LogicMonitor Collector Ports to be used while monitoring end-user devices
Review a full list of protocols and ports required for monitoring User Activity. This post will provide information regarding the ports, protocols, use case & configuration settings if required that is been used in general, with respect to LM platform. Using the " <port>/<protocol> " format is a common and standardized way to indicate network ports along with the associated protocols. This format helps provide a clear and concise representation of the port and protocol being discussed below : Inbound communication : Port Protocol Use Case Configuration Setting 162 UDP SNMP traps received from target devices eventcollector.snmptrap.address 514 UDP Syslog messages received from target devices eventcollector.syslog.port 2055 UDP NetFlow data received from target devices netflow.ports 6343 UDP sFlow data received from target devices netflow.sflow.ports 7214 HTTP/ Proprietary Communication from customJobMonitorsto Collector service httpd.port 2056 UDP JFlow data received from target devices Outbound communication : Port Protocol Use Case Configuration Setting 443 HTTP/TLS Communication between the Collector and the LogicMonitor data center (port 443 must be permitted to access LogicMonitor’spublic IP addresses; If your environment does not allow the Collector to directly connect with the LogicMonitor data centers, you canconfigure the Collector to communicate through a proxy.) N/A Other non-privileged SNMP, WMI, HTTP, SSH, JMX, etc. Communication between Collector and target resources assigned for monitoring N/A Internal communication : Port Protocol Use Case Configuration Setting 7211 Proprietary Communication between Watchdog and Collector services to OS Proxy service (sbwinproxy/sblinuxproxy) sbproxy.port 7212 Proprietary Communication from Watchdog service to Collector service agent.status.port 7213 Proprietary Communication from Collector service to Watchdog service watchdog.status.port 15003 Proprietary Communication between Collector service and its service wrapper N/A 15004 Proprietary Communication between Collector service and its service wrapper N/A Destination Ports : Port Protocol Use Case 135 TCP Port 135 is used for DCOM's initial communication and RPC (Remote Procedure Call) endpoint mapping..DCOM often uses higher port numbers in therange of 49152 to 65535 fordynamically allocated ports 22 TCP TCP for SSH connections 80 UDP NetFlow data received from target devices 443 UDP sFlow data received from target devices 25 HTTP/ Proprietary Communication from customJobMonitorsto Collector service 161 UDP JFlow data received from target devices 1433 TCP/UDP TCP for Microsoft SQL 1434 TCP/UDP The protocol used by port 1434 depends on the applicationthatis using the port. For example, SQL Server uses TCP forcommunication with clients, while the SQL Server Browserservice uses UDP 1521 TCP/UDP TCP/UDP to listen for database connections from Oracle clients 3306 TCP/UDP TCP/UDP for MySQL 5432 TCP TCP for PostgreSQL 123 NTP Connection from the library to an external NTP server. 445 TCP Server Message Block (SMB) protocol over TCP/IP LM Collector's monitoring protocols support a number of other monitoring protocols that can be incorporated into this list based on your preferences.Our LM collector supports a number of different monitoring protocols, so we can add to this list as necessary. Hopefully, through these details shared above, we will be able to understand what ports/protocols are used in LM platform. Thanks!3.5KViews34likes1CommentHow to redirect the output of the groovy script to the collector log file using groovy script?
In my groovy script, I want to redirect the output from the groovy script into the collectors log file? What should be the groovy code, to redirect the output to the collectors log file? Can anyone help me here?23Views4likes1CommentPalo Alto application data missing from Netflow
We havebeen able to get Netflow data working for a Palo Alto PA-820 firewall, but we are not seeing the application data show up. Does anyone have any suggestions on next steps we could take? Here is what has been done so far: Netflow profile has been configured on the Palo Alto side and assigned to the interface, including selecting the PAN-OS Field Types to get the App-ID and User-ID (https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/monitoring/netflow-monitoring/configure-netflow-exports) nbarhas been enabled on the collector: # enable netflow support for NBAR, IPV6 and Multicast fields netflow.nbar.enabled=true # enable netflow support for IPV6 fields netflow.ipv6.enabled=true Collector version is 34.003 We’re seeing everything we expect except the app & systemsdata on the Traffic tab for the device: Any thoughts on what we might be missing? Thank you. :-)48Views3likes0CommentsFixing misconfigured Auto-Balanced Collector assignments
I’ve seen this issue pop up a lot in support so I figured this post may help some folks out. I just came across a ticket the other day so it’s fresh on my mind! In order for Auto-Balanced Collector Groups (ABCG) to work properly, i.e.balance and failover, you have to make sure that the Collector Group is set to the ABCG and (and this is the important part) the Preferred Collector is set to “Auto Balance”. If it is set to an actual Collector ID, then it won’t get the benefits of the ABCG. You want this, not that: Ok, so that’s cool but now the real question is how do you fix this? There’s not really a good way to surface in the portal all devices where this is misconfigured. It’s not a system property so a report or AppliesTo query won’t help here… Fortunately, not all hope is lost! You can use the✨API✨ When you GET a Resource/device, you will get back some JSON and what you want is for the autoBalancedCollectorGroupId field to equal the preferredCollectorGroupId field. If “Preferred Collector” is not “Auto Balance” and set to a ID, then autoBalancedCollectorGroupId will be 0 . Breaking it down step by step: First, get a list of all ABCG IDs https://www.logicmonitor.com/swagger-ui-master/api-v3/dist/#/Collector%20Groups/getCollectorGroupList /setting/collector/groups?filter=autoBalance:true Then, with any given ABCG ID, you can filter a device list for all devices where there’s this mismatch https://www.logicmonitor.com/swagger-ui-master/api-v3/dist/#/Devices/getDeviceList /device/devices?filter=autoBalancedCollectorGroupId:0,preferredCollectorGroupId:11 (where 11 is the ID of a ABCG) And now for each device returned, make a PATCH so that autoBalancedCollectorGroupId is now set to preferredCollectorGroupId https://www.logicmonitor.com/swagger-ui-master/api-v3/dist/#/Devices/patchDevice Here’s a link to the full script, written in Python for you to check out. I’ll also add it below in a comment since this is already getting long. Do you have a better, easier, or more efficient way of doing this? I’d love to hear about it!162Views12likes9CommentsBug early release Collector Update V34.500
I have updated some of our collectors to the early release V34.500. After the update, there were various alerts from the DataSource Citrix_XenApp_DatastoreStatus, which could no longer read any data. After a short error analysis and further tests with other collectors, I replaced the here-string in the PowerShell script with a normal string input: OOTB: # Get XenApp specific creds $XenAppUser = @' ##XENAPP.USER## '@ $XenAppPass = @' ##XENAPP.PASS## '@ After customization: # Get XenApp specific creds $XenAppUser = '##XENAPP.USER##' $XenAppPass = '##XENAPP.PASS##' The query then worked perfectly again. Has anyone else experienced this phenomenon in their environment?Solved105Views21likes5CommentsFinding the culprit for TCP_StatsCollector ConnectionsEstablished alert for Windows collectors
From the collector’s device page in the LM Portal or the collectors page, get to a debug console, then here’s your !POSH one-liner to get info about the destination device that is holding your ports captive. netstat -an| sls establish | foreach { ($_ -split "\s+")[3] } | group | sort count | select count, name -last 10 In the Netstat, a shows all, n shows IP addresses rather than solving the DNS for it. TheSelect-String (aliased as sls)passes only the “Established” connection entries from the netstat down the pipeline. The foreach{} splits each line ($_ is the current object being iterated by the foreach loop) on contiguous whitespace (I use this a lot!) and takes the third element (remote address:port) to passdown the pipeline It then passes Group-Object (aliased as group) which bundles identical strings and Sort-Object (aliased as sort)by the count property of the group object. The select displays grabs the calculated match count and the name properties to limit display and just shows the -last 10 of them (which are the biggest number of matched lines due to the sort previously applied. This should give you the target/s for troubleshooting further.52Views11likes5CommentsHost Status errors corrected by logging into Collector server.
Every night we receive “Host Status” messages on several servers on one collector. You cannot “!ping” to those servers from the Collector’s debug console. However, you can ping those servers that Logic Monitor reports as down. If I log into the collector, the Host Staus messages clear (only login, do not open anything). This is what is baffling us. Has anyone seen anything like this? Thank you very much for your help.53Views10likes1CommentUsing a Dedicated Collector for each Windows Domain Controller?
We ran into trouble monitoring our Windows Domain Controllers because we want to use least privilegeand we were only receiving ping and Host Status data. It showed “No data” for CPU, disks, etc. We used the information in the link “https://www.logicmonitor.com/support/monitoring/os-virtualization/monitoring-a-domain-controller-dc” and installed the collector on a DC using the local system account and set it to monitor itself. I am now receiving CPU, disk, etc. from that domain controller. It appears the only catch is that I cannot monitor other systemswith that collector but that is OK for our situation. Are there others out there that are monitoring DCs using this method and if so, have you run into any trouble (performance, etc.)? If you are not using this method, how are you monitoring your DCs in Logic Monitor. THANK YOU very much for your assistance/opinions/guidance.Solved169Views14likes3CommentsLM Linux collector deployment failed to start Logicmonitor watchdog service
Success to set net capabilities on file `/usr/local/logicmonitor/agent/jre/bin/j ava` Detecting proxy, please wait ... Registering collector to bp.logicmonitor.com, please wait ... Init program is systemd ... Redirecting to /bin/systemctl restart logicmonitor-watchdog.service Job for logicmonitor-watchdog.service failed because the control process exited with error code. See "systemctl status logicmonitor-watchdog.service" and "journalctl -xe" for de tails. Congratulations! LogicMonitor Collector has been installed successfully! Extracting bundled JRE files ... Success to set net capabilities on file `/usr/local/logicmonitor/agent/lib/sblin uxproxy` Success to set net capabilities on file `/usr/local/logicmonitor/agent/jre/bin/j ava` Detecting proxy, please wait ... Registering collector to bp.logicmonitor.com, please wait ... Init program is systemd ... Redirecting to /bin/systemctl restart logicmonitor-watchdog.service Job for logicmonitor-watchdog.service failed because the control process exited with error code. See "systemctl status logicmonitor-watchdog.service" and "journalctl -xe" for de tails. Congratulations! LogicMonitor Collector has been installed successfully! [root@WS01UJEU1000009 ~]# systemctl status logicmonitor-watchdog.service ● logicmonitor-watchdog.service - LogicMonitor Watchdog Loaded: loaded (/etc/systemd/user/logicmonitor-watchdog.service; enabled; vendor preset: disabled) Active: failed (Result: exit-code) since Sun 2023-03-05 13:56:20 UTC; 1min 21s ago Process: 344458 ExecStopPost=/usr/local/logicmonitor/agent/bin/logicmonitor-watchdog stop true (code=exited, status=203/EXEC) Process: 344456 ExecStart=/usr/local/logicmonitor/agent/bin/logicmonitor-watchdog start true (code=exited, status=203/EXEC) Mar 05 13:56:20 WS01UJEU1000009 systemd[1]: Starting LogicMonitor Watchdog... Mar 05 13:56:20 WS01UJEU1000009 systemd[1]: logicmonitor-watchdog.service: Control process exited, code=exited status=203 Mar 05 13:56:20 WS01UJEU1000009 systemd[1]: logicmonitor-watchdog.service: Control process exited, code=exited status=203 Mar 05 13:56:20 WS01UJEU1000009 systemd[1]: logicmonitor-watchdog.service: Failed with result 'exit-code'. Mar 05 13:56:20 WS01UJEU1000009 systemd[1]: Failed to start LogicMonitor Watchdog.Solved226Views12likes2Comments