Net Inspector 2015 GETTING STARTED GUIDE. MG-SOFT Corporation. Document published on October 16, (Document Version: 10.6)

Transcription

1 MG-SOFT Corporation Net Inspector 2015 GETTING STARTED GUIDE (Document Version: 10.6) Document published on October 16, 2015 Copyright MG-SOFT Corporation

2 Introduction In order to improve the design or performance characteristics, MG-SOFT reserves the right to make changes in this document or in the software without notice. No part of this document may be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, without the express written permission of MG-SOFT Corporation. Permission to print one copy is hereby granted if your only means of access is electronic. Depending on your license, certain functions described in this document may not be available in the version of the software that you are currently using. Screenshots used in this document may slightly differ from those on your display. MG-SOFT may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. The furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property. Copyright MG-SOFT Corporation. All rights reserved. 2

3 Introduction TABLE OF CONTENTS 1 Introduction Starting Net Inspector Client Connecting Net Inspector Client to Server Connecting and Logging On to Server Net Inspector Client GUI Adding Managed Objects to Workspace Discovering Network Devices and Adding Managed Objects to Workspace Discovering Network Devices by Using the Network Discovery Wizard Discovering Network Devices by Using Discovery Panel Dialog Box...22 Setting Discovery Parameters Starting the Discovery Operation Adding Managed Objects to Workspace Based on Received SNMP Notifications and NetFlow/sFlow Streams (Auto Configuration) Adding Maps and Managed Objects to Workspace Manually Adding Maps to User View Adding Managed Objects to Maps Adding Connection Lines to Managed Objects Importing Managed Objects from CSV File Configuring Polling Parameters Configuring Polling Profiles Configuring SNMP Profiles Monitoring and Managing Alarms in Events Window Viewing Alarms for All Objects Viewing Alarms for Selected Objects Viewing Alarm History To View Alarm History for Selected Objects Filtering Alarms Finding Alarms Monitoring Alarms and Status of Managed Objects in Maps and Explorer Windows Viewing Contents of Maps in Maps Window Viewing Link Status and Utilization Viewing Device Performance Tooltips Information Provided by Icons Displayed in Maps Window - Graphics View...80 Types of Objects New Alarms Alarm Balloons All Active Alarms Alarm Rectangles Example Monitoring Propagated Alarms and Statuses in Explorer Window Propagation Example Viewing Properties of Managed Objects Opening the Properties Window

4 Introduction 9.2 About the Properties window General View System View Settings View Services View Interfaces View Resources View Storage View Viewing Device Performance Data in the Performance Statistics Window Viewing Charts Appendix: About Users, Access Rights and User Views

5 Introduction TABLE OF FIGURES Figure 1: Entering URL into Web browser to view the Net Inspector Java Client Web page... 8 Figure 2: Starting Net Inspector Client from a web browser... 9 Figure 3: Using Java Web Start Launcher to start Net Inspector Client... 9 Figure 4: Net Inspector Client main window (no connection to server) Figure 5: Connect to Net Inspector Server dialog box Figure 6: Login dialog box Figure 7: Change Password dialog box Figure 8: User view selection dialog box Figure 9: Net Inspector Java Client main window (connection with server is established) Figure 10: Network Discovery Wizard - Welcome screen Figure 11: Network Discovery Wizard - Specify SNMP Profile(s) screen Figure 12: Network Discovery Wizard - Configure Discovery Filter screen Figure 13: Network Discovery Wizard - Select Discovery Strategy screen Figure 14: Advanced Discovery Settings Figure 15: Network Discovery Wizard the last screen Figure 16: Discovery Panel Figure 17: Add Discovery dialog box Figure 18: A new discovery operation in the Discovery Panel dialog box Figure 19: A discovery operation in progress Figure 20: A discovered network displayed in the Maps window Figure 21: Setting Net Inspector auto configuration options Figure 22: Viewing new managed objects added to the map by the auto configuration feature Figure 23: Adding a new submap to a user view Figure 24: Setting the name of the newly added submap Figure 25: Example of a hierarchical structure of maps in the Explorer window Figure 26: Opening a submap Figure 27: Adding a new object to a map Figure 28: Adding a new managed object selecting the object type Figure 29: Adding a new managed object specifying object properties Figure 30: A new managed object icon on the map and the managed object Properties window Figure 31: Setting the profiles for polling a managed device Figure 32: New object is being managed (its status is Normal ) Figure 33: Connecting two icons with the Connection tool Figure 34: Selecting the connection endpoint network interfaces Figure 35: A connection line with interface status symbols and connection labels Figure 36: Editing the connection labels and endpoint interfaces Figure 37: Example of a network model with connections lines (some of them with labels) Figure 38: Selecting the Import from CSV File command Figure 39: The list of managed objects (devices) to be imported from a CSV file Figure 40: Net Inspector Server Settings dialog box, Profiles panel Figure 41: New/Edit Polling Profile dialog box Figure 42: New SNMP Profile dialog Figure 43: MIB Browser dialog box

6 Introduction Figure 44: Events window and Event Details sub-window Figure 45: Add Comment dialog box Figure 46: Viewing alarm acknowledgement details Figure 47: Opening a map from the Explorer window Figure 48: Choosing the option to view active alarms for selected managed objects Figure 49: A new tab in the Events window displaying active alarms for selected objects Figure 50: Choosing the option to view alarm history for selected managed objects Figure 51: Viewing the alarm history for selected objects Figure 52: Create Filter dialog box Figure 53: Viewing filtered alarms in the Events window Figure 54: Find Events dialog box Figure 55: Viewing results of the search operation in the Events window Figure 56: Selecting a map view Figure 57: Adjusting the zoom level Figure 58: Viewing the contents of a map in the Maps window Graphics view Figure 59: Viewing the contents of a map in the Maps window Details view Figure 60: Enabling options to display connection labels and traffic Figure 61: Connection lines and labels provide information about the current network traffic Figure 62: Viewing the device performance tooltip Figure 63: A pinned device performance tooltip window Figure 64: Example of the Explorer window contents Figure 65: Properties window General view Figure 66: Properties window System view Figure 67: Properties window Settings view Figure 68: Properties window Services view Figure 69: Properties window Interfaces view Figure 70: Properties window Resources view Figure 71: Properties window Storage view Figure 72: Opening Performance Statistics window for the selected device Figure 73: Viewing device performance statistics Figure 74: Selecting a chart from the Chart Panel dialog box Figure 75: Viewing a chart Figure 76: Closing a chart

7 Introduction 1 INTRODUCTION This guide contains instructions for completing basic operations in Net Inspector Java Client. Instructions are provided on a step-by-step basis, which should help the reader start using the software effectively. It is supposed that you are familiar with basic actions in a graphical computer environment, such as choosing a main menu command or a pop-up command, selecting items, closing windows and dialog boxes, etc. All program commands in this manual are written in bold and italic letters. Individual commands in combinations of commands are separated by the / character. For example: View / Events which means: click the View entry in the menu bar and select the Events command from the View menu. All hyperlinks in text are marked with blue colored letters, e.g., Events window. Clicking a hyperlink opens the page which the hyperlink points to. The content of this guide is listed in the Table of Contents. 7

8 Starting Net Inspector Client 2 STARTING NET INSPECTOR CLIENT Net Inspector Client is started via the Java Web Start mechanism, that lets you launch Net Inspector Client from any computer in the network using a Web browser, as described in this section. System requirement: Java Runtime Environment (JRE), version 6.0 (a.k.a. 1.6) or later must be installed on the computer that will run Net Inspector Client. JRE for various operating systems can be downloaded from the following Web page: 1. Start your Web browser application (e.g., MSIE, Mozilla Firefox, Opera, Safari, etc.) on the computer where you want to run Net Inspector Client. Tip: To run Net Inspector Client on the same computer as Net Inspector Server, select the MG-SOFT Net Inspector/Net Inspector Client command from the operating system start menu. Skip the following step and continue in step 3 below. 2. Into the Web browser URL input line enter the IP address and port (separated by a colon) on which the Net Inspector HTTP Server listens to for incoming HTTP connections (by default, the port number is 5228 ) and press the Enter key (Figure 1). Note: Net Inspector comes with its own HTTP (Web) server program that installs to the same computer as Net Inspector Server and other components of the package. Net Inspector HTTP Server serves a Web page that enables launching Net Inspector Client by using the Java Web Start framework. Figure 1: Entering URL into Web browser to view the Net Inspector Java Client Web page 3. Net Inspector Client Web page is displayed in the Web browser. Click the Start MG-SOFT Net Inspector Client link in the displayed Web page (Figure 2). 8

9 Starting Net Inspector Client Figure 2: Starting Net Inspector Client from a web browser 4. Web browser may prompt you with dialog box asking if you want to start Net Inspector Client (i.e., ni.jnlp file) with Java Web Start Launcher. Click the OK button to confirm the selection (Figure 3). Figure 3: Using Java Web Start Launcher to start Net Inspector Client 9

10 Starting Net Inspector Client 5. Java Web Start Launcher downloads the Net Inspector Client application from the Net Inspector Client Web page to the local computer. When starting Net Inspector Client for the first time on a given computer, the software also offers you the option to create a desktop shortcut for the downloaded Net Inspector Client application. Select the Yes option to create the shortcut. When the Net Inspector Client application finishes downloading, it is automatically started and the Net Inspector Client main window appears (Figure 4). Figure 4: Net Inspector Client main window (no connection to server) Please proceed to the next section for instructions on connecting and logging on to Net Inspector Server. 10

11 Connecting Net Inspector Client to Server 3 CONNECTING NET INSPECTOR CLIENT TO SERVER Before you can start using Net Inspector Client for effective fault management, you need to connect and successfully log on to Net Inspector Server, as described in this section. 3.1 Connecting and Logging On to Server 1. In the Net Inspector Client main window choose the File / Connect command or click the Connect toolbar button. 2. The Connect to Net Inspector Server dialog box appears (Figure 5), which is used for connecting Net Inspector Client to Net Inspector Server. Figure 5: Connect to Net Inspector Server dialog box 3. In the Address drop-down list in the Connect to Net Inspector Server dialog box, enter or select the IP address or the hostname of the computer that runs Net Inspector Server (engine) you wish to connect to. 4. Into the Port input line, enter the TCP port number on which the Net Inspector Server listens to for incoming client connections. The default port number is Click the Connect button. Net Inspector Client will try to establish a connection with the Net Inspector Server using the connection settings configured above. Figure 6: Login dialog box 11

12 Connecting Net Inspector Client to Server 6. Once the connection is established, the Login dialog box appears (Figure 6). Enter your username and password into the Username and Password input fields (note that both fields are case sensitive!). Note: The Design mode checkbox lets users with administrator access rights run Net Inspector Client in design mode, which allows users to have more than one user view active at the same time an copy objects between active user views. 7. Click the Login button (Figure 6). 8. Net Inspector Server checks if the account with the specified username exists and if the entered password is correct. The login procedure then proceeds as follows: If the entered username and/or password is incorrect, the Login dialog box is displayed again, so you can re-enter the login data. If the entered username and password are correct and the user account is configured so that the user must change the password upon next login, the Change Password dialog box appears (Figure 7). This dialog box lets you change your password by entering the old password into the Old password input line and a new password into the New password and Retype password input lines and clicking the Change button. Figure 7: Change Password dialog box If the entered username and password are correct and there is only one user view assigned to the user, this user view is automatically activated and one or more windows (depending on the user view configuration) open in the Net Inspector Client main window. You can start working with Net Inspector in accordance with the assigned user view and access rights. 12

13 Connecting Net Inspector Client to Server Figure 8: User view selection dialog box If the entered username and password are correct and there is more than one user view assigned to the user, the user view selection dialog box appears (Figure 8). Select the desired user view from the dialog box and click the Open button. One or more windows (depending on the user view configuration) will open in the Net Inspector Client main window. You can start working with Net Inspector in accordance with the selected user view and assigned access rights. Tip: To change your password after a successful logon, select the Tools / Server Settings command from the Net Inspector main menu and click the Users entry in the navigation tree in the Server Settings dialog box that appears. This displays the Users panel where Net Inspector users are managed. Select your user account in this dialog box and click the Change Password button. Enter the new password into the New password and Retype password input lines and click the OK button to close the dialog box and apply the password change. 13

14 Net Inspector Client GUI 4 NET INSPECTOR CLIENT GUI The Net Inspector Client graphical user interface (GUI) is composed of typical graphical user interface components, like the title bar, menu bar, toolbar, one or more windows and the status bar. The following windows form the Net Inspector Client main window: Maps Explorer Events Event Details The above listed windows are arranged side-by-side in the main window. Windows can be resized by dragging their borders. All windows listed above, except the Maps window which is always displayed, can be displayed or hidden by using the View menu commands or the corresponding toolbar buttons. Additional windows and dialog boxes can be opened from the program menu, toolbars and the pop-up (context) menus. Menu Bar Toolbar Explorer Window Maps Window Graphics Toolbar Events Window Events Details Sub-Window Status Bar Figure 9: Net Inspector Java Client main window (connection with server is established) 14

15 Adding Managed Objects to Workspace 5 ADDING MANAGED OBJECTS TO WORKSPACE After logging on log on Net Inspector Server, network administrator needs to configure Net Inspector workspace. The workspace is a conceptual environment that allows you to model the managed network according to your preferences. It allows you to group managed objects in maps and to structure such maps in a hierarchical manner within user views, e.g., to depict the logical topology of the managed network. A user view is a particular view of objects registered with the Net Inspector system. User views differ in respect to what objects they display and how those objects are grouped and hierarchically structured. A user view can display either all managed, action and system objects registered with Net Inspector (e.g., an administrator user view), or any subgroup of those objects (e.g., user views assigned to users with limited access rights). An object can be displayed (included) in more than one user view. A user view displays only those alarms, which are associated with the objects included in that user view. See also section About Users, Access Rights and User Views. To start managing the network, a user with administrator access rights needs to add the managed objects that represent actual network devices to Net Inspector configuration, add those objects to the workspace and enable their monitoring. One can create different user views for different users. Managed objects can be added to the workspace either manually or by using the Net Inspector network discovery functionality. In this section network administrators will learn how to add maps and managed objects to the workspace. There are several ways to add managed objects to the workspace in Net Inspector, as described in this section: First, you will learn how to use the Network Discovery Wizard and the Discovery Panel window to discover devices on the network and add managed objects that represent discovered devices to the Net Inspector workspace. Next, you will learn how to set the auto configuration feature to enable adding of new managed objects to the workspace by receiving SNMP notifications and NetFlow/sFlow streams from the network. Next, you will learn how to add, configure and enable managed objects on the workspace manually. Finally, a process of importing managed objects from a CSV file is described. 5.1 Discovering Network Devices and Adding Managed Objects to Workspace Managed objects can be added to the workspace automatically by means of the network discovery operation that actively scans and discovers the network and by means of the auto configuration feature, which adds new object to the system and workspace when Net Inspector receives SNMP notification messages and NetFlow or sflow packets from unknown sources. 15

16 Adding Managed Objects to Workspace Discovering Network Devices by Using the Network Discovery Wizard This section describes how to use the Network Discovery Wizard to configure and run a discovery operation and add the discovered devices to the workspace (default user view). The Network Discovery Wizard starts automatically when you connect to Net Inspector Server for the first time (i.e., when no managed objects exist in Net Inspector configuration). You can also start the Network Discovery Wizard at any time later, as described in this section. To discover devices on the network: 1. Connect to Net Inspector Server as a user with administrator access rights (e.g., admin). 2. If the Network Discovery Wizard Welcome screen does not appear automatically, use the Tools / Discovery Wizard command to display it (Figure 10). Figure 10: Network Discovery Wizard - Welcome screen 3. Click the Next button at the bottom of the screen to proceed to the next step of the Network Discovery Wizard. 16

17 Adding Managed Objects to Workspace 4. In the Specify SNMP Profiles screen, you need to select the SNMP access profiles that will be used for discovering the network devices. Please note that the SNMP access profile with which a device has been discovered, is automatically assigned to that device, so Net Inspector Server will use it to poll that device. Note: The order in which SNMP profiles are listed is important. During the discovery, the toplisted SNMP profile is used first in an attempt to discover your network devices, if unsuccessful, the second-listed profile is used, etc. The SNMP profile with which a device has been discovered is automatically used for the subsequent polling of that device. It is recommended to move more secure SNMP profiles (e.g., SNMPv3 profiles) to the top of the list. Figure 11: Network Discovery Wizard - Specify SNMP Profile(s) screen To use a profile in the discovery operation, enable it by checking the checkbox in front of its name in the SNMP profiles list. You should enable those profiles that contain the SNMP settings accepted by your SNMP devices (SNMP version, port, community name, or SNMPv3 user settings). To create a new profile and add it to the list, click the Add button and configure the parameters for the new profile in the New SNMP Access Profile dialog box that appears. To edit a profile, select it in the list, click the Edit button and edit the profile parameters in the Edit SNMP Access Profile dialog box that appears. If you want to import SNMP access profiles from a file, click the Import button and select the desired SNMP access profiles XML file in the Open dialog box, 17

18 Adding Managed Objects to Workspace To move a profile up or down on the list, select the profile and click the Up or Down button, respectively. 5. After you have selected the desired SNMP profile(s), click the Next button at the bottom of the screen to proceed to the next step. 6. The Configure Discovery Filter screen appears (Figure 12). In this step you can optionally select or configure a filter that will narrow down the discovery results by filtering out devices that do not match the filter criteria. To skip using a discovery filter, leave this screen empty or select the <No Filter> entry from the Discovery filter drop-down list. To configure the filter, follow the instructions displayed by the wizard. For more details, please refer to the Net Inspector Client Reference Manual, Manage Discovery Filters dialog box section. Figure 12: Network Discovery Wizard - Configure Discovery Filter screen 7. After you have configured the filter (optionally), click the Next button at the bottom of the screen to proceed to the next step. 18

19 Adding Managed Objects to Workspace 8. In this step of the Network Discovery Wizard, you need to select one of the following strategies for discovering your network (Figure 13): Figure 13: Network Discovery Wizard - Select Discovery Strategy screen To perform the discovery operation within the subnet, which the Net Inspector Server computer is a member of, select the Scan local subnet radio button. To perform the discovery operation within the user-specified range(s) of IP addresses, select the Scan IP range(s) option. Click the Add button next to the list of IP ranges. Into the IP Range dialog box that appears, enter the first and the last IP address of the range, which you want to scan for network devices. Optionally, repeat this procedure to add more IP ranges to the list. Optionally, use the Delete and Edit buttons to edit or delete the selected IP ranges. To use the progressive network discovery operation that starts querying a single SNMP device and progressively discovers its neighbors and subnets, select the Progressive network discovery option. Into the Start SNMP agent address input line, enter the IP address of the SNMP device to be scanned first. 19

20 Adding Managed Objects to Workspace Check the Scan entire subnets (not larger than B class) checkbox if you want the Net Inspector to scan entire subnets (up to B-class size) it detects during the progressive discovery operation (this might be time consuming). Note that independently of this setting, Net Inspector always scans entire C-class subnets it discovers, and never scans entire subnets that are larger than B-class. To limit the depth of the progressive discovery operation to a specific number of hops, click the Advanced button, and set the number of hops into the TTL (Time-to-Live) input line in the Advanced Discovery Settings dialog box (Figure 14). 9. If you do not want the discovered devices and their interconnections to be added to the default user view, click the Advanced button at the bottom of the Select Discovery Strategy screen. 10. The Advanced Discovery Settings dialog box appears (Figure 14). Figure 14: Advanced Discovery Settings From the Target user view drop-down list, select the user view to which you want the discovered devices (managed objects) and their interconnections to be added. In the Submap drop-down list, select or enter the name of the submap to which you want the discovered devices (managed objects) and their interconnections to be added. If the specified submap does not exist yet, it will be created. 20

21 Adding Managed Objects to Workspace Check the Create submaps for subnets checkbox if you want Net Inspector to automatically create subnet maps and put the discovered devices into subnet maps when devices are added to the selected user view. Check the Preserve connections checkbox if you want Net Inspector to preserve manually added connections between managed objects when adding discovered managed objects and their interconnections to the submap. This option is relevant only if the target submap already contains (some) managed objects and connections between them. In the Connection labels drop-down list, select what information will be displayed in connection labels. You can choose to display the IP address or the name or the IP address and name of the endpoint network interface. One can hide the connection labels later by clicking the Connection labels checkbox in the graphics toolbar. Check the Display tunnel connections checkbox if you want Net Inspector to display also the discovered tunnel connections between managed objects. Click the OK button to apply the settings and close the Advanced Discovery Settings dialog box. For more details about the advanced discovery parameters, please see the next section. 11. Click the Next button at the bottom of the screen to proceed to the final step. 12. In the final step (Figure 15) you can review the discovery settings and start the discovery operation. Figure 15: Network Discovery Wizard the last screen 21

22 Adding Managed Objects to Workspace 13. After you have reviewed the discovery settings, click the Start Discovery button at the bottom of the screen to start the network discovery operation and finish the Network Discovery Wizard. 14. While the discovery operation is in progress, the Discovery is running message and a progress bar is displayed in the status bar of the Net Inspector Client main window. To view the intermediate results (discovered devices and subnets) of the discovery operation, select the Tools / Discovery Panel command to display the Discovery Panel dialog box (Figure 16) and open the relevant discovery operation in it. When the discovery operation finishes, the newly discovered devices are automatically added to the selected user view (Figure 20) Discovering Network Devices by Using Discovery Panel Dialog Box This section describes how to discover network devices without using the Network Discovery Wizard. Note: Before running the discovery operation, it is recommended to enable SNMP on all switches and routers in your network. This enables discovering the physical network topology. Users with administrator access rights are permitted to open the Discovery Panel dialog box to view and manage discovery operations, as well as add discovered devices and their interconnections to the workspace and to the system (Device Panel dialog box). Discovery operation is a procedure that systematically scans the network for network devices and their (inter)connections by means of ICMP ping and/or SNMP queries. The search is performed in accordance with the user-specified discovery parameters. Net Inspector supports three different network discovery methods: local - discovers the network (devices and their connections) within the local subnet range - discovers the network within the specified range of IP addresses progressive - discovers the network by means of the progressive SNMP-based network scan operation. This operation starts by querying one SNMP device and continues by progressively discovering its neighbors and subnets by examining the routing tables and other relevant data on scanned objects. More than one discovery operation can exist and run simultaneously in Net Inspector (e.g., each discovery operation being performed on a different part of the network, storing results to different configuration database and adding devices to different user views). Setting Discovery Parameters To discover network devices without using the Network Discovery Wizard: 1. Select the Tools Discovery Panel command from the main menu. 2. The Discovery Panel dialog box opens (Figure 16). 22

23 Adding Managed Objects to Workspace Figure 16: Discovery Panel 3. Click the Add button in the Discovery Panel dialog box, to add a new discovery operation to the Discovery Panel. 4. The Add Discovery dialog box appears (Figure 17), where you can configure discovery settings, as follows: 23

24 Adding Managed Objects to Workspace Figure 17: Add Discovery dialog box Into the Name input line, enter the name (short description) of the discovery operation you are adding. If you want to enable running the discovery operation repeatedly every day at the same time, check the Run discovery every day at checkbox in the Schedule frame and enter the corresponding hours and minutes into the accompanying input lines. If this option is enabled in combination with the Automatically add discovered devices option, Net Inspector will automatically add the newly discovered devices in each run to the selected user view and start monitoring them. In the Results frame, check the Automatically add discovered devices checkbox. If this option is enabled, Net Inspector automatically adds newly discovered devices to the workspace (i.e., selected user view) and Device Panel dialog box (i.e., selected configuration), as follows: 24

25 Adding Managed Objects to Workspace Configuration (drop-down list) Lets you select the configuration file, which the discovered devices will be stored in. Select the Config0 option. User view (drop-down list) Lets you select the user view, which the discovered devices will be added to. Select the default option. Submap (drop-down list) Lets you select or enter the name of the target submap, i.e., submap, which the discovered devices and their interconnections will be added to. If the specified submap does not exist yet, it will be created. Preserve connections (checkbox) Check this checkbox if you want the Net Inspector to preserve manually added connections between managed objects when adding discovered managed objects and their interconnections to the submap. This option is relevant only if the target submap already contains (some) managed objects and connections between them. Connection labels (drop-down list) select what information will be displayed in connection labels, i.e., labels on the ends of lines connecting managed objects. You can choose to display the IP address or the name or the IP address and name of the endpoint network interface. One can hide the connection labels later by clicking the Connection labels checkbox in the graphics toolbar. Display tunnel connections (checkbox) checkbox if you want Net Inspector to display also the discovered tunnel connections between managed objects. Discovery filter (drop-down list) Lets you select a discovery filter in order to discover only those devices that match the filter conditions. Select the <no filter> option. For more details, please refer to the Net Inspector Client Reference Manual, Manage Discovery Filters dialog box section. In the Strategy frame, specify the preferred discovery strategy, as follows: ICMP Ping (checkbox) Check this checkbox to enable using ICMP Ping queries for discovering the network devices. SNMP (checkbox) Check this checkbox to enable using SNMP queries for discovering the network devices and their interconnections. Scan ENTITY-MIB (checkbox) If this checkbox is checked, Net Inspector scans the ENTITY-MIB on discovered devices via SNMP protocol and creates a managed object for each discovered entity. If this checkbox is not checked, entities are ignored and a single managed object is created for each discovered device. 25

26 Adding Managed Objects to Workspace Scan local subnet (radio button) If this option is selected, Net Inspector discovers the network (devices and their connections) within the local subnet, i.e., subnet the computer running Net Inspector Server is a member of. Scan IP range(s) (radio button) If this option is selected, Net Inspector discovers performs the discovery operation within the specified IP range(s). To add the desired IP ranges use the following controls: Add (button) Click this button to open the IP Range dialog box, where you can specify the IP range into the following input lines: Start address (input line) The start address of the IP range. Stop address (input line) The end address of the IP range. Delete (button) Deletes the selected range. Edit (button) Opens the IP range dialog box where you can edit the selected range. Progressive network discovery (radio button) The Progressive network discovery starts by querying a single SNMP device and progressively discovers its neighbors and subnets by examining the routing tables and other relevant data on scanned objects. You have to enter the IP address of the SNMP device to be scanned first. SNMP agent address (input line) The IP address of the SNMP-enabled device that will be scanned first. Scan entire subnets (not larger than B class) (checkbox) If this checkbox is checked and Net Inspector discovers a device that has a network mask that is larger than traditional class C network mask and does not exceed the size of class B mask, it will scan also the entire subnet, which the discovered device is a member of (this can be time consuming). Note that Net Inspector will always scan entire C class subnets it discovers, however, it will not scan entire subnets that are larger than B class. Click the Advanced button to open the Advanced Discovery Settings dialog box where you can specify advanced discovery parameters, as follows: Timeout (input line) Sets the timeout interval in seconds for ICMP ping and SNMP requests. Retries (input line) Sets the retries count, i.e., the number of times the ICMP ping and SNMP requests will be retransmitted after the first timeout occurs. 26

27 Adding Managed Objects to Workspace TTL (input line) Sets the time-to-live parameter that limits the lifetime of discovery packets to the specified number of hops (number of routers over which the discovery packets will be passed. This parameter is important for limiting the depth of the SNMP scan discovery operation. Max queue size (input line) Specifies the maximum number of concurrent SNMP queries. By using this parameter, you can control the CPU usage and the speed of discovery. By increasing this number, the CPU load and speed will increase and vice-versa. After viewing/modifying the above parameters, click the OK button to close the Advanced Discovery Settings dialog box and apply the settings. In the SNMP Profiles frame, check the Use all configured SNMP profiles checkbox. This way, all existing SNMP profiles will be used in the discovery operation. First, the network will be scanned using the SNMPv3 profile(s), then using the SNMPv2c, and finally by using the SNMPv1 profile(s). Every managed object will be automatically assigned that SNMP profile with which is has been discovered. If the required SNMP profile for accessing your network devices does not exists yet, you should create it in the Server Settings dialog box, Profiles panel before starting the discovery operation. If the Use all configured SNMP profiles checkbox is not checked, you can specify what SNMP profiles will be used in the discovery operation and in which order. For more details, please refer to the Net Inspector Client Reference Manual, Discovery Panel dialog box section. 5. After specifying the discovery parameters, click the OK button to close the Add Discovery dialog box and add the newly configured discovery operation to the Discovery Panel (Figure 18). Figure 18: A new discovery operation in the Discovery Panel dialog box 27

28 Adding Managed Objects to Workspace Starting the Discovery Operation Note: Before running the discovery operation, it is recommended to enable SNMP on all switches and routers in your network. This enables discovering the physical network topology. 1. To start the discovery operation, select it in the Discovery Panel dialog box and click the Start toolbar button. 2. To see the results, select the discovery operation in the Discovery Panel dialog box and click the Discovery results button. 3. The Discovery dialog box for the selected discovery operation appears (Figure 19). Figure 19: A discovery operation in progress 4. A Discovery in progress. Found X hosts in Y subnets message appears in the status bar and the Discovery results area starts displaying the interim results, i.e., discovered subnets and devices (Figure 19). Discovered devices appear as child items of the subnet maps, except in cases where devices are members of two or more subnets. 28

29 Adding Managed Objects to Workspace You can close the Discovery dialog box and the Discovery Panel dialog box and leave the discovery operation running in the background. While the discovery operation is running, the Net Inspector Client status bar displays the Discovery is running message and a progress bar. You can reopen those dialog boxes at any time to view the status and most recent discovery operation results. If you want to stop the discovery operation before it finishes, click the Stop button in the Discovery Panel dialog box. 5. When the discovery operation is finished or stopped, the managed object icons representing discovered devices are automatically added to the workspace (if the Automatically add discovered devices option is enabled in the discovery operation configuration). More specifically, managed objects are added to the selected user view in the Maps window and Net Inspector starts automatically monitoring those devices. Managed objects are also connected with lines that represent connections between them (Figure 20). Figure 20: A discovered network displayed in the Maps window 5.2 Adding Managed Objects to Workspace Based on Received SNMP Notifications and NetFlow/sFlow Streams (Auto Configuration) Net Inspector incorporates the auto configuration feature, which automatically adds new object to the system and (optionally) to the workspace when Net Inspector receives SNMP Trap and Inform notification messages and NetFlow or sflow packets from unknown sources. The auto configuration feature is enabled by default for both 29

30 Adding Managed Objects to Workspace SNMP notification messages and NetFlow/sFlow messages. This section describes the auto configuration feature settings and functioning. 1. To determine if auto configuration is enabled, select the Tools / Server Settings command and click the Auto Configuration entry in the navigation tree in the Server Settings dialog box to display the Auto Configuration panel (Figure 21). 2. In the Auto Configuration panel, make sure the Add devices on received SNMP notifications from unknown sources to configuration checkbox is checked and the correct configuration is selected in the accompanying drop-down box (e.g., Config0). Check also the Add devices to user view checkbox to enable adding managed objects for newly discovered devices to the selected user view. In the accompanying drop-down list select the user view which managed objects will be added to and optionally, enter the name of the map which the devices will be added to into the accompanying map input line. If the map input line is left empty, managed objects will be added to the root of the selected user view. Figure 21: Setting Net Inspector auto configuration options 3. Ensure the Add devices on received NetFlow streams from unknown sources to configuration checkbox is checked and the correct configuration is selected in the accompanying drop-down box (e.g., Config0). Check also the Add devices to user view checkbox to enable adding managed objects for newly discovered NetFlow/sFlow devices to the selected user view. In the accompanying drop-down list select the user view which managed objects will be added to and optionally, enter the name of the map which the devices will be added to into the accompanying map input line. If the map input line is left empty, managed objects will be added to the root of the selected user view. 4. Click the OK button to apply the changes and close the Server Settings dialog box. 5. Configure remote SNMP devices to send SNMP Trap or Inform notifications messages to the computer where Net Inspector Server runs. In case of a distributed configuration where two or more Net Inspector polling engines are used, direct the SNMP notification sending to the nearest polling engine. 6. Configure remote devices to send NetFlow or sflow packets to the computer where Net Inspector Server runs. In case of a distributed configuration, where two or more Net Inspector polling engines are used, direct the NetFlow/sFlow packets to the nearest polling engine. 30

31 Adding Managed Objects to Workspace 7. Net Inspector will automatically add a new managed object to the system (Device Panel) and to the workspace (user view and map) when it receives an SNMP Trap and Inform notification message or NetFlow/sFlow packets from a new device. Net Inspector will check the SNMP version and community name or username (in case of SNMPv3) in the received SNMP Trap or Inform notification message and assign the matching SNMP access profile (if it exists) to the new managed object. If no SNMP profile with matching SNMP access parameters exists in Net Inspector, the default SNMP profile is selected. In addition, the default polling profile is automatically assigned to all new managed objects. Managed objects that have been automatically added to the system are marked with the New label displayed in the upper-left corner of the managed object icon. New Netflow managed objects are also marked as NetFlow sources with the NF label displayed in the lower-left corner of the managed object icon (Figure 24). Figure 22: Viewing new managed objects added to the map by the auto configuration feature 8. To remove the New label from managed objects, right-click the respective managed object(s) and choose the New Device toggle command from the pop-up menu. Tip: Users with administrator access right can view all new objects in the system. To view all new managed objects, select the View / Device Panel to open the Device Panel window and select the New Device filter from the Show drop-down menu in the upper-left section of the Device Panel toolbar. 31

32 Adding Managed Objects to Workspace 5.3 Adding Maps and Managed Objects to Workspace Manually In addition to using the network discovery and auto configuration feature, users with administrator access rights may add maps and managed objects to the system and to the workspace also manually. Furthermore, action objects (Mail, Command, and SMS) and graphic objects (lines, rectangles, artistic text, etc.) can be added to the workspace only manually. This section will show you how to manually create maps on the workspace and how to place managed objects on these maps Adding Maps to User View Net Inspector uses the concept of maps, which are containers that can hold various types of objects (managed objects, system objects, action objects), graphic elements (lines, rectangles, bitmaps, etc.) and other maps (submaps). Using the maps, one can group objects into maps and structure such maps in a hierarchical manner within user views. After a fresh installation, Net Inspector workspace contains only the default user view and no maps. This section describes how to add maps to the default user view. 1. If the Explorer window is not displayed, select the View / Explorer command or click the Explorer toolbar button to display it. 2. Select the default user view icon in the Explorer window, right-click it and select the Add/New Submap command from the pop-up menu (Figure 23). Figure 23: Adding a new submap to a user view 32

33 Adding Managed Objects to Workspace 3. A new submap icon with the default name Submap 1 will appear below the selected user view icon in the Explorer window and the Submap Properties window is automatically displayed prompting you to specify a different name for the newly created submap (Figure 24). Figure 24: Setting the name of the newly added submap 4. Into the Name input line in the Submap Properties window, enter the desired name for the new submap and click the Apply button (Figure 24). Close the Submap Properties window. 5. By following the above procedure, you can add more (sub)maps to the user view, e.g., to create a hierarchical structure of maps according to your preferences (e.g.: Figure 25). Figure 25: Example of a hierarchical structure of maps in the Explorer window 33

34 Adding Managed Objects to Workspace Adding Managed Objects to Maps 1. If the Explorer window is not displayed, select the View / Explorer command or click the Explorer toolbar button to display it. 2. In the Explorer window navigate to the (sub)map to which you would like to add managed objects and double-click the submap or right-click it and select the Open pop-up command (Figure 26). Figure 26: Opening a submap 3. A new tab appears in the Maps window, displaying the contents of the opened (sub)map. Right-click inside this map in the Maps window and choose the Add/New Object command from the pop-up menu (Figure 27). Figure 27: Adding a new object to a map 34

35 Adding Managed Objects to Workspace 4. The New Object dialog box first screen appears. Select the type and class of the object that best match the device you are going to manage (e.g., IP server) and click the Next button at the bottom of the dialog box (Figure 28). Figure 28: Adding a new managed object selecting the object type 5. The New Object dialog box second screen appears (Figure 29). Specify the properties of the managed object you are adding, as follows: Figure 29: Adding a new managed object specifying object properties 35

36 Adding Managed Objects to Workspace Into the Name input line, enter the name of the managed object, as it will appear in Net Inspector. Into the Address input line, enter the IPv4 or IPv6 address or the fully qualified domain name of the managed object. Into the Description input line, optionally enter a short description of the managed object. Into the Vendor input line, optionally enter the vendor of the managed device. From the Class drop-down list, select the class of the managed object, which can be one of the following: Workstation Server Printer Switch Router Gateway Equipment Multiplexer Transport Database Firewall Transmitter Any In the Submap drop-down list, the currently selected submap is displayed. If you wish to add the object to another submap, click the Browse button next to this drop-down list and select the desired submap from the Browse dialog box that appears. In the Configuration drop-down list, the name of current device configuration file is displayed (e.g., Config0). If you want to save the new object to another configuration file (must first be specified in the niengine.ini file please see the Net Inspector Installation and Configuration Guide), select it from this dropdown list. In the Polling engine drop-down list, select the IP address of the Net Inspector Performance Manager polling engine that will be used for polling the given device, or select the Built-in engine option in order for Net Inspector Server (fault manager) to poll the given device. The former option is available when using Net Inspector WorkGroup or Enterprise Edition, which include the Performance Management functionalities. If you select a Performance Manager polling engine in this drop-down list, additional performance statistics about the given device will be available via the Show Performance Statistics command. If you select the Built-in engine option, no performance history data will be available for the given managed object. 6. After specifying the properties of the managed object, click the Finish button in the New Object dialog box second screen to add the new managed object to the selected configuration and submap. The new object is added also to the Device 36

37 Adding Managed Objects to Workspace Panel dialog box (View/Device Panel), which lists all objects registered with Net Inspector. 7. A new managed object icon is added to the selected map and the Properties window of the managed object appears automatically (Figure 30). Note that the monitoring of the managed object is not yet enabled (indicated by the blue color of the managed object icon background). One needs to assign the correct polling profile and SNMP access profile to the new managed object before enabling its monitoring, as describe in the next steps. Figure 30: A new managed object icon on the map and the managed object Properties window 8. Select the Settings entry from the category drop-down list displayed in the upper section of the Properties window (Figure 30). 9. The Settings view is displayed in the Properties window (Figure 31). 37

38 Adding Managed Objects to Workspace Figure 31: Setting the profiles for polling a managed device From the Polling profile drop-down list select the name of polling profile that will be used for polling the managed object. A polling profile controls what parameters will be monitored and what are the threshold values for triggering and clearing alarms. To view the details of existing polling and SNMP access profiles, click the Manage Profiles button and view the details of existing profiles in the Manage Profiles dialog box. If the polling profile you want to use does not exist yet, you can create it in the Manage Profiles dialog box. From the SNMP access profile drop-down list select the name of SNMP access profile that will be used for polling the managed object. An SNMP access profile contains a set of parameters for accessing SNMP agents on managed objects. To view the details of existing polling and SNMP access profiles, click the Manage Profiles button and view the details of existing profiles in the Manage Profiles dialog box. If the SNMP access profile you want to use does not exist yet, you can create it in the Manage Profiles dialog box. 10. After setting the profiles for polling the managed object, apply the changes by clicking the Apply button ( ) in the managed object Properties window toolbar. 11. Finally, enable monitoring of the managed object by clicking the Enable button ( ) in the toolbar of the managed object Properties window. Net Inspector will start polling the managed object and listening for SNMP Trap and Inform messages sent by the managed object. If everything was configured properly, the status of the manage object changes from Unmanaged to Normal, i.e., the managed object icon background color changes from blue to green (Figure 32). 38

39 Adding Managed Objects to Workspace Figure 32: New object is being managed (its status is Normal ) 12. Close the managed object Properties window. Tip: For instructions on viewing the statuses of managed objects an managing alarms associated with them, please refer to the section Monitoring Alarms and Status of Managed Objects in Maps and Explorer Windows Adding Connection Lines to Managed Objects 1. In the Explorer window or in the Maps window, double-click the (sub)map that contains the objects you would like to connect with connection lines. The contents of the opened (sub)map is displayed in the new tab in the Maps window. Tip: If the map is currently displayed in the Details view, select the Graphics entry from the toolbar drop-down list to switch to the Graphics view. 2. In the Graphics toolbar, click the Lock/Unlock button ( ) to unlock the map for editing. Tip: If the Graphics toolbar is not displayed, use the View / Graphics Toolbar toggle command to display it. 39

40 Adding Managed Objects to Workspace 3. In the Graphics toolbar, click the Connection tool button ( ). 4. To add a connection line, click the first device icon in the Maps window, move the mouse pointer to the second (target) device icon and click it (Figure 33). Figure 33: Connecting two icons with the Connection tool 5. A connection line appears between the two icons and the Interfaces dialog box (Figure 34) is displayed that lets you Select the network interfaces used on both ends of the connection (if this information is available via SNMP). Tip: A connection endpoint network interface can be selected only if the corresponding device supports SNMP, if it implements the standard SNMP MIB-II interfaces table (iftable), and if SNMP monitoring/network interfaces option is enabled in the polling profile assigned to the device. Figure 34: Selecting the connection endpoint network interfaces 6. If you have selected a network interface on one or both connected devices, a network interface status node (e.g.: ) appears at the corresponding end of the connection line (Figure 35). This symbol represents the current status of the given network interface used for the connection. The status can be either up ( ), down ( ) disabled ( ), or not present ( ). Furthermore, the description of the selected interface automatically appears as an interface label on the corresponding end of the connection line (Figure 35). 40

41 Adding Managed Objects to Workspace Figure 35: A connection line with interface status symbols and connection labels Tip 1: If you wish to disable displaying interface status nodes on connections in the current map in the Maps window, uncheck the Interface nodes checkbox in the Graphics toolbar. Tip 2: To disable displaying connection labels on connections in the current map in the Maps window, uncheck the Connection labels checkbox in the Graphics toolbar. 7. A connection line can have 3 labels: left, right and center label. Labels are used, for example, for naming the connection and its endpoint interfaces/addresses. To add connection labels to a connection or to edit connection labels, double-click the connection line with the selection tool ( ) to open the Connection Labels dialog box and configure labels in it (Figure 36). Optionally, edit the connection endpoint interfaces by selecting different interfaces from the Source and Target drop-down lists in the Connection Labels dialog box. Figure 36: Editing the connection labels and endpoint interfaces 8. After you have configured the connection labels and or endpoint interfaces, click the OK button to close the Connection Labels dialog box and apply the changes (Figure 37). 41

42 Adding Managed Objects to Workspace 9. Repeat the procedure above to add additional connection lines to objects in the Maps window, Graphics view. Connection lines enable modeling the physical and logical topology of the network. See an example in figure below. Figure 37: Example of a network model with connections lines (some of them with labels) 42

43 Adding Managed Objects to Workspace 5.4 Importing Managed Objects from CSV File Users with administrator access rights can import managed objects (devices) from a CSV (comma separated value) file and add them to the system and to the currently active map in the Maps window. Imported objects appear also in the Device Panel dialog box. The CSV file should contain the following data about the devices (one line per device): Device IP address, device name, polling profile, SNMP profile, PM polling engine Allowed data separator characters:, ; Import rules: 1) Only one attribute for each device may be used, which must be IPv4 or IPv6 address 2) If more than 5 attributes are present for each device, only the first 5 will be used 3) All the missing attributes will be replaced with the default values To import managed objects from a CSV file: 1. In the Explorer window navigate to the (sub)map to which you would like to add managed objects and double-click the submap or right-click it and select the Open pop-up command (Figure 26). 2. A new tab appears in the Maps window, displaying the contents of the opened (sub)map. Right-click inside this map in the Maps window and choose the Add/ Add / Import from CSV File command from the pop-up menu (Figure 38). Figure 38: Selecting the Import from CSV File command 3. In the Import dialog box that appears, select a desired CSV text file from disk. 43

44 Adding Managed Objects to Workspace 4. The Import from CSV File Available Devices dialog box (Figure 39) appears that lets you view and edit the list of managed objects (devices) contained in the selected CSV file: To edit the polling profile, SNMP profile or Performance Manager polling engine of a managed object, click inside the respective field in the list to display the drop-down list and select a different entry from the drop-down list (Figure 39). To modify an attribute of two or more managed objects at the same time, select the objects in the list and click the Modify selected button and then choose the desired polling profile, SNMP profile or Performance Manager polling engine from the corresponding drop-down lists in the dialog box that appears. To remove a managed object from the list, select it in the list and click the Remove button. To add a managed object to the list, click the Add button. This adds a new line to the list of managed objects. Specify the missing attributes of the managed objects (IP address, name, polling profile, SNMP profile, polling engine). Check the Poll imported devices checkbox in order for Net Inspector to start immediately monitoring devices after importing them. Figure 39: The list of managed objects (devices) to be imported from a CSV file 5. After viewing and optionally editing the list of managed objects (devices) to be imported, click the Import button to import new objects and add them to the currently active map in the Maps window. 44

45 Configuring Polling Parameters 6 CONFIGURING POLLING PARAMETERS Users with administrator access rights are allowed to configure parameters that control device polling. These parameters are grouped in two types of profiles: A SNMP access profile contains parameters for accessing SNMP agents on managed objects (e.g., SNMP version, community name, etc.). A polling profile contains parameters for polling managed objects by means of ICMP and SNMP protocols (e.g., polling categories, intervals, thresholds, etc.). Polling and SNMP profiles are configured in the Profiles panel of the Server Settings dialog box (Figure 40) in Net Inspector Client. Once a new SNMP or polling profile is created, it can be assigned to a managed device in the managed object Properties window, Settings view (Figure 31). Figure 40: Net Inspector Server Settings dialog box, Profiles panel 45

46 Configuring Polling Parameters 6.1 Configuring Polling Profiles 1. In Net Inspector Client, select the Tools / Server Preferences command from the main menu to display the Server Preferences dialog box (Figure 40). 2. Click on the Profiles option to display the profiles. 3. To create a new polling profile, click the Add button in the Polling tab of the Profiles panel. The New Polling Profile dialog box appears (Figure 41), where you can configure a new polling profile, using the following controls: Figure 41: New/Edit Polling Profile dialog box 46

47 Configuring Polling Parameters Name (input line) The name of the polling profile. This is a label under which all the settings in this dialog are saved. Check every (input line) Specifies the interval in seconds for checking the managed object status and SNMP agent state (i.e., ICMP Echo and SNMP Ping polling). Poll every (input line) Specifies the interval for polling network services (SNMP, HTTP, IMAP, DNS; SSH, etc.) in seconds. Therefore, this setting also controls the interval for monitoring parameters that are collected through SNMP, except those SNMP parameters for which separate polling interval is configured below. Resync Interval (2 input lines) Specifies the interval in hours and minutes for automatic alarm resynchronization (if both input lines contain 0 (zero), the automatic alarm resynchronization is disabled). Timeout (input line) Specifies the timeout value in seconds. This value determines how long Net Inspector Server will wait for a response to each SNMP and ICMP Echo request it sends to the managed object, before generating a timeout interrupt signal. Retries (input line) Specifies the number of times the SNMP and ICMP Echo request will be retransmitted after the first timeout occurs. Monitors (frame) ICMP (checkbox) If this checkbox is checked, the ICMP Echo (ping) polling is enabled. Services (checkbox) If this checkbox is checked, the monitoring of network services is enabled. If monitoring of network services is enabled in Net Inspector WorkGroup and better editions, each managed object is automatically scanned for the supported network services and detected services are automatically monitored. In the LITE Edition of Net Inspector, you need to manually configure which network services will be monitored on each managed object in the Services view of the device Properties window. SNMP (checkbox) If this checkbox is checked, the SNMP polling is enabled. The checkboxes below determine what information besides the basic system information will be monitored via SNMP (e.g., network interfaces, resources, processes, etc.): Override ping OID (checkbox, input line and drop-down list) If this checkbox is checked, the default SNMP Ping parameters can be overridden. SNMP Ping operation is used to monitor the status (availability) of the SNMP agent on the managed device. By default, this is achieved by periodically querying it with SNMP GetNext requests containing the 0.0 OID (this mechanism retrieves the value of the first accessible OID that lexicographically follows the OID of 0.0). If you would like some other OID to 47

48 Configuring Polling Parameters be queried or use the SNMP Get operation instead, check the Override ping OID checkbox and enter the desired OID into the OID input line and select the SNMP operation (GetNext or Get) to be used for retrieving this OID from the Operation drop-down list. Network interfaces (checkbox and input lines) If this checkbox is checked, the network interfaces on the managed object will be monitored via SNMP. In the accompanying Poll every input line enter the polling interval (in seconds) for monitoring network interface statistics. Furthermore, you can set the threshold values for triggering and clearing alarms associated with interfaces. If Net Inspector Server is used for polling, the collected information will be displayed in the Interfaces view of the managed object s Properties window (Figure 69). If Performance Manager polling engine is polling the device, the collected information will be displayed in the Interfaces frame in the Device Statistics window (Figure 73). Interface status (checkbox) If this checkbox is checked, Net Inspector monitors the status network interfaces on the given managed object and triggers alarm if any of the interfaces goes down without being administratively disabled. The alarm is automatically cleared when the interface comes up again. In utilization (checkbox and two input lines) If this checkbox is checked, you can enter the interface inbound utilization threshold values (in %) into the accompanying input lines. This way, Net Inspector will trigger an alarm when the interface inbound utilization rate exceeds the configured value for triggering the alarm (first input line) and clear the alarm when the same utilization rate falls below the clear alarm threshold value (second input line). Out utilization (checkbox and two input lines) If this checkbox is checked, you can enter the interface outbound utilization threshold values (in %) into the accompanying input lines. This way, Net Inspector will trigger an alarm when the interface outbound utilization rate exceeds the configured value for triggering the alarm (first input line) and clear the alarm when the same utilization rate falls below the clear alarm threshold value (second input line). In error rate (checkbox and two input lines) If this checkbox is checked, you can enter the interface inbound error rate threshold values (in %) into the accompanying input lines. This way, Net Inspector will trigger an alarm when the interface inbound error rate exceeds the configured value for triggering the alarm (first input line) and clear the alarm when the error rate falls below the clear alarm threshold value (second input line). Out error rate (checkbox and two input lines) If this checkbox is checked, you can enter the interface outbound error rate threshold values (in %) into the accompanying input lines. This way, Net Inspector will trigger an alarm when the interface outbound error rate exceeds the configured value for triggering the alarm (first input line) and 48

49 Configuring Polling Parameters clear the alarm when the error rate falls below the clear alarm threshold value (second input line). Host Resources (checkbox and input line) If this checkbox is checked, the utilization of device system resources, like the memory usage, CPU load, etc., will be monitored via SNMP (on Cisco devices and hosts supporting the HOST-RESOURCES-MIB module). In the accompanying Poll every input line enter the polling interval (in seconds) for monitoring host resources statistics. Furthermore, you can set the threshold values for triggering and clearing alarms associated with the system resource utilization. If Net Inspector Server is used for polling, the collected information will be displayed in the Resources view of the managed object s Properties window (Figure 70). If Performance Manager polling engine is polling the device, the collected information will be displayed in the Memory and Processor Info frame and in the in the Storage Info frame in the Device Statistics window (Figure 73). Memory usage (checkbox and two input lines) If this checkbox is checked, you can enter the device memory usage threshold values (in %) into the accompanying input lines. This way, Net Inspector will trigger an alarm when the device memory usage exceeds the configured value for raising the alarm (first input line) and clear the alarm when the memory usage falls below the clear alarm threshold value (second input line). CPU load (checkbox and two input lines) If this checkbox is checked, you can enter the device CPU load threshold values (in %) into the accompanying input lines. This way, Net Inspector will trigger an alarm when the device CPU load exceeds the configured value for raising the alarm (first input line) and clear the alarm when the CPU load falls below the clear alarm threshold value (second input line). Storage usage (checkbox and two input lines) If this checkbox is checked, you can enter the device data storage unit usage threshold values (in %) into the accompanying input lines. This way, Net Inspector will trigger an alarm when the device storage usage exceeds the configured value for raising the alarm (first input line) and clear the alarm when the storage usage falls below the clear alarm threshold value (second input line). Processes (checkbox and input line) Note: This option is available only if MG-SOFT Net Inspector WorkGroup and Enterprise Edition. If this checkbox is checked, the processes running on devices supporting the HOST-RESOURCES-MIB module will be monitored via SNMP. The process information, i.e., process name, running status, process memory usage and process CPU usage, will be displayed only for the selected processes. Into the accompanying Poll every input line enter the polling interval (in seconds) for monitoring processes. Furthermore, you can set the threshold values for 49

50 Configuring Polling Parameters triggering and clearing alarms associated with the process status and resources consumption. Collected information will be displayed in the Processes frame in the Device Statistics window (Figure 73). Process status (checkbox) If this checkbox is checked, Net Inspector monitors the status of processes on the given managed object and triggers an alarm if any of the processes stop running. The alarm is automatically cleared when the process is running again. Process CPU (checkbox and two input lines) If this checkbox is checked, you can enter the processes CPU load threshold values (in %) into the accompanying input lines. This way, Net Inspector will trigger an alarm when the processes CPU load exceeds the configured value for raising the alarm (first input line) and clear the alarm when the CPU load falls below the clear alarm threshold value (second input line) Process memory If this checkbox is checked, you can enter the processes memory usage threshold values (in MB) into the accompanying input lines. This way, Net Inspector will trigger an alarm when the processes memory usage exceeds the configured value for raising the alarm (first input line) and clear the alarm when the memory usage falls below the clear alarm threshold value (second input line). IP SLA (checkbox and input line) Note: This option is available only if MG-SOFT Net Inspector WorkGroup and Enterprise Edition. If this checkbox is checked, the IP SLA statistics will be monitored on Cisco routers that are properly configured and provide this information via SNMP. Into the accompanying Poll every input line enter the polling interval (in seconds) for monitoring IP SLA statistics. Furthermore, you can set the threshold values for triggering and clearing alarms associated with the IP SLA metrics. Collected information will be displayed in the IP SLA page in the Performance Statistics window. For more information on configuring IP SLA operations on Cisco devices, please consult the Cisco documentation RTT measurement status (checkbox) If this checkbox is checked, Net Inspector monitors the round trip time measurement status for all enabled IP SLA services on the given managed objects and triggers an alarm, if any enabled service is down. The alarm is automatically cleared when the service is up again. 50

51 Configuring Polling Parameters Echo round trip time (checkbox and two input lines) If this checkbox is checked, the ICMP echo round trip time threshold is enabled. Enter the echo round trip time threshold values (in ms) into the accompanying input lines. This way, Net Inspector will trigger an alarm when the echo round trip time exceeds the configured value for raising the alarm (first input line) and clear the alarm when the round trip time falls below the clear alarm threshold value (second input line). Path echo round trip time (checkbox and two input lines) If this checkbox is checked, the full path echo round trip time threshold is enabled. Enter the full path echo round trip time threshold values (in ms) into the accompanying input lines. This way, Net Inspector will trigger an alarm when the full path echo round trip time exceeds the configured value for raising the alarm (first input line) and clear the alarm when the round trip time falls below the clear alarm threshold value (second input line). TCP connect round trip time (checkbox and two input lines) If this checkbox is checked, the IP SLA TCP connect round trip time threshold is enabled. Enter the TCP connect round trip time threshold values (in ms) into the accompanying input lines. This way, Net Inspector will trigger an alarm when the TCP connect round trip time exceeds the configured value for raising the alarm (first input line) and clear the alarm when the round trip time falls below the clear alarm threshold value (second input line). HTTP round trip time (checkbox and two input lines) If this checkbox is checked, the IP SLA HTTP round trip time threshold is enabled. Enter the HTTP round trip time threshold values (in ms) into the accompanying input lines. This way, Net Inspector will trigger an alarm when the HTTP round trip time exceeds the configured value for raising the alarm (first input line) and clear the alarm when the round trip time falls below the clear alarm threshold value (second input line). DNS round trip time (checkbox and two input lines) If this checkbox is checked, the IP SLA DNS round trip time threshold is enabled. Enter the DNS round trip time threshold values (in ms) into the accompanying input lines. This way, Net Inspector will trigger an alarm when the DNS round trip time exceeds the configured value for raising the alarm (first input line) and clear the alarm when the round trip time falls below the clear alarm threshold value (second input line). DLSW round trip time (checkbox and two input lines) If this checkbox is checked, the IP SLA DLSW (Data Link Switching Plus) round trip time threshold is enabled. Enter the DLSW round trip time threshold values (in ms) into the accompanying input lines. This way, Net Inspector will trigger an alarm when the DLSW round trip time exceeds the configured value for raising 51

52 Configuring Polling Parameters the alarm (first input line) and clear the alarm when the round trip time falls below the clear alarm threshold value (second input line). DHCP round trip time (checkbox and two input lines) If this checkbox is checked, the IP SLA DHCP round trip time threshold is enabled. Enter the DHCP round trip time threshold values (in ms) into the accompanying input lines. This way, Net Inspector will trigger an alarm when the DHCP round trip time exceeds the configured value for raising the alarm (first input line) and clear the alarm when the round trip time falls below the clear alarm threshold value (second input line). FTP round trip time (checkbox and two input lines) If this checkbox is checked, the IP SLA FTP round trip time threshold is enabled. Enter the FTP round trip time threshold values (in ms) into the accompanying input lines. This way, Net Inspector will trigger an alarm when the FTP round trip time exceeds the configured value for raising the alarm (first input line) and clear the alarm when the round trip time falls below the clear alarm threshold value (second input line). Jitter round trip time (checkbox and two input lines) If this checkbox is checked, the IP SLA VoIP Jitter round trip time threshold is enabled. Enter the Jitter round trip time threshold values (in ms) into the accompanying input lines. This way, Net Inspector will trigger an alarm when the Jitter round trip time exceeds the configured value for raising the alarm (first input line) and clear the alarm when the round trip time falls below the clear alarm threshold value (second input line). Cisco Jitter SD (checkbox and two input lines) If this checkbox is checked, the VoIP source-to-destination jitter threshold is enabled. This applies to one-way jitter measured from source to destination router. Jitter is the variation in delay between arriving packets (inter-packet delay variance). Jitter affects voice quality by causing uneven gaps in the speech pattern of the person talking. Enter the source-to-destination jitter threshold values (in ms) into the accompanying input lines. This way, Net Inspector will trigger an alarm when the source-to-destination jitter (as measured by the IP SLAs) exceeds the configured value for raising the alarm (first input line) and clear the alarm when the source-to-destination jitter falls below the clear alarm threshold value (second input line). Cisco Jitter DS (checkbox and two input lines) If this checkbox is checked, the VoIP destination-to-source jitter threshold is enabled. Enter the destination-to-source jitter threshold values (in ms) into the accompanying input lines. This way, Net Inspector will trigger an alarm when the destination-to-source jitter (as measured by the IP SLAs) exceeds the configured value for raising the alarm (first input line) and 52

53 Configuring Polling Parameters clear the alarm when the destination-to-source jitter falls below the clear alarm threshold value (second input line). Cisco packet loss SD (checkbox and two input lines) If this checkbox is checked, the VoIP source-to-destination packet loss threshold is enabled. This applies to one-way packet loss from source to destination router. Enter the source-to-destination packet loss threshold values (in %) into the accompanying input lines. This way, Net Inspector will trigger an alarm when the source-to-destination packet loss (as measured by the IP SLAs) exceeds the configured value for raising the alarm (first input line) and clear the alarm when the source-to-destination packet loss falls below the clear alarm threshold value (second input line). Cisco packet loss DS (checkbox and two input lines) If this checkbox is checked, the VoIP destination-to-source packet loss threshold is enabled. This applies to one-way packet loss from destination to source router. Enter the destination-to-source packet loss threshold values (in %) into the accompanying input lines. This way, Net Inspector will trigger an alarm when the destination-to-source packet loss (as measured by the IP SLAs) exceeds the configured value for raising the alarm (first input line) and clear the alarm when the destination-to-source packet loss falls below the clear alarm threshold value (second input line). Cisco MOS (checkbox and two input lines) If this checkbox is checked, the mean opinion score (MOS) threshold is enabled. The estimated mean opinion score (MOS) is a numerical indication of the perceived quality of sound after compression and transmission. Cisco routers with enabled VoIP UDP jitter IP SLAs will calculate and express the estimated MOS value as a number in the range of 1 to 5, where 1 is the lowest audio quality, and 5 is the highest quality. A MOS value of zero indicates that MOS data is not available. Enter the MOS threshold values into the accompanying input lines. This way, Net Inspector will trigger an alarm when the MOS (as measured by the IP SLAs) falls bellow the trigger alarm threshold value (first input line) and clear the alarm when it raises again above the clear alarm threshold value (second input line). OK (button) Saves all changes and closes the New/Edit Polling Profile dialog. Cancel (button) Discards all changes and closes the New/Edit Polling Profile dialog. Tip 1: Once you have configured a new polling profile, you can assign it to a managed object in the managed object Properties window, Settings view (Figure 31). Tip 2: To quickly assign a polling profile to two or more managed objects, select the objects in the Maps window, right-click them and choose the Tools/Change Profile command from the mouse context (pop-up) menu. Then select the desired polling profile from the Change Profile dialog box that appears and click the OK button to apply the change for all selected objects. 53

54 Configuring Polling Parameters 6.2 Configuring SNMP Profiles 1. In Net Inspector Client, select the Tools / Server Preferences command from the main menu to display the Server Preferences dialog box (Figure 40). 2. Click on the Profiles option to display the profiles. 3. To create a new SNMP access profile, switch to the SNMP tab in the Server Settings dialog box and click the Add button in the SNMP tab of the Server Settings dialog box. The New SNMP Access Profile dialog box appears (Figure 42), where you can configure a new polling profile, using the following controls: Figure 42: New SNMP Profile dialog Name (input line) The name of the SNMP profile. This is a label under which all the settings in this dialog box are saved. Port (input line) The UDP port on which SNMP agents on managed devices listen to for incoming SNMP requests. 54

55 Configuring Polling Parameters SNMP version (radio buttons) The version of SNMP protocol used for querying SNMP agents on managed objects and for receiving SNMP Trap and Inform notification messages sent by those SNMP agents. Settings (frame) The SNMPv1 and SNMPv2c community name settings. This frame is disabled if SNMPv3 protocol is selected in the SNMP version frame. Read community (input line) The SNMP community name to be used with all SNMPv1 or SNMPv2c queries sent by Net Inspector. Write community (input line) The SNMP community name to be included into SNMPv1 or SNMPv2c Set requests sent by Net Inspector. Trap community (input line) The community name included in SNMPv1 Trap or SNMPv2c Trap or Inform messages sent by the SNMP agents on managed devices. SNMPv3 Settings (frame) The SNMPv3 security settings. This frame is enabled only if the SNMPv3 protocol is selected in the SNMP version frame. Security user name (input line) The name of the SNMPv3 USM user to be used for exchanging all SNMPv3 messages between Net Inspector and managed objects (including SNMPv3 Trap and Inform messages sent by the managed objects). Context name (input line) The name of the context in which the management information conveyed in SNMPv3 messages is accessed. Authentication protocol (drop-down list) and Change Password/Key (button) The drop-down list lets you select the SNMPv3 authentication protocol (HMAC-MD5 or HMAC-SHA) to be used for authenticating SNMPv3 messages sent on behalf of the given SNMPv3 user. The Change Password/Key button opens the Authentication Password or Key dialog box that lets you enter the authentication protocol password or key. Privacy protocol (drop-down list) and Change Password/Key (button) The drop-down list lets you select the SNMPv3 privacy protocol (CBC-DES or CFB-AES-128) to be used for encrypting SNMPv3 messages sent on behalf of the given SNMPv3 user. The Change Password/Key button opens the Privacy Password or Key dialog box that lets you enter the privacy protocol password or key. Do not localize authentication and privacy keys (checkbox) If this checkbox is checked, the software uses non-localized authentication and privacy keys. 55

56 Configuring Polling Parameters Verify (button) Opens the built in MIB Browser where you can verify your new or existing profile (Figure 43). To verify that your new profile is correct enter the IP address of the machine that is running the SNMP agent with the profile you are creating into the Address input line and press enter or click the Contact button. Figure 43: MIB Browser dialog box Tip: For more information on the MIB Browser window, please refer to the Net Inspector Client Reference Manual, section MIB Browser Window. OK (button) Applies all changes and closes the dialog box. Cancel (button) Discards all changes and closes the dialog box. Tip 1: Once you have configured a new SNMP access profile, you can assign it to a managed object in the managed object Properties window, Settings view (Figure 31). Tip 2: To quickly assign a SNMP access profile to two or more managed objects, select the objects in the Maps window, right-click them and choose the Tools/Change Profile command from the mouse context (pop-up) menu. Then select the desired SNMP access profile from the Change Profile dialog box that appears and click the OK button to apply the change for all selected objects. 56

57 Monitoring and Managing Alarms in Events Window 7 MONITORING AND MANAGING ALARMS IN EVENTS WINDOW Net Inspector triggers alarms when it detects network problems or changes in important parameters of managed objects functioning. Alarms are triggered also when problems occur within particular Net Inspector subsystems (e.g., the configuration module triggers an alarm if it cannot connect to the configuration database, etc.) and when Net Inspector fails to perform the designated action (e.g., the mail module triggers an alarm if it cannot send an e mail for some reason). Alarms are messages that indicate faults or conditions that could lead to faults on managed, action and system objects. Alarms are triggered and handled by Net Inspector Server. Net Inspector Server logs alarms in a database and dispatches alarm information to connected Net Inspector Clients, which provide the graphical user interface for viewing and managing (i.e., acknowledging, filtering, finding, etc.) alarms. Net Inspector Client displays alarms in the Events window (Figure 44). Each alarm in the Events window is displayed in a separate line. Alarm details are displayed in the Event Details sub-window (Figure 44). In addition, information about alarms is shown also in the following windows: Maps window: Graphics view (alarm balloons and alarm rectangles), Details view ( Alarms and New Alarms columns), Explorer window (alarm propagation). An important attribute of every alarm is the alarm severity level that indicates the severity (difficulty) of the condition on the object. In Net Inspector Client, each alarm severity level is assigned a different symbol and color. The alarm severity level colors can be configured to meet the user preferences (in the User Preferences dialog box, Colors panel). The following figure displays alarm severity levels (listed top-down from least to most severe), their symbols and default colors: Alarms can be active or cleared. When an alarm is triggered, it becomes and remains active until the condition that clears this alarm is met. The severity level of an active alarm can be Informational, Warning, Minor, Major, or Critical. When an alarm is cleared, its state changes from active to cleared (without changing the severity level). By default, cleared alarms are displayed in green background color when listed in the Events window. For the full description of alarm details, please consult the Events Window section of the Net Inspector Client Reference Manual. This section describes how to monitor, acknowledge, filter and find alarms in the Events window. 57

58 Monitoring and Managing Alarms in Events Window 7.1 Viewing Alarms for All Objects 1. If the Events window is not displayed, select the View / Events command or click the Events toolbar button to display it (Figure 44). 2. The Active Alarms tab in the Events window displays all active alarms that exist on the managed, action and system objects included in the user view that is currently open (active). The list of alarms displayed in the Active Alarms tab is dynamic, meaning that newly triggered alarms are automatically added to the list, and cleared alarms automatically disappear from the list (by default). The leftmost section of the Events window displays the current alarm summary, i.e., the total number of active alarms and the number of active alarms broken down by severity levels (represented by severity icons). Note: The Active Alarms tab displays only active alarms. When an alarm is triggered, it becomes and remains active until the condition that clears this alarm is met. For example, if a managed object does not respond to Net Inspector Server queries, the Device is down alarm is activated and displayed in the Active Alarms tab of the Events window. This alarm is cleared when the same managed object starts responding to Net Inspector Server queries again. By default, alarms automatically disappear from the list in the Active Alarms tab when they are cleared (except for alarms that have been manually cleared by users). Options to display or hide cleared alarms can be set according to your preferences by using the Table Options / Keep Cleared Alarms and Table Options / Keep Manually Cleared Alarms toggle pop-up menu commands in any tab of the Events window. 3. To display or hide individual columns in the Events window, click the column selector displayed on top of the vertical scrollbar of the Events window and choose the names of columns you want to display or hide form the toggle menu that appears. 4. To enable viewing even more details about alarms, click the Event Details button to display the Event Details sub-window in the right section of the Events window (Figure 44). Figure 44: Events window and Event Details sub-window 5. Select an alarm in the Active Alarms tab in the Events window to view its details in the Event Details sub-window. Tip: For the full description of alarm details, please consult the Events Window section of the Net Inspector Client Reference Manual. 58

59 Monitoring and Managing Alarms in Events Window 6. To enable audible alarm notifications, i.e., emitting acoustic signals when new alarms are triggered, click the Sound button in the Events window. Tip: You can configure audible alarm options in the Client Preferences dialog box, Sounds panel. 7. To sort the alarms list in the Events window by a column, click the relevant column heading. For example, to sort listed alarms by the severity level, click the Severity column heading in the Active Alarms tab. 8. To change the position of a column in the Events window, click the column heading and drag it to the desired position left or right from its current position. 9. To enable or disable coloring rows according to the colors assigned to alarm severity levels, check or uncheck the Use Colors option in the Events window column selector. 10. To quickly locate the object that is associated with a particular alarm, select the alarm in the Events window and chose the Go To Source pop-up command. This command finds the object, which is the source of alarm and highlights it in the Maps window. 11. To add a comment to the alarm, select the alarm, choose the Add Comment popup command, and enter a text of your choice into the Add Comment dialog box that appears. User comments are shown in the Comment column, which can be displayed by selecting the Comment entry from the Events window column selector. Figure 45: Add Comment dialog box 12. Net Inspector automatically prefixes the comment text displayed in the Comment column with the username and the IP address of the user who has added the comment. 13. To acknowledge an alarm, select it in the Events window and chose the Acknowledge pop-up command or check the Acknowledged checkbox in the Events window. By acknowledging an alarm you declare that you are aware of the condition reported by the alarm. 14. A check mark appears in the Acknowledged checkbox, indicating that the alarm is acknowledged. Furthermore, Net Inspector automatically records the relevant information about the acknowledgement operation and displays it in the Event Details sub-window, i.e., the date and time of the alarm acknowledgement as well as the username and IP address of the user who has acknowledged the alarm (Figure 46). 59

60 Monitoring and Managing Alarms in Events Window Figure 46: Viewing alarm acknowledgement details 15. To unacknowledge an alarm (e.g., if you think the problem requires additional attention), select it in the Events window and chose the Unacknowledge pop-up command or uncheck the Acknowledged checkbox in the Events window. 16. A check mark disappears from the Acknowledged checkbox in the Events window. Again, Net Inspector records relevant details about this operation and displays them in the Event Details sub-window. 60

61 Monitoring and Managing Alarms in Events Window 7.2 Viewing Alarms for Selected Objects In addition to monitoring active alarms for all objects (described in the previous section), you can view active alarms also for individual objects, as described in this section. 1. Open the map that contains the object(s) whose active alarms you want to view by expanding the hierarchical map tree in the Explorer window (View / Explorer), selecting the relevant map and choosing the Open pop-up command. Figure 47: Opening a map from the Explorer window 2. Objects included in the selected map are displayed in a new tab in the Maps window. The new tab carries the name of the opened map (e.g., Map1). 61

62 Monitoring and Managing Alarms in Events Window 3. Select one or more object on the map and choose the Alarms / Active Alarms pop-up command (Figure 48). Tip: To select more than one object on the map, press and hold down the left mouse button while dragging the mouse pointer over the objects you want to select. Alternatively, press and hold down the CTRL key (for selecting individual objects) or the SHIFT key (for selecting a range of adjacent objects) and click the objects with your mouse. Figure 48: Choosing the option to view active alarms for selected managed objects 4. A new tab appears in the Events window displaying a list of active alarms associated with the selected objects (Figure 49). The list of alarms is dynamic, meaning that newly triggered alarms are automatically added to the list, and cleared alarms automatically disappear from the list (by default). Figure 49: A new tab in the Events window displaying active alarms for selected objects Tip 1: For more information on viewing and acknowledging alarms in the Events window, please refer to the Viewing Alarms for All Objects section of this manual. Tip 2: To remove a tab from the Events window, right click the tab symbol at the bottom of the Events window and select the Close [tab name] pop-up command. 62

63 Monitoring and Managing Alarms in Events Window 7.3 Viewing Alarm History Net Inspector Client lets you view the alarm history for one or more objects in the currently active user view. The alarm history list includes all alarms (active and cleared) To View Alarm History for Selected Objects 1. Open the map that contains the object(s) you want to view the alarm history for by expanding the hierarchical map tree in the Explorer window (View / Explorer), selecting the relevant map and choosing the Open pop-up command (Figure 47). 2. Objects included in the selected map are displayed in a new tab in the Maps window. The new tab carries the name of the opened map (e.g., Map1). 3. Select one or more object on the map and choose the Alarms / History pop-up command. Tip: To select more than one object on the map, press and hold down the left mouse button while dragging the mouse pointer over the objects you want to select. Alternatively, press and hold down the CTRL key (for selecting individual objects) or the SHIFT key (for selecting a range of objects) and click the objects with your mouse. Figure 50: Choosing the option to view alarm history for selected managed objects 4. A new tab opens in the Events window, displaying a (gradually populating) list of all alarms (active and cleared) that exist in the Net Inspector database for the selected objects. When the alarm history tab is open, newly triggered alarms 63

64 Monitoring and Managing Alarms in Events Window associated with the selected objects are automatically added to the list (and by default, cleared alarms do not disappear from the list). Figure 51: Viewing the alarm history for selected objects 5. The progress bar at the bottom of the Alarm History tab moves from left to right and vice-versa while the alarm history data is being fetched from the database. To abort the fetch operation and view a partial alarm history list, click the Abort button. Tip 1: For more information on viewing and acknowledging alarms in the Events window, please refer to the Viewing Alarms for All Objects section of this manual. Tip 2: To remove a tab from the Events window, right click the tab symbol at the bottom of the Events window and select the Close [tab name] pop-up command. 64

65 Monitoring and Managing Alarms in Events Window 7.4 Filtering Alarms Net Inspector Client lets you create a filter to display only those active alarms that match the filter conditions. Filtered alarms are displayed in a separate tab in the Events window. The list of filtered alarms dynamically changes over time, i.e., new alarms that match the filter criteria are added to the list when they are triggered, while cleared alarms disappear from the list (by default). Filters are created in the Create Filter dialog box (Figure 52), which contains a toolbar that lets you create filter conditions and add them to the filter one-by-one. New condition toolbar: CONDITION OPERATOR VALUE TYPE This toolbar lets you create a filter condition by selecting the condition type, operator and value from the corresponding drop-down lists. Once the condition is configured, you can add it to the filter by clicking the Add button in the right section of the Create Filter dialog box. The central section of the dialog box (Conditions panel) displays the entire filter consisting of filter conditions and relations between them. The Conditions panel displays a filter in form of a hierarchical tree, where the filter conditions are connected with logical operators (AND, OR). To create a filter and displays active alarms that match the filter conditions proceed as follows: 1. Select the Event / Create Filter command to open the Create Filter dialog box. Figure 52: Create Filter dialog box 65

66 Monitoring and Managing Alarms in Events Window 2. Into the Name input line, enter the filter name. This is also the name of a tab in the Events window in which the filtered results will be displayed. 3. In the New Condition toolbar, select the desired values from the Condition type, Operator, and Value drop-down lists to create a filter condition. You can select among the following types of conditions: Severity Specifies the severity level of the alarm. If this condition type is selected, you can choose the alarm severity level from the Value drop-down list (e.g. Critical, Major, etc.). Source Uniquely identifies the object, which has triggered the alarm. If this type of condition is selected, click the ( ) Browse button next to the Value field to open the Select Source dialog box. The Select Source dialog box displays two panels; the left panel contains the expandable map tree, while the panel on the right displays all objects included in the map that is selected in the left panel. The left panel also displays some properties of the listed objects, including their unique object IDs. To select a Source object, click the relevant map in the left panel, choose the object on the right panel and click the Select button. Alternatively, you can select one or more objects in the Maps window and then open the Create Filter dialog box. This will automatically create filter conditions for selected source objects. Source name Specifies the name of the object (as displayed on the workspace), which has triggered the alarm. If this condition type is selected, you can enter the name of the object into the Value input line. Note, however, that two or more objects can have the same name. Use the Source condition type to uniquely specify the source in such case. Source info Specifies additional information about the problem (as displayed in the Source Info column in the Events window). If this condition type is selected, you can enter additional informational about the object into the Value input line (e.g., Processor:#1 ). Source type Specifies the type of the object, which has triggered the alarm. If this condition type is selected, you can choose the type of the object from the Value dropdown list (e.g. IP, etc.). Message A short description of the alarm. If this condition type and the operator is or is not is selected, you can choose a message from the list of all messages in the Value drop-down list (e.g. Device is down ). If this condition type and the operator contains is selected, you can enter a text string (e.g., Dev ) into the Value input line to find all alarms whose message field contains the specified character(s). Cause Specifies the cause of the alarm. If this condition type is selected, you can choose a cause from the Value drop-down list (e.g. Lan Error ). 66

67 Monitoring and Managing Alarms in Events Window Type Specifies the type of the alarm. If this condition type is selected, you can choose an alarm type from the Value drop-down list (e.g. Communication ). Event state Specifies the state of the alarm or event. If this condition type is selected, you can choose an event or alarm state from the Value drop-down list (e.g. ACKNOWLEDGED or MANUALLY CLEARED or UNCLEARED, etc.). (Un)Acknowledge time Specifies the date and time of acknowledging or unacknowledging the alarm or event. If this condition type is selected, you can enter the desired date and time into the Value input line, using the date and time formatting as configured in the user preferences (e.g., Sep 12, :45:12 PM ). (Un)Clear time Specifies the date and time of clearing or unclearing the alarm or event. If this condition type is selected, you can enter the desired date and time into the Value input line, using the date and time formatting as configured in the user preferences (e.g., Sep 12, :45:12 PM ). Event state info Specifies who has changed the state of the alarm or event as last. This can be either a user that has managed alarm (e.g., acknowledged, unacknowledged, manually cleared, uncleared) or the Auto if the alarm has been automatically cleared by the system. When specifying a user, you can also specify the location (IP address) of the user who has managed the alarm in square brackets (e.g., operator [ ]). If this condition type is selected, you can enter an event state info into the Value input line (e.g. admin [ ] or Auto, etc.). 4. After you have selected the desired entries from the Condition type, Operator, and Value drop-down lists, click the Add button to add the condition to the Filter. The added condition will appear in the central section of the dialog box (Conditions panel). 5. Repeat steps 3-4 above to add additional conditions to the filter. Note 1: If you add two or more conditions of the same type (e.g., Severity=Critical and Severity=Major), these conditions will be combined with the logical OR operator, whereas conditions of different types (e.g., Severity=Critical and Message=Device is down) are combined with the logical AND operator. Note 2: For more information on creating filters, please refer to the Net Inspector Client Reference Manual, section Create Filter dialog box. 6. To remove a condition from the filter, select it in the Filter panel and click the Remove button. 7. When you have added all filter conditions to the filter, click the OK button to apply the filter and display the filtered alarms in a new tab in the Events window. 67

68 Monitoring and Managing Alarms in Events Window Figure 53: Viewing filtered alarms in the Events window Tip 1: To save the filter, use the Event / Save Filter command and enter a meaningful name for the filter into the dialog box that appears. Saved filters can later be opened and applied using the Event / Load Filter command. Tip 2: For more information on viewing and acknowledging alarms in the Events window, please refer to the Viewing Alarms for All Objects section of this manual. Tip 3: To remove a tab from the Events window, right click the tab symbol at the bottom of the Events window and select the Close [tab name] pop-up command. 68

69 Monitoring and Managing Alarms in Events Window 7.5 Finding Alarms Net Inspector Client lets you find those alarms or events that match the user-specified search filter. Search filters are configured in the same manner as display filters. Search results are displayed in a separate tab in the Events window. The list of alarms produced by the search operation does not change over time (i.e., alarms are not automatically added to or removed from the list once the Find operation is finished). Furthermore, found alarms cannot be managed (acknowledged, unacknowledged, manually cleared, etc.). To find alarms that match the specified search filter, proceed as follows: 1. Select the Event / Find Events command or click the Find Events button in the Events window to open the Find Events dialog box (Figure 54). Note: For detailed description of the Find Events dialog box, please consult the Net Inspector Client Reference Manual. Figure 54: Find Events dialog box 2. Into the Name input line, enter the name of the Events window tab to display the search results in. 69

70 Monitoring and Managing Alarms in Events Window 3. From the Time frame drop-down list select the time period for the search operation (i.e., Today, This week, This month, User defined). The search operation will look only for those alarms/events that have been triggered within the specified time frame. 4. The From and To input lines display the start and end date and time for the search operation, depending on the entry selected in the Time frame drop-down list. If you have selected the User defined option in the Time frame drop-down list, you can specify arbitrary time frame for the search operation by entering the start and end date and time into the From and To input lines. The search operation will look only for those alarms/events that have been triggered within the specified time frame. The From an To date and time values are formatted according to the setting of the Date/Time format parameter in the User Preferences dialog box. 5. In the Search in section click the Active Alarms radio button (to search among active alarms only) or the All Alarms radio button (to search among all alarms: active and cleared). Note: The Events radio button lets you search for events which trigger, change and clear alarms. For more information about events, please see the Inspector Client Reference Manual. 6. In the New Condition toolbar, select the desired values from the Condition type, Operator, and Value drop-down lists to create a filter condition. You can select among the following options: Severity Specifies the severity level of the alarm. If this condition type is selected, you can choose the alarm severity level from the Value drop-down list (e.g. Critical, Major, etc.). Source Uniquely identifies the object, which has triggered the alarm. If this type of condition is selected, click the ( ) Browse button next to the Value field to open the Select Source dialog box. The Select Source dialog box displays two panels; the left panel contains the expandable map tree, while the panel on the right displays all objects included in the map that is selected in the left panel. The left panel also displays some properties of the listed objects, including their unique object IDs. To select a Source object, click the relevant map in the left panel, choose the object on the right panel and click the Select button. Alternatively, you can select one or more objects in the Maps window and then open the Find Events dialog box. This will automatically create filter conditions for selected source objects. Source name Specifies the name of the object (as displayed on the workspace), which has triggered the alarm. If this condition type is selected, you can enter the name of the object into the Value input line. Note, however, that two or more objects can have the same name. Use the Source condition type to uniquely specify the source in such case. Source info Specifies additional information about the problem (as displayed in the Source Info column in the Events window). If this condition type is selected, 70

71 Monitoring and Managing Alarms in Events Window you can enter additional informational about the object into the Value input line (e.g., Processor:#1 ). Source type Specifies the type of the object, which has triggered the alarm. If this condition type is selected, you can choose the type of the object from the Value dropdown list (e.g. IP, etc.). Message A short description of the alarm. If this condition type and the operator is or is not is selected, you can choose a message from the list of all messages in the Value drop-down list (e.g. Device is down ). If this condition type and the operator contains is selected, you can enter a text string (e.g., Dev ) into the Value input line to find all alarms whose message field contains the specified character(s). Cause Specifies the cause of the alarm. If this condition type is selected, you can choose a cause from the Value drop-down list (e.g. Lan Error ). Type Specifies the type of the alarm. If this condition type is selected, you can choose an alarm type from the Value drop-down list (e.g. Communication ). Event state Specifies the state of the alarm or event. If this condition type is selected, you can choose an event or alarm state from the Value drop-down list (e.g. ACKNOWLEDGED or MANUALLY CLEARED or UNCLEARED, etc.). (Un)Acknowledge time Specifies the date and time of acknowledging or unacknowledging the alarm or event. If this condition type is selected, you can enter the desired date and time into the Value input line, using the date and time formatting as configured in the user preferences (e.g., Sep 12, :45:12 PM ). (Un)Clear time Specifies the date and time of clearing or unclearing the alarm or event. If this condition type is selected, you can enter the desired date and time into the Value input line, using the date and time formatting as configured in the user preferences (e.g., Sep 12, :45:12 PM ). Event state info Specifies who has changed the state of the alarm or event as last. This can be either a user that has managed alarm (e.g., acknowledged, unacknowledged, manually cleared, uncleared) or the Auto if the alarm has been automatically cleared by the system. When specifying a user, you can also specify the location (IP address) of the user who has managed the alarm in square brackets (e.g., operator [ ]). If this condition type is selected, you can enter an event state info into the Value input line (e.g. admin [ ] or Auto, etc.). 7. After you have selected the desired entries from the Condition type, Operator, and Value drop-down lists, click the Add button to add the condition to the Filter. The added condition will appear in the central section of the dialog box (Conditions panel). 8. Repeat steps 6-7 above to add additional conditions to the search filter. 71

72 Monitoring and Managing Alarms in Events Window Note 1: If you add two or more conditions of the same type (e.g., Severity=Critical and Severity=Major), these conditions will be combined with the logical OR operator, whereas conditions of different types (e.g., Severity=Critical and Message=Device is down) are combined with the logical AND operator. Note 2: For more information on creating search filters, please refer to the Net Inspector Client Reference Manual, section Find Events dialog box. 9. To remove a condition from the filter, select it and click the Remove button. 10. When you have added all filter conditions to the filter, click the Find button to start the search operation. 11. Search results are displayed in a new tab in the Events window (Figure 55). The search progress bar at the bottom of this tab moves from left to right and viceversa, until the search operation is finished. To abort the search operation, click the Abort button in the Events window. Figure 55: Viewing results of the search operation in the Events window Tip 1: To find alarms for particular objects only, select those objects in the Maps window and use the Alarms / Find Alarms pop-up command. This will open the Find Events dialog box and automatically insert the appropriate Source type of condition(s) into it in order to restrict the search operation to the selected object(s). You can then add additional conditions to the Find Events dialog box by following the procedure described above. Tip 2: To modify the search conditions after the search operation has been started, select the tab in the Events window where the results of this search operation are displayed and use the Events / Modify Filter command. The Find Events dialog box will reappear listing all the conditions that were used in the initial/previous search operation. After modifying the search conditions, click the Find button again. The old research results will be deleted and the new search results will be displayed in the same tab of the Events window. Tip 3: To save the search filter, use the Event / Save Filter command and enter a meaningful name for the filter into the dialog box that appears. Saved filters can later be opened and applied using the Event / Load Filter command. Tip 4: To remove a tab from the Events window, right click the tab symbol at the bottom of the Events window and select the Close [tab name] pop-up command. 72

73 Monitoring Alarms and Status of Managed Objects in Maps and Explorer Windows 8 MONITORING ALARMS AND STATUS OF MANAGED OBJECTS IN MAPS AND EXPLORER WINDOWS In addition to the Events window, information about active alarms is displayed in the Maps and Explorer windows as well. Furthermore, the Maps and Explorer windows provide also information about the current status of objects. The Maps window can display managed objects, system objects, action objects and submaps either by means of icons (Graphics view) or by means of a table (Details view). The Graphics view provides information about active alarms in alarm balloons above the icons and in alarm rectangles displayed on the icons that represent objects and submaps. The Details view displays information about active alarms on objects and submaps in the Alarms and New Alarms columns. Both views display also the information about the current status of objects. The Explorer window displays the Net Inspector workspace structure, i.e., all user views assigned to the user and the hierarchical tree-like structures of maps and submaps within user views. Maps contain zero or more objects, submaps, and graphic elements (lines, connections, rectangles, bitmaps, etc.). The Explorer window is used for displaying the contents of maps in the Maps window and for switching between user views. Besides, the Explorer window is used also for configuring and monitoring the object status and alarm propagation. This section describes the principle of monitoring active alarms and object statuses in the Maps and Explorer windows. 8.1 Viewing Contents of Maps in Maps Window 1. To enable the Graphics view, select the Graphics entry from the toolbar dropdown menu (Figure 56). Figure 56: Selecting a map view 2. Open the map that contains the object(s) you want to monitor by expanding the hierarchical map tree in the Explorer window (View / Explorer), selecting the relevant map and choosing the Open pop-up command (Figure 47). 3. A new tab opens in the Maps window, displaying the icons representing the objects (and submaps if any) contained in the selected map. The new tab carries the name of the opened map (e.g., Basement). 73

74 Monitoring Alarms and Status of Managed Objects in Maps and Explorer Windows Tip: By following the above procedure you can open as many new tabs in the Maps window as there are maps in the Explorer window; each tab will display the contents of one map. Figure 57: Adjusting the zoom level 4. If necessary, adjust the map view magnification from the Zoom drop-down list (Figure 57) to match your preferences. Figure 58: Viewing the contents of a map in the Maps window Graphics view 74

75 Monitoring Alarms and Status of Managed Objects in Maps and Explorer Windows 5. In the Graphics view, different types of icons are used for representing different types and classes of objects (e.g., router, switch, server, mail object, submap, etc). Furthermore, the icon colors reveal the current status of the object it represents. Additionally, information about active alarms is provided by alarm balloons displayed above the icons and by alarm rectangles displayed on the icons that represent objects and submaps. For more details, please refer to the Information Provided by Icons Displayed in Maps Window - Graphics View section. 6. To view the map contents in Details view, select the Details entry from the toolbar drop-down menu (Figure 56). Figure 59: Viewing the contents of a map in the Maps window Details view 7. The Details view (Figure 59) displays a list of all objects and submaps on the selected map. Each object is listed in a separate row. The following columns let you monitor the status and active alarms on the listed objects: Status Displays the current status of the object. In case of a submap, this field displays the most critical status of the object(s) included in the submap. Alarms Displays the total number of active alarms on the object or the total number of active alarms on all objects in the submap (in case of a submap). This field reflects the color of the most severe active alarm that currently exists on the object, according to the alarm severity colors configured in the User Preferences dialog box, Color panel. In case of a submap, this field reflects color that matches the color of the most severe alarm that exists on the objects within the given submap. New Alarms - Displays the number of new alarms on the object or the number of new active alarms on all objects in the submap (in case of a submap). New alarms are active alarms, which are not acknowledged. The New Alarms field reflects the color of the most severe new alarm that currently exists on the object, according to the alarm severity colors configured in the User Preferences dialog box, Color panel. In case of a submap, this field reflects color that matches the color of the most severe new alarm that exists on the objects within the given submap. State - Displays a graphic symbol (circle) whose color indicates the current operability state of the SNMP agent on the managed object (this property is shown only for the managed objects). The following operability states and colors are used: operability state: Disabled color: grey 75

76 Monitoring Alarms and Status of Managed Objects in Maps and Explorer Windows Enabled Unavailable Testing green red blue Tip: For description of other columns displayed in the Details view, please consult the Maps Window section of the Net Inspector Client Reference Manual. 8. To open the Properties window and view the properties of the selected object (including all active alarms associated with the object), select the object and chose the Properties pop-up command. 9. To query a managed object to determine if it responds to Ping (ICMP Echo) and SNMP requests, select it in the Maps window and choose the Tools / Ping or Tools / SNMP Ping pop-up command. This open the Ping and SNMP Console dialog box and displays the query results in it. For more information about the Ping and SNMP Console dialog box, please see the Net Inspector Client Reference Manual. Tip 1: For more information on viewing and acknowledging alarms in the Events window, please refer to the Viewing Alarms for All Objects section of this manual. Tip 2: To remove a tab from the Maps window, right click the tab symbol in the Maps window and select the Close [tab name] pop-up command Viewing Link Status and Utilization In the Graphics view you can view the current link status (up or down) and traffic (interface in/out bitrate and utilization). If this option is enabled, the thickness and color of connection lines automatically changes, visualizing the current status, bitrate and utilization of connection links. The width of a connection line automatically increases with increasing connection data throughput (bitrate) and its color automatically changes from black to pale red with increasing link utilization. If a link is down, the color of the connection line is pure red. The link status, bitrate and utilization is shown only for connections between objects that support SNMP MIB-II Interfaces table and for which the endpoint interfaces are known. Displaying link status and traffic can also be enabled or disabled by enabling or disabling the Interface nodes option available in the Graphics toolbar. 1. If a map is currently not displayed in the Graphics mode, select the Graphics entry from the toolbar drop-down menu (Figure 56) to enable the Graphics view. 2. In the Graphics toolbar, check the Interfaces nodes checkbox to enable displaying the interface nodes and connection status and traffic. To enable displaying current bitrates and link utilization rates in connection labels, check also the Connection labels checkbox in the Graphics toolbar (Figure 60). Figure 60: Enabling options to display connection labels and traffic 76

77 Monitoring Alarms and Status of Managed Objects in Maps and Explorer Windows 3. The width of connection lines will indicate the current data throughput (the higher bitrate, the thicker line) and the color of connection lines will indicate the current link utilization (black low utilization, brown moderate utilization, orange medium utilization, pale red high utilization). If a link is down, the color of the connection line is pure red. (Figure 61). Figure 61: Connection lines and labels provide information about the current network traffic Viewing Device Performance Tooltips In the Graphics view you can view the latest device performance information in a tooltip that is displayed if you hover the mouse over a managed object icon. Optionally, you can pin a tooltip and place it to the desired position on the screen, so it remains visible all the time. 1. If a map is currently not displayed in the Graphics mode, select the Graphics entry from the toolbar drop-down menu (Figure 56) to enable the Graphics view. 1. In the Graphics toolbar, check the Enable tooltips checkbox to enable displaying the device performance tooltips. 2. Place a mouse pointer over a managed object icon (without clicking) to see its main properties and current (last retrieved) device performance information in a tooltip (Figure 62). 77

78 Monitoring Alarms and Status of Managed Objects in Maps and Explorer Windows Figure 62: Viewing the device performance tooltip Tooltips provide the following information (depending on whether a device supports this type of parameters and whether polling of this type of parameters is enabled): Name The name of the managed object (device) Object ID - Displays the unique identification code of the managed object within the Net Inspector system. Address - The IP address or host name of the managed object. Type, Class - The type and class of the object. Interfaces - The name, IP address, current status and inbound and outbound utilization rates of monitored network interfaces. CPU The number of CPU cores and the average CPU load. Storage Information about device storage units and their usage (including disk units and memory). Active Alarms - The list of active alarms (if ay) on the object and their properties (severity, date/time, messages, etc.). 78

79 Monitoring Alarms and Status of Managed Objects in Maps and Explorer Windows 3. Click the tooltip titlebar showing the pin symbol ( ) to transform the tooltip into a window and pin it to the desktop. You can resize and move the pinned window to the desired position on the screen (e.g., to monitor device performance parameters and alarms in it). The content of the pinned tooltip window is automatically refreshed when new information is available. Tip: You can have several pinned tooltip windows open at the same time. Figure 63: A pinned device performance tooltip window 4. To close the pinned tooltip window, click the Close (X) button in the upper right section of the tooltip window. 79

80 Monitoring Alarms and Status of Managed Objects in Maps and Explorer Windows Information Provided by Icons Displayed in Maps Window - Graphics View The Graphics view in the Maps window displays the contents of maps by means of icons that represent managed objects, action objects, system objects, alarm panels and submaps. Types of Objects This section describes the built-in object types. In addition, new object types can be defined by users with administrator access rights in the Server Settings dialog box, Object Types panel. a) The following icons are used to represent managed objects (devices): IP workstation (generic IP device) IP switch IP router IP server IP database IP firewall IP equipment IP transmitter IP printer 80

81 Monitoring Alarms and Status of Managed Objects in Maps and Explorer Windows b) The following icons are used to represent different types of action objects: MAIL (mail object) CMD (command object) SMS (SMS object) The action objects represent actions (e.g., sending, SMS sending, command execution) that are carried out by Net Inspector when events are triggered in order to notify users of events/alarms or to fix the detected network problem in an automated fashion. Action objects can be placed onto maps and monitored in the same way as managed objects. Although being primarily used for notifying users about alarms associated with managed objects, action objects themselves trigger alarms when they fail to perform the designated action (e.g., send an e mail). Furthermore, the status of the action object changes if any critical fault occurs while performing the action operation. c) The following icons are used to represent different types of system objects (Net Inspector subsystems): SYS_CONFIG (configuration object) SYS_SNMP_NOTIF (SNMP notification object) SYS_EVENT (event object) SYS_PERF_MNG (performance manager object) The system objects represent different parts of Net Inspector system. System objects can be placed onto maps and monitored in the same way as managed objects. System objects trigger alarms when there are problems with the Net Inspector subsystems they represent. Furthermore, the status of system objects changes if any critical faults associated with the corresponding subsystems occur. This principle lets you monitor the health of both, the network and the management system in the same manner. d) The following icon is used to represent a map (submap): Map (submap) 81

82 Monitoring Alarms and Status of Managed Objects in Maps and Explorer Windows e) The cloud symbol is used to represent an unknown device (e.g., hub, unmanaged switch, etc.) or part of the network. Cloud symbols are added to the workspace by the Net Inspector discovery module or manually by using the graphics toolbar. Cloud (unknown device or part of the network) Status of Objects The background color of an object icon indicates the status of that object (device, action functionality, Net Inspector subsystem). The following table shows the default object status colors, object statuses and their meanings (statuses are ordered from least to most critical): Default Icon Background Color (blue) (light blue) (green) (orange) Object Status unmanaged indeterminate normal major Meaning (M=managed object, A=action object, S=system object) M A S M A S M A S M A S Device is not being managed (polling is disabled). Action operation (e.g., sending) is disabled. Net Inspector subsystem (e.g. configuration module 3) is disabled. Device is being managed (polling is enabled) but information about device reachability is currently unavailable (e.g., immediately after enabling polling or after loosing the connection with polling engine). Not applicable. Not applicable. Device is being managed (polling is enabled) and it is responding to Net Inspector queries. Action operation (e.g., sending) is enabled and it functions normally (no critical faults exist). Net Inspector subsystem (e.g. event storage subsystem) is enabled and performs its function successfully (no critical faults exist). Device is being managed (polling is enabled), but it is not responding to Net Inspector SNMP queries. Not applicable. Not applicable. 82

83 Monitoring Alarms and Status of Managed Objects in Maps and Explorer Windows (red) critical M A S Device is being managed (polling is enabled), but it is not responding to Net Inspector queries. Action operation (e.g., sending) is enabled, but it fails to perform its function due to at least one critical fault. Net Inspector subsystem (e.g. event storage subsystem) is enabled, but it fails to perform its function due to at least one critical fault. By default, the background of the map icon reflects the color of the most critical status that can be found among the objects in the given map and all its submaps. Tip: Object status colors can be configured in the User Preferences dialog box, Color panel. New Alarms Alarm Balloons Dynamical Nature of Alarm Balloons Small graphic symbols called alarm balloons ( )dynamically appear and disappear above the icons that represent managed objects, action objects, system objects, alarm panels and (sub)maps (if objects are not disabled). An alarm balloon appears above an object icon when at least one new alarm (i.e., active alarm that is not acknowledged) exists on that object, and disappears when all alarms associated with the object are acknowledged or cleared. Similarly, an alarm balloon appears above the submap icon if at least one new alarm exists on the objects within that submap or any of its submaps (if alarm propagation is not disabled), and such alarm balloon disappears when all alarms on those objects are acknowledged or cleared. Displaying the Number of New Alarms The alarm balloon above the object icon displays the number of new alarms that currently exist on that object. The alarm balloon above the submap icon displays the number of new alarms that currently exist on the objects within that submap (note that the alarm numbers are propagated only one hierarchical level higher, while alarm colors are propagated up to the top-level submaps of the user view). Reflecting the Severity of New Alarms An alarm balloon automatically changes its color to match the color of the most severe new alarm that currently exists on the object. In case of a submap, the alarm balloon reflects the color of the most severe new alarm that exists on the objects within the given map branch (i.e., in the given map and its submaps). The alarm severity levels and their default colors - and thus also the default colors of alarm balloons are: 83

84 Monitoring Alarms and Status of Managed Objects in Maps and Explorer Windows The alarm severity levels, their symbols and default colors (listed from least to most severe) Tip: Alarm severity colors can be configured in the User Preferences dialog box, Color panel. All Active Alarms Alarm Rectangles Dynamical Nature of Alarm Rectangles Small rectangles ( ) displayed in the lower-right section of object and submap icons indicate the number (and severity level) of all active alarms on the given object or on the objects within the given submap. As alarm balloons, rectangles that indicate the total number of active alarms also dynamically appear and disappear (when objects are enabled). A rectangle symbol appears in the lower-right section of the object icon when at least one active alarm exists on that object, and disappears when no more active alarms exist on that object (i.e., when all alarms are cleared). Similarly, a rectangle appears on the submap icon if at least one active alarm exists on the objects within that submap or any of its submaps (if alarm propagation is not disabled), and such alarm balloon disappears when no more active alarms exist on those objects. Displaying the Total Number of Active Alarms The alarm rectangle on the object icon displays the total number of active alarms that currently exist on that object. The alarm rectangle on the submap icon displays the total number of active alarms that currently exist on the objects within that submap (note that the alarm numbers are propagated only one hierarchical level higher, while alarm colors are propagated up to the top-level submaps of the user view). Reflecting the Severity of Active Alarms The alarm rectangle on the object icon automatically changes its color to match the color of the most severe alarm that currently exists on that object. The alarm rectangle on the submap icon reflects the color of the most severe alarm that exists on the objects within the given submap and all its submaps. The picture above displays the alarm severity levels and their default colors. 84

85 Monitoring Alarms and Status of Managed Objects in Maps and Explorer Windows Example Let us suppose that 2 active alarms concurrently exist on the managed object. The severity levels of these alarms are Major and Critical. The critical alarm has been acknowledged by the network operator, while the major alarm has not been acknowledged yet. In such case, the alarm balloon will indicate the number 1 (as there is one non-acknowledged alarm associated with the object) and reflect the color assigned to the Major severity level (i.e., orange, by default, as shown in the picture on the left). The alarm rectangle, on the other hand, will show the total number of active alarms (2) and reflect the color of the critical alarm (i.e., red, by default). Note also that the icon background in the picture on the left reflects the red color, indicating that the status of this managed object is Critical (according to the default color settings). 85

86 Monitoring Alarms and Status of Managed Objects in Maps and Explorer Windows 8.2 Monitoring Propagated Alarms and Statuses in Explorer Window The colors of map icons in the Explorer window dynamically change to indicate the current status of objects and alarms on objects within those maps and their submaps. By default, the most critical object status and active alarm is propagated upward the hierarchical map branch for all objects and submaps. Users with administrator access rights can configure (enable or disable) the propagation for individual objects in the (sub)map Properties windows. Object Status Propagation If the propagation is not disabled, a map icon in the Map Explorer window reflects different colors to indicate the current status of objects included in the map and its submaps (i.e., in the given map branch). Colors reflected by map icons can be configured in the User Preferences dialog box, Colors panel. By default, map icons reflect the following colors: - the map contains no managed or system objects - the status of all objects in the given map and its submaps is unmanaged (polling is disabled) - the most critical object status in the given map and its submaps is informational (this is an intermediate status shown immediately after enabling object polling) - the most critical object status in the given map and its submaps is normal (note that such maps may contain also unmanaged objects) - the most critical status of the objects in the given map and its submaps is major (status of at least one object in the given map branch is major ) - the most critical status of the objects in the given map and its submaps is critical (status of at least one object in the given map branch is critical ) Note that map icons always reflect the most critical status, for example, if a map contains objects having the status of normal and critical, the map will reflect the color assigned to the critical status (which is red, by default). Alarm Propagation A map icon also indicates the most critical new alarm (i.e., active alarm that is not acknowledged) that exists on the objects within the given map and its submaps. This is achieved by displaying the alarm severity level icon on top of the map icon, for example: Severity level of the most critical new alarm on the objects within this map and its submaps is Warning Severity level of the most critical new alarm on the objects within this map and its submaps is Major Severity level of the most critical new alarm on the objects within this map and its submaps is Critical 86

87 Monitoring Alarms and Status of Managed Objects in Maps and Explorer Windows Propagation Example 1. If the Explorer window is not displayed, select the View / Explorer command or click the Explorer toolbar button to display it (Figure 64). Net Inspector Server name active user view hierarchical map structure within the user view inactive user views Figure 64: Example of the Explorer window contents 2. The Explorer window opens and displays all user views assigned to the user and the hierarchical tree-like structures of maps and submaps within these user views. Maps contain zero or more managed objects, system objects and submaps. In the example above, the Critical status of the object and Critical alarm is propagated from the Basement map to the Building 1 map to the Subnet 1 map. Tip 1: To view the contents of a map, select it in the Explorer window and use the Open pop-up command. This will open a new tab in the Maps window and display the contents of the selected map in it. Tip 2: To switch to another user view, select an inactive user view in the Explorer window and use the Open pop-up command. This will close the current user view and open (activate) the selected one. 87

88 Viewing Properties of Managed Objects 9 VIEWING PROPERTIES OF MANAGED OBJECTS This section describes how to view the properties of managed objects, i.e., the basic information about the object, its current status, active alarms associated with the managed object, polling and SNMP configuration settings, information about object network interfaces, system resources, etc. In Net Inspector LITE Edition, all this information can be viewed in the managed object s Properties window. In other editions of Net Inspector (which integrate MG-SOFT Performance Manager application), the information about object network interfaces, system resources, and monitored services are not displayed in the managed object s Properties window. Instead, a more detailed device performance statistics with full history of collected data are displayed in the Performance Statistics window. 9.1 Opening the Properties Window 1. Open the map that contains the managed object(s) you want to view the properties of by expanding the hierarchical map tree in the Explorer window (View / Explorer), selecting the relevant map and choosing the Open pop-up command (Figure 47). 2. A new tab opens in the Maps window, displaying the managed objects (and submaps if any) contained in the selected map. 3. To open the Properties window and view the properties of the selected managed object (including all active alarms associated with the managed object), select a managed object and chose the Properties pop-up command. 4. The Properties window appears, displaying the General view (Figure 65). Figure 65: Properties window General view 88

89 Viewing Properties of Managed Objects 9.2 About the Properties window The Properties window contains several views, displaying different categories of parameters (e.g., General, Settings, System, ). Users can switch between views, by selecting the corresponding entries from the category drop-down list displayed in the upper section of the Properties window. Note that some of the entries displayed in the category drop-down list are static (i.e., always displayed), while others are dynamic, i.e., they are displayed only if the managed object provides information from the respective category and only if Net Inspector Server is used for polling these managed objects. Note If polling is performed by a Performance Manager polling engine (e.g., when using MG-SOFT Net Inspector WorkGroup or Enterprise Edition), the dynamic entries are not displayed in the managed object s Properties window. Instead, the corresponding interface, services and device resource usage statistics are displayed in the Performance Statistics window. The following entries (and views) in the Properties window are static: General (object name, address, description, list of active alarms, etc.) System (object type, class, location, vendor, OS, etc.) Settings (assigned polling and SNMP profiles, resynchronization configuration) Services (monitored TCP and UDP services) in Net Inspector LITE Edition only If the managed object supports SNMP protocol, the following dynamic entries may appear in the category drop-down list of the Properties window (depending on the MIB modules supported by the SNMP agent on the given device and the polling profile and polling engine assigned to the corresponding managed object): Interfaces (information about system network interfaces) Resources (information about the system resources) Storage (information about the system storage units) The Properties window status bar displays the following object properties (from left to right): The icon and name of the object, The node ID, i.e., the identification number of the device that has been assigned to it by the user (according to the user s classification system) The ID of the object, i.e., the unique identification code of the object within the Net Inspector system, The current status of the managed object General View The General view of the Properties window provides the following information (Figure 65): Name (input line) Displays and lets you edit the name of the managed object. By default, this is the host name of the managed object. 89

90 Viewing Properties of Managed Objects Type (input line) Displays the type of the managed object (e.g., IP). Address (input line) Displays and lets you edit the IP address or the host name of the managed object. Description (input line) Displays and lets you edit a short description of the managed object. Net Inspector discovery operation enters the value of the sysdescr.0 object instance returned by the SNMP agent into this input line. Polling Engine (drop-down list) Displays and lets you lets you select the polling engine used for polling the given device. This is useful when MG-SOFT Performance Manager application is installed and integrated with MG-SOFT Net Inspector application (multiple polling engines can be deployed across the network in such configuration). If you select a Performance Manager polling engine in this drop-down list, additional performance statistics about the given device will be available via the Show Performance Statistics command. If the option Built-in engine is selected, then the given device is polled by Net Inspector Server and no performance history data is available for it. Note: This drop-down list is enabled only when using Net Inspector Workgroup or Enterprise Edition, which include the Performance Management functionalities. NetFlow source (checkbox) Sets the selected managed object as a NetFlow source device, i.e., a device that sends NetFlow v5 or v9 packets or sflow v5 packets to Net Inspector (this must be first configured on the given device (e.g., a router) using vendor-specific methods). Net Inspector WorkGroup and Enterprise Editions incorporate a NetFlow collector and analyzer software module that receives NetFlow packets from source devices and provide NetFlow traffic statistics in the Polling Engine Home Page window, NetFlow page. Active alarms (frame) Displays the object alarm summary (the total number of active alarms and number of active alarms broken down by severity levels) and a list of active alarms on the given object (same as in the Events window) System View To switch to the System view, select the System entry from the category drop-down list (Figure 65). The System view provides the following information (Figure 66): Type (input line) Displays the type of the managed object (IP). Class (input line) Displays the class of the managed object. Tags (input line) and Edit (button) Displays and lets you add a tag (user description) to the managed object. Objects can be searched by the value of their tags. 90

91 Viewing Properties of Managed Objects Location (input line) The physical location of the managed object. Net Inspector discovery operation sets this value to the value of the syslocation.0 object instance returned by the SNMP agent. Vendor (input line) The vendor of the managed object. Net Inspector discovery operation sets this value to the name of the enterprise responsible for the OID returned by the sysobjectid.0 object instance. The enterprise names displayed are taken from the list of private numbers as registered with IANA and stored on the Net Inspector Server (//Engine/data/nienterprise.txt). Figure 66: Properties window System view OS (input line) The operating system running on the managed object. URL (input line) and Open (button) The URL (uniform resource locator) address, e.g., which provides additional information about the managed object (e.g., Icon (input line) The name of the icon used for representing the managed object (as configured in the Manage Object Typed window). Geographic coordinates (frame) The geographic coordinates that specify the physical location of the managed object. The geographic coordinates are compatible with the Google TM Maps coordinates. 91

92 Viewing Properties of Managed Objects X (input line) Specifies the geographic coordinate projected on the X-axis. Y (input line) Specifies the geographic coordinate projected on the Y-axis. Z (input line) Specifies the geographic coordinate projected on the Z-axis Settings View To switch to the Settings view, select the Settings entry from the category drop-down list (Figure 65). The Settings view provides the following information (Figure 67): Polling profile This drop-down list displays the name of polling profile assigned to the managed object. A polling profile contains a set of parameters for polling managed objects via ICMP and SNMP protocols. Users with administrator access rights can assign a different polling profile to the managed object by selecting its name from this dropdown list. SNMP access profile This drop-down list displays the name of the SNMP access profile assigned to the managed object. An SNMP access profile contains a set of parameters for accessing SNMP agents on managed objects. Users with administrator access rights can assign a different SNMP access profile to the managed object by selecting its name from this drop-down list Resynchronization (frame) Figure 67: Properties window Settings view The Resynchronization frame is available only if the managed object is of type IP. The settings in this frame control how the event resynchronization is performed (Command) with the given object and how Net Inspector monitors whether the events are synchronized or not for the given object (e.g., third-party device). These settings 92

93 Viewing Properties of Managed Objects are used for synchronizing the events with arbitrary third-party SNMP agents that support event resynchronization. Command (input line) Specifies the command that triggers the resynchronization of events with a thirdparty SNMP agent. Enterprise OID (input line) Specifies the enterprise OID associated with the SNMP notification (i.e., the value of the Enterprise field in SNMPv1 Trap messages or the value of the snmptrapenterprise.0 variable binding in SNMPv2 and SNMPv3 Trap and Inform messages). Each SNMP notification message that reports an event on the managed object must contain the specified enterprise OID in order for it to be accepted by Net Inspector as event. Trap count binding (input line) Specifies which variable binding in the variable bindings list (e.g., binding nr. 3 or 4 or 5 ) of the SNMP notification message reports the current event count (i.e., the number of events on the given managed object). Net Inspector Server checks the continuity of this counter in every received SNMP notification message reporting events to determine if its list of events is synchronized with the list of events maintained internally by the managed object. If a difference in the trap count value is detected, Net Inspector executes the above configured resynchronization command Services View The Services view is displayed only in the LITE Edition of Net Inspector. In other editions of Net Inspector, the services statistics are displayed in the Performance Statistics window. The Services view allows users with administrator access rights to scan the wellknown ports on the device for supported TCP and UDP network services. These services include HTTP, HTTPS, FTP, DNS, SMTP, IMAP, IMAPS, POP3, SSH, Telnet, NNTP, NNTPS, SIP, H.323, LDAP, LDAPS, IPP, LPD, MsSQL, MySQL and Oracle services. Users with administrator access rights can also select which of the detected network services will be monitored on the given device, as well as configure and enable monitoring of custom, user-defined services. Once configured, the Services view displays the status of monitored services (i.e., whether the services are accessible or not). To switch to the Services view, select the Services entry from the category drop-down list (Figure 65). The Services view provides the following information (Figure 68): The Services view displays the Services list providing information about network services on the managed object in the following columns (note that this list is empty by default): Note: Services will be monitored only if services monitoring is enabled in the polling profile assigned to the given managed object. How frequently the information displayed in this view is updated depends on the polling interval (Poll every X seconds) set in the polling profile. 93

94 Viewing Properties of Managed Objects Monitoring State (checkbox) A check mark in this checkbox indicates that the given service is being monitored. Name Displays the name of the service. Figure 68: Properties window Services view Status Displays the service status, which can be one of the following: Unmanaged - monitoring is disabled Informational - monitoring is enabled and the first query is in progress (immediately after enabling the service monitoring) Normal - monitoring is enabled and the service is accessible Critical - monitoring is enabled and the service is not accessible Port Displays the port number on which the service listens to for incoming connections. Protocol Displays the transport protocol used by the service (TCP or UDP) Interfaces View The Interfaces view is displayed only if the SNMP agent on the managed object returns information provided by the MIB-II interfaces group of objects. Note: How frequently the information displayed in this view is updated depends on the polling interval set in the polling profile assigned to the given managed object. 94

95 Viewing Properties of Managed Objects To switch to the Interfaces view, select the Interfaces entry from the category dropdown list (Figure 65). The Interfaces view provides the following information (Figure 69): Figure 69: Properties window Interfaces view By default, the Interfaces view lists all network interfaces on the managed object and displays the following columns: Interface Displays the name of the interface as reported by the SNMP agent. Status Displays the status of the interface as reported by the SNMP agent. In Util Displays the inbound utilization rate of the interface (as reported by the SNMP agent). Out Util Displays the outbound utilization rate of the interface (as reported by the SNMP agent). Additional information about interfaces (in additional columns) can be displayed in this view by selecting entries from the column selector displayed above the vertical scrollbar of this view. For the meaning of these columns, please see the description of columnar objects in the iftable (RFC1213-MIB). 95

96 Viewing Properties of Managed Objects Resources View The Resources view is displayed only if the SNMP agent on the managed object supports the HOST-RESOURCES-MIB module and provides this MIB information via SNMP. Note: How frequently the information displayed in this view is updated depends on the polling interval set in the polling profile assigned to the given managed object. To switch to the Resources view, select the Resources entry from the category dropdown list (Figure 65). The Resources view provides the following information (Figure 70): Figure 70: Properties window Resources view Info (frame) This frame displays information about the available memory, used memory, number of processes and users on the system, as reported by the SNMP agent. Besides, the memory usage (in %) is displayed in a linear gauge chart. Processor (frame) Displays the CPU load (in %) for all processors in the system (as reported by the SNMP agent) Storage View The Storage view is displayed only if the SNMP agent on the managed object supports the HOST-RESOURCES-MIB module and provides this MIB information via SNMP. Note: How frequently the information displayed in this view is updated depends on the polling interval set in the polling profile assigned to the given managed object. 96

97 Viewing Properties of Managed Objects To switch to the Storage view, select the Storage entry from the category drop-down list (Figure 65). The Storage view displays the following information (Figure 71): Hide removable storages (checkbox) If this checkbox is checked, the information about removable storage units (e.g., floppy drives, optical drives, etc.) is not displayed. Storages (frame) Displays all data storage units on the system (e.g., disk partition, virtual memory, physical memory, etc.), capacities of these storage units and their current usage. Usage of storage units (in %) is depicted also in 3-D pie charts in the right section of the view. Figure 71: Properties window Storage view 97

98 Viewing Properties of Managed Objects 9.3 Viewing Device Performance Data in the Performance Statistics Window In Net Inspector WorkGroup and Enterprise Edition (which integrate the Performance Manager functionality) managed objects are polled by a Performance Manager polling engine by default (as opposed to the Net Inspector LITE Edition, where polling is performed by the Net Inspector Server itself). In such configuration, the performance statistics of managed objects are not displayed in the device Properties window. Instead, you can view more detailed device performance statistics with history in the Performance Statistics window, as described in this section. Note: The Performance Statistics window is accessible only if MG-SOFT Performance Manager is installed and integrated with MG-SOFT Net Inspector application (i.e., in Net Inspector WorkGroup and Enterprise Edition). 1. Open the map that contains the managed object(s) you want to view the properties of by expanding the hierarchical map tree in the Explorer window (View / Explorer), selecting the relevant map and choosing the Open pop-up command (Figure 47). 2. A new tab opens in the Maps window, displaying the managed objects (and submaps if any) contained in the selected map. 3. To open the Performance Statistics window and view the performance data of the selected managed object, select a managed object and choose the Show Performance Statistics pop-up command (Figure 72). Figure 72: Opening Performance Statistics window for the selected device 98

99 Viewing Properties of Managed Objects 4. The Performance Statistics window appears (Figure 73). Figure 73: Viewing device performance statistics The Performance Statistics window is a Java-based web browser used for viewing the performance web page for the selected managed object directly in Net Inspector application. The device performance web page is generated by the Performance Manager polling engine that polls that device (when MG-SOFT Performance Manager and MG-SOFT Net Inspector applications are integrated). The device performance web pages include the following statistics (current data and history): device response time and packet loss rate and for SNMP devices (depending on the type) also network interface statistics, resources utilization statistics, running processes statistics, running services statistics, Cisco VoIP statistics, etc. To view more detailed graphs and tables for any monitored metric, click on its graph/chart in the device performance page. For more information about device performance web pages, please consult the Net Inspector Performance Manager User Manual, section Viewing Device Performance Data. 99

100 Viewing Charts 10 VIEWING CHARTS Net Inspector lets you monitor values of some important numerical variables (e.g., CPU load, memory usage, storage utilization, interface utilization, etc.) collected from one or more devices in charts. Charts display lines that show how the values of selected variables change over time. Charts are configured by administrators and maintained by the Net Inspector Server. Network operators can connect to Net Inspector Server and view pre-configured charts in Net Inspector Client. This document describes only how to view charts containing data collected by Net Inspector Server itself (built-in polling engine). For devices that are polled by Net Inspector Performance Manager polling engines, more detailed performance graphs are available. For details about the latter, please consult the Net Inspector Performance Manager User Manual, section Viewing Device Performance Data. 1. Select the Tools / Server Settings command and click on the Chart Panel to view the list of the existing charts (Figure 74). Figure 74: Selecting a chart from the Chart Panel dialog box 2. Select the chart you want to view in the Chart Panel and click the Open button. 3. A new tab opens in the Maps window, displaying the selected chart (Figure 75). 4. The graph lines show how the values (Y-axis) collected from the managed object(s) changes in time (X-axis). The chart is automatically updated when the new values are retrieved. How frequently the chart is updated depends on the polling interval set in the polling profile assigned to the source objects. 5. See the graph legend displayed at the bottom of the chart, showing the colors of graph lines and accompanying objects (in square brackets) from which the values are being retrieved as well as the names of variables. The units in which variables are displayed are shown in brackets on the vertical axis. 100

101 Viewing Charts 6. To see individual retrieved values depicted as scatter marks along the graph line, right-click inside the chart tab and select the Show Point pop-up command. Place your mouse pointer over a scatter mark to see its details (Figure 75), i.e., the managed object the value was retrieved from (in brackets), the variable name (e.g., CPU1), the date and time of retrieving the value, and the value itself (e.g., 51). 7. If present, use the horizontal scrollbar at the bottom of the chart, to move along the time line (X-axis). 8. Use your mouse wheel to zoom in and out of the chart. To view the entire chart, right-click inside the chart tab and select the Fit to Page pop-up command. 9. To view the chart properties (a list of source objects, monitored variables, etc.), select the Properties pop-up command that opens the chart properties dialog box. Figure 75: Viewing a chart 10. To open and view another chart, repeat the procedure described in step 2. To close the Chart Panel dialog box, click the Close button at the bottom of this dialog. This will not close the charts displayed in the Maps window. 11. To remove the chart tab from the Maps window, right click the tab symbol in the Maps window and select the Close pop-up command (Figure 76). Figure 76: Closing a chart 101

102 Appendix: About Users, Access Rights and User Views 11 APPENDIX: ABOUT USERS, ACCESS RIGHTS AND USER VIEWS Each Net Inspector user account has certain access-rights assigned. User accounts have also one or more user views assigned. User views differ in respect to what objects they include (display). The table below shows the user account types, corresponding access rights and user views: Account type Access rights User View (Typical) Administrator unlimited unlimited (includes all objects) Operator limited to managing alarms limited to a part of the network Guest limited to monitoring (viewing) alarms limited to a part of the network For more information about user accounts and user views, please consult the Net Inspector Client Reference Manual. 102