Intellipool Network Monitor 2.0

Transcription

1 User's Guide Intellipool Network Monitor 2.0 Intellipool AB Printed on 18 October, 2003

2

3 i Contents Intellipool Network Monitor Documentation 1 Copyright Notice...2 End user license agreement...3 Getting help...7 Contact information...8 Introduction 9 Planning...11 Software and hardware requirements...11 Service logon account...12 Net send...13 SNMP monitoring...14 ODBC logging...14 Firewalls and routers...14 Anti virus programs and software firewalls...14 Monitoring Windows NT/2000/XP machines...14 Monitoring Unix machines...14 DHCP Agent considerations...15 Internal web server...15 Web server security...15 Backup of configuration repository...16 File security...16 User logon verifications...16 Agent username and password...16 SMS notification...16 Paging...19 CPU usage and threading...20 Memory usage...21 Installation check list...22 Getting started...23 Program settings...24 Creating new operator accounts...24 Creating a new operator group...25 Creating new action lists...26 Scanning for objects and agents...27 Assigning the restart list with global changes...28 Summary...28

4 ii Contents How to obtain updates...29 Intellipool Network Monitor Concepts 31 Action lists...31 Auto scan...32 Data extraction...32 Dependency tree...32 Frequently used terms...32 Internal servers...34 Logging...34 Networks,Objects And agents...36 Operators and operator groups...36 Reports...37 Schedules...38 Test procedure...38 The configuration repository...39 How to use Intellipool Network Monitor 41 Action lists...43 Creating a action list...44 Deleting an action...45 Dependency trees...46 Frequently used user interface terms...49 Global changes...50 Index page and menus...52 My settings...53 NOC view...55 Networks, objects and agents...57 Creating a agent...57 Delete a agent...59 Agent information page...59 Agent list page...61 Agents with alarms page...61 Agents by type page...62 Agent mini list page...62 Creating a network...63 Delete a network...64 Network info page...65 Network list page...67 Network by agent type page...68 Creating a object...69 Delete a object...70 Object information page...70 Creating dependency...72 Importing objects...72 Object list page...73 Operators and operator groups...75 Create an operator group...75 Delete an operator group...76 Change the default operator group...76 Create an operator...77 Delete an operator...79 Program settings...81 Generic settings...83 Log settings...88 Pagegate integration...89

5 Contents iii Reports...91 Creating a report template...91 Creating a report...94 Viewing a report...96 Schedule a report...97 Copy a report...98 Delete a report a report...99 Schedules Creating a operator schedule Creating a maintenance schedule Creating an event schedule...108

6 iv Contents System administration Agent documentation 113 Bandwidth agent CPU load agent DHCP agent Disk size agent DNS agent Event log agent File check agent FTP agent HTTP agent ICA agent IMAP4 agent INM agent LDAP agent Memory size agent Network interface load agent NNTP agent ODBC agent Ping agent POP3 agent Process agent RDP agent Service agent SMTP agent SNMP agent SNMP Trap agent SSH2 agent SSH2 script agent Swap size agent Syslog agent TCP port scan agent Telnet agent TempTrax agent Text file scan agent TFTP agent Winperf agent Action documentation 157 Clear Windows Event log Execute command via SSH Execute windows command List reset Net Send Paging via PageGate SNMP Set Send SMS Send mail Wake-on-LAN Windows service control Data extraction 169 agent_graph agent_statusstring...171

7 Contents v agent_uptimestring dir operator_status version Frequently Asked Questions 177 Agent questions File and directory related questions Misc questions Notification questions Username, password and logon questions Guides 189 Action list example Formatting alarm and restart messages Monitoring Windows user logon failures Remote reboot of Windows machine SSH2 script agent, average load for Unix Index 201

8

9 1 C HAPTER 1 Intellipool Network Monitor Documentation This document is written for the experienced system administrator who is familiar with Windows, Unix, networking and monitoring technologies. In This Chapter Copyright Notice...2 End user license agreement...3 Getting help...7 Contact information...8

10 2 Intellipool Network Monitor 2.0 User's Guide Copyright Notice Intellipool Network Monitor Copyright Intellipool AB. SSH2 support powered by sshlib, Copyright (C) by Bitvise Ltd, portions Copyright (C) by Wei Dai. All rights reserved The software contains proprietary information of Intellipool AB; it is provided under a license agreement containing restrictions on use and disclosure and is also protected by copyright law. Reverse engineering of the software is prohibited. Due to continued product development this information may change without notice. The information and intellectual property contained herein is confidential between Intellipool AB. and the client and remains the exclusive property of Intellipool AB. If you find any problems in the documentation, please report them to us in writing. Intellipool AB does not warrant that this document is error-free. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopying, recording or otherwise without the prior written permission of Intellipool AB. Intellipool AB Franzengatan 14 SE Härnösand Sweden +46 (0) Internet [email protected] Website:

11 Intellipool Network Monitor Documentation 3 End user license agreement Intellipool Network Monitor Version 2.0 This license agreement is a binding contract between you (natural person or legal entity) and Intellipool AB, and applies to the software product from Intellipool AB specified above. By installing, producing copies or otherwise using this software, you are accepting the terms of this license agreement, and thereby consenting to be bound by it. If you do not accept the terms of this license, you are not entitled to install or use this software. 1. Licensed Product The Licensed Product consists of the software program in a machinereadable form, including specifications and other electronic documentation, as indicated above. 2. Grant of license This License Agreement gives the licensee a non-exclusive right to use the Licensed Product pursuant to the terms and conditions of this Agreement. 3. License fee The rights granted under this License are conditioned on the licensee having paid the license fee for the Licensed Product, pursuant to the terms and conditions applied by the licensor at the time in question. 4. Free versions of the software The terms and conditions of this license agreement shall also apply to users who are given access to the free version of the software product supplied by the Licensor. 5. Scope of the License The Licensee shall be entitled to install one copy of the Licensed Product on a single computer, which is used to provide users within the organisation of the Licensee with access to the functions of Licensed Products. A few copies of the Licensed Product may be made for security- and archive-related purposes. Copies of the Licensed Product produced in this manner shall be subject to the terms and conditions of this Agreement.

12 4 Intellipool Network Monitor 2.0 User's Guide The Licensee may not, by itself or through another, use, copy or otherwise transfer or use the Licensed Product, in whole or in part, other than as set forth in this License Agreement. The Licensee may not, by itself, nor through another, discover, decompile or otherwise use the code to the Licensed Product to any extent not expressively allowed pursuant to law. The Licensee may not, directly or indirectly, with or without consideration, sublicense, lease, lend or otherwise allow anyone but the Licensee to control or use the Licensed Product. Production of copies of the Licensed Product for private use is thus not allowed. The assignment of any and all rights pursuant to this License Agreement may only be done with the written consent of the Licensor. 6. Licensor s right to the Licensed Product The rights granted by this license shall not be construed to mean that the Licensor s rights, including copyright and patent rights, where applicable, to the Licensed Product are being transferred to the Licensee. Nor do the rights granted by this license mean a transfer to the Licensee of title to the Licensed Product or to the medium on which the Licensed Product are made accessible to the Licensee. 7. The Licensee s duty to inspect and right to rescind The Licensee, upon receiving the Licensed Product, has an obligation to check its functions and quality. If the Licensee finds that the Licensed Product do not fulfil the functions specified by the Licensor in the documentation included with the Licensed Product pursuant to section one, the Licensee shall be entitled to rescind the License Agreement. This right to rescission is conditioned upon the Licensor receiving a written notice within thirty (30) days of the date of delivery. In the case of a rescission, the Licensor shall immediately refund the license fee. The Licensee shall not have the right to interest on this amount. In the event the Licensed Product has been sold through a distributor, the distributor shall be responsible to effect a refund of the license fee. 8. Right to cure defects, etc. The Licensor shall cure deviations from the software specification of the Licensed Product, provided that the deviations affect the use of the Licensed Product to a significant degree. The Licensor may, in conjunction with this, choose to upgrade the Licensee s version of the software. 9. Limitation of liability

13 Intellipool Network Monitor Documentation 5 Beyond what is stipulated in the above provisions, the Licensor shall have no liability for the functioning or quality of the Licensed Product, since any defects are fully regulated through this Agreement. Thus, the Licensor shall not be obligated, under any circumstances, to pay damages on account of a defect in the Licensed Product. In addition, the Licensor shall have no liability for damage or injury, whether direct or indirect, which may have been sustained by the Licensee, regardless whether such damage or injury consists of lost revenues or additional expenses, such as lost or damaged data or the liability to reimburse a third party. 10. Confidentiality The Licensed Product contains business and trade secrets belonging to the Licensor. These have been made accessible to third parties only through this License Agreement. The Licensee is therefore under an obligation not to make the Licensed Product accessible to others without the written consent of the Licensor, and to take all reasonable actions to prevent third parties from accessing the business and trade secrets that the Licensed Product contain. The licensee is responsible for ensuring that the relevant staff receive instruction in this matter, and are obligated to abide by the rules for using the Licensed Product. The Licensee s obligation to maintain confidentiality shall continue to apply after the right to use the Licensed Product pursuant to this Agreement ceases due to cases of rescission or termination, or through assignment. The obligation to maintain confidentiality continues for a period of five years. In the case of copies maintained on file, pursuant to law, the obligation to maintain confidentiality shall continue as long as the Licensee shall keep the copy on file. The Licensee shall be obligated to store Licensed Product in a secure manner during the period of the license, so as to prevent dissemination of the Licensed Product. 11. Damages, etc. In the event the Licensee shall violate any term of this Agreement that is of material importance to the Licensor, the Licensee shall indemnify the Licensor for its damage, regardless of whether or not the Licensor shall choose to rescind this Agreement. If, as a result of the breach of contract, an unauthorized person shall gain access to information regarding all or part of the Licensed Product, and this shall adversely affect the opportunities of the Licensor to market and grant licenses for the Licensed Product, the damage in each individual case shall be deemed to be equal to five Basic Amounts for National Insurance, unless damage in excess of that amount is proved.

14 6 Intellipool Network Monitor 2.0 User's Guide If the Licensee s breach of contract consisted of producing unauthorized copies, or parts thereof, the Licensee shall not only be obligated to pay the license fees for the unauthorized copies produced, but shall also be obligated to compensate the Licensor for any additional damage or injury. 12. Term of the License, termination Upon payment of the license fee, the rights granted under this license shall continue indefinitely. At any time during the term of this license, the Licensee shall be entitled to terminate this Agreement. This termination shall not entitle the Licensee to a refund of any part of the license fee paid. The Licensor shall be entitled to terminate this License Agreement upon immediate notice in the event the Licensee shall violate any of the terms of the Agreement. The rights granted under this license shall automatically terminate when the Licensed Product is no longer in the possession of the Licensee. Upon the termination of this Agreement, the Licensee shall be obligated to immediately destroy the Licensed Product, including both the software itself and copies thereof and the specifications and other documentation. 13. Disputes Disputes regarding the interpretation and/or application of this Agreement shall, in all cases, be determined by a Swedish court according to Swedish law.

15 Intellipool Network Monitor Documentation 7 Getting help Intellipool is committed to give you good and fast support. Your copy of Intellipool Network Monitor comes with 30 days support and one year of free upgrades. Frequently Asked Question This is a compiled list of common answers and questions, you may want to look through this document, perhaps your question is already answered here. support Send the mail to [email protected] Please be as thorough as possible when you describe your problem.

16 8 Intellipool Network Monitor 2.0 User's Guide Contact information Mail: Intellipool AB Franzengatan Härnösand Sweden Phone: +46-(0) Web

17 9 C HAPTER 2 Introduction Intellipool Network Monitor is an easy to use network monitor that can monitor many different protocols and services. When a service or protocol enters an alarm state or exits an alarm state INM can execute predefined actions lists. Intellipool Network Monitor operates by testing standard protocols and functions in your network, by doing so you never need to install any software on the monitored host. In this documentation we will refer to Intellipool Network Monitor as the abbreviation INM In This Chapter Planning...11 Getting started...23 How to obtain updates...29

18

19 11 Planning This section describes the prerequisite that has to be met before INM can be utilized to its fullest. By reading this section many common installation and setup problems can be avoided. This section also provide a check list that can be used to make a final check out before installing INM. Software and hardware requirements Recommended software and hardware requirements Operating system: Windows 2000 SP 3 or Windows XP SP 1 Hardware Intel Pentium III 800 MHz or AMD Athlon/Duron 800 MHz 128 Mb memory 20 Mb free disk space Network interface card Browser supported Microsoft Internet Explorer 5.0 or greater Opera 6.0 or greater The following features must be enabled in your browser settings. Accept third party cookies Java script enabled Cookies are needed to keep track of the user session. Java scripts are used by the web interface and must be enabled.

20 12 Intellipool Network Monitor 2.0 User's Guide Service logon account INM executes as a Windows service on the host machine and must be granted a Windows account with permission to access other Windows machines. Default INM is installed using the local machine account. We recommend that a special user account is created for the INM service, the account must have permission to access the following items on a remote machine. The following rights must be granted the new account Act as part of operating system Allow log on locally Log on as a service Profile system performance Profile single process The account password should be set to Password never expires The following agents can be affected by an account that is not allowed to access the above mentioned items. Process agent Disk size agent Swap size agent CPU load agent Memory size agent Service agent Event log agent File check agent Generic Windows Performance agent To verify that the account can access the resources need for INM to operate follow these steps. 1. Login on the INM host machine with the account created for INM 2. Start Perfmon.exe 3. Try to add a counter from a remote machine you wish to monitor with INM 4. If step 3 works continue with next step, otherwise check the account settings an begin from step 1 5. Open a file explorer window and try to access a default share of the machine you wish to monitor by typing the UNC path (ex. \\remotemachine\c$) 6. If you are asked to enter a user name and password to gain access you need to check the account settings and begin from step 5.

21 Chapter 2 Introduction 13 When the account have passed the test above configure the INM service to use that account instead of the local account. Net send The service "Messenger" must be running on both the INM host machine and the machine that the alert is sent to.

22 14 Intellipool Network Monitor 2.0 User's Guide SNMP monitoring ODBC logging Firewalls and routers To use the SNMP Agent the Windows SNMP service must be installed and started on the INM host machine. Consult the Windows documentation on installing the SNMP service. The data source used for ODBC logging must be a system data source. It cannot be a user data source because the INM service cannot access user data sources. INM uses many different ports and protocols to preformed agent tests. Its very important that firewalls and routers between the INM host machine and the monitored hosts are configured so traffic from and to the INM host machine can pass through. To get a complete list of assigned port numbers follow this link Anti virus programs and software firewalls Anti virus programs and software firewalls can cause INM not to work properly. Therefore we recommend not to run any software firewalls or anti virus program on the INM host machine. Monitoring Windows NT/2000/XP machines Monitoring Unix machines INM supports monitoring of all performance objects and counters on the following Windows versions. Windows NT 4.0 workstation and server with service pack 6 Windows 2000 Professional and server with service pack 3 Windows 2003 Standard and enterprise edition Windows XP professional Some agents uses the built in SSH2 client to access a Unix hosts in a secure fashion. These agents require a username and password to execute a command on the Unix machine and return the result. The agents that is using SSH2 and requires a username and password are: Disk size agent

23 Chapter 2 Introduction 15 DHCP Agent considerations Internal web server Web server security Swap size agent Process agent File check agent SSH2 agent (username/password optional) (1) SSH2 script agent (2) The account used for these agents must have the permission to execute the following commands: df k ps e -f free k ls -l --full-time (1) If no username/password is specified the agent does a simple connection test that works with SSH1 servers as well. (2) The agent executes a user specified command and the account must have permission to execute that command. The DHCP agent uses the MAC address of the first network interface card that is installed in the INM host machine to request an IP address from a DHCP server. It is important that the network interface card not is configured to use DHCP, the DHCP agent will try to request an IP address with the MAC address and then immediately release the address rendering the interface card with an invalid address. INM features a built in web server that delivers the interface to a browser. The web server is (default) using port 8080 (TCP), if another service is using port 8080 (TCP) INM will fail to open that port and will shutdown. The port used by the web server can be changed in the init.cfg file, INM needs to be restarted before the changes take affect. The built in web server can not write files to disk and reads the html template library only at startup. The template library is also protected with a strong encryption algorithm. The web server can be configured to only accept connection from a range of IP numbers. Information how to configure the IP numbers accepted by the web server can be found in the program settings page. By default the web server accepts all incoming connections.

24 16 Intellipool Network Monitor 2.0 User's Guide Backup of configuration repository File security User logon verifications Agent username and password SMS notification INM saves the configuration into a file called settings.nxd, after the configuration is successfully saved a copy is made. The file, named "settings.bak", is used by INM if the current file is invalid or missing. To make backup copies of the configuration repository, use the backup function in program settings page. Its not recommended that external programs take backups of the settings.nxd file while INM is running. More information about the backup function in the program settings page. All data files accessed by INM are encrypted with a strong encryption algorithm that protects the data from tampering and unauthorized use. INM uses only basic HTML for its interface to be compliant with almost any browser. Both the username and password identifying a user is sent back to INM unencrypted. Therefore the login page should NOT be treated as a secure login, only a basic user validation. If needed, encryption should be applied on lower OSI level to ensure that the connection not can be eavesdropped. When creating an agent both username and password is sent back to INM unencrypted. This is a weakness that could be exploited by a person with knowledge of IP networks. When viewing a created agent INM only sends the username to the browser, the password is masked with a random count of * signs. INM can send SMS messages directly if a GSM phone is connected to the INM host. INM uses the following commands to send a SMS. ATZ AT+CMGF AT+CMGS The GSM phone must comply with the GSM 7.05 standard. Check list for SMS phone installation: 1 Connect the phone cable to one of the INM host computers serial ports

25 Chapter 2 Introduction 17 2 Install the modem driver for your phone (if needed) 3 With a terminal program connect to the phone. 4 Try to send a SMS by typing the following ATZ AT+CMGF=1 AT+CMGS= PHONENUMBER INM SMS TEST Press CTRL-z 5 The SMS should now be sent, remember to replace PHONENUMBER with the number of the receiving phone and keep the quote signs (ex ). On the last line you should press the CTRL-z key combination. 6 The phone should answer with CMGS followed by a number indicating the ID of the sent SMS. 7 Select the serial port the phone is connected to in the "program settings" page. CMS Error codes Error Code 8 Operator determined barring 10 Call barred 21 Short message transfer rejected 27 Destination out of service 28 Unidentified subscriber 29 Facility rejected 30 Unknown subscriber 38 Network out of order 41 Temporary failure 42 Congestion 47 Resources unavailable, unspecified 50 Requested facility not subscribed 69 Requested facility not implemented 81 Invalid short message transfer reference value 95 Invalid message, unspecified 96 Invalid mandatory information 97 Message type non-existent or not implemented 98 Message not compatible with short message protocol state 99 Information element non-existent or not implemented 111 Protocol error, unspecified

26 18 Intellipool Network Monitor 2.0 User's Guide 127 Interworking, unspecified 128 Telematic interworking not supported 129 Short message Type 0 not supported 130 Cannot replace short message 143 Unspecified TP-PID error 144 Data coding scheme (alphabet) not supported 145 Message class not supported 159 Unspecified TP-DCS error 160 Command cannot be actioned 161 Command unsupported 175 Unspecified TP-Command error 176 TPDU not supported 192 SC busy 193 No SC subscription 194 SC system failure 195 Invalid SME address 196 Destination SME barred 197 SM Rejected-Duplicate SM 198 TP-VPF not supported 199 TP-VP not supported 208 D0 SIM SMS storage full 209 No SMS storage capability in SIM 210 Error in MS 211 Memory Capacity Exceeded 212 SIM Application Toolkit Busy 213 SIM data download error 255 Unspecified error cause 300 ME failure 301 SMS service of ME reserved 302 Operation not allowed 303 Operation not supported 304 Invalid PDU mode parameter 305 Invalid text mode parameter 310 SIM not inserted 311 SIM PIN required 312 PH-SIM PIN required 313 SIM failure

27 Chapter 2 Introduction SIM busy 315 SIM wrong 316 SIM PUK required 317 SIM PIN2 required 318 SIM PUK2 required 320 Memory failure 321 Invalid memory index 322 Memory full 330 SMSC address unknown 331 No network service 332 Network timeout 340 NO +CNMA ACK EXPECTED 500 Unknown error 512 User abort Paging INM can be integrated with Pagegate, paging server software from Notepage Inc. Pagegate can page user via numeric pagers, alpha numeric pagers and wireless phone standards not directly supported by INM. INM uses the GetAscii interface to communicate with Pagegate, before the GetAscii method can be used a directory must be created that both INM and the Pagegate server can access. The Pagegate settings can be found in the "program settings page. Refer to the Pagegate documentation how to setup Pagegate to poll from the GetAscii directory and how you create Pagegate users. Note that both the Pagegate users and INM operator Pagegate ID must be the same.

28 20 Intellipool Network Monitor 2.0 User's Guide CPU usage and threading INM is a highly threaded application that can take advantage of machines with more than one CPU. For each agent test INM spawns a new thread that executes the test. The action lists are executed in a separate thread and the INM core is running as a separate thread. The web server is running in a thread and each session is handled in a separate thread. This is why INM, unlike many other programs, can be scaled from monitoring just a few objects to several thousands objects without any modifications. This is an example of how threads are distributed in two different scenarios. When executing on a single CPU machine the same CPU executes all the threads. When a machine contains more than one CPU, the threads will be divided between the different CPU s making it possible to monitor more objects.

29 Chapter 2 Introduction 21 Memory usage To calculate the average agent/object memory usage the following numbers can be used. Type Size (bytes) Agent 1000 Agent statistical data Object 300 The INM executable consumes 11.5 mb. Example This example assumes 2 active data inputs per agent. To estimate the memory need of a 1000 agent, 100 object INM installation. Agent size 1000 x ( (16000 * 2)) = 31.4 mb Object size = 100 * 300 = = 29.9 kb INM executable = 11.5 mb Total memory consumption 31.4 mb mb kb = 42.9 mb This is the minimum memory consumption after 12 hours execution time, this value does not include error logs and other parameters. A good rule of thumb is to double the amount of memory indicated by this calculation.

30 22 Intellipool Network Monitor 2.0 User's Guide Installation check list Make a estimation of the number of objects and agents INM will monitor and using the numbers provided in the "Memory usage" section, calculate the estimated memory usage of INM. Check that the host machine has enough free memory to run INM. Make an port usage assessment and make necessary changes in firewalls and routers to make it possible for INM to test external devices Check that the host machine meets the software and hardware requirements Make sure that a Windows account that have the right privileges has been created and tested If Net send is going to be used, check that the "messenger" service is started. If SNMP will be used, install and start the Windows SNMP service on the INM host machine If ODBC logging will be used, create a ODBC system data source on the INM host machine. Make sure that no antivirus program is interfering with INM disk I/O operations and network communication. If a software firewall is installed on the INM host machine make sure it does not interfere with incoming or outgoing network communication Check that no other service is using port 8080, if so, change the port number in the init.cfg file after installation and restart INM. If a GSM phone will be used, install it and verify that it is responding correctly with a terminal program If a TempTrax Model F thermometer will be used, install it and verify that it is responding correctly with a terminal program Install Intellipool Network Monitor Assign the Windows account to INM in the service property page and restart the service

31 23 Getting started By following this guide you will learn the basics about INM configuration. To connect to the INM web server you can use the link created in the Intellipool Network Monitor program group or by entering the following URL in your web browser you connect to INM. If you are connecting to INM from another machine than the INM host, replace the localhost with the INM host machine name. When you connect to INM you will see the login page in the browser. The first time you login you must use the default account created for you when installing INM. Username Admin Password Admin Both fields are case sensitive. After you entered the username and password press the login button. You should change the password for the default account directly after you login the first time.

32 24 Intellipool Network Monitor 2.0 User's Guide Program settings The program settings page contains parameters that INM needs when performing different tasks. To open the program settings page click on the "Program settings" link in the "Settings" menu. GSM phone COM port If you installed a GSM phone and will be using the send SMS action or the send SMS scheduled event select the COM port where the phone is installed. Primary and secondary mail server The address is used by both the send mail action and scheduled send mail events. Specify the mail server you want to use as your primary mail server and optional a secondary backup server. Return address Creating new operator accounts Some servers are configured to refuse mail without a valid return address, if not specified correctly INM might not be able to send mail. You need to create at least one operator account or modify the precreated account in order to receive notifications. Open the operator page in the settings menu. Click on the New operator link in the task bar to create a new operator or click on the pre-created Admin operator to edit. User name and password In the operator property page you need to specify a user name (if you create a new operator) and a new password. address If you want to receive notifications you need to enter a valid e- mail address into the field. Phone number Enter the number to your GSM phone to receive notifications by SMS. Operator access Check the following checkboxes Groups Objects and agents read

33 Chapter 2 Introduction 25 Objects and agents write Schedules Settings Click on the Save button to save the operator account. Creating a new operator group INM users are called operators and are organized into operator groups. Each operator can be assigned to one or more operator groups. A group of operators can then be assigned to an object, the group will receive notifications in event of an alarm condition for one or more agents within that object. To create a new operator group or modify the pre-created open the operator groups page in the settings menu. Click on the New group link in the task bar to create a new operator group or click on the pre-created Admin group to edit. Name and description Enter a name and description of the group. Default group Check the checkbox if you want this group to be the default group assigned when creating new objects. Operators Select the operator you want to include into this group. Press and hold the ctrl key to select multiple operators. Click on the Save button to save the operator account.

34 26 Intellipool Network Monitor 2.0 User's Guide Creating new action lists An action list is a list composed of one or more pre-defined actions that can be executed upon an alarm event or a restart event. Each action list can be used as either an alarm action list (that are triggered when a agent enters a alarm state) or a restart action list (that are triggered when a agent in alarm state switches to ok state). The difference in between alarm action list and restart action list are that the alarm action list is executed based on the current alarm generation number. The step-by-step execution of an alarm action list can be useful to escalate notifications upon repeated alarms from an agent. When triggered all actions in a restart action list is executed. In this example we will only create one action list, used both for alarm and restart events. Click on the New list link in the task bar to create a new action list. Name and description Enter the name and description of the action list. Make default Check the checkbox to make this action list the default alarm list assigned to new objects. Click on the Save button to save the action list. Click on the name of the created action list to enter the action list info page. Click on the Add action link in the task bar to add a new action to the list. Select the Send mail action. Save the new action by clicking on the Save button. The new action list contains just one action, the send mail action. You will receive one mail when an agent enter the alarm state and one mail if it goes back to ok state.

35 Chapter 2 Introduction 27 Scanning for objects and agents INM can help you creating objects and agents by scanning a specified IP range. To open the auto scan page first open the Network list in the Network menu. Select the pre-created network and click on the Auto scan link in the Object list task bar. C-Subnet Enter the address of the c class net. Ex IP-range Enter the range in the c class net that should be scanned. If you enter 1-20 the addresses to will be scanned. Agent selection To speed up the auto scan process de-select the agent types you know are not present in your network. Note the DHCP agent will take approximate 1 minute to scan for, by de-selecting it you will greatly speed up the auto scan process. When done selecting the agent types to include in the auto scan click on the Yes button. When started, the auto scan process can take several minutes to complete. During the execution the auto scan process will show the detected hosts. Click on the Done button to return to the object list page.

36 28 Intellipool Network Monitor 2.0 User's Guide Assigning the restart list with global changes The auto scan process does not assign a restart list to the objects. We must therefore assign the restart list after the auto scan is complete. By using the global changes page you can assign a restart list to all selected objects. Open the global changes page in the Settings menu. In the object changes section. Restart action Select the created action list in the drop done box. Select objects Select all the objects in the list box by holding down the ctrl key and clicking on the name of the objects. Click on the Save button to assign the restart list to the selected objects. Summary INM is now configured and ready for use, the configuration in this example will send a mail to the operators if an agent fails a test 5 consecutive times and send a mail when the agent tests ok in alarm state. Each agent will be tested every sixty seconds, if the agent switches to alarm state it will be tested every ten minutes.

37 Chapter 2 Introduction 29 How to obtain updates Intellipool Network Monitor comes with a version check feature that can help you determine if there is a update available. The version control feature is only available for operator with system administrator access flag set. Proxy server If there is need to route outgoing requests via a proxy server the default proxy settings will be used. The default proxy settings can be specified in the program settings page. How do the version check feature work The version check feature sends a HTTP get request to Intellipool's web server, located at The page that the function retrieve contains information about the current version of INM. Does the version check feature send any information to Intellipool? The only information sent to intellipool is a normal HTTP get request, no other information is sent.

38

39 31 C HAPTER 3 Intellipool Network Monitor Concepts This chapters describes basic Intellipool Network Monitor concepts. In This Chapter Action lists...31 Auto scan...32 Data extraction...32 Dependency tree...32 Frequently used terms...32 Internal servers...34 Logging...34 Networks,Objects And agents...36 Operators and operator groups...36 Reports...37 Schedules...38 Test procedure...38 The configuration repository...39 Action lists An action list is a list composed of one or more pre-defined actions that can be executed upon an alarm event or a restart event. Alarm action list Alarm action list is assigned to objects and works as a to-do list in event of an alarm. Each action in an alarm action list has alarm numbers. The current alarm number is increased for every new alarm that the agent generates. When an agent switches from alarm to ok state the alarm number is reset. Restart action list The restart action list can optional be assigned to an object. The restart action list does not use the alarm number because the list will only be called one time, when the agent switch from alarm to failed state. After executing the restart list the agent switches from alarm to ok state.

40 32 Intellipool Network Monitor 2.0 User's Guide Auto scan Auto scan is a process that can automatically detect objects and add agents. The auto scan feature can scan a single IP address or a whole c class net. INM will not add duplicates if an address is scanned more than one time. Data extraction The data extraction interface can be used to integrate data from INM in a custom application or web site. Dependency tree Agents can be organized into dependency trees when you want to test agents in a specific order. The dependency trees makes sure that only the first agent with an alarm state is executing its alarm action list. Dependency trees can be useful in a scenario when you want to test a chain of agents and you want the most significant agent to send the alarm and not the following agents in the chain. Frequently used terms This table describes some frequently used terms used in INM. Term Agent Object Network Alarm state Failed state Ok state Action Action list The representation of a remote service or protocol. Defined as a network peer, is the parent of one or more agents. A collection of objects. A network is an entity that is used to organize related objects. The agent has failed n tests and the state is set to Alarm. The agent has failed a test but has not yet met the alarm generation criteria. Initial state of an agent. A command to execute a predefined function. A list containing one or more actions.

41 Chapter 3 Intellipool Network Monitor Concepts 33 Restart action list Alarm action list Operator Operator group Dependency tree Alarm generation Alarm test interval Auto scan Alarm event Test interval Restart event A type of action list that can be assigned to an agent to instruct it what to do when an agent switch from alarm to ok state. A type of action list that can be assigned to an agent to instruct it what to do when the agent switch ok state to alarm state. A INM user. A group of operators that can be assigned to objects and agents. A tree representation of a network, the tree consists of agents that are tested in a specific order. The ordering can prevent that several agent sends alarms having the same root problem. The number of consecutive failed tests before the agent switch from ok to alarm state. The time between the tests when agent is in alarm state. INM can automatically scan both single IP numbers or whole C nets for services and/or protocols to monitor. Occurs every time an agent with alarm state failing its test including the time it switches from ok to alarm state. Time in seconds between tests. Occurs when the agent in an alarm state succeed with a test.

42 34 Intellipool Network Monitor 2.0 User's Guide Internal servers INM includes a number of servers that is used for user interface, extracting data from INM and other functions. XML server The xml server is used by external application (such as the INM Notifier application) to extract data from INM. The transmission of data between the XML server and the client is encrypted and a logon procedure must take place before the client is granted access. Syslog server The internal syslog server can receive syslog messages from other syslog servers or syslog enabled applications, syslog agents can poll message received. The syslog server must be enabled before the syslog agents are created/activated. The syslog server supports the UDP protocol. Web server INM have a built in web server that is used for the user interface. By default the web server listen to the port 8080 to not interfere with a normal web server. Logging During the execution INM will save important information into to a log that can be directed to several different destinations. XML log file ODBC database Syslog Eventlog

43 Chapter 3 Intellipool Network Monitor Concepts 35 XML log file The log file is placed in the directory "logs" and is named systemlog.xml. The style sheet used by the XML file is called systemlog.xsl. ODBC log The ODBC log can create a database or you can specify an already created database to place the log table log into. The ODBC driver must support insert, use and create table command and if you wish INM to create the database for you it must also support the create database command. The ODBC data source must be of System datasource type. The log table is created with the following fields: Field Length Type Time 64 Char Object 64 Char Agent 64 Char Text 255 Char No index is created for the table log. Syslog INM can send log information to a syslog daemon. You have to specify destination and port to a host that have a syslog server running. The INM syslog client is using the UDP protocol and port 514 by default. Event log INM will store information into the Windows Event log under the Application log folder. INM will enter a path into the Windows registry telling the Event log where it can find the inmservice.exe file.

44 36 Intellipool Network Monitor 2.0 User's Guide Networks,Objects And agents The object/agent model An object is defined as a peer in a network, for example a computer, firewall or a router. An agent is a protocol or service executing hosted by an object. The object contains global information such as IP address and default action lists for alarm and restart actions, agents contain specific information that is used to perform a test. Networks A network is a collection of one or more objects. Networks can be used to organize related objects based on for example customer or geographic location. Operators and operator groups INM users are called operators and are organized into groups. An operator is defined by the following information: Username Password address Phone number (SMS notification) Pagegate username Name Address Phone number Cell phone number Additional text INM will use the information to validate logon attempts and when contacting the operator in the event of an alarm. Each operator can be assigned to one or more operator groups. A group of operators can be assigned to an object, the group will receive notifications in event of an alarm condition for one or more agents within that object. Access rights control what an operator can change and what objects the operator has access to.

45 Chapter 3 Intellipool Network Monitor Concepts 37 Reports INM has the ability to store statistical data from agents and produce reports based on that data. Reports in INM are composed by a number of different components. Template A template contains general "look and feel" parameters and can be reused for different reports. Data input A data input is a stream with statistical data from a agent, each agent can have several data inputs with different types of data. Report A report is based on a template and can contain graphs, comments and custom images. Each graph can be composed of up to 4 data inputs. Data storage All statistical data that is generated by an agent is stored in a file located in the "statistics" sub directory. When the file has grown larger than 10 mb INM will switch to a new file and rename the old file with the current date. INM will never delete a statistical file and it is the administrators responsibility to ensure that there is enough disk space to store statistical data. Sample resolution The minimum sample time is 5 minutes, if the agents does test more often the result record will be an average for the last 5 minutes. Real time charts Cached statistical data for the last 12 hours can be shown in the agent info page if the "display" option is enabled.

46 38 Intellipool Network Monitor 2.0 User's Guide Schedules With schedules you can schedule operator work hours, object downtime and events. Operator schedule Operator schedules can be used to control the work hours of an operator. The operator will just receive notifications from INM on the hours that are defined in his/her operator schedule. If no schedule is defined the operator will always receive notifications. Maintenance schedule Maintenance schedules can be used to plan downtime of an object. During a maintenance period no testing will be preformed on the object and its agents. The maintenance schedule can be a single maintenance period or a repeating maintenance period. Event schedule Event schedules can be used to start execution of actions on a single occasion or on a repeating schedule. Test procedure All active agents are tested within a specified test interval, the interval is specified in seconds. The alarm generation value defines how many consecutive failed tests until the first alarm is generated. If that alarm generation value is five, the agent need to fail five tests before it switches from ok to alarm state. If the agent fails three times and the fourth time tests ok the counter will be reset to zero. The alarm delay value defines the time between the tests when the agent is in an alarm state.

47 Chapter 3 Intellipool Network Monitor Concepts 39 The configuration repository INM will store all information in a configuration repository that is placed in the same directory that the INM executable. The configuration repository is encrypted with a strong encryption algorithm that will ensure that only INM can read the information. The configuration is automatically saved when you alter some data in INM. The configuration repository is a file named settings.nxd. Every time the repository is saved a backup file called settings.bak is created.

48

49 41 C HAPTER 4 How to use Intellipool Network Monitor Intellipool Network Monitor is administrated trough a modern web interface that is made to be as easy to understand as possible. This chapter covers the user interface and how to perform common tasks. In This Chapter Action lists...43 Dependency trees...46 Frequently used user interface terms...49 Global changes...50 Index page and menus...52 My settings...53 NOC view...55 Networks, objects and agents...57 Operators and operator groups...75 Program settings...81 Reports...91 Schedules System administration...111

50 43 Action lists An action list is a series of actions executed when triggered by an external event. The event can be when an agent switches state from ok to alarm, then the action list is called an alarm action list. When an agent switches state from alarm to ok it s called a restart action list. The action lists can be accessed from the main menu Settings. Send mail Sends an to operators and/or extra recipient Send SMS Sends an to operators and/or extra recipient Paging via Pagegate Page an operator via Pagegate. Execute windows command Executes a user defined windows command. Execute command via SSH2 Executes a user defined command trough a SSH2 connection. Start service Start a windows service. Stop service Stops a windows service. Pause service Pause a windows service. Continue service Continues a paused windows service. Restart service Restarts a windows service. List reset Can be used only in alarm action list, resets the current position so the next action performed will be the first in the list

51 44 Intellipool Network Monitor 2.0 User's Guide Net send Sends a notification using the Windows net send command. Wake-on-LAN Sends a WOL packet to a remote host to start the host. The host must support AMD s Magic Packet standard. Clear event log Clear the event log on a Windows host. Event log name should not contain the Log postfix for the standard event logs system, application and security. SNMP Set Sends a SNMP set command to a SNMP enabled host, requesting to change a value identified by a OID (Object Identifier). Creating a action list To create a new list press the New list link on the action list task bar. Field Name Make default Name of the list, as it will appear in the alarm/restart selection list in the object property page. A description of the action list Makes the action list the default alarm action list. New objects will be assigned the default list when created.

52 Chapter 4 How to use Intellipool Network Monitor 45 Press the Save button to save the action, press, Cancel to discard the new action list. Select the action list to add new actions to by clicking on the name of the action list. Adding a action to the action list To add a new action to an action list press the Add action link on the Actions task bar. Select the action by clicking on the name of it, or click on the Cancel button to return to the Action list info page. Deleting an action Deletes the current action list. If the action list is assigned as an alarm action list to an object, the objects alarm action list is replaced with the default action list. The default action list cannot be deleted. If the deleted action list is assigned as a restart action list to one or more objects the objects are not assigned a new restart action list.

53 46 Intellipool Network Monitor 2.0 User's Guide Dependency trees Agents can be organized into dependency trees when you want to test agents in a specific order. The dependency tree tests the agents in a predefined order, when a node enters alarm states the test of the child nodes are ignored. The dependency trees page can be accessed from the main menu "Settings". There is no restriction how many dependency trees that can be created but the different trees cannot contain the same agents. Column Name Delete Name of the dependency tree of the dependency tree Deletes the dependency tree, the agents are returned to normal test order. New dependency tree To create a new dependency tree press the "New dependency tree" link on the task bar. Field Name Test time Name of the dependency tree of the dependency tree Approximate test time for the entire dependency tree

54 Chapter 4 How to use Intellipool Network Monitor 47 Alarm generation Ignore deactivated Active Alarm generation count for all agents in the tree Check this box to ignore deactivated objects and networks while testing the tree Active/deactivate state for the dependency tree Press the "Save" button to save the new dependency tree. Press the "Cancel" button to discard the new dependency tree. Adding agents to a dependency tree To add agents to the dependency tree click on the name of the dependency tree in the dependency tree page Column Expand/collapse (no text) New node/new child Agent Status (no text) Delete (no text) A symbol is shown in this column when a nod contains on or more child. You can collapse and expand this node by clicking on this symbol The command buttons for adding new parallel node or new child to the current node Initial empty. When a node is created an agent can be assign to it by clicking on the "Select agent" text Shows the current status of the agent Deletes a node and all children to that node

55 48 Intellipool Network Monitor 2.0 User's Guide A new dependency tree does not contain any agents. To add the first node in the tree click on the arrow icon. Continue to add nodes and child nodes to the tree until you have created a tree that represent the desired test order. When the test order is defined agents can be assigned to each node by clicking on the text "Select agent". The select agent page contains all agents that are not assigned to a dependency tree. Select one agent from the list and press the "Ok" button to assign that agent to the node in the dependency tree. The test starts when the tree is complete. The agent that's currently tested is highlighted with a darker background color. The agents are indented in the order they are tested. Removing agents from a dependency tree To delete an agent in a dependency tree click on the "trash can" icon right most in the list of agents. When you delete an agent all of its child nodes will also be deleted. Note that this only delete the agent from the dependency tree, it will not be deleted from the object. Deleting a dependency tree To delete a dependency tree click on the "trash can" icon to the right of the dependency tree name. Deleting a dependency tree will not delete the agents, the agents will return to test in the normal way.

56 Chapter 4 How to use Intellipool Network Monitor 49 Frequently used user interface terms Some frequently used user interface terms Term Page Table Link Task bar Refers to a INM interface web page A table is used to present information in an orderly fashion. All table headers can be used to sort information in ascending or descending order. A link is a static text that links to a functions, the text is always shown in dark blue On a page such as the Operator list the heading is followed by one or more links, that area is called the task bar While using INM you will notice that some icons is used on different pages to indicate common operations. Here follows a list of the most used icons. Icon Indicates that a schedule is in-active or that a operator has been assigned a schedule that s in-active Indicates that a schedule is active or that a operator has been assigned a schedule that s active Edit properties Status ok Status failed Status alarm Status deactivated. Placing the mouse cursor over this icon displays the source of the deactivation, which can be a network, object or an agent. The icon links to the deactivated network, object or agent. Mandatory field Delete Maintenance mode Enumeration tool, all valid values for fields with this symbol can be enumerated.

57 50 Intellipool Network Monitor 2.0 User's Guide Global changes The global changes page can be used to alter one or more parameters of both agents and objects. The global changes page can be accessed from the main menu "Settings". Object changes This section of the page can be used to change parameters of one or more objects. Field Operator group Alarm action Restart action Select to change the operator group responsible for the objects. Select to change the alarm action list of the objects. Select to change the restart action list of the objects.

58 Chapter 4 How to use Intellipool Network Monitor 51 Select object(s) Select the objects to apply the changes to. To select more than one object press and hold the Ctrl key while selecting. Agent changes This section of the page can be used to change parameters of one or more agents. The parent objects are listed before their agents in the list. Field Test interval Alarm generation Alarm action Restart action Delete agent(s) Statistics storage Modify statistics Select agent(s) New test interval for selected agents. Leave blank to keep the current value. New alarm generation for selected agents. Leave blank to keep the current value Select to change the alarm action list of the agents Select to change the restart action list of the agents Check this box to delete the selected agents. Modify storage of statistics for the selected type. Use the Ctrl key to select multiple types. Enable or disable storage of the above statistics parameters. Select the agents to apply the changes to. To select more than one agent press and hold the Ctrl key while selecting. To apply the changes press the "Save" button. To exit the page without applying the changes press the Cancel button. The changes will take effect the next time an agent is tested.

59 52 Intellipool Network Monitor 2.0 User's Guide Index page and menus The index page is displayed after you logon and shows important state information about agents, objects and recent log events. The main menu is always shown at the top of each page. In the main menu you can access each section in INM by using the drop down menus. If you want to go back to the index page you can click on the "Intellipool Network Monitor" logotype above the main menu. The main menu also contains the "Logout" button where you can click to end your session To safely end a session press the logout button. If the browser is closed without pressing the logout button the session will be active for 1 minute after the browser is closed. My settings page The "my settings" page contains contact information, username and password. The operator can change the settings without having access to the operator page. History bar

60 Chapter 4 How to use Intellipool Network Monitor 53 INM keeps track on the last pages you have visited and organize them into the history bar.to access one the pages in the history bar you just click on the desired link in the history bar. On the right side of the history bar a "i" symbol is placed, if the "i" symbol is pressed a small window with a summary information about the current page is shown. The information window also contains a link to the relevant chapter in the documentation. My settings My settings page contains parameters that the operator can modify without access to the operator page. The page can be accessed by clicking on the "My settings" link in the menu.

61 54 Intellipool Network Monitor 2.0 User's Guide Field name Username Password Operator group SMS number Pagegate user Tip of the day Compression Name of the operator, used for login and identification Operator password The operator is a member of the groups listed in field. Operator address, used when sending notifications to operator by . You can specify multiple addresses by separating them with a comma. Operator mobile phone number, used when sending notifications to operator by SMS. Username in Pagegate system Displays tip of the day on the index page. Threshold in Kb before compressed data is sent from the webserver. Default zero (no compression) To save the operator press the Save button, to cancel the operation press Cancel.

62 Chapter 4 How to use Intellipool Network Monitor 55 NOC view The NOC view (Network Operation Centre) is designed as a read only view that can be used as a information screen. There is two different versions of the NOC view, one displaying objects on the vertical axis and one displaying networks on the vertical axis. The NOC view should be displayed in the browsers full screen mode, both Opera and Internet Explorer can be switched to full screen mode by pressing the F11 key. The vertical axis displays either objects or networks, the horizontal axis displays a sum of the agents in each of this objects or networks. The agent column will reflect the status of all the agents of this type, if one agent is in alarm state this will override the other agents and the column will display a red light. In the left upper corner of the agent list a large colored rectangular area is shown. This reflects the overall status of the system, if one agents is in alarm status the area will be colored red. Log The log table will show the five latest log items. Operator information The NOC view contains information how may operators that is logged on to INM and how many operators that are on duty. A operator is considered "on duty" if he/she is in a active operator scheduled. Deactivation status In the to right corner of the NOC view a summary of deactivated networks, objects and agents is displayed.

63 57 Networks, objects and agents Creating a agent To create a new agent open the object information page of object that will be the parent of the agent. Click on the "Add agent" link in the task bar and select a agent type from the list.

64 58 Intellipool Network Monitor 2.0 User's Guide If more than one agent is selected from the list the agents will be created in a de-activated state and the object information page will be shown. Click on the "Ok" button create the agent and edit the agent properties. Field Required Name Yes Display name of the agent Test interval Yes Time in second between tests Alarm generation Yes How many consecutive failed tests until the first alarm is generated Alarm delay Yes Time in seconds between tests after the first generated alarm Alarm action list No Action list used when agent enters alarm state (overrides object setting) Restart action list No Action list used when agent exit alarm state (overrides object setting) Username No Username, used by some agents

65 Chapter 4 How to use Intellipool Network Monitor 59 Password No Password, used by some agents Active Agent active/de-activate switch Log downtime No Enable/disable downtime log Display/store No Enable/disable of storage and display of statistical data. When done editing the agent properties click on the "Save" button to save the agent. Delete a agent Agent information page To delete an agent click on the thrash can icon of the agent. The agent information page displays summary information about the agent. Column Name Object Status Type Alarms Test interval Alarm delay Name of agent. Name of parent object. Links to object information page. Shows the current state of the agent. If the parent object is in maintenance mode the status lamp is override by the maintenance symbol Type of agent Number of generated alarms Time (in seconds) between the tests of the agent Test time (in seconds) when the agent is in alarm state Alarm generation Specifies the number of failed tests before the agent switches state from ok to alarm state

66 60 Intellipool Network Monitor 2.0 User's Guide Next test Shows the time to the next test Alarm action list Shows the assigned alarm action list, if the field is blank the objects alarm action list is used. Restart action list Shows the assigned restart action list, if the field is blank the objects restart action list is used Uptime Current status Last status changes Acknowledge alarm The consecutive time the agent has tested ok. If the time is prefixed by an asterisk ( * ) the time indicates the consecutive time the agent has been in alarm state Displays a status message generated by the most recent test Displays the latest status changes (ie. when the agent switches between ok and alarm) with time and status message When the agent is in alarm state the "acknowledge alarm" link is displayed in the task bar. Acknowledge alarm can be used to send notification that the current operator is handling the alarm to the rest of the operators in the operator group assigned to the agents parent object. The acknowledge message can be sent via , SMS or PageGate. When executed the agent will be disable and the status of the agent set to ok. Properties Shows the agent property page where you can change agent parameters. Test now Sets the time to next test to zero seconds, that will cause the agent to start a new test immediately. Activate/Deactivate Activates or deactivates the agent. Delete Deletes the agent.

67 Chapter 4 How to use Intellipool Network Monitor 61 Agent list page The agent list page shows a summary of all the agents Column Name Properties Object Status Type Alarm count (AC) Uptime Next test Delete Name of agent. Links to agent info page Links to agent properties. Name of parent object. Links to object information page Shows the current state of the agent or if the object is in maintenance mode Type of agent If agent is in alarm state the field will show the number of generated alarms The consecutive time the agent has tested ok. If the time is prefixed by an asterisk ( * ) the time indicates the consecutive time the agent has been in alarm state Shows the time to the next test Icon that will delete the agent if clicked. User has to confirm the deletion Agents with alarms page All columns except the property and delete column can be used to sort the list content. The agent with alarms page shows only agents that have enter alarm state. The layout of the page are identical to the Agent list page.

68 62 Intellipool Network Monitor 2.0 User's Guide Agents by type page The agents by type page sort all agents into a tree structure. The nodes in the tree structure each contain one agent type and show the overall state of the agents in the node. Agent mini list page This page show the agents only with their status lamp making it possible to show the status for a large number agents with out the need to scroll in the browser window. If you hold the mouse cursor above a status lamp a tool tip will show more information about the agent. If you click on the lamp you will be redirected to the agent info page.

69 Chapter 4 How to use Intellipool Network Monitor 63 Creating a network To create a new network click on the "New network" option in the "Network" menu. Enter the network properties and click on the "Save" button to create the network. Network properties Field Required Name Yes Display name of the network of the network Active Changes the active/deactive status of the network and all child objects. Make default Makes the network the default network. All objects that are created with autoscan will be placed in the default network. When creating a new object the default network will be selected.

70 64 Intellipool Network Monitor 2.0 User's Guide Contact information The contact information part of the network properties are a collection of optional information. The contact information can be included in s sent to operators. Field Required Company Company name Address 1 Contact address Address 2 Contact address Phone Phone number of contact person Fax Company fax number Contact Name of contact person of contact person Cellphone Cellphone number of contact person Additional Additional information Delete a network To delete an network click on the thrash can icon of the network. All objects in the network will be moved to the default network. The default network can not be deleted.

71 Chapter 4 How to use Intellipool Network Monitor 65 Network info page The network information page provides an overview of the selected network. The page can be accessed by clicking on the network name in one of the network pages. The page contains information about the network and a list of the objects in the network. Properties Shows the network property page where network parameters can be changed. Delete Deletes the network and moves the objects to the default network. The default network cannot be deleted Activate/Deactivate Fast activation/deactivation of all objects/agents in the network. Network auto-scan The auto scan process can be very useful when a large number of objects must be created. The process can scan up to 255 IP address at the same time. The process scans for objects and place them in the network. There is no need to wait for the operation to complete, the auto scan process can run in the background.

72 66 Intellipool Network Monitor 2.0 User's Guide Field C-subnet Enter the C subnet address (Ex ) IP-range Include agents Enter the range within the C-subnet to scan. Example To start the auto scan press the Start button. INM will scan the address range to and including Select the agent types you want to scan for, to reduce the time it takes to scan for objects/agents select only the agents that are present in the network The progress page will show the status of the auto scan process, the progress indicator shows how much of the process is completed. The list contains the object the auto scan found. If an object already exists it will not be re-scanned and a message already in list will show. The auto scan process will try to resolve the IP number into a hostname and assign that as the name of the object when possible. The network auto scan can be repeated any time to add new objects to the network.

73 Chapter 4 How to use Intellipool Network Monitor 67 Network list page The network list page shows a summary of all the networks. Column Name Status Delete Name of network. Links to network info page Shows the current state of the network Icon that will delete the network if clicked. User has to confirm the deletion

74 68 Intellipool Network Monitor 2.0 User's Guide Network by agent type page The network list page shows a summary of all the networks sorted by agent type. Column Name Status Delete Name of network Shows the current state of the network Icon that will delete the network if clicked. User has to confirm the deletion

75 Chapter 4 How to use Intellipool Network Monitor 69 Creating a object To create a new object either click on the New object link in the Object list task bar or use the "New object" link in the desired network. Field Name Address Use template (only available to new object) Operator group Alarm action list Restart action list Network Active Name of object. Links to object info page The address of the object. IP number or any name that can be resolved by a DNS. of the object. Select to initialize this object with agents from the selected object template. The agents inherits all parameters from the agents in the object template. Select the operator group which the object should be administrated by. If not altered the default operator group will be used. Select the default alarm action list for the agents belonging to this object (Each agents can be assigned another action list to override this list). Select the default restart action list for the agents belonging to this object (Each agents can be assigned another action list to override this list). Select the network that this object should be a member of. The default network is selected by default. If checked the object is marked as active and testing of agents will be performed.

76 70 Intellipool Network Monitor 2.0 User's Guide Wake-on-LAN Template Mac address of the network interface card to use with wake-on-lan action. Check this box to allow this object to be used as an object template. Press the Save button to create the new object. Delete a object To delete an object click on the thrash can icon of the object. This operation will also delete all the agents associated with this object. Object information page The object information page provides an overview of the selected object. The page can be accessed by clicking on the object name in the object list. The object view also contains a list with the agents belonging to the object.

77 Chapter 4 How to use Intellipool Network Monitor 71 Properties Shows the object property page where object parameters can be changed. Deactivate/Activate Fast deactivation/activation of all agents that belongs to the object. Create dependency Makes it possible to create a dependency tree of the current object or insert the current object as a dependency tree branch in a existing dependency tree. Delete Deletes the object, all agents that belongs to the object will also be deleted. Agent list The agent list shows the agents that belong to the object. The columns hold information about the state of the agent. From the agent list you can access the agent information page, agent property page and delete the agent. Add agent Add one or more agents to the object. If more than one agent is created the new agents is de-activated by default. Auto scan The auto scan searches for new agents in the current object. It should not be confused with Network auto scan which searches for new objects.

78 72 Intellipool Network Monitor 2.0 User's Guide Creating dependency To create a dependency tree from the current object click on the "Create dependency" in the object information page. Field Select tree Tree name Root agent Child agents Select an existing dependency tree to insert this tree as a root branch Specify a name of a new dependency tree Selects the root agent of this dependency tree Select the child agents to the root agent, the child agents will be inserted under the root agent in the tree hierarchy. Click on the "Ok" button to create the new dependency tree or cancel to abort the operation. Importing objects The import object feature can be used to quickly create a large number of objects from a text file containing object definitions.

79 Chapter 4 How to use Intellipool Network Monitor 73 The text file must be formatted according to the following rules. Object_name ; Object_destination ; Object_description [;Object_template] CR+LF Field Object_name Object_destination Object_description Object_template Name of object. Links to object info page The address of the object. IP number or any name that can be resolved by a DNS. of the object. Optional parameter, name of a current object that will be used as a template for the new object. The new object will inherit the templates agents and network. Each line in the import file must be terminated with carriage return (CR) and line feed (LF). Each field in must be separated with a semicolon ( ; ).The maximum size of the file to import is one megabyte. The feature can only be accessed by operators with the system admin flag set. To import a file, select a file from the local machine and press the import button. If any errors occur during the process an error message will be displayed. If the process was successful the object list will be shown. Object list page The object list page shows a summary of all objects created. From this page you can create new objects, modify objects and delete objects. For more information about the relationship between objects and agents read the introduction chapter. Column Name Properties (no text) Name of object. Links to object info page Links to object properties

80 74 Intellipool Network Monitor 2.0 User's Guide Status/Maintenance (no text) Address Operator group Network Delete agent Shows the status of the agents belonging to the object. If the object is in maintenance mode the status lamp is override by the maintenance symbol Address to object, either a numeric IP address or a doted host name Shows the assigned operator group Network that object belongs to. Links to Network information page Icon that will delete the agent if clicked. User has to confirm the deletion All columns except the property and delete column can be used to sort the list content.

81 75 Operators and operator groups Create an operator group To create new groups press the New group link on the task bar. Field name Name Default group Available operators Current members Group manager Name of the group, used for identification, cannot be a duplicate. of the operator group If checked the group is the default group assigned to created objects and agents. List of operators that can be included into this operator group. Select an operator and press the "Add" button to add the operator to this group. The operator will be moved to the "Current members" box when added. List of current members in the operator group. To remove an operator from the group, select the operator and click on the "Remove" button. Designates a group manager that will be contacted upon an alarm if no other operators are available (if scheduling conflict should occur or the other operator not has valid contact information) in the group.

82 76 Intellipool Network Monitor 2.0 User's Guide The fields post fixed with the mandatory symbol ( ) must be entered. To save the operator press the Save button, to cancel the operation press Cancel. Delete an operator group Change the default operator group To delete a operator group click on the delete icon in the operator group list. The default group cannot be deleted. If a group that currently is assigned to objects the object will be assigned the default group. To switch the default operator group (the group assigned to new objects and agents), open up the new default operator group s property page. Check the Default group page and save the operator group. The new default group will be assigned to all new objects.

83 Chapter 4 How to use Intellipool Network Monitor 77 Create an operator To create a new operator click New operator on the operator list task bar. Field name Username Password Operator group Name of the operator, used for login and identification Operator password Free text field The operator is a member of the groups listed in field. When the operator is created this field will initial be blank. Use the operator group page to add the operator to an operator group. Operator address, used when sending notifications to operator by . You can specify multiple addresses by separating them with a comma.

84 78 Intellipool Network Monitor 2.0 User's Guide SMS number Pagegate user Contact name Contact phone Contact Cellphone Contact address 1 Contact address 2 Additional info Tip of the day Compression Operator mobile phone number, used when sending notifications to operator by SMS. Username in Pagegate system Name of operator Phone number Cell phone number Address line Address line Other additional information Displays tip of the day on the index page. Threshold in Kb before compressed data is sent from the webserver. Default zero (no compression) The operator access options can be used to revoke/grant access. The read flag grants the rights to view lists but not information pages. If both modify and read flag are checked the modify flag overrides the read flag. Field name Operators & groups Networks Objects Agents System admin Action lists Dependency lists Schedule Reports Settings Owner objects Add/edit/delete operators and operator groups. If only the read flag is checked the operator is granted read only access. Add/edit/delete networks. If only the read flag is checked the operator is granted read only access. Add/edit/delete objects. If only the read flag is checked the operator is granted read only access. Add/edit/delete agents. If only the read flag is checked the operator is granted read only access. Check this box to make the operator system administrator. The system administrator will receive mail about serious system errors, gets access to the import objects function and system wide data extraction capability. Add/edit/delete action lists. Add/edit/delete dependency lists. If checked the operator can add, edit and delete schedules If checked the operator can add, edit and delete reports and report templates. If checked the operator can modify program settings If checked the operator is only shown the objects and agents that are assigned to the operator group(s) he/she is a member of. Log entries on index page will be restricted to those generated by objects monitored by the assigned operator group.

85 Chapter 4 How to use Intellipool Network Monitor 79 Auto login The auto login feature enables the operator to access the agent list and agents by type pages directly without the need to login. The following URL format can be used. To access Agent list as user Admin To access Agent by type as user Admin To access Agents with alarms as user Admin To access the network list as user Admin The fields post fixed with the mandatory symbol ( ) must be entered. To save the operator press the Save button, to cancel the operation press Cancel. Delete an operator To delete a operator, click on the delete icon in the operator list. The last operator with permission to create new operators cannot be deleted.

86 81 Program settings The program settings contain generic program settings, log configurations and PageGate settings. The scope of the settings is global, for example, changing the refresh time affects all users. To apply changes you must save the settings by clicking on the "Save" button.

87 82 Intellipool Network Monitor 2.0 User's Guide

88 Chapter 4 How to use Intellipool Network Monitor 83 Generic settings Disable INM These two options are only shown to a user with system administration rights. If option "tests" is checked all testing will be disabled, if option "actions" is checked no actions will be executed. Refresh time The refresh time controls the update time for certain pages (ex. Agent list and agents by type). Select the time from the predefined values in the combo box. GSM phone COM port If you want to use the Send SMS action you need to connect a GSM phone to the INM host machine. The combo box shows the current com ports installed on the INM host machine. Select the com-port that the phone is attached to. PIN Code Optional PIN code field. Some GSM phone solution requires INM to send the PIN code before sending a message. Enter the 4 digit PIN code in this field. SMTP server The SMTP server is used when sending notifications to users, enter the address (in number form or a DNS name) to the SMTP server you want to use. Note that the SMTP server must be able to accept all the addresses you are planning to use. This is the primary SMTP server that normally will be used. SMTP server 2 The secondary SMTP server is used when INM cannot connect to the primary SMTP server. Return address Some SMTP servers are configured to only accept incoming s with a valid return address. Since INM is unable to receive s you must define an account that can receive s that are returned for some reason. Test interval The default test interval in seconds. INM will use this value as the default test time for agents created with auto scan and will be inserted in the "Test interval" field when you create a new agent.

89 84 Intellipool Network Monitor 2.0 User's Guide Alarm generation The default alarm generation count. INM will use this value as the default alarm generation count for agents created with auto scan and will be inserted into the "Alarm generation" field when you create a new agent. Alarm delay The default alarm delay in seconds. INM will use this value as the default alarm delay time for agents created with auto scan and will be inserted into the "Alarm delay" field when you create a new agent. Alarm message The default alarm message setting enables you to customize the information sent to an operator upon an alarm. Into the text you can insert flags that are expanded when the message is compiled and sent. The following flags can be used. Flag %T Current time %O Object name %D Object destination/address %A Agent name %E Agent error message %L Distribution list %X Dependency tree status %S Object description %N Network name %I Network contact information Restart message The default restart message setting enables you to customize the information sent to an operator upon a restart of an agent. Into the text you can insert flags that are expanded when the message is compiled and sent. The following flags can be used Flag %T Current time %O Object name %D Object destination/address %A Agent name

90 Chapter 4 How to use Intellipool Network Monitor 85 %E Agent error message %L Distribution list %X Dependency tree status %S Object description %N Network name %I Network contact information %C Status report for latest test performed Acknowledge message The default acknowledges message enables you to customize the message sent to other operators when you acknowledge an alarm. Into the text you can insert flags that are expanded when the message is compiled and sent. The following flags can be used. Flag %T Current time %O Object name %D Object destination/address %A Agent name %S Object description %N Network name %P Current operator, the operator who acknowledged the alarm Alarm subject The default alarm subject enables you to customize the subject line in the message sent upon an alarm. Into the subject line you can insert flags that are expanded when the message is compiled and sent. The following flags can be used. Flag %T Current time %O Object name %D Object destination/address %A Agent name %N Network name

91 86 Intellipool Network Monitor 2.0 User's Guide Restart subject The default restart subject enables you to customize the subject line in the message sent upon a restart. Into the subject line you can insert flags that are expanded when the message is compiled and sent. The restart subject line can use the same flags as the alarm subject line. Acknowledge subject The default acknowledge subject enables you to customize the subject line in the message sent upon acknowledge of an alarm by an operator. Into the subject line you can insert flags that are expanded when the message is compiled and sent. The acknowledge subject line can use the same flags as the alarm subject line. Syslog server Check this flag to start the internal syslog server. The server will start (or stop) when you save the settings. The internal syslog server must be started before using syslog agents. Syslog server port The port number the syslog server will listen on for syslog messages. If the server already is running you need to stop and start the server to apply the new port number. Syslog server PTTL The syslog server stores the entire syslog message for a period of time so the syslog agents can fetch the messages from the server when they are tested. The packet time to live value should be greater than the test time of all the syslog agents otherwise the agents might miss packets. The packets will be deleted from the internal syslog server according to the time to live value if a syslog agent does not retrieve them. IP connection list In this field you can specify which IP number range is allowed to connect to the INM web interface. If the field is empty no restrictions applies. If you should enter an invalid IP range you can always connect to the interface from the INM host machine. Example Allows every client with an IP number in-between and including this range to connect. More rules can be added below the first line. Example 2

92 Chapter 4 How to use Intellipool Network Monitor Allows a single host to connect. XML server Starts or stops the internal XML server. The XML server can be used with the INM data extraction API and the INM agent. The XML server must be start if you want to monitor INM with another INM host. XML server port Port number used by XML server. To apply a new port number when the server is start you need to first stop the server and then start it. Login notice Shows a custom login notice at the login page. Default is blank. Telnet login prompt Some agents and actions can use Telnet instead of SSH2. INM needs to know the format of the telnet server login prompt. Specify one or more possible login prompts that exist on the different monitored machines. Separate multiple entries with a comma. Telnet password prompt Some agents and actions can use Telnet instead of SSH2. INM needs to know the format of the telnet server password prompt. Specify one or more possible password prompts that exist on the different monitored machines. Separate multiple entries with a comma. Telnet prompt Some agents and actions can use Telnet instead of SSH2. INM needs to know the format of the telnet server command prompt. Specify one or more possible command prompts that exist on the different monitored machines. Separate multiple entries with a comma. Backups Check this flag to enable automatic backup of the INM configuration repository. Backup interval Select the frequency of the automatic backups. Each backup will create a new backup file in the directory "nxdbackup" in the INM root directory.

93 88 Intellipool Network Monitor 2.0 User's Guide Log settings Windows event log Enables INM to log information into the "Application" event log. ODBC log Enables INM to log information to an ODBC connected database. If INM fails to open the ODBC data source this flag will be unchecked, refer to the log file for more information about the error. ODBC datasource Name of the ODBC data source. It must be a valid system data source registered in the Data source administrator Windows utility. It cannot be a user data source, INM cannot access user data sources since INM is installed as a service. ODBC database Name of the ODBC database. INM will create a table called "log" in the specified database, if the database does not exists INM will create it (if the ODBC driver support database creation). ODBC username Username for the ODBC data source. ODBC password Password for the ODBC data source Syslog Enables INM to send log information to a syslog server. This function should not be confused with the internal syslog server. The syslog client is only used to send information to another syslog server. Syslog address The address of the syslog server receiving the log information. Syslog port The port number of the syslog server.

94 Chapter 4 How to use Intellipool Network Monitor 89 Pagegate integration Interface method Currently INM only supports the "GetAscii" interface. Polling directory A directory where INM will write information that the PageGate server will pickup for delivery. The directory can be any valid UNC path.

95 91 Reports Before any reports can be created storage of data must be enabled. This is done in the agent property page. Notice that there is two options, display and store. Storage can also be enabled using the global changes page. Display This option enable logging for real-time charts in the agent info page. No data is saved to disk. Data is saved internal for about 12 hours. Each agent will consume about 16 kb of memory per data source. Store This option enables storage to disk, records will be stored on disk and can be used to generate reports. Creating a report template To create a new template click on the "New template" link in the template task bar.

96 92 Intellipool Network Monitor 2.0 User's Guide Template properties Field Name Header Footer Logotype Logotype placement Default Name of the template of the template Header text in report Footer text in report Logotype image included in the report. To add logotypes to the list, place images in the \reports\image\logo subdirectory and reload the view. Alignment of logotype image Check this option to make this template the default template. Graph template properties Field Color scheme Background 1 Background 2 Grid color Text color Pre created color scheme. If you want to define your own color scheme use the fields below. Custom XY axis background color Custom chart background color Color of the grid Color of the text Line color 1 Line color of data input 1 Line color 2 Line color of data input 2 Line color 3 Line color of data input 3 Line color 4 Line color of data input 4

97 Chapter 4 How to use Intellipool Network Monitor 93 To create a custom color scheme select the "Custom" color scheme option and enter the color values in the fields below. The format of the color specification is hexadecimal RGB (Red, Green and Blue), each element has the range between 00 and FF. Example White FFFFFF Red FF0000 Blue 0000FF Green 00FF0 Yellow FFFF80 Save the report by clicking on the "Save" button. You can preview the template by clicking on the template name in the template list.

98 94 Intellipool Network Monitor 2.0 User's Guide Creating a report To create a new report click on the "New report" link in the report task bar. Enter a name and description of the new report and select the appropriate template for this report. Click on the "Save" button to continue to the next step. When the report is created at least one graph should be added. A graph describe a data type, time period and size. The graph can contain up to 4 different data inputs. A data input is the actual data that has been saved by the agent. To add a graph open the report and click on the "Add graph" link in the "Items" task bar.

99 Chapter 4 How to use Intellipool Network Monitor 95 Adding a graph Field Header Footer Period User offset or period Data type Data options Fill Size Legend Summary Header text describing the graph. You can use the following format flags: %P - time period of graph Text placed after the graph Time period for graph data. The choices are relative to the date and time the report is executed User defined offset or fixed time period. To use a fixed time period for comparison enter two dates here in the format YYYY-MM-DD. Or specify the number of days to be used as offset in the first textfield. The type of data that is to be shown in the graph. The graph can only contain one type of data. Display average, min or max values in the graph If the graph should be filled (selected) or lines (unselected) Width and height of graph in pixels. Min size 250 x 100, Max size 1024 x 512 Includes a legend describing the data plotted in the graph. Include statistical summary per input or for all inputs

100 96 Intellipool Network Monitor 2.0 User's Guide Adding a comment Comments is a free text field that can be added to the report. Click on the "comment" link in the "items" task bar. Field Text Text displayed in the comment item Adding a image Images can be inserted into the report. The images is loaded from the subdirectory \reports\images\. Click on the "image" link in the "items" task bar to create a image item. Field Image Image placement Select the image to insert in the report. Horizontal alignment of the image Adding data inputs to a graph Each graph can contain up to 4 data inputs. To add a new data input to a graph, click on the graph in the item list and click on the "Add input" link. Select the input and press the "save" button. Viewing a report Stored reports can be viewed directly in the browser by clicking on the "view" link in the report info page task bar. Reports can also be viewed by clicking on the view icon in the report list page.

101 Chapter 4 How to use Intellipool Network Monitor 97 Schedule a report Reports can be executed and sent to recipients automatical using a scheduled event. To create a schedule report event open the schedule page and click on the "New event" link in the "event schedule" task bar. Select the "Generate report" link.

102 98 Intellipool Network Monitor 2.0 User's Guide Event properties Field Report Operator group Operator Recipient Select the report to schedule. Select to send report to all operators in this operator group Select to send report to a specific operator Enter a specific recipient Single event schedule Fields Date Time Expires The date the event period should be triggered Time of day to trigger the event If checked the schedule will be deleted when it expires. Repeating event schedule Fields Active between Expires Day of week Hours in day Last in month Day(s) in month Enter between which dates the event schedule should be active. Leave both fields blank to make the schedule permanently active. If checked the schedule will be deleted when it expires. Select the days that the schedule should be active. Specify a start time of the event in day selected to trigger the event. Select if the event should be triggered in the last day of month. Enter specific day numbers in month. Click on the "Save" button to save the event and return to the schedule page. Copy a report To create a copy of a report click on the "Copy" link in the report info task bar. The copy will be named "Copy of..." and placed in the report list. Delete a report To delete a report use the delete link in the report info page or click on the trash can icon in the report list.

103 Chapter 4 How to use Intellipool Network Monitor 99 a report To a report with out creating a scheduled event use the function in the report list. Click on the icon for the report to . Use the drop down boxes to select a operator group and/or a operator, optionally a extra recipient address can be entered in the "Recipient" field. Click on the "OK" button to the report.

104 101 Schedules Schedules are used to control the work hours of operators, execute actions on a given time and to define scheduled downtime of objects. The schedule page is divided into three parts, operator, maintenance and event schedules.

105 102 Intellipool Network Monitor 2.0 User's Guide Creating a operator schedule Operator schedules can be used to control the work hours of an operator. The operator will receive notifications from INM on the hours that are defined in the operator schedule. If no schedule is defined the operator will always receive notifications. The period that marks the work hours of an operator in a schedule is called blocks. A block is defined as a period of days and contains a set of rules that controls on which hours the operator is on duty in the block. Several blocks can be stacked together to compose a schedule that has alternating work hours for an operator. Example. An operator can work between and every weekday except Saturday and Sunday in the first block that runs for a week (7 days). In the next block the operator is scheduled between and every weekday except Saturday and Sunday. The active period for the schedule must specify an start day and optionally a end date. The end date of the schedule is the date when the schedule stops being active, if no end date is specified the schedule will be repeated. Each operator that is scheduled is marked with a icon ( ) in the operator list page. To add a new schedule click the "New schedule" link on the operator schedule task bar. Field Schedule name Active start Active end Expire Name of the schedule of the schedule Date when the schedule becomes active (YYYY- MM-DD) The end date of this schedule (includes this date). Leave this field blank if you want to create a repeating schedule. If checked the schedule will be deleted when it expires.

106 Chapter 4 How to use Intellipool Network Monitor 103 Click the "Save" button to save the schedule and return to the schedule list page. Click on the name of the new operator schedule to add new blocks. A block is a period of time that defines when the operator is active. One or more block can be added to the schedule to define a repeating time period describing when a operator is on duty.each block is defined by a set of rules and length of the block, the length of the block is defined in days. When a block is created a set of rules must be added to the block. The rules defines when the operator is available with in the time period defined by the block. The rule also defines which operators that are affected by this block. One rule limitations exists, a rule cannot be defined for a time period that spans two days. If you want to create a rule that spans between 17:00 and 07:00 the following day, you must create two rules that spans between to and to To add a new block click on the "Add block" link in the task bar.

107 104 Intellipool Network Monitor 2.0 User's Guide Specify the length of this block and click on the "Save" button to proceed to the block definition page. Select the days, time and operators that should be affected by this rule. Click on the "Save" button to save this rule. Column Block Status (no text) Length Move (no text) Delete (no text) Summary of the block definition and commands for deleting and modifying the block A light is shown if the schedule is active. Length of block in days If more than one block is defined you can move the order of the block with the arrows. Deletes the block.

108 Chapter 4 How to use Intellipool Network Monitor 105 The example operator schedule above defines 3 rules within the a block that spans over seven days. Rule # 1 Operator Admin is on duty between 07:00 and 17:00 every day except Saturday and Sunday. Rule #2 Operator Robert is one duty between 17:00 and 23:59 every day except Saturday and Sunday. Rule #3 Operator Robert is one duty between 00:00 and 07:00 every day except Saturday and Sunday. The operator schedule will be from active and the block rules will repeat every week.

109 106 Intellipool Network Monitor 2.0 User's Guide Creating a maintenance schedule Maintenance schedules can be used to plan downtime of an object, during the maintenance period non of the agents belonging to the object will be tested. The maintenance schedule can be a single maintenance period or a repeating maintenance period. The single period maintenance mode defines an absolute period by date, time and length of maintenance period. The repeating maintenance period can be configured to a certain day in the week, last day in month, fixed day interval or fixed days in month. Example 1 Single maintenance period that starts and lasting two hours the fifth of June Example 2 Repeating maintenance period that starts the first of June 2002 and ends last of June and repeats every monday in week between and To create a new maintenance schedule click on the "New schedule" link in the maintenance schedule task bar.

110 Chapter 4 How to use Intellipool Network Monitor 107 Field Object(s) Time Downtime Select the objects this maintenance schedule should apply to. Press and hold the ctrl key to select multiple objects. Time of day when the maintenance period starts. Length of maintenance period in hours and minutes. A maintenance schedule can be either a single maintenance schedule or a repeating event. Single maintenance schedule Field Date Expires The date the maintenance period should start If checked the schedule will be deleted when it expires. Repeating maintenance schedule Field Active between Expires Day of week Every N day Last in month Day(s) in month Enter between which dates the maintenance schedule should be active. Leave both fields blank to make the schedule permanently active. If checked the schedule will be deleted when it expires. Select the days that the schedule should be active. Maintenance period repeats every N days. Can be combined with Day of week. Select if the maintenance should start at the last day in month. Enter specific day numbers in month. Click on the "Save" button to save this maintenance schedule.

111 108 Intellipool Network Monitor 2.0 User's Guide Creating an event schedule Event schedules can be used to start execution of actions on a single occasion or on a repeating schedule. To create a new scheduled event click on the New event link on the task bar. Event type Send mail Send SMS Paging via PageGate Execute windows command Execute command via SSH2 Start service Stop service Pause service Continue service Restart service Clear event log Wake-on-lan Send mail to operator, group or other recipient Send SMS to operator, group or other recipient Page operator or group via Pagegate Execute command on INM host Execute command on a remote host via SSH2 Start a Windows service Stop a Windows service Pause a started Windows service Continue a paused Windows service Stops and then starts a Windows service Clear the event log on a Windows host. Event log name should not contain the Log postfix for the standard event logs system, application and security. Sends a broadcast packet to a network interface card ordering the host machine to start. The host bios must support WOL and the network interface card must support AMD Magic Packet standard.

112 Chapter 4 How to use Intellipool Network Monitor 109 Generate a report Generates a report and sends it to recipients by Select the type of event to schedule in the type selection page. In this example we will use the send mail type. Field Operator group Operator Recipient Mail text Send mail to operator group Send mail to a specific operator Extra recipient of the mail The text of the mail sent to the recipients. Single event schedule Fields Date Time Expires The date the event period should be triggered Time of day to trigger the event If checked the schedule will be deleted when it expires.

113 110 Intellipool Network Monitor 2.0 User's Guide Repeating event schedule Fields Active between Expires Day of week Hours in day Last in month Day(s) in month Enter between which dates the event schedule should be active. Leave both fields blank to make the schedule permanently active. If checked the schedule will be deleted when it expires. Select the days that the schedule should be active. Specify a start time of the event in day selected to trigger the event. Select if the event should be triggered in the last day of month. Enter specific day numbers in month. Click on the Save button to the event schedule.

114 Chapter 4 How to use Intellipool Network Monitor 111 System administration The system administration page can be accessed by operators with the "sys admin" flag set. The page contain system wide functions for maintenance and license registration. License and version information The section contain license key registration and version check feature. Enable/disable tests This function enables (enabled by default) or disables all testing done by INM. The state of the flag is saved in the settings file Enable/disable actions This function enables (enabled by default) or disables all execution of actions. The state of the flag is saved in the settings file Enable/disable statistical storage This function enables (enabled by default) or disables all storage of agent statistics. The state of the flag is saved in the settings file Rebuild statistical database If any of the statistical database files are damaged this function can be used to attempt to re-create the files and remove bad data. This function can take some time to execute. System shutdown This function enables the system administrator to shutdown INM. All settings will be saved and log information flushed to disk before the shutdown starts. Note that both check boxes must be selected before you can press the shutdown button, to prevent that the system in brought down accidently.

115 113 C HAPTER 5 Agent documentation In This Chapter Bandwidth agent CPU load agent DHCP agent Disk size agent DNS agent Event log agent File check agent FTP agent HTTP agent ICA agent IMAP4 agent INM agent LDAP agent Memory size agent Network interface load agent NNTP agent ODBC agent Ping agent POP3 agent Process agent RDP agent Service agent SMTP agent SNMP agent SNMP Trap agent SSH2 agent SSH2 script agent Swap size agent Syslog agent TCP port scan agent Telnet agent TempTrax agent Text file scan agent TFTP agent Winperf agent...154

116 114 Intellipool Network Monitor 2.0 User's Guide Bandwidth agent Auto-scan The agent measures the transfer speed between INM and an object. The test measure the time it takes to downloads 20 kb data from the Chargen service. The Chargen service must be installed on the object in order to perform this test. Parameters Parameter name Transfer speed Measured in kilobit per second. Error messages Text Cannot connect to host Host connection terminated unexpectedly Current connection speed N kbit/sec is lower than threshold (N kbit/sec) The agent was unable to connect to the host within the socket timeout time. Connection terminated by the monitored host while the agent was reading or writing the socket. The test indicates that the transfer speed is below the specified threshold. The Chargen service must be installed and running on the object. The Chargen service uses port 19 (TCP) by default. Note that the transfer speed is in kilobit per second. If this agent is created by an auto scan process it is deactivated by default.

117 Chapter 5 Agent documentation 115 CPU load agent Windows supported The agent monitors CPU usage on a Windows host. Parameters Parameter name CPU number Maximum load Detailed report The number of the CPU on the host. Zero based index. The maximum allowed CPU load in percent. The alarm report will contain all processes and their current CPU usage. Error messages Text Test failed, cannot connect to remote performance monitoring subsystem. Test failed, can not find instance Test failed, CPU load monitoring not enabled on target machine CPU(N) usage N %, threshold set to N % The agent was unable to connect to the host remote performance monitoring subsystem. The most common cause to this problem is that the service account assigned to INM does not have the required rights to access the host. The agent was unable to find the CPU number that was entered into the CPU number field. The CPU number does not exist on the monitored host. The agent was unable to find the CPU performance object on the monitored host. The current CPU usage is above the specified threshold. INM must be installed with a user that has access rights to the Windows host.

118 116 Intellipool Network Monitor 2.0 User's Guide DHCP agent Auto-scan The DHCP agent can verify that a DHCP server is able to lease IP addresses to clients. The agent returns the retrieved address to the DHCP server immediately after it received the address. Error messages Text The DHCP client can not retrieve a MAC address for the local network adapter Can not connect to host Can not bind DHCP server port The DHCP server indicated that it has no address to offer client Operation did not complete, server response missing The agent was unable to retrieve the MAC address of the local network interface card. The agent was unable to connect to the DHCP server within the socket timeout time. The agent was unable to bind the socket to the DHCP server port. Another application or DHCP client blocks the agent. The DHCP server was unable to offer the agent an IP number. The error message indicates that the DHCP server does not have any free IP address to lease to clients. The DHCP server did not answer the client s request to lease an IP number within the timeout limit (1 minute). It is very important that the INM host machine is not using DHCP for its own network interface card. If the host machine use DHCP the result could be that INM is releasing the IP address belonging to the machine. INM uses the MAC address of the first installed network card to request an IP address from the DHCP server.

119 Chapter 5 Agent documentation 117 Disk size agent Auto-scan Windows and GNU/Linux The agent monitors free disk space on a Windows or Unix host. Parameters Parameter name Disk name Presentation unit Use Windows share Minimum free size Use telnet The name of the disk to monitor. Select the unit to use in the real-time chart. If checked the test is performed using a Win32 API function instead of Windows performance API. The smallest free size of the specified disk in megabytes. Use the telnet protocol instead of SSH2 Error messages Text Test failed, cannot connect to remote performance monitoring subsystem. Test failed, can not find instance Test failed, disk size monitoring not enabled on target machine Free disk space(n) N mb, threshold set to N mb Invalid response from host The agent was unable to connect to the host remote performance monitoring subsystem. The most common cause to this problem is that the service account assigned to INM does not have the required rights to access the host. The agent was unable to find the disk name that was entered into the disk name field. The disk name does not exist on the monitored host. The agent was unable to find the disk performance object (logical disk) on the monitored host. The disk has less than specified amount of free space left. The Unix host response was not valid and the agent was unable to parse the response.

120 118 Intellipool Network Monitor 2.0 User's Guide The Windows test uses the registry interface to monitor a disk on the local machine or a remote machine. The Unix test uses SSH2 to logon to a Unix host and needs a username and password to perform the test. The command that is used is df -k, the agent parses the returned string to find out the current free size of the specified disk. If the telnet protocol is used instead of SSH2 the telnet default parameters must be properly set in the program settings page. The agent can also monitor a Windows disk using an alternative method, this requires that a share be specified as Disk name instead of a volume. The agent does not support enumeration of shares. The alternative method can be used if the diskperf function not is enabled on the monitored machine.

121 Chapter 5 Agent documentation 119 DNS agent Auto-scan The agent connects to a specified DNS server and tries to translate a specified address into another address form. The entered address can be in number form ( ) or in the name form ( Parameters Parameter name Name The address to use for translation test. To test more than one addresses at the time separate the addresses with a semi colon in this field. Error messages Text Host record query failed. The DNS server was unable to translate the address. More information about the nature of the error can follow this error text.

122 120 Intellipool Network Monitor 2.0 User's Guide Event log agent Windows supported The agent reads the event log and search for messages that matches the entered parameters. Only event log entries created after the previous test are considered. This agent type has alarm generation set to one (1) so it triggers an alarm when a machine event log record is found. Do not alter the alarm generation number. The agent will always restart on the next test after an alarm since it uses the information from the previous test to determine the status of the event log. You should assign an empty restart list to agents of this type to avoid unnecessary restart messages. Parameters Parameter name Event ID Event type Log name Source string Include string(s) Exclude string(s) Include message Ignore open errors Event id number. To include all event id s, specify 1 in this field. The type of event the agent should search for. The name of the log to scan. The source of the event. If one or more strings exists in the event record message text the record is included in the test (if the other criteria s is meet). If one or more strings exists in the event record message text the record is NOT included in the test (if the other criteria s is meet). If checked the message text is include into the error report. Check this flag to ignore errors generated when the agent failed to open the event log. This option can eliminate alarms if the host of the event log is down. Error messages Text Can not connect to event log, access denied The agent was unable to connect to or read the host event log. The most common cause to this problem is that the service account assigned to INM does not have the required rights to access the host. More information in the Planning and consideration chapter. To ignore this type of error check the Ignore open errors flag.

123 Chapter 5 Agent documentation 121 Found matching event log record The agent has found one or more event log records that matched the entered parameters. After the text follows a detailed description of the event log message. INM must be installed with a user that has access rights to the event log on the host. Example 1 The message text of the event record should contain the user name Administrator but not the username Robert. Set include string to Administrator Set exclude string to Robert Example 2 The message text of the event record should not contain the user name Robert. Leave include string blank Set exclude string to Robert. To extract the message text from the event log record INM needs to read information from the DLL or application file that contains the event log record definition. This is done in 3 steps. 1. INM searches the local computer for the file, if found step 3 2. INM searches the monitored computer for the file 3. Opens the file and reads the event log record information If INM does not find the requested DLL, then the include/exclude test will be skipped. Message files can be copied into the INM host machines system directory or the INM root directory to speed up the search. The agent automatically excludes all log items that is logged by Intellipool Network Monitor to avoid a agent/log loop behavior.

124 122 Intellipool Network Monitor 2.0 User's Guide File check agent Windows, GNU/Linux and Aix supported The agent can check a file for modifications on both Unix and Windows hosts. The Unix part uses SSH2 to connect to the host machine. The agent saves the information about the size of the file and the date/time each test it performs, that information is used in the next test to determine if the file has changed. This agent type has alarm generation set to one (1) so it triggers an alarm when the file changes. Do not alter the alarm generation number. The agent will always restart on the next test after an alarm since it uses the information from the previous test to determine the status of the file. You should assign an empty restart list to agents of this type to avoid unnecessary restart messages. Parameters Parameter name Path Date Larger size Smaller size Path and filename (ex. c:\text.txt) Checks if the file is modified. Checks if the file grows in size Checks if the file decreases in size Error messages Text File N could not be opened Error when executing query, can not find file N File N has been modified File N has grown in size File N size has decreased The agent was unable to open the specified file. File was not found or opened by another process with exclusive right. The file was not found on the monitored host. The file has been modified since last test. The file time stamp has changed. The file size has increased since the last test. The size of file has decreased since the last test. The file check agent is dived into two parts. The Windows part of the agent uses SMB to monitor a file. The Unix test uses SSH2 to logon to a Unix host and needs a username and password to perform the test. The command that is used is ls -l --full-time, the agent parses the returned string to check the status of the file.

125 Chapter 5 Agent documentation 123 FTP agent Auto-scan The FTP agent checks if a FTP server responds to a login and a directory search. The purpose of the directory search is to verify that the storage backend is working properly. Parameters Parameter name Port number The command channel port number Error messages Text Invalid response from host Can not connect to host The agent received wrong response code from the FTP server. The expected code was 220. The agent was unable to connect to the ftp server within the socket timeout time. If no username or password is provide a simple connection test is preformed. The simple test is also preformed on auto scan.

126 124 Intellipool Network Monitor 2.0 User's Guide HTTP agent Auto-scan The HTTP agent can test a HTTP server connection and validate the content of the received page. It can verify that the content delivered by the HTTP server is the same as the previous test. It can also search for a string in the content and verify links on the web pages. The agent needs to execute one test before it shows the link it can verify in the property view. Parameters Parameter name Port number Page URL Search String Checksum Verify links Use secure HTTP Cert Store. Cert Subject Proxy server Proxy port Port number used to connect to the HTTP server. The complete URL of the page to download. The string the HTTP agent will search for in the downloaded page A flag that instructs the agent to calculate a checksum for the downloaded page and store it for future tests. The option to verify links on the web page will be shown after the first test is completed. To enable verification of a link check the corresponding checkbox. Enables support for secure communication via SSL or TLS. Name of the system certificate store. Should only be used with the secure HTTP option. String in subject line of certificate. Should only be used with the secure HTTP option. Address of a proxy server Proxy server port number Error messages Text Cannot connect to host Invalid response from host Agent parameter error The agent was unable to connect to the HTTP server within the socket timeout time. The data received from the HTTP server was an invalid HTML page. One or more parameters are invalid. Check agent configuration.

127 Chapter 5 Agent documentation 125 To many redirections Can not find string N in page N Checksum for page N has changed, before N, now N The link N did not respond HTTP standard error code 400 to 600 The agent can only follow up to 255 redirection. The redirection depth of the page was larger than 255 steps. The search string is missing in the received HTML page The content of the HTML page has been changed since last test. The agent was unable to get a response from the specified link. The test returned an error code according to the HTTP standard. If you want to reset the checksum test (if the page has been updated) you only need to open the agent properties un-check the checksum flag and save it, then open the agent properties and check the checksum flag and save the agent. If using the secure HTTP feature a server can request a client to identify itself with a certificate, the agent can be configured to use a certificate placed in a system store on the local machine, example of common store names are MY or CA. The certificate is identified by a string in its subject line.

128 126 Intellipool Network Monitor 2.0 User's Guide ICA agent Auto-scan The agent checks that an ICA server is responding to connection attempts. Parameters Parameter name Port number Port number used to connect to the ICA server. Error messages Text Cannot connect to host The agent was unable to connect to the ICA server within the socket timeout time.

129 Chapter 5 Agent documentation 127 IMAP4 agent Auto-scan The agent tests if it can login and select a mailbox. The purpose of the test is to verify that the authentication and storage part of the IMAP4 server is working. Parameters Parameter name Port number Inbox name The port number where the IMAP4 server responds. The name of the users inbox. Error messages Text Cannot connect to host Host connection terminated unexpectedly The agent was unable to connect to the IMAP server within the socket timeout time. Connection terminated by the monitored host while the agent was reading or writing the socket. Invalid response from host Can not logon to IMAP4 server, possible wrong username or password Can not select inbox N, possible wrong inbox The agent received wrong response code from the IMAP server. The expected code was * OK. The server refused the agent to logon. Check username and password. The server refused to allow the agent to select the specified inbox. Check if the inbox name is correct. If no username or password is provide a simple connection test is preformed. The simple test is preformed on auto scan.

130 128 Intellipool Network Monitor 2.0 User's Guide INM agent Auto-scan The agent checks that a Intellipool Network Monitor server is running. The agent connects to the XML server running on the remote installation of Intellipool Network Monitor. Parameters Parameter name Port number Port number used to connect to the remote INM server. Error messages Text Cannot connect to host Host connection terminated unexpectedly The agent was unable to connect to the XML server within the socket timeout time. Connection terminated by the monitored host while the agent was reading or writing the socket. Invalid response from host The agent received a invalid response from the XML server.

131 Chapter 5 Agent documentation 129 LDAP agent Auto-scan The agent checks if a LDAP server is responding to a lookup request. Parameters Parameter name Domain name LDAP domain name. Error messages Text Error opening LDAP connection LDAP bind operation failed The agent was unable to connect to the LDAP server. The LDAP bind operation failed because the username, password or domain was invalid.

132 130 Intellipool Network Monitor 2.0 User's Guide Memory size agent Windows and GNU/Linux supported The agent monitors free memory in a Windows or Unix machine. Parameters Parameter name Minimum free size Use telnet The smallest free size of the memory in megabytes. Use the telnet protocol instead of SSH2 Error messages Text Test failed, cannot connect to remote performance monitoring subsystem. Test failed, can not find instance Test failed, memory size monitoring not enabled on target machine Free memory N mb, threshold set to N mb Invalid response from host The agent was unable to connect to the host remote performance monitoring subsystem. The most common cause to this problem is that the service account assigned to INM does not have the required rights to access the host. More information in the planning section. The memory size instance does not exist on the monitored host. The agent was unable to find the memory performance object on the monitored host. More information in the planing section. The host has less than specified free memory. The Unix host response was not valid and the agent was unable to parse the response. The Windows test uses the registry interface to monitor free memory on the local machine or a remote machine. The Unix test uses SSH2 to logon to a Unix host and needs a username and password to perform the test. The command that is used is free -m, the agent parses the returned string to find out the current free memory size. If the telnet protocol is used instead of SSH2 the telnet default parameters must be properly set in the program settings page.

133 Chapter 5 Agent documentation 131 Network interface load agent Windows 2000/XP The agent monitors the load of a network interface card (NIC) on the local host or remote host. The purpose of the test is to verify that the NIC on the host not exceeds a certain traffic volume. Parameters Parameter name NIC name Max bytes per second The full name of the NIC. The maximum number of bytes transferred on this NIC per second. Error messages Text Test failed, cannot connect to remote performance monitoring subsystem. Test failed, can not find instance Test failed, NIC monitoring not enabled on target machine Network interface N current network load (send/received) N bytes, the N byte limit passed The agent was unable to connect to the host remote performance monitoring subsystem. The most common cause to this problem is that the service account assigned to INM does not have the required rights to access the host. More information in the planning section. The memory size instance does not exist on the monitored host. The agent was unable to find the NIC performance object on the monitored host. More information in the planning section. The total bytes transferred are exceeding the specified value. INM must be installed with a user that has access rights to the host. The name of the network interface card can be found in the network properties on the host machine. This agent cannot test Windows NT 4 hosts.

134 132 Intellipool Network Monitor 2.0 User's Guide NNTP agent Auto-scan The agent checks if a NNTP (Network News Transport Protocol) server can be connected to and that it returns a valid return code. Parameters Parameter name Port number Port number used to connect to the NNTP server. Error messages Text Cannot connect to host Host connection terminated unexpectedly The agent was unable to connect to the NNTP server within the socket timeout time. Connection terminated by the monitored host while the agent was reading or writing the socket. Invalid response from host The agent received wrong response code from the NNTP server. The expected code was 200.

135 Chapter 5 Agent documentation 133 ODBC agent The ODBC agent can check if an ODBC database can be opened and accessed, it can also execute a SQL query and compare the returned result with a predefined value. Parameters Parameter name Data source name SQL query No rows fail Compare value Operation The name of the database that will be used in the test. This must be a system data source. Optional SQL query to execute Test will fail if no rows is returned by query User defined compare value, only numerical values are valid. Operation used to evaluate the returned result and the predefined compare value. Error messages Text Open of database failed Returned result does not evaluate equal to compare value Returned result is equal to compare value The agent was unable to open the specified data source. Equal test. The returned string is not equal to the compare string. Not equal test. The returned string is not equal with the compare string. Returned result is less or equal to compare value Returned result is greater or equal to compare value Returned result is less to compare value Returned result is greater to compare value Greater than test. The return string is less or equal with the compare string Less than test. The return string is greater than or equal with the compare string Greater or equal than test. The return string is less than the compare string. Less or equal than test. The return string is greater than the compare string The computer running INM will need a proper ODBC driver installed for the agent to work. Check with the Windows documentation how to install and verify that the driver works. Only system data sources can be tested with this agent, user data sources can not be tested.

136 134 Intellipool Network Monitor 2.0 User's Guide Ping agent Auto-scan The agent uses the ICMP protocol to verify that a host is responding to ping packets within a pre-defined time. The agent can also verify that packets lost during test are below the specified value. Parameters Parameter name Timeout value Packet loss Packets to send Include trace Alt. IP Largest round trip time the agent will wait for the ping packet to return from the host. Specified in milliseconds Max packets lost when transmitted to host. Specified in percent of total sent packages. The number of packets to send each test. A higher value will yield a more exact packet loss and round trip time values. If checked a trace route log is included in the alarm message. Secondary IP to test. The agent can ping an alternative IP number in the same test. Error messages Text Could not load ICMP.DLL Wrong version of ICMP.DLL Ping timeout Ping round trip time N ms, threshold set to N ms Packet loss N %, threshold set to N % Secondary IP: Ping round trip time N ms, threshold set to N ms Secondary IP: Packet loss N %, threshold set to N % The agent failed to load the external system library ICMP.DLL. Make sure that the INM host machine has the ICMP.DLL located in a system directory. The agent loaded the DLL but it is the wrong version. The expected version is or higher. The host did not respond to the ping packet. The host did respond but the round trip time was higher than the maximum round trip time specified. The packet loss was higher than the specified maximum packet loss value The secondary IP of the host did respond but the round trip time was higher than the maximum round trip time specified. The packet loss of The secondary IP was higher than the specified maximum packet loss value

137 Chapter 5 Agent documentation 135 The ping protocol is one of the protocols with lowest priority in a network. Some host does not respond to ping packets by default. We recommend that the ping agent be used with caution since the protocols nature may cause INM to issue unwanted alarms. The round trip time is an average of the total round trip time for all sent packages. The packet loss is only considered if the round trip time is within the specified range.

138 136 Intellipool Network Monitor 2.0 User's Guide POP3 agent Auto-scan The agent connects to a POP3 mail server and verifies that it can logon to the server and check for mail (without affecting the status of the mailbox). The purpose is to verify that the POP3 authentication works and that the storage part of the mail server is working. Parameters Parameter name Port number Port number used to connect to the POP3 server. Error messages Text Cannot connect to host Host connection terminated unexpectedly The agent was unable to connect to the POP3 server within the socket timeout time. Connection terminated by the monitored host while the agent was reading or writing the socket. Invalid response from host Invalid server response to command USER from POP3 server Invalid server response to command PASS from POP3 server Invalid server response to command LIST from POP3 server The agent received wrong response code from the POP3 server. The expected code was +OK. The server refused the agent to logon. Check username. The server refused the agent to logon. Check password. The server refused the agent to list the content of the mailbox. Check that the user has the rights to browse the mailbox. If no username or password is provide a simple connection test is preformed. The simple test is preformed on auto scan.

139 Chapter 5 Agent documentation 137 Process agent Windows, GNU/Linux and AIX supported The agent can verify that a process is running on a Windows or Unix host. Parameters Parameter name Process name Port number Username Password Use telnet The full name of the process to watch. The number of the SSH2 port on the host machine(if Unix host).. Username (if Unix host). Password (if Unix host). Use the telnet protocol instead of SSH2 Error messages Text Test failed, cannot connect to remote performance monitoring subsystem. Test failed, can not find instance Test failed, process monitoring not enabled on target machine Process N not running Invalid response from host The agent was unable to connect to the host remote performance monitoring subsystem. The most common cause to this problem is that the service account assigned to INM does not have the required rights to access the host. More information in the planning section. The process instance does not exist on the monitored host. The agent was unable to find the process performance object on the monitored host. More information in the planning section. The process was not found in the list of currently running processes on the host machine. The Unix host response was not valid and the agent was unable to parse the response. The Windows test uses the registry interface to monitor a process on the local or remote machine. The Unix test uses SSH2 to logon to a Unix host and needs a username and password to perform the test. The command that is used is ps e f, the agent parses the returned string to find out if the process is running. If the telnet protocol is used instead of SSH2 the telnet default parameters must be properly set in the program settings page.

140 138 Intellipool Network Monitor 2.0 User's Guide RDP agent Auto-scan The agent checks that a terminal server using the RDP 5.0 protocol is responding to connection attempts. Parameters Parameter name Port number Port number used to connect to the terminal server. Error messages Text Cannot connect to host The agent was unable to connect to the terminal server within the socket timeout time.

141 Chapter 5 Agent documentation 139 Service agent Windows supported The agent verifies that one or more Windows services are running. Parameters Parameter name Service name Name of the service to monitor (the service name found in service control manager). Separate multiple service names with a comma. Error messages Text Test failed Failed to check status of service N Service N is not running The agent was unable to connect to the host service control manager. The most common cause to this problem is that the service account assigned to INM does not have the required rights to access the host. More information in the Planning and consideration chapter. The agent was able to connect to the service control manager but failed to access the service. This can indicate that the service has been deleted. The service is not running. The service is stopped or paused. INM must be installed with a user that has access rights to use the Windows service manager on the monitored host.

142 140 Intellipool Network Monitor 2.0 User's Guide SMTP agent Auto-scan The agent checks if a SMTP server can be connected to and that it returns a valid return code. Parameters Parameter name Port number Port number used to connect to the SMTP server. Error messages Text Cannot connect to host Host connection terminated unexpectedly The agent was unable to connect to the SMTP server within the socket timeout time. Connection terminated by the monitored host while the agent was reading or writing the socket. Invalid response from host The agent received wrong response code from the SMTP server. The expected code was 220.

143 Chapter 5 Agent documentation 141 SNMP agent The agent can perform a SNMP get operation on requested OID values and compare the returned value with a predefined string using a compare type. If the compare operation evaluate to false the agent will generate an alarm. Parameters Parameter name Community OID OID 2 Combine operation Divisor Compare value Compare operation Unit SNMP community to use OID (Object identifier) to get value from. Se note below on semantics of the OID. Optional OID to get value from and combine with first OID Optional operation used when getting 2 OIDs. The OIDs can be combined into a final result by using the add, subtract, divide or multiplicate operation. A value that the result will be divide with. Can be used to scale values. User defined compare value, only numerical values are valid. Operation used to evaluate the returned result and the predefined compare value. Unit of the measured value. Used in presentation only. Error messages Text SNMP Get operation failed SNMP Get operation timeout Returned OID values are not compatible Returned result does not evaluate equal to compare value The operation failed because of one of the following reasones: INM could not initiate the GET command. The object format identifier is invalid Could not connect the SNMP service on the local machine. The operation did not return any result within the timeout limit. The returned OID values is of a different type. This error will be returned if the agent is trying to combine a octet and a counter OID. Equal test. The returned string is not equal to the compare string.

144 142 Intellipool Network Monitor 2.0 User's Guide Returned result is equal to compare value Not equal test. The returned string is not equal with the compare string. Returned result is less or equal to compare value Returned result is greater or equal to compare value Returned result is less to compare value Returned result is greater to compare value Greater than test. The return string is less or equal with the compare string Less than test. The return string is greater than or equal with the compare string Greater or equal than test. The return string is less than the compare string. Less or equal than test. The return string is greater than the compare string If the compare operation evaluates to false the agent will fail the test. If Compare value is set to 50 and the compare operation is set to "Greater" and the return value return 60 it will evaluate to false and the agent will fail the test. The following OID format can be used in the OID field iso.org.dod.internet.mgmt.mib-2.interfaces.iftable.ifentry.ifoutoctets.1 Or (using the interface to index mapping) iso.org.dod.internet.mgmt.mib- Note that a special enumeration function is available to each OID field. This function will list all available interfaces descriptions for a host.

145 Chapter 5 Agent documentation 143 SNMP Trap agent The agent receives trap messages from SNMP agents on remote hosts. The agent will only receive messages that originate from the objects IP address. Parameters Parameter name Community SNMP community to use Error messages Text Received matching message The agent has received one or more SNMP trap messages from a SNMP agent on a remote host. The complete trap message follows this text. Make sure the internal SNMP server is started before creating an SNMP trap agent.

146 144 Intellipool Network Monitor 2.0 User's Guide SSH2 agent Auto-scan The agent verifies that a SSH2 server is responding to user login attempts. The agent issues a simple echo $OSTYPE command but does not parse the returned string. Parameters Parameter name Port number The port number where the SSH2 server responds. Error messages Text Cannot connect to host Host connection terminated unexpectedly The agent was unable to connect to the SSH server within the socket timeout time. Connection terminated by the monitored host while the agent was reading or writing the socket. Test failed Invalid response from host The agent was unable to complete the test. The SSH2 server did not respond correctly to the login attempt. The agent received wrong response code from the SSH server. The full test does not support older SSH1.x servers. If no username or password is provide a simple connection test is preformed. The simple test is preformed on auto scan. The connection test supports older SSH1.x servers.

147 Chapter 5 Agent documentation 145 SSH2 script agent The agent can execute a command or script on a SSH2 host and compare the returned value with a predefined string using a compare type. If the compare operation evaluate to false the agent will generate an alarm. Parameters Parameter name Command Compare value Compare operation Use telnet Port number A command to execute on the host. User defined compare value, only numerical values are valid. Operation used to evaluate the returned result and the predefined compare value. Use the telnet protocol instead of SSH2 The port number where the SSH2/telnet server responds. Error messages Text Returned result does not evaluate equal to compare value Returned result is equal to compare value Equal test. The returned string is not equal to the compare string. Not equal test. The returned string is not equal with the compare string. Returned result is less or equal to compare value Returned result is greater or equal to compare value Returned result is less to compare value Returned result is greater to compare value Greater than test. The return string is less or equal with the compare string Less than test. The return string is greater than or equal with the compare string Greater or equal than test. The return string is less than the compare string. Less or equal than test. The return string is greater than the compare string If the compare operation evaluates to false the agent will fail the test. If Compare value is set to 50 and the compare operation is set to "Greater" and the return value return 60 it will evaluate to false and the agent will fail the test.

148 146 Intellipool Network Monitor 2.0 User's Guide Swap size agent Windows and GNU/Linux supported The agent monitors the free space in a swap file on a Windows or Unix host. Parameters Parameter name Swap file name Minimum free size Use telnet Full name of the swap file to monitor The smallest free size of the specified swap file in percent. Use the telnet protocol instead of SSH2 Error messages Text Test failed, cannot connect to remote performance monitoring subsystem. Test failed, can not find instance Test failed, swap size monitoring not enabled on target machine Free swap size N %, threshold set to N % Invalid response from host The agent was unable to connect to the host remote performance monitoring subsystem. The most common cause to this problem is that the service account assigned to INM does not have the required rights to access the host. More information in the planning section. The swap size instance does not exist on the monitored host. The agent was unable to find the swap file performance object on the monitored host. More information in the planning section. The host has less than specified free swap space. The Unix host response was not valid and the agent was unable to parse the response. The Windows test uses the registry interface to monitor a swap file on the local machine or a remote machine. The Unix test uses SSH2 to logon to a Unix host and needs a username and password to perform the test. The command that is used is free -k, the agent parses the returned string to find out the current free size (in percent) of the specified swap file. If the telnet protocol is used instead of SSH2 the telnet default parameters must be properly set in the program settings page.

149 Chapter 5 Agent documentation 147 Syslog agent The syslog agent can intercept syslog message sent to INM from one or more syslog hosts. The agent can be configured to receive different types of messages. More than one syslog agent can be added to each object to receive different combinations of messages. Before you create an agent of this type you need to start the internal syslog server. Parameters Parameter name Include string(s) Exclude string(s) Filter away messages not containing these strings. Separate multiple strings with a comma Message not included if it not contains one of the string specified in this field. Separate multiple strings with a comma Error messages Text Syslog server not started or being shutdown while processing request Syslog message received The internal syslog server was not started or was shutdown while the agent tried to fetch syslog messages. Make sure the syslog is started before activating any syslog agents. More information how to start the syslog server in the Program settings chapter The syslog agent received a message that matched the search criteria. Syslog messages must be redirected to the INM host machine. If another Syslog service is executing on the INM host machine the result is unpredictable.

150 148 Intellipool Network Monitor 2.0 User's Guide TCP port scan agent The purpose with this agent is to verify that a number of ports are open or closed depending on the use. In its default state the agent is going to trigger an alarm if the port can be opened, if the invert flag is checked the agent is going to trigger an alarm if the port is closed. Parameters Parameter name Port number range Invert function Ports to scan. Check this option if you want to make the test verify that certain port is open instead of closed. Error messages Text Port number string is malformed Following port(s) is closed on host machine Following port(s) can be opened on host machine The port number string was malformed. INM was unable to extract the port numbers. Check the settings of the agent. The agent is set to test for closed ports. The list of port numbers that follows the message is closed. The agent is set to test for open ports. The list of port numbers that follows the message is open. The port range can be in the following format: The agent will scan ports between and including 21 to ,21-23 The agent will scan port 80 and ports between and including 21 to 23. The agent can max scan 100 ports.

151 Chapter 5 Agent documentation 149 Telnet agent Auto-scan The agent verifies that a telnet server is responding. Parameters Parameter name Port number The port number where the telnet server responds. Error messages Text Cannot connect to host Host connection terminated unexpectedly The agent was unable to connect to the telnet server within the socket timeout time. Connection terminated by the monitored host while the agent was reading or writing the socket. Invalid response from host The agent received wrong response code from the telnet server. The expected code was * OK.

152 150 Intellipool Network Monitor 2.0 User's Guide TempTrax agent The agent uses a TempTrax 2000 precision digital thermometer to measure and temperature (Model F or Model E). Parameters Parameter name Model Scale TempTrax port Select com port Max Temp Min Temp Location Enabled Select the Model F for the serial port model and Model E for the Ethernet connected model Select the temperature scale to use, note that the scale cannot be changed once selected. The port number used by the Model E version (default 80) The serial port used by the Model F version. Max temperature in the scale selected. Min temperature in the scale selected. Location string that will be included in alarm text. Check to enable measurements from this probe Error messages Text Cannot access serial port N TempTrax device does not responding correctly The agent was unable to access the serial port. Check that no other applications is using this serial port. The agent did not receive a complete reading from the TempTrax device. When using Model E this error message indicates that the agent cannot connect to the device via the network. Current temperature N, higher than specified max temperature (N) Current temperature N, lower than specified min temperature (N) Probe N not connected The message indicates that the temperature is above the pre-defined threshold. The message indicates that the temperature is below the pre-defined threshold. The agent has detected that a enabled probe cannot be read. This can indicate that the probe is not properly connected or hardware failure in the probe or the TempTrax thermometer.

153 Chapter 5 Agent documentation 151 The temperature scale should not be altered when once selected, this is because temperature readings (for statistical reports) is stored in the scale selected. Its not necessary to enter the location string when using the Model E version, the location string will be downloaded from the probe. More information about the TempTrax range of thermometers can be found here:

154 152 Intellipool Network Monitor 2.0 User's Guide Text file scan agent The agent can read a text file on a SMB mounted drive and check for if new lines in the file contains one of the specified strings. The agent generates an alarm if the specified search criteria are meet. Parameters Parameter name Path Search string Invert Function Path and file name of the file to scan. The string to search for, separate multiple search strings with a comma. The agent will generate an alarm if the file has not changed since last test. Note that the search string is not used when this option is used. Error messages Text Can not open file Found string N in text file N The file N has not been changed since last test The agent was unable to open the specified file. Check that the path and file name is correct. The agent encountered a matching string while scanning the text file. The file is the same size as the last test. INM must be installed with a user that has access rights to use the specified path. Its recommended that the alarm generation count is set to 1 for this agent, if so the agent will alarm on the first line that matches the specified search criteria. The agent opens the file in text mode, do not use this agent with binary files.

155 Chapter 5 Agent documentation 153 TFTP agent Auto-scan The agent tests if a TFTP server is responding to a RRQ operation. The purpose of the test is to verify that the TFTP server is running. Parameters Parameter name Port number The port number where the TFTP server responds. Error messages Text Cannot connect to host Host connection terminated unexpectedly The agent was unable to connect to the TFTP server within the socket timeout time. Connection terminated by the monitored host while the agent was reading or writing the socket. Invalid response from host The agent received wrong response code from the TFTP server. The agent tries to download a file named INM this file does not have to exist for the test to succeed. The agent merely checks that the TFTP server is responding in the correct way to such request.

156 154 Intellipool Network Monitor 2.0 User's Guide Winperf agent Windows The agent can test Windows performance object and compare the returned value with a predefined string using a compare type. If the compare operation evaluate to false the agent will generate an alarm. Parameters Parameter name Object Counter Instance Compare value Divisor Compare operation Unit Name of the performance object. This value can be enumerated by using the Name of the counter attached to the object. This value can be enumerated if a valid object has been specified Instance name, this value can be enumerated if valid object and counter has been previously specified. Some objects does not have any instances ( for example the "System" object). User defined compare value, only numerical values are valid. A value that the retrieved value will be divided with before the comparison. Operation used to evaluate the returned result and the predefined compare value. Unit of the measured value. Used in presentation only. Error messages Text Test failed, access denied Returned result does not evaluate equal to compare value Returned result is equal to compare value The agent was unable to connect to the remote performance subsystem. Make sure the Windows account assigned to INM has the privileges to use the monitored host performance subsystem. Equal test. The returned string is not equal to the compare string. Not equal test. The returned string is not equal with the compare string. Returned result is less or equal to compare value Returned result is greater or equal to compare value Greater than test. The return string is less or equal with the compare string Less than test. The return string is greater than or equal with the compare string

157 Chapter 5 Agent documentation 155 Returned result is less to compare value Returned result is greater to compare value Greater or equal than test. The return string is less than the compare string. Less or equal than test. The return string is greater than the compare string. The retrieved value will be divided with the divisor value before the comparison take place. The product of the division will be saved in the statistics. This feature can be very useful when dealing with counters that have large values, by applying the correct divisor value the retrieved value can be scaled down before the presentation and comparison take place. If the compare operation evaluates to false the agent will fail the test. If Compare value is set to 50 and the compare operation is set to "Greater" and the return value return 60 it will evaluate to false and the agent will fail the test.

158 157 C HAPTER 6 Action documentation In This Chapter Clear Windows Event log Execute command via SSH Execute windows command List reset Net Send Paging via PageGate SNMP Set Send SMS Send mail Wake-on-LAN Windows service control...168

159 158 Intellipool Network Monitor 2.0 User's Guide Clear Windows Event log The action can clear a event log on a specified Windows host. Field Alarm number Alarm number in action list. Ex. if alarm number is 2 the action will be executed when the agent alarm count is 2. Host Log name Filename Multiple actions can be placed on the same alarm number. Hostname or IP number of the host. Clears the event log on this host. Leave blank to use the address of the calling object. Name of the log to clear. Ex. Application Saves the log to this file before clearing it. Works only if the event log is located on the INM host machine.

160 Chapter 6 Action documentation 159 Execute command via SSH2 The SSH2 action can be used to execute a command on a host via SSH2 connection. Field Alarm number Alarm number in action list. Ex. if alarm number is 2 the action will be executed when the agent alarm count is 2. Parameters Host Port Username Password Use telnet Multiple actions can be placed on the same alarm number. Command to execute. In the command field flags can be inserted, the flags are expanded when the action is executed. Following flags are valid: %O (Object name) %A (Agent name) %S (Object description) Host name or IP address of the SSH2 server. Leave blank to use the address of the calling object. Port number of the SSH2 server Username Password Use the telnet protocol instead of SSH2. If the telnet protocol is used instead of SSH2 the telnet default parameters must be properly set in the program settings page.

161 160 Intellipool Network Monitor 2.0 User's Guide Execute windows command The action executes a command on the INM host machine. The command cannot be an interactive command that needs any interaction with a user. The action can fail if the user assigned to the INM service not has the rights to execute the command. Field Alarm number Command Parameters Alarm number in action list. Ex. if alarm number is 2 the action will be executed when the agent alarm count is 2. Multiple actions can be placed on the same alarm number. Command to execute. Ex. ipconfig Parameter of the command. Ex. /all. In the parameter field flags can be inserted, the flags are expanded when the action is executed. Following flags are valid: %O (Object name) %A (Agent name) %S (Object description)

162 Chapter 6 Action documentation 161 List reset The list-reset action, when executed, causes the execution to restart from the first action. The list-reset action can be used to get a loop behavior.

163 162 Intellipool Network Monitor 2.0 User's Guide Net Send The net send action can be used to send messages to a Windows user, the message will be presented as a pop-up message box on the users computer. The action needs that the Messenger service is started on both the INM host and the users computer. Read more about Net send in Planning and consideration. Field Alarm number User Host Alarm number in action list. Ex. if alarm number is 2 the action will be executed when the agent alarm count is 2. Multiple actions can be placed on the same alarm number. The Windows user to send the message to. Optional host where the user is located. Only needed if no domain can resolve the username.

164 Chapter 6 Action documentation 163 Paging via PageGate The action can send a message to a Pagegate user. To use this action the Pagegate integration must be properly set. For more information how to configure the Pagegate integration refer to the "program settings" page. Field Alarm number Alarm number in action list. Ex. if alarm number is 2 the action will be executed when the agent alarm count is 2. Operator group Operator Recipient Short message Multiple actions can be placed on the same alarm number. Sends the notification to the all members of the operator group. Send the notification to the operator on duty. The operator on duty is determined by examining the current operator schedule. If no operator is on duty the notification is sent to the group manager. If no group manager is set the notification is sent to all members of the operator group. Optional Pagegate recipient. If checked the following flags are omitted from the message %S (Object description) %L (Distribution list) %X (Dependency tree status) %E (Agent error message) %I (Network contact information)

165 164 Intellipool Network Monitor 2.0 User's Guide SNMP Set Sends a SNMP set command to a SNMP enabled host, requesting to change a value identified by a OID (Object Identifier). Field Alarm number Alarm number in action list. Ex. if alarm number is 2 the action will be executed when the agent alarm count is 2. Host Community OID Value Syntax type Multiple actions can be placed on the same alarm number. Host name or IP number of the host. Leave blank to use the address of the calling object. SNMP community to use. Object Identifier Value to set Type of value. Two options exists, string and integer type.

166 Chapter 6 Action documentation 165 Send SMS The action can send a SMS to an entire operator group or (if operator schedule is used) the operator(s) on duty. An extra recipient can also be specified. To use this action a SMS capable GSM phone must be installed on the INM host machine, and the COM port settings in Program settings must be properly set. Field Alarm number Alarm number in action list. Ex. if alarm number is 2 the action will be executed when the agent alarm count is 2. Operator group Operator Recipient Multiple actions can be placed on the same alarm number. Sends the SMS to the all members of the operator group. Send the SMS to the operator on duty. The operator on duty is determined by examining the current operator schedule. If no operator is on duty the SMS is sent to the group manager. If no group manager is set the mail is sent to all members of the operator group. Optional recipient phone number of the SMS.

167 166 Intellipool Network Monitor 2.0 User's Guide Send mail The action can send an to an entire operator group or (if operator schedule is used) the operator(s) on duty. An extra recipient can also be specified. Field Alarm number Alarm number in action list. Ex. if alarm number is 2 the action will be executed when the agent alarm count is 2. Operator group Operator Recipient Short message Multiple actions can be placed on the same alarm number. Sends the mail to the all members of the operator group. Send the mail to the operator on duty. The operator on duty is determined by examining the current operator schedule. If no operator is on duty the mail is sent to the group manager. If no group manager is set the mail is sent to all members of the operator group. Optional recipient mail address of the mail. If checked the following flags are omitted from the message %S (Object description) %L (Distribution list) %X (Dependency tree status) %E (Agent error message) %I (Network contact information)

168 Chapter 6 Action documentation 167 Wake-on-LAN The Wake-on-LAN action (WOL for short) can start a host that is compliant with the WOL standard. Refer to the documentation of the host to determine if the action can be used. Field Alarm number Alarm number in action list. Ex. if alarm number is 2 the action will be executed when the agent alarm count is 2. MAC Packet count Interval Multiple actions can be placed on the same alarm number. The MAC-address of the interface to send WOL packets to. The format of the MAC string is AA-BB- CC-DD-EE-FF. Leave the field blank to use the MAC address of the parent object. Number of times to send the WOL packet. Delay between packets, in seconds.

169 168 Intellipool Network Monitor 2.0 User's Guide Windows service control The service action can be used to modify the state of a Windows service. Field Alarm number Alarm number in action list. Ex. if alarm number is 2 the action will be executed when the agent alarm count is 2. Service name Host Multiple actions can be placed on the same alarm number. Name of the service Host name or IP number of the Windows host where the service is installed. Leave blank to use the address of the calling object.

170 169 C HAPTER 7 Data extraction The data extraction interface can be used to extract data from INM with HTTP Get commands. Prerequisite Each get request sent to INM must include a operator username and the operator must be flagged for "Auto login". Note that if the user is also flagged as "System admin" the user will be able to get system wide access, otherwise the information will be restricted to the data controlled by the operator groups the operator is member of. URL Syntax The format of the URL sent to INM contains some required parameters. Example URL for extracting a chart from a agent param1=2 Field cmd user id param1 Command to execute INM operator username Id of agent or operator Custom parameter (in this cast the index of the chart to display) In This Chapter agent_graph agent_statusstring agent_uptimestring dir operator_status version...175

171 170 Intellipool Network Monitor 2.0 User's Guide agent_graph This command returns a PNG image file with the selected realtime chart. This is the same chart that is shown in the agent info page. Before a chart can be extracted the chart must be enabled in the agent info page. Syntax param1=2 Field cmd user id param1 agent_graph INM operator username ID number of agent Zero based index of chart to retrieve. The index is based on enabled graphs. Returned data A PNG image file with the default size of 747x120 pixels and a color depth of 3 bytes per pixel.

172 Chapter 7 Data extraction 171 agent_statusstring The command returns the agent status string. The status string is the same shown in the agent info page. Syntax d=8 Field cmd user id agent_statusstring INM operator username ID number of agent Returned data A string containing the name of the agent and the status string separated by a pipe sign ( ' ' ). Example CPU load Agent Current CPU usage %

173 172 Intellipool Network Monitor 2.0 User's Guide agent_uptimestring The command returns the agent uptime string. The uptime string describes the uptime of the agent in hours, minutes and second. If the agent is currently in alarm state a ' * ' is added in front of the string to note that the string indicates the downtime of the agent. Syntax &id=8 Field cmd user id agent_uptimestring INM operator username ID number of agent Returned data A string containing the name of the agent and the uptime/downtime string separated by a pipe sign ( ' ' ). Example CPU load Agent 0h 59m 35s

174 Chapter 7 Data extraction 173 dir The command returns a list of available agents and operators with their name and id. This command can be useful when designing extraction URLs for all other commands. Syntax Field cmd user dir INM operator username Returned data A list of agents and operators with their IDs.

175 174 Intellipool Network Monitor 2.0 User's Guide operator_status The command returns operator status and information. Syntax 2 Field cmd user id operator_status INM operator username ID number of operator Returned data A string containing operator status and information, the fields are separated by a pipe sign ( ' ' ). Format of returned data. UserName Name Phone Cell phone Address 1 Address 2 Scheduled status Online status Field Username Name Phone Cell phone Address 1 Address 2 Scheduled status Online status INM operator username Real name Phone number Cell phone number Address field Address field "Available" if operator is scheduled and on duty, "n/a" if not on duty or not scheduled "Online" if operator is logged on to INM Example Admin Robert Franzengatan Härnösand Sweden n/a Online

176 Chapter 7 Data extraction 175 version Returns the current INM version number. Syntax Field cmd user Version INM operator username Returned data A string containing the version number of INM. Example 2.0

177 177 C HAPTER 8 Frequently Asked Questions In This Chapter Agent questions File and directory related questions Misc questions Notification questions Username, password and logon questions...186

178 178 Intellipool Network Monitor 2.0 User's Guide Agent questions Q) Why can t I monitor disk size, memory size, process, swap usage, CPU load, NIC load on Windows machines? A) If the INM host computer is running Windows 2000 service pack 3 must be installed. The service pack fixes a bug in the performance data helper library. Read more about the bug on this page MS KB EN-US,, Q315700&, (Microsoft.com knowledge base) Q) Why can t I monitor disk size or memory size on my Windows NT 4 machines? A) INM requires the latest service pack for Windows NT 4.0 (service pack 6). INM also requires that the service logon account be set to a user with administrator privileges. See chapter Planning and considerations for more information about the service logon account. Q) How do I calculate the time before the agent will generate the first alarm? A) The correct calculation is (in seconds) n = Alarm generation t = Update interval n * t = Minimum time before first alarm sent to operator 5 * 20 = 100 sec before first event is sent to the alarm action list This mean that a test have to fail n times before a event is sent to the alarm action list, for every failed time it will record information in both the log file and the agent error report. after the first event INM will wait the amount of time specified in Alarm delay. So the calculation for the following alarms is: n1 = Alarm generation n2 = Number of previous alarm events t1 = Update interval t2 = Alarm delay (n1 * t1) + (t2*n2) = Minimum time before following events is generated (5*20) + (1 * 60) = 160 sec before second alarm event

179 Chapter 8 Frequently Asked Questions 179 Q) What happens when INM generates an alarm? A) The following is an explanation of the sequence of events taking place when INM is about to dispatch an alarm action. 1. INM determines which alarm action list to use. If there is an alarm action list defined for the agent, INM will use that one. If the agent doesn't have an alarm action list defined, INM will use the alarm action list defined for the agents parent object. 2. INM will look in the alarm action list and see what kind of action that is defined for the current alarm count. For example, if this is the first generated alarm it will look at the first position in the alarm action list. If no action is defined for this position, INM will do nothing. 3. Assuming there is an event defined for this alarm count, INM will now check which operator group that is responsible for the agents parent object. 4. INM will check with the scheduler to see which operator, or operators, that are currently available. If no operator is currently available, INM will send the action to the operator flagged as responsible for the operator group. 5. INM performs the action defined in the action list Q) Why can t I get the disk space agent to work in a Windows environment? A) The cause to this error can be that you have not enabled the disk performance counter, issue the command diskperf -YV on the monitored machine and reboot. For further information about the diskperf utility consult your Windows documentation for further info regarding the disk performance system. Q) What type of command does the process agent issue on a UNIX host? A) The agent issues a ps e -f command and parse the result string to verify that the process is running. Q) What type of command does the swap size agent issue on a UNIX host? A) The agent issues free m command and parse the result string to verify that the swap file has enough free space. The output format from the host should look like this. total used free shared buffers cached Mem: /+ buffers/cache: Swap:

180 180 Intellipool Network Monitor 2.0 User's Guide Q) What type of command does the disk size agent issue on a UNIX host? A) The agent issues df k DISKNAME command and parses the result string to verify that the swap file has enough free space. The output format from the host should look like this. Filesystem 1M-blocks Used Available Use% Mounted on /dev/hda % / none % /dev/shm

181 Chapter 8 Frequently Asked Questions 181 File and directory related questions Q) What is the init.cfg file A) The init.cfg file contains settings that do not fit into the program settings page for one reason or another. Q) What is the name of the file INM stores its settings? A) Its named "settings.nxd" and is located in the same directory as the executable. Each time INM saves your settings it will also create a backup file called "settings.bak placed in the same directory. Q) Is the settings.nxd file encrypted? A) Yes it is encrypted using a strong encryption algorithm Q) Can I delete the log file while INM is running? A) Yes Q) How large can the log file grow? A) When the log file gets larger than 1 Mb INM renames it and creates a new log file. Q) Why have INM stopped recording information into the log file? A) Check that the file systemlog.xml is not read or write protected. Check that the disk has enough free space to hold a 10 MB file. Q) What is the resource.lng file? A) The file contains localization information. Q) What is the file? A) contains html templates for the web interface Q) What subdirectories does INM use A) The following directories are used by INM Directory /nxdbackup /statistics /logs /reports/images /reports/images/logo Used by auto backup function. Statistical database storage log file Images for image items in reports Images for logotypes in report templates

182 Chapter 8 Frequently Asked Questions 183 Misc questions Q) How do I stop the INM service A) Open the Service control manager and select the Intellipool Network Monitor service and press the stop action. Q) How to connect to INM when entered an erroneous IP range for the web server? A) You can always connect from the INM host machine, that IP number is always accepted. Ex. On the INM host machine open a browser window and type Q) How do I change the web server port number A) Open the init.cfg file and change the webserver_port key to the desired port number. You must restart INM before the new settings will take affect. Q) Does INM send any information back to Intellipool? A) No Q) What type of operating system does INM require? A) Windows 2000 Professional or Windows XP Professional with the latest service pack. Q) Does INM support any proxy connections? A) Yes, the HTTP agent supports proxy connections Q) Does INM support SSL connections? A) Yes, the HTTP agent supports SSL Q) Can I move INM to another computer? A) Yes, follow these steps 1. In the Service control window (under administrative tools) stop the INM service. 2. Copy the INM program folder to the new host. 3. Uninstall INM on the old host 4. In a command line window, change the current directory to the directory containing INM. 5. Type inmservice.exe i (this command installs INM as a service)

183 184 Intellipool Network Monitor 2.0 User's Guide 6. Type inmservice.exe s (this command starts INM) 7. Close the command window 8. INM is now running on the new host INM does not save any information (other than uninstall information and a value for the event log) in the Windows register. Remember that you are not allowed to have the same copy of INM installed on more than one machine. Q) How to use a Microsoft Access database with ODBC logging A) Unlike most other ODBC data source types, Microsoft Access data source must contain a database before INM can use the datasource. Use the ODBC Data source administrator to create a Access data source (as a system data source ). In the created data source create a database. Enter the name of the created data source and database in the Program settings chapter. Q) Why can t I define a schedule rule that spans over two days? A) A rule cannot be defined for a time period that spans two days. If you want to create a rule that spans between 17:00 and 07:00 the following day, you must create two rules that spans between to and to Q) I'm having speed issues when remotely accessing the INM interface, why? A) In some configurations a browser uses a proxy for accessing both the internal and external network. The proxy can cause INM web interface slow downs, configure the proxy settings in the browser to bypass the proxy for the address of the Intellipool Network Monitor host machine.

184 Chapter 8 Frequently Asked Questions 185 Notification questions Q) Does INM support paging to an alphanumeric pager? A) Yes, INM has support for paging by integrating Notepage Pagegate. For more information about Notepage and Pagegate visit this site Q) What type of GSM Phones does INM support? A) INM supports and GSM phone or GSM modem that understands text mode SMS commands. For more details about setting up a SMS notification solution please refer to the chapter Planning. Q) Why can t I get the Net Send action to work? A) Make sure the service "Messenger" is running on both the INM host and the user machine. INM also requires that the service logon account be set to a user with administrator privileges. See chapter Planning for more information about the service logon account.

185 186 Intellipool Network Monitor 2.0 User's Guide Username, password and logon questions Q) What is the default created username and password? A) The default operator account is created with username Admin and password Admin. Q) Is the login window username and password fields case sensitive? A) Yes Q) I ve lost my password and can not access INM A) We cannot and will not try to help you recover a lost password (security issue). To access INM again delete the settings.nxd file, INM will create a new one with default settings but you will lose your settings. Q) Why can I not logon to INM? A) It can be one of the following issues Your browser settings does not accept third party cookies You did not use the correct character case (both user name and password is case sensitive) Your IP number is refused by the INM Web server (check IP range in Program settings from the INM host machine) Q) Why can I not delete an operator? A) A operator cannot be deleted if 1. It s the last operator with permission to create new operators 2. It s the current operator

186 Chapter 8 Frequently Asked Questions 187 Q) How can I make a auto login URL A) INM operators that have auto login access rights can use the following url format to directly access the agent list and agents by type pages. To access agent list with user Admin To access agents by type with user Admin To access agents with alarms with user Admin To access the network list as user Admin

187 189 C HAPTER 9 Guides Intellipool frequently publishes guides that can help you getting more out of INM. Follow the following link to view the latest guides In This Chapter Action list example Formatting alarm and restart messages Monitoring Windows user logon failures Remote reboot of Windows machine SSH2 script agent, average load for Unix...198

188 190 Intellipool Network Monitor 2.0 User's Guide Action list example When an agent has entered alarm state, INM will set that agent's alarm count to 1. For each consecutive failed test, the agent's alarm count will increase by one.with actionlists, it is possible to configure different actions for a specific alarm count. Note that actionlists can be specified on a per agent basis if you want to. Example 1 Lets start with an easy scenario, you only want a notification by the first time an agent fails. Then you would configure an action list that would look like the example below: This action list will send an to the responsible operator group the first time an agent fails. Example 2 Let's make the first action list a bit more useful. If the service or function the agent is monitoring still is not functional after 5 consecutive tests, ie the alarm count is set to 5, we want a SMS message sent. To accomplish this, modify the actionlist so it looks like this:

189 Chapter 9 Guides 191 Example 3 For some agents you might want continuous notifications. To accomplish this, you use the "restart list" action. If you would like an sent every time the agent fails, you would setup an action list that looks like this: The numbers in parenthesis in the alarm number column tells you at what alarm count the action will be executed. Restart lists When an agent is in alarm state and suddenly tests ok, INM will reset the status of that agent to green and at the same time execute a restart list, if there is one specified. Restart lists are optional but can be specified, just as action lists, on a per object and on a per agent basis.if you create a list that is going to be used as a restart list, the alarm number parameter is irrelevant. INM will execute all of the actions defined in the list. The "restart list action" is ignored when INM executes a restart list.

190 192 Intellipool Network Monitor 2.0 User's Guide Formatting alarm and restart messages Each agent can override the format of the default alarm and restart messages found in the program settings page.this is done by adding a custom message format in the agent properties page. Introduction The following flags can be used to embed runtime information into messages. Flag %T Current time %O Object name %D Object destination/address %A Agent name %E Agent error message * %L Distribution list (address of recipients) * %X Dependency tree status * %S Object description * %I Network contact information *

191 Chapter 9 Guides 193 The formatted string should be entered into the 'Alarm message' or 'Restart message' fields in the agent properties page. Whenever the 'short message' option is used for notifications, the fields marked with an asterisk '*' will be removed from the message. Example 1 %O (%D) - %A Error message: %E The above format option would translate to the following: 'Object name' ('Object address') - 'Agent name' Error message: 'This is the error' Example 2 %I Object: %O Agent: %A, %E. %L The above format option would translate to the following: 'Network contact info' Object: 'Object name' Agent: 'Agent name', 'This is the error'. 'Distribution list'

192 194 Intellipool Network Monitor 2.0 User's Guide Monitoring Windows user logon failures This guide is an example of how to create agents that monitors Windows logon failures and other security aspects of a Windows network. Pre-requisition The INM service must be assigned a user account that can read the event log of the monitored machine. Auditing of the following parameters must be set (for domain or local computer): Logon events, set to log failure Policy settings set to log failure and success Properly configured action lists Configuring an event log agent Create an event log agent in the object you wish to monitor, keep all parameters as default values except the following ones. Field Event source Computer Value Empty Empty Event ID 529 Filter including Filter excluding Event type Include message Event log Failure Empty Audit failure Checked Security This agent will now generate an alarm each time it discovers logon failures in the event log.after the first agent has been created it will be easy to add more agents that will monitor other security aspects. The list below covers some of the more important event ID's. Make sure that auditing is turned on for each category, otherwise Windows will not log these into the event log. Logon failures Event ID Message text 529 Unknown user name or bad password 530 Account logon time restriction violation

193 Chapter 9 Guides Account currently disabled 532 The specified user account has expired 533 User not allowed to logon at this computer 534 The user has not been granted the requested logon type at this machine 535 The specified account's password has expired 536 The NetLogon component is not active 537 An unexpected error occurred during logon 539 Account locked out IP Sec auditing Event ID Message text 541 IPSec security association established. 542 IPSec security association ended.mode: Data Protection (Quick mode) 543 IPSec security association ended.mode: Key Exchange (Main mode) 544 IPSec security association establishment failed because peer could not authenticate 545 IPSec peer authentication failed 546 IPSec security association establishment failed because peer sent invalid proposal 547 IPSec security association negotiation failed Policy Changes Event ID Message text 608 User Right Assigned 609 User Right Removed 610 New Trusted Domain 611 Removing Trusted Domain 612 Audit Policy Change 613 IPSec policy agent started 614 IPSec policy agent disabled 615 IPSec Policy Changed 616 IPSec policy agent encountered a potentially serious failure 617 Kerberos Policy Changed 618 Encrypted Data Recovery Policy Changed 619 Quality of Service Policy Changed 620 Trusted Domain Information Modified

194 196 Intellipool Network Monitor 2.0 User's Guide Summary Monitoring event logs can be very important both for security reasons and as a service to the users.you can quickly detect if a user have locked him/her self out by typing the wrong password but also detect attempts to break the password of an account. Before you enable auditing you should analyze the need for this in your organization. Auditing can generate a large number of event records, so you might need to schedule an event log clean now and then to manage the size of the event log. Intellipool Network Monitor has an action called "Clear event log" that can be used for this purpose.

195 Chapter 9 Guides 197 Remote reboot of Windows machine This guide is an example of how to create an action that remotely restarts a Windows machine.pre-requisition: - 'shutdown' command line utility, this is standard in Windows XP. Windows 2000 users can find it in the Windows 2000 administrator s resource kit. Verify that you have the shutdown command line utility installed by typing 'shutdown /?' on the command line of the INM host machine. Configuring the action Create an "Execute windows command" action in the action list that will be used to restart a Windows machine. Select the appropriate alarm number to trigger this action.in the command field enter the following command: shutdown In the parameter field enter: -r -f -m \\%D -t 60 -r Reboots computer -f Forces running applications to close -m Specifies the computer that you want to shut down, notice the \\%D, this will cause INM to expand the object destination address into the parameter -t Time in seconds that the shutdown command will wait before starting the shutdown process Summary With this example, the action will start the shutdown process after 60 seconds. Also make sure that the user running the INM service have sufficient user rights to initiate the shutdown.

196 198 Intellipool Network Monitor 2.0 User's Guide SSH2 script agent, average load for Unix This guide is an example of how to create your own agents with the SSH2 script agent. In this example we will be making an average load agent for Unix. Pre-requisition Unix host with SSH2 installed Support for the Unix commands 'uptime' and 'cut' Configuring the agent To create an average load agent for a Unix host you can use the SSH2 script agent. The SSH2 script agent can execute an arbitrary script on any type of machine that is capable of SSH2 or Telnet communication. The return value from the script is sent back to the agent and compared with a predefined value. The agent features several types of operations to compare the predefined value and the returned value. To create the agent click on the "Add agent" link in the desired object. In the 'Command' field enter the following script: uptime cut -d":" -f 4 cut -d"," -f 1 This short script does the following: 1. 'uptime' command writes the following: 09:54 up 154 days, 11:51, 40 users, load average: 1.77, 2.04, The first cut command extracts the load average part 1.77, 2.04, The second cut command extracts the load average for the last 5 minutes which is the first column.

197 Chapter 9 Guides 199 The value selected as the upper threshold for the returned value must be selected by you; for example if you want the agent to trigger an alarm if the load average for the last 5 minutes is above 1, enter 1 into the 'compare value' field. Select the 'greater' operation from the 'compare operation' list. Press the 'Save' button to create the agent and start the operation of the agent. Summary The script entered into the command field can be very long and its recommended that it is put into a shell script file on the host machine. Like all the agents and actions that uses SSH2 there is an option to use Telnet instead of SSH2. Telnet is by its nature an insecure protocol and should only be used in a protected environment. Also note that the Telnet protocol uses a different port number than the SSH2 protocol

198 201 Index A Action documentation 157 Action list example 190 Action lists 31, 43 Agent documentation 113 Agent information page 59 Agent list page 61 Agent mini list page 62 Agent questions 178 Agent username and password 16 agent_graph 170 agent_statusstring 171 agent_uptimestring 172 Agents by type page 62 Agents with alarms page 61 Anti virus programs and software firewalls 14 Assigning the restart list with global changes 28 Auto scan 32 B Backup of configuration repository 16 Bandwidth agent 114 C Change the default operator group 76 Clear Windows Event log 158 Contact information 8 Copy a report 98 Copyright Notice 2 CPU load agent 115 CPU usage and threading 20 Create an operator 77 Create an operator group 75 Creating a action list 44 Creating a agent 57 Creating a maintenance schedule 106 Creating a network 63 Creating a new operator group 25 Creating a object 69 Creating a operator schedule 102 Creating a report 94 Creating a report template 91 Creating an event schedule 108 Creating dependency 72 Creating new action lists 26 Creating new operator accounts 24 D Data extraction 32, 169 Delete a agent 59 Delete a network 64 Delete a object 70 Delete a report 98 Delete an operator 79 Delete an operator group 76 Deleting an action 45 Dependency tree 32 Dependency trees 46 DHCP agent 116 DHCP Agent considerations 15 dir 173 Disk size agent 117 DNS agent 119 E a report 99 End user license agreement 3 Event log agent 120 Execute command via SSH2 159 Execute windows command 160 F File and directory related questions 181 File check agent 122 File security 16 Firewalls and routers 14 Formatting alarm and restart messages 192 Frequently Asked Questions 177 Frequently used terms 32 Frequently used user interface terms 49 FTP agent 123 G Generic settings 83 Getting help 7 Getting started 23 Global changes 50 Guides 189

199 202 Fel! Formatmallen är inte definierad. H How to obtain updates 29 How to use Intellipool Network Monitor 41 HTTP agent 124 I ICA agent 126 IMAP4 agent 127 Importing objects 72 Index page and menus 52 INM agent 128 Installation check list 22 Intellipool Network Monitor Concepts 31 Intellipool Network Monitor Documentation 1 Internal servers 34 Internal web server 15 Introduction 9 L LDAP agent 129 List reset 161 Log settings 88 Logging 34 M Memory size agent 130 Memory usage 21 Misc questions 183 Monitoring Unix machines 14 Monitoring Windows NT/2000/XP machines 14 Monitoring Windows user logon failures 194 My settings 53 N Net send 13 Net Send 162 Network by agent type page 68 Network info page 65 Network interface load agent 131 Network list page 67 Networks, objects and agents 57 Networks,Objects And agents 36 NNTP agent 132 NOC view 55 Notification questions 185 O Object information page 70 Object list page 73 ODBC agent 133 ODBC logging 14 operator_status 174 Operators and operator groups 36, 75 P Pagegate integration 89 Paging 19 Paging via PageGate 163 Ping agent 134 Planning 11 POP3 agent 136 Process agent 137 Program settings 24, 81 R RDP agent 138 Remote reboot of Windows machine 197 Reports 37, 91 S Scanning for objects and agents 27 Schedule a report 97 Schedules 38, 101 Send mail 166 Send SMS 165 Service agent 139 Service logon account 12 SMS notification 16 SMTP agent 140 SNMP agent 141 SNMP monitoring 14 SNMP Set 164 SNMP Trap agent 143 Software and hardware requirements 11 SSH2 agent 144 SSH2 script agent 145 SSH2 script agent, average load for Unix 198 Summary 28 Swap size agent 146 Syslog agent 147 System administration 111 T TCP port scan agent 148 Telnet agent 149 TempTrax agent 150 Test procedure 38 Text file scan agent 152 TFTP agent 153 The configuration repository 39 U User logon verifications 16 Username, password and logon questions 186

200 Index 203 V,W Wake-on-LAN 167 Web server security 15 version 175 Viewing a report 96 Windows service control 168 Winperf agent 154