of the alert email. You can include any of the following variables:

• [hostname]: The hostname of the device.
• [description]: The description of the device.
• [os]: The operating system of the device.
• [user-defined1-30]: User-defined field number. Refer to User-defined fields - Legacy UI.
• [lastuser]: The login name of the user that last logged in to the device.
• [sitename]: The name of the site in which the device resides.
• [category]: The category of the alert raised (for example, performance or event log).
• [type]: The type of the alert raised (for example, memory or disk usage).
• [alert]: The trigger details of the monitor that raised the alert.
• [ipaddress]: The external IP address (public IP address) of the device.
• [alertuid]: The alert ID.

NOTE  If the mapped device (that is, the Autotask configuration item) has a contact assigned in Autotask, that contact will be selected for the alert ticket by default.

NOTE  The Ticket Title field in Autotask has a limit of 255 characters. If your subject line exceeds this limit, it will be truncated in the ticket's Ticket Title field at 255 characters.

NOTE  The Ticket Summary field in ConnectWise PSA has a limit of 100 characters. If your subject line exceeds this limit, it will be truncated in the ticket's Ticket Summary field at 100 characters.

NOTE  Any Drive Disk Usage monitor will only show value for a drive that is closest to the threshold set within the monitor. Refer to Disk Usage Monitor (Windows only) in the legacy UI and Disk Usage monitor in the New UI.

NOTE  ESXi Data Store monitor will only show the datastore that is closest to the threshold set within the monitor. Refer to ESXi Data Store Monitor in the legacy UI and ESXi Data Store monitor in the New UI.

NOTE  Real-time monitoring metrics are stored for seven days and up to a maximum of 60 metrics. If no data is received in seven days (for example, the device goes offline), the Latest Value and Last Reading results will revert to No Data and Never, respectively.
No Data for Latest Value and Never for Last Reading are always displayed for the following monitor types: Datto Continuity, Event Log, Online Status, and Patch.

NOTE  The Latest Value field is always blank for a Ransomware monitor, which is available in the New UI.

NOTE  Real-time monitoring metrics are stored for seven days and up to a maximum of 60 metrics. If no data is received in seven days (for example, the device goes offline), the Latest Value and Last Reading results will revert to No Data and Never, respectively.
No Data for Latest Value and Never for Last Reading are always displayed for the following monitor types: Datto Continuity, Event Log, Online Status, and Patch.