I want to include and exclude sensors from an existing device template. How can I do that?
How can I include and exclude sensors from device templates?
Votes:
1
15 Replies
Votes:
3
This article applies as of PRTG 22
Include and exclude filters for device templates
You can use filters to define which sensors are added if you apply a device template in PRTG. You can include or exclude specific column names to filter the sensors.
Information: Check out our device templates video tutorial here.
Instructions
1. Find out what filters you can use
1.1 Create a device template
First, you must create a new device template. For details, see PRTG Manual: Create Device Template.
1.2 Find and open the device template
You can find the device templates in the \devicetemplates subfolder of the PRTG program directory.
Open the device template with a text editor and find the section that looks like this:
<!--
Available column names for filtering:
"id"
"name"
"volume"
"comment"
"supportsalignment"
-->
You can filter for one or more of the column names.
2. How to use filters
Enter the column names between the include or exclude tags that you can find below Available column names for filtering.
2.1 Filter rule format
Filter rules are based on the following format:
columnname[value]
Important notice: Values are case-sensitive. |
Here are some examples of what a filter can look like:
volume[mysql_l0]
measurement[CPU]
64bit[1]
Important notice: The displayed value may differ from the internal value you have to use for the filter. At the moment, you have to use a workaround. Follow the steps below to find out which value you have to use: |
- Follow steps 1.1 and 1.2
- Enter none between the include tags and any between the exclude tags
- Save and close the device template
- Apply the device template in PRTG
- Navigate to the \Logs\debug subfolder of the PRTG data directory. Find the default path below.
%programdata%\Paessler\PRTG Network Monitor\Logs\debug
- Open CoreAutoDiscovery.log
- Search for the name of the device template you have applied. The line that you are looking for looks like this:
Template Assigned; Device ID: 2661; Name: device_template_name
- Below the corresponding line, you can find the internal values that the sensor provides. The lines you are looking for look like this, for example:
Row 32 ["45:Sonicwall X1","(045) Sonicwall X1 Traffic",1,"1 GBit/s",117,1,"Sonicwall X1"] removed by filter
For comparison, the corresponding meta-scan section of the SNMP Traffic sensor:
Click to enlarge.
You can see that the displayed values differ from the internal values. See the table below to understand the pattern:
Column name | Displayed value | Internal value |
---|---|---|
ID | 45:Sonicwall X1 | 45:Sonicwall X1 |
Name | (045) Sonicwall X1 Traffic | (045) Sonicwall X1 Traffic |
Status | Connected | 1 |
Speed | 1 GBit/s | 1 GBit/s |
Type | Gigabit Ethernet | 117 |
64bit | Yes | 1 |
Internal name | Sonicwall X1 | Sonicwall X1 |
Note: To filter column names that contain Yes, No, True, or False as value, always use the internal values 1 or 0.
2.2 Supported logical operators
You can use the logical operators AND, OR, AND NOT, and NOT.
2.3 Supported operational modes
You can use different optional modes. You can enter modes in the following format: columnname[value,mode]
The following modes are supported:
2.3.1 String modes:
- substring: This mode filters for a specific substring (default)
- exact: This mode enforces an exact match of a value
For example, to filter for any results with a name that contains the sequence SonicWall, use the filter name[SonicWall,substring].
2.3.2 Number modes: These interpret and compare values as numbers. They only support integer values without extra characters and without thousands separators. They also support hex format.
- equal
- greater
- greaterorequal
- less
- lesslessorequal
For example, to filter for any result with the priority 1 or higher, use the filter priority[1,greaterorequal].
Basic example:
A filter can look like the following:
<include>
any
</include>
<exclude>
name[test] OR name[demo]
</exclude>
Advanced example:
Complex expressions can be created using parentheses and AND, OR, AND NOT, or NOT:
<include>
any
</include>
<exclude>
NOT (name[/vol/vol_mysql_l0/mysql_l0/mysql_l0.lun] AND volume[mysql_l0])
</exclude>
3. Exceptions
3.1 Values with brackets or commas
If you use values with brackets or commas, you have to escape them with quotes:
- name[Intel[R] 82574L Gigabit Network Connection] --> Leads to error "unknown token 82574L"
- name["Intel[R] 82574L Gigabit Network Connection"] --> Works as expected
3.2 Values with quotes
If you use values with quotes, you have to escape them and the entire value with quotes:
- Hello "World" Test --> Leads to an error
- "Hello ""World"" Test" --> Works as expected
Important notice: The behavior of the SNMP Traffic sensor is different. For details, see How does auto-discovery with SNMP Traffic sensors work? |
Created on Dec 17, 2020 11:25:30 AM
Last change on Jan 5, 2023 8:41:56 AM by
Brandy Greger [Paessler Support]
Votes:
0
Hi,
This is a great improvement to the templates...
One question, for generic / Custom advanced sensors, most of them return
<!-- Available column names for filtering: --> <include>any</include> <exclude>none</exclude>
Which indicates that no filtering is available...
Is there a field name for plain sensor name ?
If I create a Custom SNMP Table sensor, and want to apply that to a group of devices.
It may create hundreds of sensors...
I'm only interested in the ones with "fan" or "psu" in the sensor name.
What would the syntax be ?
Something like:
<include>sensorname[fan] OR sensorname[psu]</include>
Or all except "Power Sensor" and
<exlude>sensorname[Power Sensor] OR sensorname[Voltage Sensor]</exclude>
Also, Is the include/exclude required when you try to include / exclude
Thanks
JR
Created on Feb 24, 2021 9:21:54 PM by
JR Andreassen
(10)
●2
Last change on Feb 25, 2021 5:12:42 AM by
Sven Roggenhofer [Paessler Technical Support]
Votes:
0
Hi there,
please take a look at point 2.1, where it is explained how to get the (internal) values for the filter. The filtername is the name of the column shown in the table, when creating the sensor.
Kind regards,
Matthias Kupfer - Team Tech Support
Votes:
0
Hi Mathias, Thank you for the reply...
A couple of follow up questions...
- Is there a field for the "Sensor Name" that will work for any sensor (Like "SensorName[blah,substring]"?
- Field Names for Custom Tables.. If I read your answer and section 2.1 correctly... A custom table can be filtered on any column by name. That means a Custom SNMP Table on "1.3.6.1.2.1.2.2" that returns :
ifIndex ifDescr ifType ifMtu ifSpeed ifPhysAddress ifAdminStatus ifOperStatus ifLastChange ifInOctets ifInUcastPkts ifInNUcastPkts ifInDiscards ifInErrors
I can use any of the OID var/field names to filter ? Like:
<include>(ifOperStatus[1] and ifDescr[WAN,substring])</include>
If the MIBs are not loaded, for a table like "1.3.6.1.2.1.99.1.1", they will com back as OID like:
"1.3.6.1.2.1.99.1.1.1.1" "1.3.6.1.2.1.99.1.1.1.2" "1.3.6.1.2.1.99.1.1.1.3" "1.3.6.1.2.1.99.1.1.1.4" "1.3.6.1.2.1.99.1.1.1.5" "1.3.6.1.2.1.99.1.1.1.6" "1.3.6.1.2.1.99.1.1.1.7" "1.3.6.1.2.1.99.1.1.1.8"
What would the field names look like ?
<include>("1.3.6.1.2.1.99.1.1.1.1"[1]</include> <exclude>"1.3.6.1.2.1.99.1.1.1.6"[RPM,substring])</exclude>
I appreciate you sharing your insight
Created on Feb 25, 2021 10:32:27 PM by
JR Andreassen
(10)
●2
Last change on Feb 26, 2021 1:28:01 PM by
JR Andreassen
(10)
●2
Votes:
0
Hi Florian, hi all
With this filter function the device templates become a lot more interesting.
I am happy to share my results of the different filtering options here.
Maybe this will help one or the other PRTG user to better understand the filter functionality.
I tried them with a Cisco switchstack of the C9300series.
The goal was to read out only three interfaces with SNMP.
Variant 1 include the required interfaces and exclude none --> The three interfaces are showed as sensors of the device
Variant 2 include the required interfaces and exclude any --> No interfaces are showed
Variant 3 includes any and exclude the three interfaces --> All interfaces except the three excluded interfaces are showed as sensors of the device
Variant 4 includes any and negate the three interfaces from the exclude --> The three interfaces are showed as sensors of the device
Variant 1 and variant 4 shows the same result. They show the three interfaces as sensors of the device.
Variant 1:
<include>
(name[(Te1/1/8)] OR name[(Te2/1/8)] OR name[(Po1)])
</include>
<exclude>
none
</exclude>
Variant 2:
<include>
(name[(Te1/1/8)] OR name[(Te2/1/8)] OR name[(Po1)])
</include>
<exclude>
any
</exclude>
Variant 3:
<include>
any
</include>
<exclude>
(name[(Te1/1/8)] OR name[(Te2/1/8)] OR name[(Po1)])
</exclude>
Variant 4:
<include>
any
</include>
<exclude>
NOT (name[(Te1/1/8)] OR name[(Te2/1/8)] OR name[(Po1)])
</exclude>
Best regards,
Alain
Votes:
0
Hello Alain,
Thank you very much for sharing your experience with the community. Have a nice day!
Regards.
Votes:
0
Hi.... Alain, That's great...
But, it did unfortunately not solve my problem...
The question was for our friends at Paessler...
- What fieldnames are available ?
- What "static" field names are available "name", "value", etc
- How do we handle Custom SNMP Table names and OIDs in the return from the Meta-Scan ?
I have a template that builds the name using "NameTemplate" from OID's... Which happens after the creation, IE ... not available until after the first sensor scan...
<create id="_snmp_entPhySensorTable" kind="snmpcustomtable" meta="snmptable" requires="snmp_entPhySensorTable_noncisco" displayname="PhysSensor: Generic / (Unit) - [1.3.6.1.2.1.1.5.0]"> <metadata> <tableoid> <cell col="0">1.3.6.1.2.1.99.1.1</cell> <cell col="1">entPhySensorTable</cell> </tableoid> <identcolumn> <cell col="0">table_index</cell> <cell col="1">table_index</cell> </identcolumn> </metadata> <createdata> <tags>snmpcustomsensor snmpcustomtable physsensor entsensor snmp prtgc prtgclean</tags> <priority>3</priority> <comments/> <primarychannel>2</primarychannel> <position>50</position> <inherittriggers> <flags> <inherited/> </flags> <cell>1</cell> </inherittriggers> <stack>0</stack> <usesingleget/> <nametemplate>PhysSensor: [1.3.6.1.2.1.47.1.1.1.1.2[index]] ([1.3.6.1.2.1.99.1.1.1.6[index]])</nametemplate> <identcolumn> <cell col="0">table_index</cell> <cell col="1">table_index</cell> </identcolumn> <tableoid> <cell col="0">1.3.6.1.2.1.99.1.1</cell> <cell col="1">entPhySensorTable</cell> </tableoid> <channel1column> <cell col="0">1.3.6.1.2.1.99.1.1.1.5</cell> <cell col="1">entPhySensorOperStatus</cell> </channel1column> <channel2column> <cell col="0">1.3.6.1.2.1.99.1.1.1.4</cell> <cell col="1">entPhySensorValue</cell> </channel2column> ...
In these cases... the "Name" is "PhysSensor: [1.3.6.1.2.1.47.1.1.1.1.2[index]] ([1.3.6.1.2.1.99.1.1.1.6[index]])"
<exclude>name[DOM,substring]</exclude> Error in <exclude> filter of device template "Generic Lean" in <create id="_snmp_entPhySensorTable">: Unknown token "name". ... <exclude>1.3.6.1.2.1.47.1.1.1.1.2[DOM,substring]</exclude> Error in <exclude> filter of device template "Generic Lean" in <create id="_snmp_entPhySensorTable">: Unknown token "1.3.6.1.2.1.47.1.1.1.1.2".
It would be nice if the error printed out the list of valid "tokens"...
The only alternative I see is adding the type as a column, and storing a static value in the sensor and then using it ... Which is not desirable...
Is there a way to filter on the metascan ?
<create id="_snmp_entPhySensorTable" kind="snmpcustomtable" meta="snmptable" requires="snmp_entPhySensorTable_noncisco" displayname="PhysSensor: Generic / (Unit) - [1.3.6.1.2.1.1.5.0]"> <metadata> <tableoid> <cell col="0">1.3.6.1.2.1.99.1.1</cell> <cell col="1">entPhySensorTable</cell> </tableoid> <identcolumn> <cell col="0">table_index</cell> <cell col="1">table_index</cell> </identcolumn> <exclude>name[DOM,substring]</exclude> ... </metadata>
Like you can do in the "Check Metascan"...
<check id="check_XXXXX" meta="snmpnext" requires="snmp"> <metadata> <oid>1.3.6.1.4.X</oid> </metadata> <checksubstring>Matched SubString Value to include</checksubstring> <excludevalue>Matched SubString Value to exclude</excludevalue> </check>
We appreciate you sharing your insight...
Thanks
JR
Votes:
1
Here's an example which is probably a common use-case:
Monitoring network interfaces from a Windows Host using SNMP but excluding the the following:
- WFP 802.3 MAC Layer LightWeight Filter
- QoS Packet Scheduler
- Npcap Packet Driver (NPCAP)
This is the XML code for the device template in case it helps someone else:
<create id="snmptraffic" kind="snmptraffic" meta="portscan" requires="snmp"> <createdata> <tags>bandwidthsensor snmptrafficsensor</tags> <priority>3</priority> <comments>Ethernet</comments> <primarychannel>-1</primarychannel> <position>60</position> <inherittriggers> <flags> <inherited/> </flags> <cell>1</cell> </inherittriggers> <stack>0</stack> <usesingleget/> <usebulkgetnext/> <stack>0</stack> <namein>Traffic In</namein> <nameout>Traffic Out</nameout> <namesum>Traffic Total</namesum> <trafficmode/> <monitorstate>1</monitorstate> </createdata> <include>any</include> <exclude>internalname[-WFP,substring] OR internalname[-QoS,substring] OR internalname[-Npcap,substring] OR internalname[Loopback,substring]</exclude> <triggerdata/> </create>
The filtering logic is only this:
<include>any</include> <exclude>internalname[-WFP,substring] OR internalname[-QoS,substring] OR internalname[-Npcap,substring] OR internalname[Loopback,substring]</exclude>
But I guess it's easier to see within the whole context.
Best Regards,
Luciano Lingnau [Paessler]
Created on Sep 2, 2021 9:39:56 AM by
Luciano Lingnau [Paessler]
Last change on Sep 2, 2021 10:26:46 AM by
Luciano Lingnau [Paessler]
Votes:
0
Hello again... So the substring search, is it supposed to be case sensiitive ?
The expression :
<exclude>name[local,substring]</exclude>
Does not exclude "*LOCAL*"
2022-01-17 20:33:59.657525 INFO TId 9040 CoreAutoDiscovery> Device ID: 132187 Name: DS on au-vcsa-001 Host: au-vcsa-001.local ProbeGUID: {....} 2022-01-17 20:33:59.657525 INFO TId 9040 CoreAutoDiscovery> Device Templates; Device ID: 132187; Selected: 1 2022-01-17 20:33:59.673157 INFO TId 9040 CoreAutoDiscovery> Template Loaded; Device ID: 132187; Name: NonLocal_VCDataStores 2022-01-17 20:34:04.829539 INFO TId 9040 CoreAutoDiscovery> Template Check; Device ID: 132187; Check ID: ping; FOUND 2022-01-17 20:34:05.095169 INFO TId 9040 CoreAutoDiscovery> Template Check; Device ID: 132187; Check ID: dotnet461808; FOUND 2022-01-17 20:34:07.032735 INFO TId 9040 CoreAutoDiscovery> Template Check; Device ID: 132187; Check ID: metavmwareserverhostsoap; FOUND 2022-01-17 20:34:07.032735 INFO TId 9040 CoreAutoDiscovery> Template Assigned; Device ID: 132187; Name: OTMonitor_VCDataStores 2022-01-17 20:34:09.048381 INFO TId 9040 CoreAutoDiscovery> Row 8 [datastore-1862,HOST-012-ESXI_local] removed by filter 2022-01-17 20:34:09.048381 INFO TId 9040 CoreAutoDiscovery> Row 7 [datastore-1861,HOST-011-ESXI_local] removed by filter 2022-01-17 20:34:09.048381 INFO TId 9040 CoreAutoDiscovery> Row 6 [datastore-1860,HOST-010-ESXI_local] removed by filter 2022-01-17 20:34:09.048381 INFO TId 9040 CoreAutoDiscovery> Row 5 [datastore-1859,HOST-009-ESXI_local] removed by filter 2022-01-17 20:34:09.048381 INFO TId 9040 CoreAutoDiscovery> Template Create Meta Request; Device ID: 132187; Create ID: VMwareDatastoreExtern.nonlocal; FOUND: 28 2022-01-17 20:34:34.299011 INFO TId 9040 CoreAutoDiscovery> Sensor Created; Device ID: 132187; Create ID: VMwareDatastoreExtern.nonlocal; Sensor ID: 132504; Name: Datastore Free: HOST-CCSS-vSAN 2022-01-17 20:34:34.299011 INFO TId 9040 CoreAutoDiscovery> Sensor Created; Device ID: 132187; Create ID: VMwareDatastoreExtern.nonlocal; Sensor ID: 132505; Name: Datastore Free: HOST-U19A-ESXI_LOCAL 2022-01-17 20:34:34.299011 INFO TId 9040 CoreAutoDiscovery> Sensor Created; Device ID: 132187; Create ID: VMwareDatastoreExtern.nonlocal; Sensor ID: 132506; Name: Datastore Free: HOST-U19B-ESXI_LOCAL 2022-01-17 20:34:34.299011 INFO TId 9040 CoreAutoDiscovery> Sensor Created; Device ID: 132187; Create ID: VMwareDatastoreExtern.nonlocal; Sensor ID: 132507; Name: Datastore Free: HOST-U19C-ESXI_LOCAL 2022-01-17 20:34:34.299011 INFO TId 9040 CoreAutoDiscovery> Sensor Created; Device ID: 132187; Create ID: VMwareDatastoreExtern.nonlocal; Sensor ID: 132508; Name: Datastore Free: HOST-U19D-ESXI_LOCAL 2022-01-17 20:34:34.299011 INFO TId 9040 CoreAutoDiscovery> Sensor Created; Device ID: 132187; Create ID: VMwareDatastoreExtern.nonlocal; Sensor ID: 132509; Name: Datastore Free: HOST-013-ESXi-LOCAL 2022-01-17 20:34:34.314628 INFO TId 9040 CoreAutoDiscovery> Sensor Created; Device ID: 132187; Create ID: VMwareDatastoreExtern.nonlocal; Sensor ID: 132510; Name: Datastore Free: HOST-014-ESXi-LOCAL 2022-01-17 20:34:34.314628 INFO TId 9040 CoreAutoDiscovery> Sensor Created; Device ID: 132187; Create ID: VMwareDatastoreExtern.nonlocal; Sensor ID: 132511; Name: Datastore Free: HOST-015-ESXi-LOCAL ....
Thanks again JR
Votes:
0
Hi JR,
The values are indeed case-sensitive, therefore you need to use "<exclude>name[LOCAL,substring]</exclude>" instead.
If it doesn't work, let me know.
Best regards.
Votes:
0
Hi there,
are Wildcards supported like name[cp-template*] see template config snip below
<!--
Available column names for filtering:
"field"
"name"
-->
<include>
any
</include>
<exclude>
name[cp-template*]
</exclude>
Votes:
0
Hello again Paessler-ists...
I have another question about the templates...
I have a stack of Fortigates which we are monitoring..
Some of the interfaces are controll interfaces with interface speed 0...
How do I exclude those ?
I have tried variations on this, which does not work:
<exclude> speed[1,less]</exclude>
<exclude> speed[0,equal]</exclude>
By setting different filters I get the debug output:
CoreAutoDiscovery> Row 18 [22,"(022) naf.vDOM-Infra naf.vDOM-Infra",1,,131,1,] removed by filter
CoreAutoDiscovery> Row 16 [20,"(020) naf.vDOM-1 naf.vDOM-1",1,,131,1,] removed by filter
CoreAutoDiscovery> Row 13 [17:MD1-V10-iSCSI,"(017) XX1-V10-iSCSI Internal-VLAN10",1,"1 GBit/s",135,1,XX-V10-iSCSI] removed by filter
It seems there is no speed text or integer if the interface speed is 0...
How do we specify that ?
Also, how do you specify adminstatus vs operational status
Given the following data from the trace
ifType .1.3.6.1.2.1.2.2.1.3.19 = INTEGER: 131 .1.3.6.1.2.1.2.2.1.3.20 = INTEGER: 131 .1.3.6.1.2.1.2.2.1.3.21 = INTEGER: 131 ifSpeed .1.3.6.1.2.1.2.2.1.5.19 = Gauge32: 0 .1.3.6.1.2.1.2.2.1.5.20 = Gauge32: 0 .1.3.6.1.2.1.2.2.1.5.21 = Gauge32: 0 ifAdminStatus 1.3.6.1.2.1.2.2.1.7 up(1), down(2) testing(3) .1.3.6.1.2.1.2.2.1.7.19 = INTEGER: 1 .1.3.6.1.2.1.2.2.1.7.20 = INTEGER: 1 .1.3.6.1.2.1.2.2.1.7.21 = INTEGER: 1 ifOperStatus 1.3.6.1.2.1.2.2.1.8 up(1), down(2) testing(3) unknown(4), dormant(5) notPresent(6) lowerLayerDown(7) .1.3.6.1.2.1.2.2.1.8.19 = INTEGER: 1 .1.3.6.1.2.1.2.2.1.8.20 = INTEGER: 1 .1.3.6.1.2.1.2.2.1.8.21 = INTEGER: 1 ifConnectorPresent 1.3.6.1.2.1.31.1.1.1.17 'true(1)/false(2)' if the interface sublayer has a physical connector and the value .1.3.6.1.2.1.31.1.1.1.17.19 = INTEGER: 2 .1.3.6.1.2.1.31.1.1.1.17.20 = INTEGER: 2 .1.3.6.1.2.1.31.1.1.1.17.21 = INTEGER: 2 ifAlias .1.3.6.1.2.1.31.1.1.1.1.19 = STRING: "l2t.root" .1.3.6.1.2.1.31.1.1.1.1.20 = STRING: "naf.vDOM-1" .1.3.6.1.2.1.31.1.1.1.1.21 = STRING: "l2t.vDOM-1"
Thanks JR
Created on Oct 25, 2023 5:55:12 PM by
JR Andreassen
(10)
●2
Last change on Nov 1, 2023 7:24:31 AM by
Moritz Heller [Paessler Support]
Votes:
0
Hi JR,
did you already tried to exclude everything? In this way, you can check the debug log for all found Sensors and also their values. I suspect that these are not reported as 0 in PRTG and another value is displayed (e.g. blank or NULL)
Votes:
0
Hi JR,
Which Sensor did you try?
Whith the SNMP Traffic v2 Sensor you have different options regarding the ifOperStatus and the ifAdminStatus.
Another way to determine by yourself the ifOperStatus and the ifAdminStatus is the usage of the SNMP Custom Table Sensor and then to define which Channels you want to monitor.
Then you can determine yourself which return value gets which PRTG state.
Best Regards,
Alain
Votes:
0
Hi...
I did exclude to get the output.
CoreAutoDiscovery> Row 18 [22,"(022) naf.vDOM-Infra naf.vDOM-Infra",1,,131,1,] removed by filter CoreAutoDiscovery> Row 16 [20,"(020) naf.vDOM-1 naf.vDOM-1",1,,131,1,] removed by filter CoreAutoDiscovery> Row 13 [17:MD1-V10-iSCSI,"(017) XX1-V10-iSCSI Internal-VLAN10",1,"1 GBit/s",135,1,XX-V10-iSCSI] removed by filter
Here we have speed (returns 1000000): 1,"1 GBit/s",135 This one does not have speed (0): 1,,131 The problem is that the speed comes back as blank when it is "0"
So, the question is, what is the expression to exclude interfaces with speed of Zero ? speed[0,equal] ? speed[1,less] ?
Thanks JR
Add comment