What is the current best practice for ACC Agent or Server Down alerting?

[Paul Bloem]

Prior to our latest upgrade of the ACC-F and ACC-M plugins, there was a "Self-Healing Events" policy that would start pinging servers if the agent was disconnected or went down, and throw an event if it was unreachable.

After upgrading, that policy's name has been updated to "Deprecated policy: Self-Healing Events" and the only events we see when an agent is down are generic "There are disconnected agents from the MID <mid_name>" that is tied to the MID server.

Is anyone aware of the current best practice for alerting when a server goes down? Should we be creating our own policy that constantly performs the ping checks? Some configuration setting I'm missing?

[tschneider]

Hey Paul,

now it is working, At least the agent down monitor is. Ping test doesn't seem to work.

Step 2 I had missed initially. The script itself was still disabled. Once that was activated everything sprung to life. 

Thanks a lot for your assistance. Still wondering where ServiceNow is going with this. Monitoring the agent status is vital in my opinion and I haven't found anything in the MID server logs that would indicate an agent being down. So could not use health log analytics. 

I also would like to be informed when a machine is unreachable on the network. Which to me is a different alert than just an agent down.

I had tried to create a flow that triggers whenever the Status field in [sn_agent_ci_extended_info] changes. Couldn't get it to work. The trigger would only fire when I manually change something on the record. But not when the status gets changed by a background process.

Have a good day

Thorsten