I want to include and exclude sensors from an existing device template. How can I do that?
Created on Dec 14, 2020 11:20:18 AM by
8 Replies
Accepted Answer
This article applies as of PRTG 21
Include and exclude filters for device templates
You can use filters to define which sensors are added if you apply a device template in PRTG. You can include or exclude specific column names to filter the sensors.
Instructions
1. Find out what filters you can use
1.1 Create a device template
First, you must create a new device template. For details, see PRTG Manual: Create Device Template.
1.2 Find and open the device template
You can find the device templates in the \devicetemplates subfolder of the PRTG program directory.
Open the device template with a text editor and find the section that looks like this:
<!--
Available column names for filtering:
"id"
"name"
"volume"
"comment"
"supportsalignment"
-->
You can filter for one or more of the column names.
2. How to use filters
Enter the column names between the include or exclude tags that you can find below Available column names for filtering.
2.1 Filter rule format
Filter rules are based on the following format:
columnname[value]
Important: Values are case-sensitive.
Here are some examples of what a filter can look like:
volume[mysql_l0]
measurement[CPU]
64bit[1]
Important: The displayed value may differ from the internal value you have to use for the filter. At the moment you have to use a workaround. Follow the steps below to find out which value you have to use:
- Follow steps 1.1 and 1.2
- Enter none between the include tags and any between the exclude tags
- Save and close the device template
- Apply the device template in PRTG
- Navigate to the \Logs\debug subfolder of the PRTG data directory. Find the default path below.
%programdata%\Paessler\PRTG Network Monitor\Logs\debug - Open CoreAutoDiscovery.log
- Search for the name of the device template you have applied. The line that you are looking for looks like this:
Template Assigned; Device ID: 2661; Name: device_template_name
- Below the corresponding line, you can find the internal values that the sensor provides. The lines you are looking for look like this, for example:
Row 32 ["45:Sonicwall X1","(045) Sonicwall X1 Traffic",1,"1 GBit/s",117,1,"Sonicwall X1"] removed by filter
For comparison, the corresponding meta-scan section of the SNMP Traffic sensor:
Click to enlarge.
You can see that the displayed values differ from the internal values. See the table below to understand the pattern:
| Column name | Displayed value | Internal value |
|---|---|---|
| ID | 45:Sonicwall X1 | 45:Sonicwall X1 |
| Name | (045) Sonicwall X1 Traffic | (045) Sonicwall X1 Traffic |
| Status | Connected | 1 |
| Speed | 1 GBit/s | 1 GBit/s |
| Type | Gigabit Ethernet | 117 |
| 64bit | Yes | 1 |
| Internal name | Sonicwall X1 | Sonicwall X1 |
Note: To filter column names that contain Yes, No, True, or False as value, always use the internal values 1 or 0.
2.2 Supported logical operators
You can use the logical operators AND, OR, AND NOT, and NOT.
2.3 Supported operational modes
You can use different optional modes. You can enter modes in the following format: columnname[value,mode]
The following modes are supported:
2.3.1 String modes:
- substring: This mode filters for a specific substring (default)
- exact: This mode enforces an exact match of a value
For example, to filter for any results with a name that contains the sequence SonicWall, use the filter name[SonicWall,substring].
2.3.2 Number modes: These interpret and compare values as numbers. They only support integer values without extra characters and without thousands separators. They also support hex format.
- equal
- greater
- greaterorequal
- less
- lesslessorequal
For example, to filter for any result with the priority 1 or higher, use the filter priority[1,greaterorequal].
Basic example:
A filter can look like the following:
<include>
any
</include>
<exclude>
name[test] OR name[demo]
</exclude>
Advanced example:
Complex expressions can be created using parentheses and AND, OR, AND NOT, or NOT:
<include>
any
</include>
<exclude>
NOT (name[/vol/vol_mysql_l0/mysql_l0/mysql_l0.lun] AND volume[mysql_l0])
</exclude>
3. Exceptions
3.1 Values with brackets or commas
If you use values with brackets or commas, you have to escape them with quotes:
- name[Intel[R] 82574L Gigabit Network Connection] --> Leads to error "unknown token 82574L"
- name["Intel[R] 82574L Gigabit Network Connection"] --> Works as expected
3.2 Values with quotes
If you use values with quotes, you have to escape them and the entire value with quotes:
- Hello "World" Test --> Leads to an error
- "Hello ""World"" Test" --> Works as expected
Important: The behavior of the SNMP Traffic sensor is different. For details, see How does auto-discovery with SNMP Traffic sensors work?
Created on Dec 17, 2020 11:25:30 AM by
Last change on Mar 4, 2021 2:32:18 PM by
Hi,
This is a great improvement to the templates...
One question, for generic / Custom advanced sensors, most of them return
<!-- Available column names for filtering: --> <include>any</include> <exclude>none</exclude>
Which indicates that no filtering is available...
Is there a field name for plain sensor name ?
If I create a Custom SNMP Table sensor, and want to apply that to a group of devices.
It may create hundreds of sensors...
I'm only interested in the ones with "fan" or "psu" in the sensor name.
What would the syntax be ?
Something like:
<include>sensorname[fan] OR sensorname[psu]</include>
Or all except "Power Sensor" and
<exlude>sensorname[Power Sensor] OR sensorname[Voltage Sensor]</exclude>
Also, Is the include/exclude required when you try to include / exclude
Thanks
JR
Created on Feb 24, 2021 9:21:54 PM by
Last change on Feb 25, 2021 5:12:42 AM by
Hi there,
please take a look at point 2.1, where it is explained how to get the (internal) values for the filter. The filtername is the name of the column shown in the table, when creating the sensor.
Kind regards,
Matthias Kupfer - Team Tech Support
Created on Feb 25, 2021 3:05:09 PM by
Hi Mathias, Thank you for the reply...
A couple of follow up questions...
- Is there a field for the "Sensor Name" that will work for any sensor (Like "SensorName[blah,substring]"?
- Field Names for Custom Tables.. If I read your answer and section 2.1 correctly... A custom table can be filtered on any column by name. That means a Custom SNMP Table on "1.3.6.1.2.1.2.2" that returns :
ifIndex ifDescr ifType ifMtu ifSpeed ifPhysAddress ifAdminStatus ifOperStatus ifLastChange ifInOctets ifInUcastPkts ifInNUcastPkts ifInDiscards ifInErrors
I can use any of the OID var/field names to filter ? Like:
<include>(ifOperStatus[1] and ifDescr[WAN,substring])</include>
If the MIBs are not loaded, for a table like "1.3.6.1.2.1.99.1.1", they will com back as OID like:
"1.3.6.1.2.1.99.1.1.1.1" "1.3.6.1.2.1.99.1.1.1.2" "1.3.6.1.2.1.99.1.1.1.3" "1.3.6.1.2.1.99.1.1.1.4" "1.3.6.1.2.1.99.1.1.1.5" "1.3.6.1.2.1.99.1.1.1.6" "1.3.6.1.2.1.99.1.1.1.7" "1.3.6.1.2.1.99.1.1.1.8"
What would the field names look like ?
<include>("1.3.6.1.2.1.99.1.1.1.1"[1]</include>
<exclude>"1.3.6.1.2.1.99.1.1.1.6"[RPM,substring])</exclude>
I appreciate you sharing your insight
Created on Feb 25, 2021 10:32:27 PM by
Last change on Feb 26, 2021 1:28:01 PM by
Hi Florian, hi all
With this filter function the device templates become a lot more interesting.
I am happy to share my results of the different filtering options here.
Maybe this will help one or the other PRTG user to better understand the filter functionality.
I tried them with a Cisco switchstack of the C9300series.
The goal was to read out only three interfaces with SNMP.
Variant 1 include the required interfaces and exclude none --> The three interfaces are showed as sensors of the device
Variant 2 include the required interfaces and exclude any --> No interfaces are showed
Variant 3 includes any and exclude the three interfaces --> All interfaces except the three excluded interfaces are showed as sensors of the device
Variant 4 includes any and negate the three interfaces from the exclude --> The three interfaces are showed as sensors of the device
Variant 1 and variant 4 shows the same result. They show the three interfaces as sensors of the device.
Variant 1:
<include>
(name[(Te1/1/8)] OR name[(Te2/1/8)] OR name[(Po1)])
</include>
<exclude>
none
</exclude>
Variant 2:
<include>
(name[(Te1/1/8)] OR name[(Te2/1/8)] OR name[(Po1)])
</include>
<exclude>
any
</exclude>
Variant 3:
<include>
any
</include>
<exclude>
(name[(Te1/1/8)] OR name[(Te2/1/8)] OR name[(Po1)])
</exclude>
Variant 4:
<include>
any
</include>
<exclude>
NOT (name[(Te1/1/8)] OR name[(Te2/1/8)] OR name[(Po1)])
</exclude>
Best regards,
Alain
Hello Alain,
Thank you very much for sharing your experience with the community. Have a nice day!
Regards.
Created on Mar 2, 2021 1:40:17 PM by
Hi.... Alain, That's great...
But, it did unfortunately not solve my problem...
The question was for our friends at Paessler...
- What fieldnames are available ?
- What "static" field names are available "name", "value", etc
- How do we handle Custom SNMP Table names and OIDs in the return from the Meta-Scan ?
I have a template that builds the name using "NameTemplate" from OID's... Which happens after the creation, IE ... not available until after the first sensor scan...
<create id="_snmp_entPhySensorTable" kind="snmpcustomtable" meta="snmptable" requires="snmp_entPhySensorTable_noncisco" displayname="PhysSensor: Generic / (Unit) - [1.3.6.1.2.1.1.5.0]"> <metadata> <tableoid> <cell col="0">1.3.6.1.2.1.99.1.1</cell> <cell col="1">entPhySensorTable</cell> </tableoid> <identcolumn> <cell col="0">table_index</cell> <cell col="1">table_index</cell> </identcolumn> </metadata> <createdata> <tags>snmpcustomsensor snmpcustomtable physsensor entsensor snmp prtgc prtgclean</tags> <priority>3</priority> <comments/> <primarychannel>2</primarychannel> <position>50</position> <inherittriggers> <flags> <inherited/> </flags> <cell>1</cell> </inherittriggers> <stack>0</stack> <usesingleget/> <nametemplate>PhysSensor: [1.3.6.1.2.1.47.1.1.1.1.2[index]] ([1.3.6.1.2.1.99.1.1.1.6[index]])</nametemplate> <identcolumn> <cell col="0">table_index</cell> <cell col="1">table_index</cell> </identcolumn> <tableoid> <cell col="0">1.3.6.1.2.1.99.1.1</cell> <cell col="1">entPhySensorTable</cell> </tableoid> <channel1column> <cell col="0">1.3.6.1.2.1.99.1.1.1.5</cell> <cell col="1">entPhySensorOperStatus</cell> </channel1column> <channel2column> <cell col="0">1.3.6.1.2.1.99.1.1.1.4</cell> <cell col="1">entPhySensorValue</cell> </channel2column> ...
In these cases... the "Name" is "PhysSensor: [1.3.6.1.2.1.47.1.1.1.1.2[index]] ([1.3.6.1.2.1.99.1.1.1.6[index]])"
<exclude>name[DOM,substring]</exclude> Error in <exclude> filter of device template "Generic Lean" in <create id="_snmp_entPhySensorTable">: Unknown token "name". ... <exclude>1.3.6.1.2.1.47.1.1.1.1.2[DOM,substring]</exclude> Error in <exclude> filter of device template "Generic Lean" in <create id="_snmp_entPhySensorTable">: Unknown token "1.3.6.1.2.1.47.1.1.1.1.2".
It would be nice if the error printed out the list of valid "tokens"...
The only alternative I see is adding the type as a column, and storing a static value in the sensor and then using it ... Which is not desirable...
Is there a way to filter on the metascan ?
<create id="_snmp_entPhySensorTable" kind="snmpcustomtable" meta="snmptable" requires="snmp_entPhySensorTable_noncisco" displayname="PhysSensor: Generic / (Unit) - [1.3.6.1.2.1.1.5.0]"> <metadata> <tableoid> <cell col="0">1.3.6.1.2.1.99.1.1</cell> <cell col="1">entPhySensorTable</cell> </tableoid> <identcolumn> <cell col="0">table_index</cell> <cell col="1">table_index</cell> </identcolumn> <exclude>name[DOM,substring]</exclude> ... </metadata>
Like you can do in the "Check Metascan"...
<check id="check_XXXXX" meta="snmpnext" requires="snmp">
<metadata>
<oid>1.3.6.1.4.X</oid>
</metadata>
<checksubstring>Matched SubString Value to include</checksubstring>
<excludevalue>Matched SubString Value to exclude</excludevalue>
</check>
We appreciate you sharing your insight...
Thanks
JR
Created on Mar 5, 2021 9:57:29 PM by
Here's an example which is probably a common use-case:
Monitoring network interfaces from a Windows Host using SNMP but excluding the the following:
- WFP 802.3 MAC Layer LightWeight Filter
- QoS Packet Scheduler
- Npcap Packet Driver (NPCAP)
This is the XML code for the device template in case it helps someone else:
<create id="snmptraffic" kind="snmptraffic" meta="portscan" requires="snmp"> <createdata> <tags>bandwidthsensor snmptrafficsensor</tags> <priority>3</priority> <comments>Ethernet</comments> <primarychannel>-1</primarychannel> <position>60</position> <inherittriggers> <flags> <inherited/> </flags> <cell>1</cell> </inherittriggers> <stack>0</stack> <usesingleget/> <usebulkgetnext/> <stack>0</stack> <namein>Traffic In</namein> <nameout>Traffic Out</nameout> <namesum>Traffic Total</namesum> <trafficmode/> <monitorstate>1</monitorstate> </createdata> <include>any</include> <exclude>internalname[-WFP,substring] OR internalname[-QoS,substring] OR internalname[-Npcap,substring] OR internalname[Loopback,substring]</exclude> <triggerdata/> </create>
The filtering logic is only this:
<include>any</include> <exclude>internalname[-WFP,substring] OR internalname[-QoS,substring] OR internalname[-Npcap,substring] OR internalname[Loopback,substring]</exclude>
But I guess it's easier to see within the whole context.
Best Regards,
Luciano Lingnau [Paessler]
Created on Sep 2, 2021 9:39:56 AM by
Last change on Sep 2, 2021 10:26:46 AM by
Please log in or register to enter your reply.
Disclaimer: The information in the Paessler Knowledge Base comes without warranty of any kind. Use at your own risk. Before applying any instructions please exercise proper system administrator housekeeping. You must make sure that a proper backup of all your data is available.
Add comment