Custom Inventory Integration Alerting And Dashboarding

I feel I have looked through various posts and documentation pages (I have plenty of NR Tabs open at least…) but I am still pretty much just stuck on stupid at the moment.

I have a Custom Integration written in Python 3. I am just returning the settings of an application based on that application’s command output. I can see the data in Infrastructure -> Inventory but I cannot figure out how to alert on it!

I need an alert when the Value is True and can ignore when the Value is False. I have sample servers returning both Values as test cases, but when trying to build an Alert around this, or query the Custom Integration to build a Dashboard, I cannot seem to figure out how to find the data with a query.

# cat /etc/newrelic-infra/integrations.d/nri_falcon_sensor_rfm_status.yml
integrations:
  - name: falcon_sensor_rfm_status
    exec: python3 /opt/bin/nri_falcon_sensor_status.py

# python3 /opt/bin/nri_falcon_sensor_status.py
{"data": [{"inventory": {"falcon_sensor_status": {"reduced_functionality_mode": false}}}], "name": "falcon_sensor_rfm_status", "protocol_version": "2", "integration_version": "1.0.3"}

# newrelic-infra -version
New Relic Infrastructure Agent version: 1.12.1, GoVersion: go1.14.4

Thanks in advance!

Hi, @michael.ellis: Generally, alert conditions are based on metrics or events. I don’t think it is possible to create an alert condition based on inventory data.

Thanks @philweber. What are your suggestions? Change this data collection type? I am wondering if I am getting confused by all the documentation and suggestions…

Thanks again!

Can I dashboard the Inventory data? I just need the visibility, an Alert would actually be overkill for this particular use-case.

As far as I know, the only way to view Inventory data is in the Infrastructure UI. If you want to view it on a dashboard, I believe it must be a metric (numeric) or event.

https://docs.newrelic.com/docs/infrastructure/manage-your-data/data-instrumentation/default-infrastructure-events

Consider adding an attribute or an event.

For Crowdstrike we use tags on the hosts.

Thanks @philweber and @6MM. I will try testing some additional Attributes and/or Events this week. I have not looked too much at Tags as yet but will certainly give it a more thorough read.

Once I figure out what makes sense for us I will update again and mark a Solution.

Thanks again!

1 Like

@michael.ellis Looking forward to hearing how it all worked out for you!

Hello @JoiConverse, @philweber and @6MM.

As suggested and after talking to @bteets in our usual call, I have updated my Integration to send the command output in as an Insights Event. I am now able to Dashboard and Alert off the information being gathered. Updated code is below. But basically I am calling a Bash script that then calls the Python script to collect the data, then the Bash script forms the Insights API call. It is still a bit clunky but this will do for now, once I can get additional Python modules pushed out to the environment I can remove the need to call the Bash script.

$ cat /etc/newrelic-infra/integrations.d/nri_falcon_sensor_rfm_status.yml
integrations:
  - name: falcon_sensor_info_test3
    exec: /bin/bash /opt/bin/nri_falcon_sensor_status.sh


$ cat /opt/bin/nri_falcon_sensor_status.sh
#!/bin/bash

## Bash Script to collect Falcon Sensor Reduced Functionality Mode Status.
## Status is collected from Python Script, then sent to New Relic's Insights API

## Create Temp File
out_file=$(/usr/bin/mktemp)

## Call Python script to collect and format data
/opt/bin/nri_falcon_sensor_status.py 2>&1 | tee ${out_file}

## Ship data off to New Relic
gzip -c ${out_file} | \
  curl --data-binary @- -X POST \
  -H "Content-Type: application/json" \
  -H "X-Insert-Key: NRII-xXxXxXxXxXxXxXxXxXxXxXxXxXx" \
  -H "Content-Encoding: gzip" https://insights-collector.newrelic.com/v1/accounts/2582064/events

## Remove Temp File
rm -f ${out_file}

Huge thanks to everyone! I have not looked at Tagging anything as of yet.

1 Like