Creating and Editing Device Templates

Device templates allow you to save a device configuration, apply it to one or more devices, and reuse the same configuration over and over again. A device template contains multiple tabs. For a list of the tabs and their descriptions, see the Creating a Device Template section.

When you apply a device template to a device group or to selected devices, all the devices that use the device template will inherit the field values from the device template. Therefore, you will not need to manually define settings for each device in the affected pages.

You can use a device template in multiple ways:

You can apply a device template to a device group to automate the configuration of all devices in the device group.
From the Device Manager page (Registry > Devices > Device Manager), you can apply a device template to one or more selected devices to automate the configuration of the selected devices.
From the Device Groups page (Registry > Devices > Device Groups), you can use the bulk configuration tool to apply configuration settings to all the devices in a device group. These configuration settings do not have to be defined or saved in a device template.
From the Device Manager page (Registry > Devices > Device Manager), you can use the bulk configuration tool to apply configuration settings to one or more selected devices. These configuration settings do not have to be defined or saved in a device template.

All the ways to use a device template are described in the section on using device templates.

The following section describes how to create a device template and how to edit a device template.

Use the following menu options to navigate the SL1 user interface:

To view a pop-out list of menu options, click the menu icon ().
To view a page containing all of the menu options, click the Advanced menu icon ().

Before You Start

Before you start creating and working with device templates, consider the following:

How have you defined device groups? Can you apply a uniform set of configuration settings to all the devices in a device group?
Are there multiple devices that require the same set of configuration settings? Could you create a device template to configure these devices?
Do most of the devices in a device group require a uniform set of configuration settings, yet there are a few devices that require a different set of configuration settings? If so, you could create a child device group for the few devices that require a different set of configuration settings. You could apply one device template to the parent device group and another device template to the child device group.

Viewing the List of Device Templates

To view a list of existing device templates:

Go to the Configuration Templates page (Registry > Devices > Templates).

The Configuration Templates page displays the following about each device template:

Template Name. Name of the configuration template.
ID. Unique, numeric ID, assigned to the device template automatically by SL1.
Created By. Username of the user who created the device template.
Created On. Date the device template was created.
Last Edited By. Username of the user who created or last edited the device template.
Edited On. Date and time the device group was created or last edited.
Tools. For each device template, one or more of the following tools may be available:

Edit this template(). Leads to the Device Template Editor page, where you can view the details of a device template and edit one or more values ion a configuration template.
Checkbox(). To delete a device template, select this checkbox, select the Select Actions drop-down (in the lower right) and then select Delete Template.

Filtering the List of Device Templates

The Configuration Templates page includes six filters. You can filter the list of device templates by one or more of the following parameters: Template Name, ID, Created By, Created On, Last Edited By, and Edited On. You can specify one or more parameter to filter the display of device templates. Only device templates that meet all of the filter criteria will be displayed in the Configuration Templates page.

You can filter by one or more parameters. The list of device templates is dynamically updated as you select each filter. For each filter except Created On and Edited On, you must enter text to match against. SL1 will search for device templates that match the text, including partial matches. Text matches are not case-sensitive.

You can use special characters in each filter.

To filter the list of device templates:

Go to the Configuration Templates page (Registry > Devices > Templates).

The Configuration Templates page displays a list of device templates. To sort the list, you can enter a value in one or more of the following headings:

Template Name. Name of the device template. You can enter text to match, including special characters, and the Configuration Templates page will display only device templates that have a matching template name.
ID. Unique, numeric ID, assigned to the device template automatically by SL1. You can enter numbers to match, including special characters, and the Configuration Templates page will display only device templates that have a matching template ID.
Created By. ScienceLogic user who created the device template. You can enter text to match, including special characters, and the Configuration Templates page will display only device templates that were created by a matching username.
Created On. Date and time the device template was created. You can select from a list of time periods. The Configuration Templates page will display only device templates that were created within that time period.
Last Edited By. ScienceLogic user who last edited the device template. You can enter text to match, including special characters, and the Configuration Templates page will display only device templates that were edited by a matching username.
Last Edited. Date and time the device template was last edited. You can select from a list of time periods. The Configuration Templates page will display only device templates that were last edited within that time period.

Special Characters

When filtering a list in a registry page, you can include the following special characters to search each field except those that display date and time:

NOTE: When searching for a string, SL1 will match substrings by default, even if you do not include any special characters. For example, searching for "hel" will match both "hello" and "helicopter". When searching for a numeric value, SL1 will not match a substring unless you use a special character.

Special Character	Description	Example
, (comma)	(For strings or numeric values) Specifies an OR operation.	"dell,micro" would match all values that contain the string "dell" OR the string "micro".
& (ampersand	(For strings or numeric values) Specifies an AND operation.	"dell&micro" would match all values that contain both the string "dell" AND the string "micro", in any order.
! (exclamation point)	(For strings or numeric values) Specifies a NOT operation. You can also use the "!" character in combination with the arithmetic special characters (min-max, >, <, >=, <=, =) described below.	"!dell" would match all values that do not contain the string "dell".
* (asterisk)	(For strings or numeric values) Specifies a "match-zero-or-more" operation. For a string, matches any string that matches the text before and after the asterisk. For a numeral, matches any numeral that contains the text.	"heler" would match "helpers" and "helicopter" but not "hello". "325" would match "325", "32561", and "325000". "*000" would match "1000", "25000", and "10500000".
? (question mark)	(For strings or numeric values) Specifies a "match any one character" operation.	"l?ver" would match the strings "oliver", "levers", and "liver", but not "believers". "135?" would match the numbers "1350", "1354", and "1359", but not "13502".
^ (caret)	(For strings only) Specifies a "match the beginning" operation. Matches any string that begins with the specified string.	"^sci" would match "scientific" and "sciencelogic", but not "conscious".
$ (dollar)	(For strings only) Specifies "match the ending". Matches any string that ends with the specified string. You can use both ^ and $ if you want to match an entire string. For example, "^tern$" would match the strings "tern" or "Tern" or "TERN"; it would not match the strings "terne" or "cistern".	"ter$" would match the string "renter" but not the string "terrific".
min-max	(For numeric values only) Matches any value between the specified minimum value and the maximum value, including the minimum and the maximum.	"1-5 "would match 1, 2, 3, 4, and 5.
- (dash)	(For numeric values only) A "half open" range. Matches values including the specified minimum and greater, or including the specified maximum and lesser.	"1-" matches 1 and greater, so it would match 1, 2, 6, 345, etc. "-5" matches 5 and less, so it would match 5, 3, 1, 0, etc.
> (greater than)	(For numeric values only) Matches any value greater than the specified value.	">7" would match all values greater than 7.
< (less than)	(For numeric values only) Matches any value less than the specified value.	"<12" would match all values less than 12.
>= (greater than or equal to)	(For numeric values only) Matches any value that is equal to or greater than the specified value.	">=7" would match all values 7 and greater.
<= (less than or equal to)	(For numeric values only) Matches any value that is equal to or less than the specified value.	"<=12" would match all values 12 and less.
= (equal)	(For numeric values only) Matches a value that is equal to the the specified value. You can also use this special character to match a negative value, as demonstrated in the example.	"=-5 " would match "-5" instead of being evaluated as the "half open range" as described above.

Creating a Device Template

To define a new device template, perform the following steps:

Go to the Configuration Templates page (Registry > Devices > Templates).
Click the Create button. The Device Template Editor page appears.
In the Template Name field, supply a name for the template.
You can then supply values in one or more of the following tabs:

NOTE: In each tab, all of the fields are disabled (grayed-out) by default. To enable a field and change its value, click on the field name.

Config. Contains all the fields in the Device Properties page (except device name and device IP) and all the fields in the Device Thresholds page. When you apply a device template to a device group or selected devices, you do not have to manually define any settings in the Device Properties page or the Device Thresholds page for the devices that use the template. All the devices that use the template will inherit the field values from the device template.
Interface. Contains all the fields in the Interface Properties page that define how SL1 will monitor one or more network interfaces and the thresholds for those network interfaces. When you apply a device template to a device group or selected devices, you do not have to manually define any settings in the Interface Properties page for the devices that use the template. All the devices that use the template will inherit the field values from the device template.
CV Policies. Specifies one or more web-content policies that can be applied to all devices that use the template. These web-content policies enable SL1 to monitor a website. SL1 will periodically check the website for specified content. If the content cannot be found on the website, SL1 will generate an event. When you apply a device template to a devices, you do not have to manually define any web-content and availability policies in the Monitoring Policies page for the devices. All the devices that use the template will inherit the web-content policies from the device template; SL1 will automatically create these web-content policies for each device that uses the template.
Port Policies. Specifies one or more TCP/IP Port policies that can be applied to all member devices. These TCP/IP Port policies tell SL1 to monitor a specified port for availability every five minutes. Availability refers to the port's ability to accept connections and data. When you apply a device template to a device group, you do not have to manually define any TCP/IP port policies in the Monitoring Policies page for the member devices. All the devices in the device group will inherit the TCP/IP port policies from the device template; SL1 will automatically create these port policies for each device that uses the template.
Svc Policies. Specifies one or more Windows service policies that can be applied to devices that use the template. These Windows service policies tell SL1 to monitor the device and look for the specified service. You can define a service policy so that SL1 monitors whether or not the service is running and then performs an action (starts, pauses, or restarts the service, reboots or shuts down the device, triggers the execution of a remote script or program). When you apply a device template to devices, you do not have to manually define any Windows service policies in the Monitoring Policies page for those devices. All the devices that use the template will inherit the Windows service policies from the device template; SL1 will automatically create these Windows service policies for each device that uses the template.
Proc Policies. Specifies one or more Process policies that can be applied to devices that use the template. These Process policies tell SL1 to monitor the device and look for the process. You can define a process policy so that SL1 monitors whether or not the process is running and optionally, how much memory a process can use and how many instances of a process can run simultaneously. When you apply a device template to devices, you do not have to manually define any Process policies in the Monitoring Policies page for those devices. All the devices that use the device template will inherit the Process policies from the device template; SL1 will automatically create these process policies for each device that uses the template.
Dynamic Apps. Specifies one or more Dynamic Applications that can be aligned with devices that use the template. SL1 will use the specified Dynamic Applications to retrieve data from the devices that use the template. (Note that each device that uses the template might also be aligned with additional Dynamic Applications that have been aligned with the device in other ways; for example, from the automatic alignment that occurs during discovery.) When you apply a device template to devices, you do not manually have to align Dynamic Applications in the Dynamic Application Collections page for those devices. All devices that use the device template will be aligned with the Dynamic Applications specified in the device template.

If you select a Dynamic Application in a Device Template, and that Dynamic Application has associated thresholds, you can change one or more of those thresholds from the Device Template. The thresholds you specify in the Device Template will override the thresholds defined in the Dynamic Application. When you apply a device template to devices , you do not manually have to edit the Dynamic Application Thresholds in the Device Thresholds page for those devices. All devices that use the device template will inherit the Dynamic Application Thresholds specified in the device template.
You can change the frequency at which SL1 will poll all devices that use a device template to retrieve the information specified in a Dynamic Application. This value will override the default value specified in the Dynamic Applications.

Logs. Specifies one or more Log File Monitoring Policies to apply to all devices that use the template. A Log File Monitoring Policy specifies a log file or Windows log that the SL1 agent will monitor on a device and the logs that the SL1 agent will send to SL1. When the SL1 agent sends a log to SL1, SL1displays the log entry in the Device Logs for the associated device. SL1 can then use that log entry to trigger events. When you apply a device template to devices, you do not have to manually define any log monitoring policies in the Log File Monitoring page for those devices. All of the devices that use the device template will inherit the log monitoring policies from the device template; SL1 will automatically align the log monitoring policy with each device that uses the template.

In each tab in a device template, you can choose to define all the fields or you can choose to define only one or more fields. When you apply the configuration template to devices, only those fields you defined in the template will be applied to the devices. For the remaining fields, the devices will retain their previous values or use the default values.
If you see a grayed-out field in a device template, this means that the template will not change the current value for that field; the devices that use this template will retain their previous values or use the default values for that field. To change the value of a grayed-out field, simply click on the field and edit the value.

Defining Device Properties and Device Thresholds in the Config Tab

The Config tab allows you to define the configuration settings from the Device Properties page (except device name and device IP) and all the fields in the Device Thresholds page.

In the Config tab, you can define one or more of the following fields:

NOTE: In the Config tab, you can choose to define all the fields from the Device Properties page and the Device Thresholds page or you can choose to define only one or more fields. When you apply the device template to devices, only those fields you defined in the template will be applied to the devices. For the remaining fields, the devices will retain their previous values or use the default values. When you have disabled a field, it appears grayed-out in the device template.

Device Organization. Organization that will become the parent organization for the device. You can select from a list of all organizations in SL1.

NOTE: If you include a device template in a PowerPack and then install the PowerPack on a different SL1 system, the Device Organization field will be cleared and disabled on the SL1 system where the PowerPack is installed. For details, see the section on PowerPacks.

SNMP Read. The community string for read-only access to SNMP information on the device. The community string is a password that allows SL1 to gather information from the device. This community string is defined in the Credential Management page (System > Manage > Credentials).
SNMP Write. The community string for write access to SNMP information on the device. The community string is a password that allows SL1 to send information to the device. This community string is defined in the Credential Management page (System > Manage > Credentials).

NOTE: SNMP credentials that are deleted from SL1 will also be removed from device templates.

Availability Protocol. Protocol that SL1 will use to communicate with the device to determine the device's availability. Choices are TCP, UDP, or ICMP.
Avail Port. Port that SL1 will use to communicate with the device to determine the device's availability.
Latency Protocol. Protocol that SL1 will use to communicate with the device to determine the device's latency. Choices are TCP, UDP, or ICMP.
Latency Port. Port that SL1 will use to communicate with the device to determine the device's latency.
Avail + Latency Alert. Specifies how SL1 should respond when the device fails an availability check, a latency check, or fails both. These options allow you to create separate events when SNMP fails on a device and when a device is not up and running. Choices are:

Enabled. SL1 will create the following events:

If the device fails the availability check, generates the event "Device Failed Availability Check: UDP - SNMP"
If the device fails the latency check, generates the event, "Network Latency Exceeded Threshold: No Response"
If the device fails both the availability check and the latency check, generates the event "Device Failed Availability and Latency checks"

Disabled. SL1 will create the following events

If the device fails the availability check, generates the event "Device Failed Availability Check: UDP - SNMP"
If the device fails the latency check, generates the event, "Network Latency Exceeded Threshold: No Response"
If the device fails both the availability check and the latency check, generates only the event "Device Failed Availability Check: UDP - SNMP". The event "Network Latency Exceeded Threshold: No Response" is suppressed under the availability event.

Collection. Specifies whether SL1 will collect data from the device . Choices are "enabled" or "disabled".
Collector Grp. Specifies the collector group that SL1 will use to collect data from the device. You can select from a list of existing collector groups.
Coll. Type. Specifies how SL1 should perform discovery. The choices are:

Standard. SL1 will perform discovery of each device based on the device's IP address. This method is appropriate for devices using standard DNS.
DHCP. SL1 will perform discovery of each device based on the device's MAC address. This method is appropriate for devices using DHCP.

Critical Ping. Frequency with which SL1 should "ping" the device. If the device does not respond, SL1 creates an event. The choices are disabled, every 5 seconds, every 15 seconds, every 30 seconds, every 60 seconds, and every 120 seconds.

NOTE: SL1 does not use data from the critical ping to create device availability reports. SL1 will continue to collect device availability data only every five minutes.

NOTE: Because high-frequency data pull occurs every 15 seconds, you might experience up to 15 seconds of latency between an unavailable alert and that alert appearing in the Database Server if you set Critical Ping to 5 seconds.

NOTE: You might experience some performance issues if you have a large number of devices using Internal Collection Dynamic Applications (ICDAs) to monitor Critical Availability on a brief polling interval.

Event Mask. Events that occur on a single device within the selected time interval are grouped together. This allows related events to be rolled-up and posted together, under one event description. Select a time span from the drop-down list. Values range from 30 seconds to 1 month.
Auto-Clear Events. Auto Clear automatically removes an event from the Event Console if a specified succeeding event occurs. For example, suppose the event "Device not responding to ping" occurs. If the next polling session produces the event "Device now responding normally to ping", the Auto Clear feature could clear the event. If you do not want events to be cleared automatically, uncheck this field. For the selected device, this field overrides the global auto-clear settings in the Event Policy Editor page.
Accept All Logs. This checkbox specifies whether or not you want to keep and save all logs for this device. If you want to retain only logs associated with events, uncheck this field.
Daily Port Scans. This checkbox specifies whether or not you want SL1 to perform a daily scan of the device for open ports.
Auto-Update. This checkbox specifies whether or not you want SL1 to perform a nightly discovery of the device and update records with changes to the device. If this field is unchecked, SL1 will not perform nightly discovery; changes to the device, including newly opened ports, will not be recorded by SL1.
Bypass Interface Inventory. This checkbox specifies whether or not the discovery processes should discover network interfaces. This value is used during re-discovery (clicking the binoculars icon () in the Device Properties page) and during nightly auto-discovery (run automatically by SL1 every night to update device information).

If selected, discovery processes will not attempt to discover interfaces for each device aligned with this template.
If not selected, discovery processes will attempt to discover network interfaces for each device aligned with this template using the Interface Inventory Timeout value and Maximum Allowed Interfaces value for the device.

Scan All IPs. If selected, SL1 will scan all IP addresses on a device when looking for open ports. If the device uses multiple IP Addresses, SL1 will scan for open ports on all IPs during initial dynamic-discovery and nightly dynamic-discovery.
Dynamic Discovery. If selected, SL1 will automatically assign the appropriate Dynamic Applications to the device during discovery.
Preserve Hostname. If selected, the name of the device in SL1 will remain the same, even if the name of the actual device is changed. If unselected, the SL1 name for the device will be updated if the name of the actual device is changed.
Disable Asset Update. If selected, during nightly discovery, SL1 will not update the asset record associated with the device. For the selected device, this checkbox over-rides any settings defined in the Asset Automation page (System > Settings > Assets).

System Latency. During polling, SL1 initially pings monitored devices. The value in this field is the maximum number of milliseconds for the device to respond to SL1's ping (round-trip time divided by 2). When the latency threshold is exceeded, SL1 generates an event for that device. The default value is 1500 ms. To disable this threshold for the current device, set the threshold to 0 (zero) milliseconds. When you disable a threshold, SL1 does not generate an event for the threshold.
Availability Ping Count. If the Availability Protocol for a device is set to ICMP, this field specifies the number of packets that should be sent during each availability check. The default value is 1.
Availability Packet Size. If the Availability Protocol for a device is set to ICMP, this field specifies the size of each packet, in bytes, that is sent during each availability check. The default value is 56 bytes.
Availability Required Ping Percentage. If the Availability Protocol for a device is set to ICMP, this field specifies the percentage of packets that must be returned during an availability check for SL1 to consider the device available. The default value is 100%.
Device Logs Max. Maximum number of records to store in the device log. When a log file reaches its maximum size, the oldest records will be deleted. The default value is 495,000 records.
Device Logs Age. Maximum number of days to store each record in the device log. Records that are older than the specified number of days are automatically deleted. The default value is 546 days.
Bandwidth Data. Number of days to retain bandwidth usage data and CBQoS bandwidth data collected from each interface on a device. This data is collected as frequently as every minute (depending upon the user-defined monitoring policy). Bandwidth data that is older than the specified number of days is automatically deleted. The default value is defined in the Data Retention Settings page (System > Settings > Data Retention).
Daily Rollup Bandwidth Data. Number of days to retain daily normalized data and daily normalized CBQoS data for each interface on a device. Daily normalized data that is older than the specified number of days is automatically deleted. The default value is defined in the Data Retention Settings page (System > Settings > Data Retention).
Hourly Rollup Bandwidth Data. Number of days to retain hourly normalized data and hourly normalized CBQoS data for each interface on a device. Hourly normalized data that is older than the specified number of days is automatically deleted. The default value is defined in the Data Retention Settings page (System > Settings > Data Retention).
Raw Performance Data. Number of days to store raw performance data (usually data collected by Dynamic Applications).
Daily Rollup Performance Data. Number of days to retain daily normalized performance data for the device. This setting applies to daily normalized availability data, normalized latency data, normalized file system data, normalized data for monitoring policy statistics, and normalized data for Performance Dynamic Applications for which a specific Daily Rollup Retention setting has not been defined. Daily normalized performance data that is older than the specified number of days is automatically deleted. The default value is defined in the Data Retention Settings page (System > Settings > Data Retention).

Hourly Rollup Performance Data. Number of days to retain hourly normalized performance data for the device. This setting applies to hourly normalized availability data, normalized latency data, normalized file system data, normalized data for monitoring policy statistics, and normalized data for Performance Dynamic Applications for which a specific Hourly Rollup Retention setting has not been defined. Hourly normalized performance data that is older than the specified number of days is automatically deleted. The default value is defined in the Data Retention Settings page (System > Settings > Data Retention).
Journal Data. Number of days to retain raw collected data from Dynamic Applications of type "journal." The default value is defined in the Data Retention Settings page (System > Settings > Data Retention).
Configuration Data. Number of days to retain data from Dynamic Applications of type “configuration.” The default value is defined in the Data Retention Settings page (System > Settings > Data Retention).
SSL Certificate Purge Timeout. Specifies the number of days after which SSL certificate data will be purged. The default value is 0 days.

In SL1, normalized data does not include polling sessions that were missed or skipped. So for normalized data, null values are not included when calculating maximum values, minimum values, or average values.

You might want to retain normalized data for longer periods of time and non-normalized data for shorter periods of time. This allows you to save space and still create historical reports.

Interface Inventory Timeout. Specifies the maximum amount of time that the discovery processes will spend polling a device for the list of interfaces. After the specified time, SL1 will stop scanning the device, will not update the device, and will continue with discovery. When a value for this setting is specified for a device in the Device Thresholds page or applied to a device using a device template, this setting is used during re-discovery (clicking the binoculars icon () in the Device Properties page) and during nightly auto-discovery (run automatically by SL1 every night, to update device information). The default value is 600,000 ms (10 minutes).
Maximum Allowed Interfaces. Maximum number of interfaces per device. If a device exceeds this number of interfaces, SL1 will stop scanning the device, will not update the device, and will continue with discovery. When a value for this setting is specified for a device in the Device Thresholds page or applied to a device using a device template, this setting is used during re-discovery (clicking the binoculars icon () in the Device Properties page) and during nightly auto-discovery (run automatically by SL1 every night, to update device information). The default value is 10,000.

Defining Interface Monitoring in the Interface Tab

The Interface tab allows you to define one or more fields from the Interface Properties page; these fields define how SL1 will monitor one or more network interfaces and the thresholds for those network interfaces. Each field that you define will be applied to all the devices that use the template.

In the Interface tab, you can define one or more of the following fields:

Apply Settings To. Specifies which interfaces should use the settings defined in this tab. The choices are:

All Interfaces on device. Applies the settings to all discovered network interfaces on each member device.
Management interface only. Applies the settings only to the interface that SL1 uses to communicate with each member devices.

Collection State. This field can have one of two values:

Enabled: SL1 monitors the network interface and collects data on the network interface for reports.
Disabled: SL1 does not monitor the network interface or collect data on the network interface for reports.

Collection Frequency. When you enable monitoring (collection) for an interface, you must specify how frequently you want SL1 to collect data from the interface. Your choices are every:

1 Minute
5 Minutes
10 Minutes
15 Minutes
30 Minutes
60 Minutes
120 Minutes

The Network Interface reports will display the average incoming and outgoing bandwidth-usage for the current day in the selected intervals.

Interface Alerting. Alerting for this interface can be enabled or disabled. When disabled, the interface is monitored, but events are not generated for the interface.
Rollover Alerting. Specifies whether or not SL1 will generate an event when the counter for the interface rolls over. This field does not affect the Network Usage graphs. This field is most helpful for interfaces that are busy and require frequent monitoring, but for which the device supports only 32-bit counters (instead of 64-bit counters). The counters on such interfaces rollover frequently.
Collect Errors. Specifies whether or not SL1 will collect data on packet errors on the interface. Packet errors occur when packets are lost due to hardware problems such as breaks in the network or faulty adapter hardware.
Collect Discards. Specifies whether or not SL1 will collect data on interface discards. Discards occur when an interface receives more traffic than it can handle (either very large message or many messages simultaneously). Discards can also occur when an interface has been specifically configured to discard. For example, a user might configure a router's interface to discard packets from a non-authorized IP.
Measurement Scale. Unit of measurement for bandwidth reports for the interface. The choices are:

Mega
Giga
Kilo
Tera
Peta

Percentile Calculation. The basis for bandwidth billing for this interface. The choices are:

Accumulative. Customer is billed for total inbound and outbound bandwidth for all applicable interfaces. Billing is at the specified percentile point.
Inbound. Customer is billed for the total inbound bandwidth for all applicable interfaces. Billing is at the specified percentile point.
Outbound. Customer is billed for the total outbound bandwidth for all applicable interfaces. Billing is at the specified percentile point.
Highest Poll. Customer is billed for either the total inbound or total outbound, whichever is highest, for each applicable interfaces. Billing is at the specified percentile point.

Counter Type. Specifies whether the interface uses a 32-bit counter or a 64-bit counter to measure bandwidth on the interface. During discovery, SL1 automatically discovers which type of counter is associated with each interface. A 32-bit counter will roll-over (restart at 0) after about four billion octets (bytes) have passed through the interface. A 64-bit counter will roll-over after 1.85 x 1016 octets (bytes) have passed through the interface. Most high-speed interfaces use a 64-bit counter to measure bandwidth on the interface. If a 64-bit counter is available, SL1 will use it by default.

Counter 32. Specify that the interface uses a 32-bit counter.
Counter 64. Specify that the interface uses a 64-bit counter.

Percentile Factor. Many service providers use a percentile bandwidth measure when billing customers for bandwidth usage. In this field, you can select the percentile factor, and SL1 will perform the calculations for you at billing time. For example, if a provider chose the percentile factor "95", SL1 would collect bandwidth data every five minutes for an entire month. At billing time, the highest 5% of readings are dropped. The customer is charged for the 95% highest reading. This prevents customers from being billed for unusual spikes. The choices for percentile factor are:

100% -1%, in increments of 1%.

Auto Name Update. Specifies whether SL1 should update or overwrite the interface name during nightly discovery.
Interface Name Format. Specifies the format of the network interface name that you want to appear in events. If you selected Interface Alias for the deprecated Interface Name Precedence field in a previous release of SL1, the format for existing interfaces is set to {alias}. If you selected “Interface Name” for the deprecated Interface Name Precedence field in a previous release of SL1, the format for existing interfaces is set to {name}. The default format is {name}. You can use a combination of string text and the following tokens to define the interface name format for events, such as string_{name}, string_{alias}, {name}{alias}, or {ifdesc}:

{alias}
{name}
{state}
{ifdescr}
{if_id}
{did}
{ifindex}
{ifphysaddress}
{iftype}
{ifspeed}
{ifhighspeed}
{ifoperstatus}
{ifadminstatus}

NOTE: If Disable Discovery Name Update is selected for an interface in its Interface Properties page, SL1 cannot change the interface name during nightly auto-discovery and during re-discovery, regardless of the settings in the Interface Event Display Name field. To apply a new naming convention to interfaces, you must first ensure that Disable Discovery Name Update is not selected for those interfaces. You can do this in the Network Interfaces page (Registry > Networks > Interfaces): select the interfaces you want to rename, select the Select Actions field (in the lower right), and choose Auto-Name Update > Enable.

If you have specified that SL1 should monitor an interface, SL1 will collect data about the interface and also monitor performance thresholds for the interface. SL1 will use either the default threshold or the custom threshold you define in this pane.

Inbound %. If the rate of inbound transfer on the interface is greater than the value selected in this field, SL1 will generate an event. Possible choices are 0% through 100%. The value can include up to three digits after the decimal point. The percentage is in relation to all traffic on the interface. So if inbound transfer on this interface exceeds the selected percentage of all traffic, SL1 will generate an event. The default value is 65%.
Outbound %. If the rate of outbound transfer on the interface is greater than the value selected in this field, SL1 will generate an event. Possible choices are 0% through 100%, in increments of 1%. The percentage is in relation to all traffic on the interface. So if outbound transfer on this interface exceeds the selected percentage of all traffic, SL1 will generate an event. The default value is 65%. The value can include up to three digits after the decimal point.
Inbound Bandwidth. If the rate of inbound transfer on the interface is greater than the value selected in this field, SL1 will generate an event. The default value is 0 Mbps (no alerting). The value can include up to three digits after the decimal point.
Outbound Bandwidth. If the rate of outbound transfer on the interface is greater than the value selected in this field, SL1 will generate an event. The default value is 0 Mbps (no alerting). The value can include up to three digits after the decimal point.
Inbound Errors. If the number of inbound packet errors on the interface is greater than the value selected in this field, SL1 will generate an event. The default value is 0 packets (no alerting). The value can include up to three digits after the decimal point.

NOTE: Packet errors occur when packets are lost due to hardware problems such as breaks in the network or faulty adapter hardware.

Outbound Errors. If the number of outbound packet errors on the interface is greater than the value selected in this field, SL1 will generate an event. The default value is 0 packets (no alerting). The value can include up to three digits after the decimal point.
Inbound Discards. If the number of inbound discards on the interface is greater than the value selected in this field, SL1 will generate an event. The default value is 0 packets (no alerting). The value can include up to three digits after the decimal point.

NOTE: Packet discards occur when an interface receives more traffic than it can handle (either very large message or many messages simultaneously). Discards can also occur when an interface has been specifically configured to discard. For example, a user might configure a router's interface to discard packets from a non-authorized IP.

Outbound Discards. If the number of outbound discards on the interface is greater than the value selected in this field, SL1 will generate an event. The default value is 0 packets (no alerting). The value can include up to three digits after the decimal point.
Inbound Error %. If the percentage of inbound errors (that is, the percentage of all inbound traffic during a single polling session that results in an error) on this interface is greater that the value selected in this field, SL1 will generate an event. The value can include up to three digits after the decimal point.
Outbound Error %. If the percentage of outbound errors (that is, the percentage of all outbound traffic during a single polling session that results in an error) on this interface is greater that the value selected in this field, SL1 will generate an event. The value can include up to three digits after the decimal point.
Inbound Discard %. If the percentage of inbound discards (that is, the percentage of all inbound traffic during a single polling session that results in a discard) on this interface is greater that the value selected in this field, SL1 will generate an event. The value can include up to three digits after the decimal point.
Outbound Discard %. If the percentage of outbound discards (that is, the percentage of all outbound traffic during a single polling session that results in a discard) on this interface is greater that the value selected in this field, SL1 will generate an event. The value can include up to three digits after the decimal point.

Defining Web-Content Monitoring in the CV Policies Tab

The CV Policies tab allows you to define one or more web-content and availability policies. These policies enable SL1 to monitor a website. SL1 will periodically check the website for specified content. If the content cannot be found on the website, SL1 will generate an event.

In the CV Policies tab, you can define one or more of the following fields:

Subtemplate Selection. In this pane, you can choose to add a new Web Content Monitoring policy to the configuration template or edit an existing Web Content Monitoring policy in the configuration template.

To add a new Web Content Monitoring policy to the configuration template, select Add New CV Sub-template.
To edit an existing Web Content Monitoring policy, highlight it. The remaining panes will be populated with values from the selected policy.

Policy Name. Name of the new policy. Can be any combination of letters and numbers.
State. Specifies whether or not the policy is active. You can select one of the following:

Enabled. Policy is active. SL1 will query the specified website every five minutes.
Disabled. Policy is not active.

Port. Port on web-server to which SL1 will send queries. This is usually port 80 (the HTTP port) or port 443 (the HTTPS port).
Timeout. After specified number of seconds, SL1 should stop trying to connect to the website, or if already connected, stop searching for content. If the timeout period elapses before SL1 can connect or find the content, an event is generated.
Uniform Resource Locator (URL). URL or IP address where the website is located. If the website requires login and the login is forms-based (user enters username and password in the index page), include the username and password in the URL. You can include the following variable in this field:

%D. SL1 replaces this variable with the IP address of the currently aligned device.
%N. SL1 replaces this variable with the hostname of the currently aligned device.

Post String. If the URL is very long or requires data that cannot be transferred with a standard "GET" request (that is, data that cannot be included in the URL), you can enter a POST string in this field. The data will be sent with the cURL equivalent of an HTTP POST command. Data should be formatted as follows:

variable=value
If you are going to include more than one variable/value pair, separate each pair with an ampersand.
For example, suppose you want to send values for the following fields:

Birthyear
Value

You could enter the following in the Post String field:
Birthyear=1980%Value=OK

NOTE: If you want to include non-alphanumeric characters in the Post String field, make sure you encode the characters using appropriate URL encoding.

Cookie Value. For pages that require a cookie value to be set, enter the cookie value in this field.
Browser Emulation. Specifies how to format the query. Select the agent that is compatible with the web server.
HTTP Auth Username:Password. For websites that pop-up a dialog box asking for username and password, use this field. Enter the user name and password in this field. Use the format "username:password".
SSL Encryption. Specifies whether SL1 should use SSL when communicating with the website. If login for the website is forms-based, enable this option.
Expression Check #1. Regular expression to search for.
Expression Check #2. Another regular expression to search for.
Error Codes. Specifies the HTTP status code you expect to receive in the response. If any other status code is returned, SL1 will generate an event.
Referer String. URL of the website. Some load-balanced configurations will not allow a request for a specific IP address. If you entered a specific IP address in the URL field, you can spoof a URL in this field.
Host Resolution. Host name of the website. Some load-balanced configurations will not allow a request for a specific IP address. If you entered a specific IP address in the URL field, you can spoof a fully-qualified host name in this field. You can include the following variable in this field:

%N. SL1 replaces this variable with hostname of the currently aligned device.

Proxy Server:Port. For companies or organizations that use proxy servers, enter the URL and port for the proxy server in this field. Use the format "URL:port_number".
Proxy Username:Password. For companies or organizations that use proxy servers, enter the username and password for the proxy server in this field. Use the format "username:password".
Min Page size (Kb). Page size means the size of the page, in Kb, specified in the URL of the policy. If the returned page is not at least the size specified in this field, SL1 generates an event. This threshold triggers the event "Page size below minimum threshold."
Max Page size (Kb). Page size means the size of the page, in Kb, specified in the URL of the policy. If the returned page is larger than the size specified in this field, SL1 generates an event. This threshold triggers the event "Page size above maximum threshold."
Min Download speed (kb/s). Download speed is the speed, measured in Kb/s, at which data was downloaded from the server (specified in the policy) to SL1. If the download speed is not at least the speed specified in this field, SL1 generates an event. This threshold triggers the event "Download speed below threshold."
Max nslookup time (msec). NSlookup speed is the speed at which your DNS system was able to resolve the name of the server specified in the policy. If the lookup time exceeded the value in this field, SL1 generates an event. This threshold triggers the event "DNS hostname resolution time above threshold."
Max TCP connect time (msec). TCP connect time is the time it takes for SL1 to establish communication with the external server. In other words, the time it takes from the beginning of the HTTP request to the TCP/IP connection. If the connection time exceeds the value in this field, SL1 generates an event. This threshold triggers the event "TCP connection time above threshold."
Max overall transaction time (msec). Overall transaction time is the total time it takes to make a connection to the external server, send the HTTP request, wait for the server to parse the request, receive the requested data from the server, and close the connection. If the overall transaction time exceeds the value in this field, SL1 generates an event. This threshold triggers the event "Total transaction time above threshold."

Defining TCP/IP Port Monitoring in the Port Policies Tab

The Port Policies tab allows you to define one or more TCP/IP Port policies (otherwise defined in the Monitoring Policies page for a device). These TCP/IP Port policies tell SL1 to monitor a specified port for availability every five minutes. Availability refers to the port's ability to accept connections and data.

In the Port Policies tab, you can define one or more of the following fields:

Subtemplate Selection. In this pane, you can choose to add a new TCP/IP Port Monitoring policy to the configuration template or edit an existing TCP/IP Port Monitoring policy in the configuration template.

To add a new Port Monitoring policy to the configuration template, click Add New Port Sub-template.
To edit an existing Port Content Monitoring policy, highlight it. The remaining panes will be populated with values from the selected policy.

Add Policy To. Specifies how the template should apply the TCP/IP Port Monitoring policy. Choices are:

All devices. SL1 will apply the TCP/IP Port Monitoring policy to each device aligned with this configuration template.
Only devices whose IP(s) have a matching port. SL1 will apply the TCP/IP Port Monitoring policy only to those devices where the port is available.

Per-IP Policy Creation. Specifies whether SL1 should apply the TCP/IP Port Monitoring policy to all IP addresses on each member device or only to the Admin Primary IP address. Choices are:

All Device IPs. SL1 will apply the TCP/IP Port Monitoring policy to all IP addresses on each member device.
Management IP Only. SL1 will apply the TCP/IP Port Monitoring policy only to IP address each member device uses to communicate with SL1.

Port/Service. Port number and the corresponding service running on the port.
State. Can be one of the following:

Enabled. Port is being monitored by ScienceLogic port Policy.
Disabled. Port is not being monitored by ScienceLogic port Policy.

Critical Poll. Frequency with which SL1 should "ping" the device. If the device does not respond, SL1 creates an event. The choices are:

Disabled. SL1 will not ping the device.
Enabled. SL1 will ping the device every 60 seconds.

NOTE: SL1 does not use this ping data to create device availability reports. SL1 will continue to collect device availability at the interval specified during discovery.

Defining Windows Services Monitoring in the Svc Policies Tab

The Svc Policies tab allows you to define one or more Windows service policies (otherwise defined in the Monitoring Policies page for a device). These Windows service policies tell SL1 to monitor the device and look for the specified service. You can define a service policy so that SL1 monitors whether or not the service is running and then performs an action (starts, pauses, or restarts the service, reboots or shuts down the device, triggers the execution of a remote script or program).

In the Svc Policies tab, you can define one or more of the following fields:

Subtemplate Selection. In this pane, you can choose to add a new Windows Service Monitoring policy to the configuration template or edit an existing Windows Service Monitoring policy in the configuration template.

To add a new Windows Service Monitoring policy to the configuration template, select Add New Service Sub-template.
To edit an existing Windows Service Monitoring policy, highlight it. The remaining panes will be populated with values from the selected policy.

Add Policy To. Specifies how SL1 should apply the template to member devices. Choices are:

All devices. SL1 will apply the Windows Service Monitoring policy to each device aligned with this configuration template, even if the specified Windows service is not available on each device.
Only devices that have a matching service. SL1 will apply the Windows Service Monitoring policy only to those member devices where the service is available.

Service Name. Service to be monitored by the policy. Select from a list of all Windows services discovered in the network by SL1.
Alert if Found. Condition under which SL1 should create an event about the service. Choices are:

Disabled. SL1 will create an event if the service is disabled.
Enabled. SL1 will create an event if the service is enabled.

Service Action. If the device is a Windows computer running a WMI agent, you can define some automated actions, based on the condition specified in the Alert if Found field.

Disabled. The Service Action field is disabled and no automated actions are performed.
Stop Service. If the service has the condition specified in the Alert if Found field, stop the service.
Start Service. If the service has the condition specified in the Alert if Found field, start the service.
Pause Service. If the service has the condition specified in the Alert if Found field, pause the service.
Restart Service. If the service has the condition specified in the Alert if Found field, restart the service.

System Action. If the device is a Windows computer running a WMI agent, you can define some automated actions, based on the condition specified in the Alert if Found field.

Disabled. The System Action field is disabled and no automated actions are performed.
Reboot System. If the service has the condition specified in the Alert if Found field, reboot the computer.
Shutdown System. If the service has the condition specified in the Alert if Found field, shutdown the computer.

Action Script. If the device is a Windows computer running a WMI agent, you can execute a script on the computer, based on the condition specified in the Alert if Found field. For example, you might want to execute a script if a service crashed; the script could execute the steps required to cleanup any problems before restarting the service. In this field, you can specify the script to execute. The script must reside on the managed device, in the directory c:/program files/snmp informant/operating_system/spawn.

Defining Process Monitoring in the Proc Policies Tab

The Proc Policies tab allows you to define one or more Process policies (otherwise defined in the Monitoring Policies page for a device). These Process policies tell SL1 to monitor the device and look for the process. You can define a process policy so that SL1 monitors whether or not the process is running and optionally, how much memory a process can use and how many instances of a process can run simultaneously.

In the Proc Policies tab, you can define one or more of the following fields:

Subtemplate Selection. In this pane, you can choose to add a new Process Monitoring policy to the configuration template or edit an existing process Monitoring policy in the configuration template.

To add a new Process Monitoring policy to the configuration template, click Add New Service Sub-template.
To edit an existing Process Monitoring policy, highlight it. The remaining panes will be populated with values from the selected policy.

Add Policy To. Specifies how SL1 should apply the template to member devices. Choices are:

All devices. SL1 will apply the Process policy to each device aligned with this configuration template, even if the specified process is not available on each device.
Only devices that have a matching service. SL1 will apply the Process Monitoring policy only to those member devices where the process is available.

Process Name. The name of the process. Select from a list of all processes running on this device.
Process Argument. The arguments with which the process is invoked.
Memory Limit. The amount of memory each instance of the process is allowed to use. If an instance of this process exceeds this memory limit, SL1 will generate an event. The event will have a severity of "Major" and will say "process using too much memory". This is an optional field.
Minimum Instances. The minimum number of instances of the process that should be running. If the minimum instances are not running, SL1 generates an event. The event will be of severity "Major" and will say "too few processes running."
Maximum Instances. The maximum number of instances of the process you will allow to run. If the maximum number of instances is exceeded, SL1 generates an event. The event will be of severity "major" and will say " "too many processes process running."
Process User. Search for the following process user or process owner when the process is running. This field is helpful for finding processes running as root or su which should not be.

NOTE: Some hardware includes information about a process user or owner for each process in the SNMP data; some do not. Do not specify a value in the Process User field if the device does not include process user or process owner information in its SNMP data. If you specify a process user, and a device does not include process user in its SNMP data, SL1 will not generate an alert, even if it finds this process running.

Alert if Found. If you enable this option, SL1 generates an event when this process runs. The event will be of severity "major" and will say "Illicit process running."

Aligning Dynamic Applications and Defining Thresholds in the Dynamic Apps Tab

The Dynamic Apps tab allows you to select one or more Dynamic Applications to align with devices that use the device template. Dynamic Applications define which data will be collected from a device, the frequency of collection, and how the data will be displayed. When you apply a device template to a device group or selected devices, you do not have to manually align the Dynamic Applications with the devices that use the template. All devices that use the template will be aligned with the Dynamic Applications specified in the device template.

If you select a Dynamic Application in a Device Template, and that Dynamic Application has associated thresholds, you can change one or more of those thresholds in the Device Template. The thresholds in the Device Template will override the thresholds defined in the Dynamic Application. When you apply a device template to devices, you do not manually have to edit the Dynamic Application Thresholds in the Device Thresholds page for the devices that use the template. All devices that use the template will inherit the Dynamic Application Thresholds specified in the device template.

In the Dynamic Apps tab, you can define one or more of the following fields:

Subtemplate Selection. In this pane, you can choose to add one or more existing Dynamic Application to the configuration template.

To select the Dynamic Application, click on the green plus-sign () and then select the Dynamic Application in the Dynamic Application field.

Align Dynamic Application With. Specifies how SL1 should apply the template to member devices. Choices are:

All devices (align new applications and update collection states). SL1 will align the Dynamic Application with each device that uses the template, even if the SL1 cannot use the Dynamic Application to retrieve data from one or more of those devices.
Only devices that are already aligned to this application (update collection states only). SL1 will apply the settings for this Dynamic Application only to each device that both uses this template and is already aligned with the specified Dynamic Application.

Dynamic Application. Select the Dynamic Application to include in the device template. You can select from a list of all Dynamic Applications.
Credentials. Select a credential for the selected Dynamic Application. You can select from a list of credentials that are appropriate for the Dynamic Application. For example, if you select a Dynamic Application of type "SNMP Performance", the Credentials field will allow you to select from a list of SNMP credentials.
Poll Rate. Frequency, in minutes, at which SL1 will poll all devices that use this device template and retrieve the information specified in this Dynamic Application. You can use this field to set a custom polling frequency for one or more devices.This value over-rides the default value for the Dynamic Application (defined in the Dynamic Applications Properties Editor page). The default value is "1". Select from the pull-down menu. The choices range from 1 minute to 24 hours.
Dynamic Application Presentation Object(s). This pane displays a list of presentation objects (for Dynamic Applications of type "Performance") or collection objects (for Dynamic Applications of type "Configuration").

A collection object is a data point that is monitored by the Dynamic Application. At the polling frequency specified in the Dynamic Application, SL1 will retrieve a value for that data point.

For example, suppose you have a Dynamic Application named "Cisco: Environmental Status".

This Dynamic Application contains a collection object named "fan_state". The collection object will contain the current status of a fan.
This Dynamic Application is aligned with the device "cisco_catalyst".
The Dynamic Application will retrieve data from member devices every 30 minutes. This means that every 30 minutes SL1 will connect to the device "cisco_catalyst" and retrieve the value for fan status; possible values could be normal, warning, critical, and shutdown. This value will be stored in the collection object "fan_state".

For each aligned device, SL1 displays the latest value for each collection object in the Configuration Report page.

You can enable or disable each collection object that appears in the Dynamic Object Collection pane.

Enabled. SL1 will try to collect data for this collection object at the frequency specified in the Dynamic Application. SL1 will try to collect data for this collection object from each device that uses the device template.
Disabled. SL1 will not try to collect data for this collection object.

A presentation object is a definition of a report. The definition is stored in an object (a presentation object). The definition of the report is based on data retrieved with the Dynamic Application and stored in collection objects. These reports appear in the Performance page for each aligned device.

For example, suppose you have a Dynamic Application named "Cisco: Summary Statistics". Suppose this Dynamic Application includes the presentation object "% I/O Memory Used".

Suppose that the definition of this presentation object is "(number of broadcast packets/number of multicast packets) / 100", where "number of broadcast packets" is a collection object and "number of multicast packets" is a collection object.

Suppose that this Dynamic Application has a polling frequency of every 30 minutes and is aligned with the device "cisco_router". This means that every 30 minutes, SL1 will connect to the device "cisco_router" and retrieve the collection objects for the Dynamic Application.

SL1 will then use the values from the collection objects "number of broadcast packets" and "number of multicast packets" to calculate the value of the presentation object and then graph that value. SL1 will graph the value that results from each polling session in the Performance page for the aligned device.

You can enable or disable each presentation object.

Enabled. This is the default value. For each device that uses the device template, SL1 will try to generate the report defined by the presentation object. If SL1 can successfully retrieve the data (from the collection objects specified by the presentation object) from the device, the report will appear in the Performance page.
Disabled. SL1 will not try to generate the report defined by the presentation object.

NOTE: As you disable a presentation object, SL1 checks the collection objects associated with the presentation object. If a collection object is used in only one presentation object, and that presentation object is disabled, SL1 will no longer collect data for the associated collection object. If a collection object is used in multiple presentation objects, and one or more of those presentation objects is still enabled, SL1 will continue to collect data for the associated collection object. If a collection object is used in multiple presentation objects, and all those presentation objects are disabled, SL1 will no longer collect data for that collection object.

Dynamic Application Thresholds. This pane displays a list of threshold objects associated with the Dynamic Application. You can accept the default value as defined in the Dynamic Application, or you can manually change the value within this template.

A threshold object is a variable that contains a threshold value. SL1 can use this threshold value when defining alerts and presentation objects.

For example, suppose we have a Dynamic Application named "Cisco:Swap". Suppose this Dynamic Application includes two collection objects: "Free Swap", and "Used Swap". Suppose this Dynamic Application also includes a threshold object called "high_swap" with a value of "80".

We could then create an alert that uses the collection objects to specify "when swap usage exceeds the value of the threshold object (80%), trigger an alert".

We could define an event policy, based on this alert.

For each aligned device, this swap threshold will also appear in the Device Thresholds page.

To change the value of a threshold object, click on the name of the threshold and then move the slider. The new threshold value will be used for each device that uses the device template.

Raw Data Retention. Number of days to retain raw data collected from the device using this Dynamic Application. Raw data that is older than the specified number of days is automatically deleted. The default value is defined in the Data Retention Settings page.
Crunched Data Retention. Appears only for Journal Dynamic Applications. Number of days to retain data that has been processed using the presentation objects in this Dynamic Application. The default value is defined in the Data Retention Settings page.
Hourly Rollup Retention. Appears only for performance Dynamic Applications. Number of days to retain hourly normalized data for this Dynamic Application. Hourly normalized data that is older than the specified number of days is automatically deleted. The default value is defined in the Data Retention Settings page.
Daily Rollup Retention. Appears only for performance Dynamic Applications. Number of days to retain daily normalized data for this Dynamic Application. Daily normalized data that is older than the specified number of days is automatically deleted. The default value is defined in the Data Retention Settings page.

Aligning Log File Monitoring Policies in the Logs Tab

Log File Monitoring policies can be aligned to devices using a Device Template.

The Logs tab allows you to align one or more Log File Monitoring Policies with the devices that use the device template. A Log File Monitoring Policy specifies a log file or Windows log that the SL1 agent will monitor on a device and the logs that the agent will send to SL1. When the SL1 agent sends a log to SL1, SL1 displays the log entry in the Device Logs & Messages page for the associated device. SL1 can then use that log entry to trigger events.

In the Logs tab, you can:

Apply an existing Log File Monitoring Policy to each device that uses the device template.
Override one or more of the parameters of the selected Log File Monitoring Policy. These overrides will apply only to the devices that use this device template.

In the Logs tab, you can define one or more of the following fields:

Subtemplate Selection. In this pane, you can choose to add one or more existing Dynamic Application to the configuration template.

To align an existing Log File Monitoring Policy with the device template, click the plus icon () in the Subtemplate pane and then supply values in one or more of the fields.
To edit a Log File Monitoring Policy in device template, go to the Subtemplate Selection pane and select the Log File Monitoring Policy you want to edit. The field in the right pane will be populated with values from the selected policy. You can then edit one or more values for the policy.

The Logs tab includes the following fields in the right pane:

Align Log Monitoring Policy With. Select how to align the Log File Monitoring Policy. Choices are:

All compatible devices. Apply the Log File Monitoring Policy to all devices that include the SL1 agent and use an operating system supported by the type of Log File Monitoring Policy.
Only devices that are already aligned to this log policy. Apply the edited Log File Monitoring Policy only to devices that are already aligned with the Log File Monitoring Policy.

Log Monitoring Policy. Select from a list of existing Log File Monitoring policies. Select the Log File Monitoring Policy you want to align with devices to which the template is applied.

The following fields allow you to override one or more settings in the Log File Monitoring Policy you selected in the Log Monitoring Policy field. These overrides apply only to devices that use the device template:

File Path. If you selected File in the Type field, this field is displayed. Enter the full path of the file to monitor.
Limit. The maximum log messages the agent sends to SL1 per minute. If the number of matching logs exceeds this value, the agent will stop sending logs to the platform for the remainder of the minute. The limit resets at the beginning of the next minute. For example, suppose you set this field to 10,000. Suppose the agent monitors a device that has 30,000 log messages. The agent will retrieve 10,000 logs and then wait until the beginning of the next minute. The agent will then retrieve the next 10,000 logs and then wait until the beginning of the next minute. The agent will continue to retrieve 10,000 logs per minute until it has retrieved all the logs from the device.
Filter. Specify a regular expression that will be used to evaluate the log messages in the specified file or Windows log. If a log message matches this regular expression, the SL1 agent will send that log message to SL1. If a log message does not match this regular expression, the SL1 agent will not send that log message to SL1.

Creating a New Device Template Based on an Existing Device Template

To define a new device template based on an existing template, perform the following steps:

Go to the Configuration Templates page (Registry > Devices > Templates).
In the Configuration Templates page, find the device template you want to use as a template to create a new device template. Click its wrench icon ().
In the Device Template Editor page, supply a new value in the Name field.

If you do not enter a new value in the Name field, SL1 will save the new device template under the same name as the existing device template, but with a different ID number. In some cases, this could make management of device templates difficult. Best practice is to supply a new name for the new device template.

Edit one or more fields, if desired.
Click the Save As button.
The new device template will appear in the Configuration Templates page.

Editing an Existing Device Template

You can edit an existing device template and change one or more of its parameters.

NOTE: Device templates are not dynamic. That is, when you update or change a device template, no changes are made to any devices that have used the template in the past.

To edit a device template:

Go to the Configuration Templates page (Registry > Devices > Templates).
In the Configuration Templates page, find the device template you want to edit. Click its wrench () icon.
The Device Template Editor page appears, populated with values from the selected device template.
If you see a grayed-out field in a device template, this means that when the template is applied to a device, the value for that field will not be changed. The device will either retain its current value for that field or will use the default value for that field. To change the value of a grayed-out field, simply click on the name of the field and edit the value.
In each tab, you can change one or more parameters. For a description of each field, see the previous sections in this chapter.
Click the Save button to save your changes to the device template.