AdRem NetCrunch. Premium and Premium XE Editions. User s Guide. Version 6.x. Network Monitoring & Management System

Transcription

1 AdRem NetCrunch Version 6.x Premium and Premium XE Editions User s Guide Network Monitoring & Management System

2 2010 AdRem Software, Inc. This document is written by AdRem Software and represents the views and opinions of AdRem Software regarding its content, as of the date the document was issued. The information contained in this document is subject to change without notice. ADREM SOFTWARE MAKES NO WARRANTS, EITHER EXPRESS OR IMPLIED, IN THIS DOCUMENT. AdRem Software encourages the reader to evaluate all products personally. AdRem Software and AdRem NetCrunch are trademarks or registered trademarks of AdRem Software in the United States and other countries. All other product and brand names are trademarks or registered trademarks of their respective owners. AdRem Software, Inc. 410 Park Avenue, 15th Floor New York, NY USA Phone: +1 (212) Fax: +1 (212) Web site:

3 Table of Contents TABLE OF CONTENTS... 3 INTRODUCTION OVERVIEW NETCRUNCH 6 ARCHITECTURE MAIN GOALS Network Presentation Monitoring Policies Alerting Reporting MONITORING THE NETWORK Basics Concepts Active Monitoring Smart Monitoring Limiting Monitoring Traffic Setting Network Dependencies Selective Down Nodes Monitoring Event Suppression Mechanism Network Service Monitoring Priorities Performance Monitoring BROWSING THE NETWORK Network Representation Nodes Maps Logical IP Network Physical Segment Dynamic View Static View Charts NETCRUNCH ADMINISTRATION CONSOLE DESCRIPTION MAIN TOOLBAR STATUS BAR NETWORK ATLAS Favorite Maps Atlas Maps MAIN WINDOW Map Window Views Atlas Dashboard Map View Summary View Monitoring View Inventory View EVENT LOG WINDOW

4 AdRem NetCrunch 6.x Premium NODE STATUS WINDOW Opening Node Status Window for Many Nodes Summary Network Services Status Network Service Performance History Network Interfaces Windows Services Performance Counters Node Relationships SETTING MONITORING TRAFFIC LIMIT FINDING A NODE BROWSING LOGS MANAGING NETWORK ATLAS ADDING NETWORKS Adding New Network ATLAS OPERATIONS Creating Maps Custom Map Dynamic View Map Creating Traceroute Map Deleting Map Renaming Map Moving Map Copying Map Exporting/Importing View Rescanning Map Recreating Routing Map Creating Groups on Routing Map Map Folder Adding New Folder Moving Folder Deleting Folder Renaming Folder ADDING AND REMOVING NODES ADDING NODES FROM FILE ENABLING/DISABLING ATLAS MONITORING TRACKING NETWORK STRUCTURE CHANGES MAINTENANCE Exporting Atlas Importing Atlas Exporting SNMP MIB Information Performing Atlas Backup Restoring Atlas WEB ACCESS PROPERTIES MANAGING NODE PROPERTIES

5 Table of Contents Type Properties TCP/IP Properties SNMP Management Properties Web Access Properties Notes Properties NODE MONITORING General Options Disabling Node Monitoring Monitoring Time Changing Monitoring Policy Membership of a Node Setting Monitoring Time Range Setting Node Dependency Changing Monitoring Type Selecting Leading Network Service and Checking Time Excluding From Monitoring Optimization Monitoring Network Services Advanced Options Setting Network Services Monitoring Priority Suppression of Node Service Events Excluding Event Suppression Enabling Monitors Automatically by Policy Windows Performance Monitoring Enabling Monitoring Changing Monitoring Time Specifying Login Information Enabling Windows Services Monitoring Changing Monitoring of Windows Event Log Defining Connection Share Inventory Monitoring Enabling/Disabling Inventory Monitoring Changing Inventory Settings NetWare Performance Monitoring Enabling Monitoring Changing Monitoring Time Managing edirectory Tree Credentials SNMP Performance Monitoring Enabling Monitoring Changing Monitoring Time Linux Performance Monitoring Mac OS X Performance Monitoring BSD Performance Monitoring ESX Server and Virtual Machines Performance Monitoring Selecting Primary Interface INVENTORY INFORMATION OF WINDOWS NODES General Tab Hardware Tab Operating System Tab

6 AdRem NetCrunch 6.x Premium Hotfixes Tab Software Tab Change Log Tab Finding Inventory Information Comparing Inventory Information MANAGING MAP PROPERTIES General IP Networks Maps Custom View Maps Changing the Map Type Changing Filtering Criteria Excluded Nodes Network Auto Discovery Map Appearance Auto Arrangement Sharing Custom Layout of a Map Web Access Properties OPERATING ON MAPS Inserting Node Inserting Node to IP Networks Map Inserting a Node to Custom Views Map Inserting Node from File Inserting Layer 2 Device Static Bridge Configuration Displaying Port Mapping Inserting a Link to Another Map Deleting Nodes Copying Node to Map Arranging Nodes Finding out Which Maps the Node Belongs To Finding out Which Policies the Node Belongs To Managing Node Notes EDITING MAPS Enabling Editing Mode Repositioning Objects Aligning Objects Changing Background Selecting Objects Single Selection Multi-Selection Inserting Graphical Objects Shape Picture Text Inserting Shape

7 Table of Contents Copying Map Objects Connecting Objects Modifying Object Properties Deleting Map Objects USING EVENT LOG EVENT LOG WINDOW EVENT LOG TOOLBAR EVENT PAGE BROWSER EVENT LOG FIELDS EVENT LOG FUNCTIONALITY QUERYING EVENTS Selecting Atlas Scope Selecting a View Selecting Time Range MANAGING CUSTOM VIEWS Creating a Custom View Defining Filtering Criteria PRINTING EVENT LIST EXPORTING EVENT LIST MANAGING EVENTS Changing Resolution of Event Assigning an Event to a User Grouping Events Deleting an Event VIEWING ALERT INFORMATION Event and Panel Preview Viewing Event Details Viewing Alert Execution Information Viewing SNMP Trap Information MONITORING POLICIES IN NETCRUNCH PREDEFINED MONITORING POLICIES CREATING MONITORING POLICIES Creating Dynamic or Blank Policy View Enabling/Disabling Dynamic Policy View Creating Policy View for Existing Map or Single Node Adding Nodes to Monitoring Policy Deleting Nodes from Monitoring Policy Deleting Monitoring Policy ALERTING BASIC CONCEPTS Event Classes Thresholds Using Thresholds in NetCrunch ALERTING ACTIONS A RESPONSE TO AN EVENT Alerting Action Types

8 AdRem NetCrunch 6.x Premium Role based Notification System Basic Action Types Control Action Types Logging Action Types Scripts Action Types Display Alert Notifications MANAGING ALERTING Adding or Removing Alerts Modifying Alerting Rules Configuring Event Parameters Creating New Events Creating Alerting Scripts List of Escalated Alerting Actions Managing Alerting Scripts Default Alerting Script Pending Alerts Clearing Pending Alerts Acknowledging Alerts Changing Message Formats REPORTING REPORT TEMPLATES Reports with Configurable Parameters Defining Performance Reports MANAGING DATA COLLECTION FOR REPORTING Creating Data Collection for Reporting Creating Datasheet Report Based on a Selected View Modifying Data Collection Rules Modifying Report Parameters REPORT VIEWER Starting the Program Generating Reports Why a generated report is empty? TREND DATA FORMAT OPERATING SYSTEM, SNMP AND APPLICATION MONITORING MONITORING SYSTEM AND NETWORK PERFORMANCE Basic monitoring Monitoring Network and Services Operating System Performance SNMP Web Page File Events MONITORING MICROSOFT SQL SERVER MONITORING MICROSOFT IIS MONITORING MICROSOFT EXCHANGE MONITORING ESX SERVER MONITORING OPTIMIZATION STRATEGY

9 Table of Contents PERFORMANCE VIEWS Creating Performance Views Managing Performance Views Changing Panel Properties Viewing Counter History with using Trend Viewer VIRTUAL PERFORMANCE COUNTERS Opening Virtual Performance Counters Window Defining New Virtual Counter Adding Counter Variable Editing Virtual Counter Properties Deleting Virtual Counter MANAGING SNMP DEVICES Viewing and Setting SNMP Variables Extending MIB data MIB Compiler Where to Look for MIB s Receiving and Responding to SNMP Traps Listening Modes Defining a Specific Trap Event Forwarding and Grouping SNMP Traps Turning NetCrunch Alert into SNMP trap Using NetCrunch MIB USING WINDOWS TOOLS USING THE PROGRAM REMOTELY REMOTE ACCESS AUDIT LOG WEB ACCESS Enabling / Disabling Web Access Defining Web Access Users Web Access User Management Managing Web Access Profiles Creating Web Access Profile Editing Web Access Profile Deleting Web Access Profile Managing Access Rights SSL Connection ADMINISTRATION CONSOLE USED ON REMOTE MACHINES PROGRAM OPTIONS GENERAL OPTIONS Server Connections Settings Changing User Interface Style NetCrunch Server Connection Settings Defining Startup Script Error Reporting Changing Confirmations Network Discovery Settings Web Access Settings

10 AdRem NetCrunch 6.x Premium Maintenance Event Database Trend Export Update Options License Manager MONITORING Monitoring Options Setting Default Node Properties Changing Default SNMP Properties Changing Default Windows Account edirectory Tree Credentials Linux Default Credentials Mac OS X Default Credentials BSD Default Credentials Inventory Default Settings Changing Thread Settings Default Network Services Changing Network Services Definition Creating Network Services Definition Changing Definition Duplicate Network Service Definition Physical Segments Topology and Layout SNMP Trap Listener Syslog Message Listener Enabling Windows Event Log DNS Resolver NOTIFICATION Notification Window Settings Pager Settings GSM Mobile Device (phone or modem) ICQ Jabber Settings MAP General Map Settings Icons Captions Styles Background Connection Lines Signaling Method Map Images Cache Map Links Settings Map Appearance Settings ADVANCED NODE MONITORING CONCEPTS UNDERSTANDING NETWORK DEPENDENCIES

11 Table of Contents First Example INTRODUCTION TO EVENT SUPPRESSION Advanced Monitoring Settings Description Important Event Suppression Information Quick Illustration Understanding Service Indeterminable Status Quick Illustration Sample Scenario First Case Second Case Third Case Fourth Case NETWORK DEPENDENCY EVENT SUPPRESSION Second Example Step 1: Setting Up Network Dependencies Step 2: Setting Up Suppression of Events Step 3: Excluding Event Suppression Conclusion SUPPRESSING NETWORK SERVICE EVENTS Third Example Step 1: Disabling Suppression From Depending Nodes Step 2: Setting Up Suppression of Service Events Step 3: Excluding Service Event Suppression Conclusion FOURTH EXAMPLE CUSTOMIZING NETCRUNCH CUSTOMIZING USER INTERFACE Customizing Layout Filtering Atlas Maps Window Undocking Windows Docking a Window Window List Aligning Docked Program Windows Readjusting Window Size Browsing All Currently Opened Windows Arranging Layout for Multi-Display Capability Saving Program Layouts Synchronizing Windows with the Network Atlas CUSTOMIZING TABLES Customizing Columns Sorting Information Grouping Information into Sections Filtering Information Table Options MANAGING NOTIFICATION USERS AND GROUPS MANAGING SNMP PROFILES

12 AdRem NetCrunch 6.x Premium EVENT SUPPRESSION MANAGER Opening Event Suppression Manager Changing Event Suppression Settings CONFIGURING NODE TOOLS MENU Adding New Menu Item Deleting Menu Item Moving Menu Item Changing Menu Item Properties IMPROVING NETWORK DEVICES IDENTIFICATION Using Device List Editor Automatically Updating the DEVICES.XML File Adding New Device Definition CUSTOMIZING SNMP VIEWS Using SNMP View Editor CHANGING EVENT TO MESSAGE TRANSLATION FORMATS TROUBLESHOOTING MONITORING NETWORK SERVICES REQUIREMENTS MONITORING WINDOWS MACHINES IN NETWORKS CONTAINING DOMAINS/WORKGROUPS WINDOWS PERFORMANCE MONITORING REQUIREMENTS MULTIPLE CONNECTIONS TO MONITORED WINDOWS NODES BY THE SAME USER COMMON MIB COMPILING PROBLEMS AND FIXES Missing Aliases MONITORING OF TCP NETWORK SERVICES SLOWDOWN CONNECTING GSM MOBILE DEVICE UTILIZING NETCRUNCH ATLAS DATA RESOURCES INDEX

13 Introduction This guide is intended for network administrators and other professionals in charge of managing enterprise networks. It will demonstrate how to use the extensive visualization, monitoring, alerting and reporting capabilities delivered by AdRem NetCrunch to monitor corporate networks in a cost and time-efficient manner. Because this manual generally applies to TCP/IP networks, from here on the term network will be used to mean specifically TCP/IP networks, unless otherwise indicated. Overview No time for downtime? That is the whole point of deploying AdRem s NetCrunch. Maintaining the highest levels of network and service availability is clearly mission-critical to any successful company. Global markets, new business and technology initiatives, and a growing need to leverage the ever-expanding Internet require a secure, reliable and faulttolerant foundation for delivering network-based services and applications with as close to 100 percent uptime as possible. Without a sophisticated and flexible monitoring, alerting and diagnostics solution, failures of vital hardware devices, network services, and applications can easily go unnoticed. Employees, business partners and customers are increasingly dependent on round-the-clock access to data in the corporate network. Each outage or service unavailability can negatively affect employee work performance and may lead to greatly reduced productivity. Worse, if a network crash occurs over a holiday or weekend period, critical services or even your entire company network could be inaccessible to customers or suppliers for hours even days before you discover the problem. In a worst-case scenario, a prospective client, unable to contact a representative of your company, could get turned off and go elsewhere. With NetCrunch 6.x from AdRem Software, you will no longer have to worry, because if an outage or emergency situation occurs on your network you will know it first. AdRem NetCrunch constantly probes and transacts with network resources at timed intervals to test their availability and responsiveness. It provides an intuitive real-time display of network performance and plots system and service behavior on easy-to-read graphical maps. If a failure or degradation occurs, NetCrunch automatically notifies scheduled administrators via or pager, providing them with the necessary diagnostic information. In addition, detailed reports can be generated on the current and historical performance of particular hosts over any given time frame. Another useful feature of the program is trend collecting. This safeguards and improves service quality and uptime in corporate network installations. AdRem NetCrunch is perfect for checking the ongoing status of company networks, or using it as a dedicated monitoring solution for particular subnets and critical network services and distributed applications. It is also recommended for consultants for troubleshooting customer networks in many locations. Because NetCrunch is a Windows client solution, they can have it installed on a laptop and carry it around with them. It is designed for small and medium- 13

14 AdRem NetCrunch 6.x Premium sized network customers and includes many useful and valuable functions for monitoring networks over longer periods. NetCrunch 6 Architecture AdRem NetCrunch is a comprehensive network management application and monitoring solution for networks consisting of up to few thousand nodes. NetCrunch 6 was designed to improve the monitoring of network infrastructures by implementing a client/server architecture and combining network visualization with detailed alerting mechanisms and reporting capabilities. The new client/server architecture brings the possibility of connecting multiple administration consoles to a one NetCrunch Server and vice versa. The AdRem NetCrunch 6.x Premium and Premium XE editions consist of the following program components: AdRem NetCrunch Server contains all program components (AdRem NetCrunch Administration Console, AdRem NetCrunch Web Server and AdRem NetCrunch Connection Broker) and database for storing all data of created network atlases. It is installed on selected by the user network machine running Windows operating system. The program allows installing many NetCrunch Servers according to the user needs. Each NetCrunch Server can be connected remotely via Web browser or NetCrunch Administration Console. Connection established via Web browser utilizes credentials defined individually for each user in the NetCrunch Server. Connection via NetCrunch Administration Console is established by using NetCrunch Connection Broker which verifies credentials specified for NetCrunch Server. Therefore, each NetCrunch Server has unique credentials specified by the user during the installation process. These credentials are used to establish simultaneous connections of many NetCrunch Administration Consoles installed on remote Windows machines. Once, NetCrunch Server credentials are verified by the NetCrunch Connection Broker, the NetCrunch Administration Console is connected directly to the NetCrunch Server. AdRem NetCrunch Administration Console it is the Graphical User Interface which allows managing all tasks related to network monitoring. It is distributed in separate installation file along with AdRem NetCrunch Connection Broker. Therefore, it can be installed on many network machines running Windows operating system. However, the user can install many NetCrunch Servers in the monitored networks. In such case, the multiple consoles can run on a remote machine simultaneously, having established connections to different NetCrunch Servers and receive event notifications from them independently. To establish connections between NetCrunch Server and NetCrunch Administration Consoles the AdRem NetCrunch Connection Broker is used. AdRem NetCrunch Connection Broker allows establishing connections with NetCrunch Server. It is installed along with the AdRem NetCrunch Server and AdRem NetCrunch Administration Console, if the console is installed separately on remote machines. NetCrunch Connection Broker is used to perform the following tasks: establishing connection between NetCrunch Administration Console and NetCrunch Server by verifying server credentials, 14

15 Introduction receiving desktop notifications on any machine where it is running and all NetCrunch Servers to which it is connected, managing the list of installed NetCrunch Servers and their credentials. AdRem NetCrunch Web Server allows accessing the NetCrunch Server via a Web browser from any remote machine. It is provided with the AdRem NetCrunch Server. The Premium/Premium XE editions of the AdRem NetCrunch 6.x program is distributed in two installation files: NCServer6Premium.exe it is the AdRem NetCrunch Server which consists of all program components described above (AdRem Administration Console, AdRem Web Server and AdRem Connection Broker). It can be run and fully managed on Windows machines where it was successfully installed. The AdRem NetCrunch Server allows remote and simultaneous connections of the NetCrunch Administration Consoles to the same network atlas, created by the user. Furthermore, it can be also accessed from any remote machine via Web browser. NCConsole6Premium.exe consists of Graphical User Interface and AdRem Connection Broker. It is dedicated to install on Windows machines selected by the user and allows connecting remotely to NetCrunch Server installed on a different Windows machine and managing network monitoring. AdRem Connection Broker is a small application used only to establish remote connection between the AdRem Administration Console and AdRem NetCrunch Server. Note The Standard edition of the AdRem NetCrunch 6.x program utilizes the NCServer6Standard.exe only. Therefore, the AdRem NetCrunch Administration Console is installed along with the AdRem NetCrunch Server as integral part of the program and cannot be used separately on remote machines. Main Goals Network Presentation A typical enterprise IT infrastructure represents a complex combination of systems, processes, data, software and hardware. Uninterrupted delivery of services and business processes hinges on proper interaction of all assets that make up a network. Consequently, mapping those different aspects of a network is crucial to the interest of an IT department in a corporation. Generally, people understand information more easily when it is presented graphically. Maps help to adjust or customize network views so users can get to relevant information quickly and efficiently. In reality, maps can show the entire logical or physical network structure as well as various functional aspects of the network topology. In the latter case, graphical representation of the network may be based on criteria such as geographical locations, organizational units or other aspects distinct to each particular company. This flexibility in viewing the network structure 15

16 AdRem NetCrunch 6.x Premium helps users comprehend different aspects of the network topology and, as a result, they are more able to easily maintain and control what they can see. NetCrunch fully supports the discovery of networks and provides almost limitless options for creating different types of network visualization. Monitoring Policies Monitoring policies in NetCrunch are used for monitoring any atlas, map or even single node. A monitoring policy is a set of rules defining what event condition should be checked (alerting) and which performance data should be collected (reporting). Therefore, a monitoring policy may consist of two elements: alerting and data collection. A monitoring policy may contain either one of the elements or both. Alerting Notifying IT administrators or department managers about arising degradations in network health or in the performance of its components is critical to proper functioning of any business organization. It directly follows that a remedy to such situations must be found as soon as possible with the least effort required. Consequently, alerting is always an integral aspect of the network monitoring process. It helps to continuously keep an eye on problems occurring in the monitored network and immediately take precautionary and corrective actions, even automatically. In fact, alerting facilitates housekeeping tasks for the administrator by helping to recognize future sources of potential problems in the network and any of its elements. In NetCrunch, alerting can be defined in any monitoring policy. The program delivers alert escalation schemes specifying that certain events, depending on their priority, trigger specified sets of actions at different times. Each successive action involves more resources or higher chains of command. In this manner, if an immediate alert action, necessitating the least amount of resources, does not produce an effect in the intended time, another action (notification or automatic recovery procedure) can occur with a more sophisticated resolution method. Specifically, the program can execute various types of actions ranging from a notification (such as sending an or SNMP trap as well as displaying an alert dialog) to running a script/program locally or remotely, and even writing alert information to a file. Reporting Constant gathering and utilization of past information about trends in network health and performance, ranks high on the list of an IT administrator s tasks. Essentially, reporting provides a long-term view of the network performance and its elements like services and applications. This significantly helps to plan the future growth and at the same time remove performance bottlenecks. As a result, reporting provides leading indicators for capacity planning and resource management. By using information obtained from processed events and gathered trends, NetCrunch provides a way to define custom data collection in any monitoring policy. Defining data collection for reporting means creating the list of reports, chosen from the predefined report 16

17 Introduction templates list. User can define the list of reports they wish, at any time. Each report can be generated, saved and forwarded to other recipients at different scheduled time. Monitoring the Network Basics Concepts There is no easy way to describe the network because of its diverse nature. However, one way of doing it is to concentrate on its most basic elements nodes with their own network address. Specifically, a decision was made to start describing network elements from layer 2 of the OSI model. This means that nodes will be understood as representing a single unique TCP/IP address. This level can serve as a starting point for looking higher into Network Services (for example, PING, FTP, POP3 or HTTP), Network Interfaces, Windows Services and Processes, and Application Performance of any monitored network element. Active Monitoring Active monitoring means that the program is constantly probing and measuring received responses from remote nodes. The simplest kind of monitoring available in NetCrunch is accessibility monitoring which simply determines the state of an object (services are down, node is down, etc.). Node state is based on the state of its monitored network services. To make this easier, by default PING service is polled by using the ICMP echo message to check node availability. In some cases, this is not enough as you may need to know more about the quality of connection. Therefore, NetCrunch also measures the number of lost packets and response times for each service. Smart Monitoring Limiting Monitoring Traffic NetCrunch is an agentless program, which means it may generate some network traffic by its monitoring. However, NetCrunch uses its own technology, which allows limiting traffic to particular networks and automatically adjusts the monitoring time. For example, if the monitoring of a certain network requires 1MB to be transmitted and users limit this traffic to 5 kb/s, transmitting that amount will take about 3 minutes as this is the usual monitoring time for nodes in that network. Setting Network Dependencies Network dependencies are a useful way to avoid unnecessary events and lower monitoring traffic. Please see the section entitled Understanding Network Dependencies on page 355, for more information on this functionality. 17

18 AdRem NetCrunch 6.x Premium Selective Down Nodes Monitoring When a node is down, only network service designated as leading service is monitored to determine connection state with the node. In the meantime, all other monitors are put in Waiting for response state. Event Suppression Mechanism You can select which node and service state events are generated or suppressed on the dependent nodes that are disabled by dependency rule when the parent node goes down for any reason. Note that this feature is only available in NetCrunch Premium XE edition. Network Service Monitoring Priorities Setting a higher priority to critical nodes helps you to monitor its network services before other type of nodes. You can even lower the priority for unimportant nodes. Note that this feature is only available in NetCrunch Premium XE edition. Performance Monitoring In case of network services, we can easily determine performance by measuring response time and number of lost packets. But we would also like to monitor other elements such as network interfaces (ports) and applications running on a node. The only way to do this is to monitor statistics gathered by the node itself. The nature of these statistics depends on the node type. For example, Windows nodes provide a number of counters measuring different resource utilization (Processor, networks, threads, system objects and application specific counters). In addition, many hardware devices like printers, routers, and switches provide a number of statistics specific to their tasks. NetCrunch simplifies access to that information by defining commonly used reports and events using predefined counters and thresholds. In most cases, the program uses SNMP protocol to retrieve that information but in case of Windows, Linux, Mac OS X, BSD and NetWare machines, it may also use OS specific protocols. 18

19 Browsing the Network This chapter presents the most common components of the NetCrunch Administration Console window. Network Representation Nodes As we mentioned above the node is the central object that gives access to its resources, services and applications running on it. Because a node represents a single TCP/IP address, it may happen that one physical device might be represented in NetCrunch by several nodes. In this case, we advise leaving the single node for service and performance monitoring, and then turning Simplified Monitoring option for the rest of them. Maps Logically, the map allows nodes to be grouped, which is very useful in the case of managing a large number of nodes. The other presentation aspects allow for the creation of nice looking graphical network maps with links to others. Logical IP Network Represents maps of the logical network topology managed by the program. User can populate these maps only with nodes that belong to a certain network. The program can arrange those maps automatically when discovering new nodes, however, they can also be manually ordered by the user. Physical Segment NetCrunch can also graphically represent physical connections between computers and manageable switches. For this to happen, it is required that an SNMP Bridge MIB module is supported by devices. Although physical maps are always fully managed by NetCrunch the users can partially arrange their layout. Dynamic View NetCrunch allows creating dynamic (automatically managed) maps based on certain filtering conditions. For example, you can easily create a map that lists all devices of the same kind or those which reside in the same location. Static View This is the simplest kind of NetCrunch map, fully managed by the users who have to manually insert nodes and arrange them. 19

20 AdRem NetCrunch 6.x Premium Charts Charts in the program are a graphical representation of specific performance counters monitored on any nodes of the atlas. Chart views may be automatically updated by the program or managed manually by the user. NetCrunch Administration Console Description When you first open the NetCrunch Administration Console, the main console window will look something similar to presented in Figure 1. Figure 1 Sample NetCrunch Administration Console window The program can consist of the following windows (not all need to be displayed at the same time), as shown in the table below: Network Atlas The Atlas is the container for all monitored objects and its views. You may treat the atlas like a document holding its contents, style and all other settings related to it. The Network Atlas consists of the Favorite Maps and the Atlas Maps window. 20

21 Browsing the Network Main Menu Main Toolbar Main Window Event Log Summary View Map View Monitoring view Inventory View It consist of the File, Edit, View, Tools, Window and Help menu items of the NetCrunch Administration Console. Provides several buttons to access main program functions. The purpose of the Main window is to present information related to the item (e.g. atlas, section or view), currently selected in the Atlas Maps window in various forms. It consists of two tabs. The first tab called the Map window, displays the name of the selected item along with the appropriate icon. This tab also contains the Summary, Map, Monitoring and Inventory views. The second tab presents the Event Log window of the item selected in the Atlas Maps window. By default, the Event Log tab is synchronized with the Atlas Maps window. Therefore, it presents events generated in the atlas, section or view selected in the Atlas Maps window. It also allows managing the list of events (e.g. changing event resolution, assigning events to user deleting events, etc.). The Event Log can also be opened as a separate window by selecting the New Event Log window item from the Window main toolbar and synchronized with other Atlas Maps items. The Summary view is available at the top of the Main window when the particular section or view is highlighted in the Atlas Maps window. It presents crucial information about all nodes and network service states available in the currently highlighted view. The Map view is available when you click the Map button at the top of the Main window. It presents network in the graphical form. Therefore, it can be conveniently used to obtain quick information about all nodes and network service states for the view currently highlighted in the Atlas Maps window. Maps in NetCrunch consist of node icons and other objects such as pictures, text, background shapes or connection lines. Furthermore, each icon indicates node monitoring status, by changing the appearance and color. A gold star indicates that the SNMP monitor is enabled. The additional information as the type and version of the operation system running on the node is also displayed. When the user stops the mouse pointer over a node, after a short period of time the hint window opens. The hint window contains the most important information about the selected node. The zoom toolbar is displayed at the bottom. It allows adjusting the zoom in order to manage the displayed size of all items of the currently selected map. The Monitoring view contains the Details, Windows, SNMP, NetWare, Linux, Mac OS X and BSD tabs according to the monitored operating system types. Information in tab is presented in a table format. The Inventory view displays detailed inventory information of Windows nodes. The view contains the Monitor and Software tabs. The Monitor tab presents information about performed inventory audits and basic information about nodes. The Software tab shows information about software installed on inventoried nodes. 21

22 AdRem NetCrunch 6.x Premium Status Bar Displays general information about the monitored atlas, its maps, monitored services, current number of new alerts received in the alerts dialog, selected optimization strategy and monitored issues. The user can click the desired link to open the appropriate window for more information. Notes By default the Main window tabs are synchronized with the Atlas Maps window. This means that if a different section or view is selected in the Network Atlas window, the Main window automatically displays its contents. In such case the Synchronize icon is pressed. The synchronization can be disabled by clicking this icon to release it. In addition, NetCrunch contains three additional stand-alone programs: Report Viewer (used to generate and display predefined reports), Performance Trend Reporter (used to create, generate and display custom trend reports), ITools (providing handy network troubleshooting tools) and WMITools (lets you perform several tasks on nodes running Windows operating system). Main Toolbar The main toolbar contains a list of common global functions accessible at any time. The main toolbar from the program is displayed in Figure 2, below. Figure 2 Main Toolbar The toolbar consists of the following icons (as shown in the table, below): Print Monitoring Policies Reports Trend Viewer ITools WMI Tools Opens the Print Preview window for the currently displayed map. Opens the NetCrunch Monitoring Policies window, where the user may manage the all alerting and data collection used in the monitored atlas. Opens the Report Viewer program (for predefined reports) where the reports may be created, viewed and generated. Opens the Trend Viewer program used for viewing trend data that was previously gathered for an atlas in NetCrunch. Opens the AdRem ITools several network tools such as Ping, Trace Route, DNS Lookup and SNMP. Opens the AdRem WMITools program with the several Windows tools such as Processes, Services, System Hardware, and Operating System. 22

23 Browsing the Network MIB Compiler Opens the MIB Compiler program used to edit and recompile vendor specific MIBs. Please note that the MIB Compiler is available only in NetCrunch Administration Console used locally on the machine with installed NetCrunch Server. Notes You can toggle on/off the showing of the main toolbar by selecting Show Main Toolbar menu item from the View menu. Please note that the Report Viewer, Trend Viewer, ITools, WMITools and MIB Compiler applications contain documentation available by selecting Help Contents from their main menu. Status Bar The main status bar displays valuable information about the monitored atlas. It also warns the user about configuration and monitoring issues in the program. The status bar consists of the following elements: Rubbish Bin this icon is used to delete nodes or events by dragging and dropping. Atlas Name displays the name of the currently monitored atlas. Monitoring Optimization this link displays information about the selected optimization strategy for the entire atlas. By using this link, the user can change the optimization strategy and add nodes to the exclusion list. Alert Received displays the number of recently received alerts. By clicking this link, the Alert Notifications window is opened with the list of recently received alerts. Monitoring Issues displays the number of the monitoring issues in the atlas. By clicking this link the Monitoring Issues window opens with a list containing information about the issue type, node where an issue occurred and reason. Configuration Warnings this link is displayed when the program needs additional configurations setup, such as Web Access or physical segments. By using this link the program automatically opens the appropriate configuration wizard. Nodes displays the number of nodes included in the monitored atlas. Network Atlas The Atlas is the container for all monitored objects and its views. You may treat the atlas like a document holding its contents, style and all other settings related to it. The Network Atlas consists of the Favorite Maps and the Atlas Maps window. 23

24 AdRem NetCrunch 6.x Premium Figure 3 Network Atlas window 24

25 Browsing the Network Favorite Maps When monitoring a network, it is very important to find out quickly, which node (or map) is currently experiencing any monitored issue. It is especially difficult when the user is monitoring a large network. NetCrunch provides an effective solution for this difficulty. In the Favorite Maps window, the folder Maps with Issues contains links only to these maps, where even one node is not in the OK status. NetCrunch adds and removes these links automatically. The link appears in the folder Maps with Issues as long as a problem within an appropriate map persists. Furthermore, in the Favorite Maps window, the user can create the direct link (by dragging) of maps or folders chosen from the Atlas Maps window, except maps belonging to the Physical Segments section. Atlas Maps The Atlas Maps window contains a special Index of Nodes section providing easy access to all monitored nodes. Further sections contain maps, folders and views of the monitored network. The Atlas Maps window consists of two sections managed by the program automatically (IP Networks and Physical Segments) and three users managed ones called Custom Views, Performance Views, and Monitoring Policies respectively. Atlas Maps Main Sections IP Networks Physical Segments Custom Views It contains two types of networks: Local and Remote networks. The Local network lists all networks as seen from the point of view of the machine NetCrunch is running on. The Remote network lists those networks which are not directly connected to the local networks. These networks are discovered during the creation of a new atlas or during a rescanning operation on it. The program also automatically adds a new remote network to this section if a previously inserted node belongs to an unknown remote network to the program. Presents lists views based on the physical network topology. The connection lines drawn on views of physical segments represent real physical network cables that link devices. Views in this section cannot be managed by the user; however their layout can be modified. In order to reflect the network topology change, NetCrunch allows monitoring and set a refresh time interval of the entire Physical Segments topology. This section may contain previously discovered nodes organized into dynamic and/or static views. It may contain any number of different network views created by the user. In the static view, the user manages (adds/removes) nodes, while in the dynamic view nodes are automatically updated based on user-specified filtering criteria. Usually, when opening a new atlas for the first time, after the network discovering step, two default folders are created: edirectory and Windows Domains. The edirectory folder lists the discovered NDS trees of the network, and it is made up of nodes that belong to them. Meanwhile, the Windows Domains folder lists the Windows domains of the network, which were found during network discovery and lists the maps and nodes that belong to them. 25

26 AdRem NetCrunch 6.x Premium Performance Views Monitoring Policies Contains graphs (in the form of charts, bars or gauges) of specific performance counters monitored on nodes (SNMP, NetWare or Windows type). Contains all predefined monitoring policies. It also contains map monitoring policy views (dynamic and/or blank) created by the user from within this section and blank policy views created from within the NetCrunch Monitoring Policy window (except monitoring policies created for a single node). If the monitoring policy was created from within the NetCrunch Monitoring Policies window for maps belonging to the Custom Views section or IP Networks section, then the appropriate link is created in the User Maps with Policy or the Network Maps with Policy folder respectively. Available View Types (in the Atlas Maps sections) Index of Nodes Logical Network Routing Map Monitoring Dependencies Map Dynamic View Static View Dynamic Monitoring Policy View with Operating System Selected Blank Monitoring Policy View with Operating System Selected Physical Segment Lists all existing nodes in the open atlas (that were previously discovered by the program or added manually by the user) in a table format. It contains nodes discovered based on the IP addressing. It belongs to the IP Networks section. Displays a routing map of the monitored network. It belongs to the Custom Views section. Displays nodes that have at least one dependent node and shows the actual monitoring dependencies between them. Displays a dynamic view whose contents are updated automatically by the program based on selected filtering criteria. The Static View contains nodes only managed by the user. The newly created static view does not contain nodes to start with. Therefore, the user needs to copy the selected nodes to such view. The view may contain nodes running different operating systems. Displays a monitoring policy view in the Monitoring Policies section whose contents are updated automatically by the program and restricted to a selected operating system. The icon appearance varies depending on the selected operating system (e.g. Windows, Mac OS X, BSD, Linux or NetWare). Displays a custom monitoring policy view in the Monitoring Policies section whose contents are static (its contents can only be updated manually by the user) and restricted to a selected operating system. The icon appearance varies depending on the selected operating system (e.g. Windows, Mac OS X, BSD, Linux or NetWare). Displays a Physical Segments views created based on a physical network topology. 26

27 Browsing the Network Port View Displays a Physical Segments views of what device is currently connected to a particular port. This map is also based on physical network topology. NetCrunch changes the color of the maps icon, except Index of Nodes to reflect their present status. The color states of a map icons are described in the table below. Normal (OK status) Yellow (WARNING status) Red (DOWN status) Gray (UNKNOWN status) Indicates the OK status of a map. All nodes (and map links) included in a map are in the OK status. Indicates a warning status of a map. At least one node (or map link) on a map is in the WARNING or DOWN status. Indicates a down status of a map. All nodes (and map links) included in a map are in DOWN status. Indicates an unknown status of a map. All nodes included in a map are in the unknown status or the map is empty. In the Atlas Maps window, every view is represented by an appropriate icon. NetCrunch changes the color of the maps' icon in the Atlas Maps window to reflect their present status. A map link also changes color if there are any nodes that are in the down or warning states in the linked map. Therefore, it is possible to use map links to indicate the map status. Please see the section entitled Signaling Method on page 351 for more information. Multiple Map and Event Log windows can be synchronized with the Atlas Maps window. This means that as you select a particular map in the atlas tree, the Map window will immediately display the content related to the selected map. Main Window The purpose of the Main window is to present information related to the monitored atlas in various forms. By default, the Main window is synchronized with the Atlas Maps window. In such case, details about item (e.g. atlas, section or view), currently selected in the Atlas Maps window are presented in the Main window. Directly above, the Main toolbar is displayed with several, frequently used tools. Right under the Main window two tabs are located. The first tab, called the Map window displays the name of the selected item along with the appropriate icon. The second tab presents the Event Log window. Please see the chapter titled Event Log Window on page 51 for more information on the subject. Map Window Views The Map window is opened by selecting the firs left tab (containing icon related to the view currently selected in the Atlas Maps window), of the Main window, located directly below the main program toolbar. The separate Map window can be opened from the program main menu by selecting the Window New Map Window item. The Map window contains the Summary, Map, Monitoring and Inventory views, available according to the selection in the Atlas Maps window (Figure 4). The Summary view presents the most common monitoring information. The Map view presents network in the graphical 27

28 AdRem NetCrunch 6.x Premium form. The Monitoring view contains the Details, Windows, SNMP, NetWare, Linux, Mac OS X and BSD tabs according to the monitored operating system types. Information in tab is presented in a table format. The Inventory view displays detailed inventory information of Windows nodes. The view contains the Monitor and Software tabs. When the atlas name is highlighted in the Atlas Maps window, the atlas dashboard is presented in the Map window. Figure 4 Map window Each view available in the Map window contains the following icons: Back Forward Allows you to move back to the previously viewed map. Allows you to display the next map (if you have moved back from an earlier map). 28

29 Synchronize With Atlas Select View Browsing the Network Permits to synchronize/unsynchornize the Main window contents with what is currently being selected in the Atlas Maps window. If this icon is pressed, the Main window is synchronized with the Atlas Maps window. This icon allows selecting the view to be presented in the Map window. This option is available only when the Map window is unsynchronized with the Atlas Maps window. At the bottom of the Map window, the total number of nodes divided by their current status is presented. Atlas Dashboard The atlas dashboard is presented in the Map window when a given Atlas network is selected in the Atlas Maps window. Dashboard presents the most critical information about monitoring process and allows viewing and/or changing the following features: Atlas Configuration the user can configure the most common options related to the monitoring process (e.g. monitoring areas, optimization, default credentials, administrator profile, Web Access, alerting scripts etc.), in the Atlas Configuration Wizard. Please see the NetCrunch Getting Started Guide for detailed information about using the Atlas Configuration Wizard. Atlas Properties by clicking the Properties button, the Atlas Properties window is opened. The user can change the desired atlas properties. Monitored Nodes Panel displays the number of monitored nodes in the atlas divided according to their current statuses (e.g. OK, Down, Warning, etc.). By clicking the desired status button in this panel, the Details tab opens presenting the list of nodes filtered by this status. Monitored Network Services Panel presents the number network services monitored in the atlas and their current statuses. Events Table the number of events divided according to their severity (e.g. critical, warnings, etc.), generated in the last 12 hours is presented in the table format panel. When icon is clicked in the desired filed of the table, the Event Log window opens with the list of events filtered by their severity, generated in the selected hour. Nodes with Problems presents the list of 10 nodes with the highest number of unacknowledged events, divided according to their severity and generated in the last 24 hours. Nodes with Longest Response Time contains the list of 10 nodes with the highest average value of the response time (RTT). By double-clicking the particular node, the user can open Status window. The average response time is validated for each monitored node and indicated on the Summary tab of the node Status window. Top Processor Utilization shows the list of 10 nodes with the highest percentage value of the processor utilization. Top Memory Utilization presents 10 nodes with the highest percentage value of memory utilization (the Memory field located in the Status window). 29