Configuration and Administration

Transcription

1 Configuration and Administration Version 8.2 Mobile Service Manager

2 Legal Notice This document, as well as all accompanying documents for this product, is published by Good Technology Corporation ( Good ). Good may have patents or pending patent applications, trademarks, copyrights, and other intellectual property rights covering the subject matter in these documents. The furnishing of this, or any other document, does not in any way imply any license to these or other intellectual properties, except as expressly provided in written license agreements with Good. This document is for the use of licensed or authorized users only. No part of this document may be used, sold, reproduced, stored in a database or retrieval system or transmitted in any form or by any means, electronic or physical, for any purpose, other than the purchaser s authorized use without the express written permission of Good. Any unauthorized copying, distribution or disclosure of information is a violation of copyright laws. While every effort has been made to ensure technical accuracy, information in this document is subject to change without notice and does not represent a commitment on the part of Good. The software described in this document is furnished under a license agreement or nondisclosure agreement. The software may be used or copied only in accordance with the terms of those written agreements. The documentation provided is subject to change at Good s sole discretion without notice. It is your responsibility to utilize the most current documentation available. Good assumes no duty to update you, and therefore Good recommends that you check frequently for new versions. This documentation is provided as is and Good assumes no liability for the accuracy or completeness of the content. The content of this document may contain information regarding Good s future plans, including roadmaps and feature sets not yet available. It is stressed that this information is non-binding and Good creates no contractual obligation to deliver the features and functionality described herein, and expressly disclaims all theories of contract, detrimental reliance and/or promissory estoppel or similar theories. Legal Information Copyright All rights reserved. All use is subject to license terms posted at legal. GOOD, GOOD TECHNOLOGY, the GOOD logo, GOOD FOR ENTERPRISE, GOOD FOR GOVERNMENT, GOOD FOR YOU, GOOD APPCENTRAL, GOOD DYNAMICS, SECURED BY GOOD, GOOD MOBILE MANAGER, GOOD CONNECT, GOOD SHARE, GOOD TRUST, GOOD VAULT, and GOOD DYNAMICS APPKINETICS are trademarks of Good Technology Corporation and its related entities. All third-party technology products are protected by issued and pending U.S. and foreign patents. Configuration and Administration Guide 2

3 Contents Section 1: Good MSM Overview 7 Required Workflow 8 Launching the Admin Console 9 Logging Out of the Admin Console 10 Admin Console Interface 11 Menu Bar 11 System Menu 11 View Menu 12 Tools Menu 13 Help Menu 14 Toolbar 14 Object Control Panel 15 Status Bar 16 Section 2: Mapping Good MSM User Roles 17 Default Windows Authentication to Manage Users 17 Configuring Role-Based Administration 20 Section 3: Configuring the Initial Settings to Run Good MSM 21 Configuration Progress Meter 21 License Details 24 Global Settings 25 SMTP / Notifications 25 Active Directory (AD) Syncing 26 User and Group Sync (Optional AD Syncing) 27 Device Management Panel 30 Device Identity Certificates 31 Apple Push Notification Service (APNs) Certificate 32 Android Security Management 33 Importing SSL Certificates 33 Security Management Activation 35 Compliance Threshold 36 DMZ Apache Configuration 36 Good Mobile Control Databases 39 Good Dynamics (GD) Server Configuration 42 Microsoft Exchange Client Access Server Configuration 44 Support Settings Panel 45 Configuration and Administration Guide 3

4 Table of Contents User Self-Service (USS) Server Configuration 45 USS Device Instructions 48 Enterprise Information Panel 50 Custom Branding 50 Support Contacts 51 Advanced Settings 52 Configuring Remote Log Collectors 53 Using the Template 54 Maintenance Panel 56 Renew SSL Certificate 56 Importing SSL Certificates 56 Renew MDM Host Certificate 58 Renew Internal Certificate 58 Renew DMZ Apache Configuration 59 Section 4: Enabling Data Analysis by Deploying the Good MSM Infrastructure 60 Status Bar 61 Loading Analyzers 62 Unloading Analyzers 63 Section 5: Custom Summary Groups 64 Creating and Modifying Custom Summary Groups 64 Creating Custom Summary Groups 65 Adding Users to Custom Summary Groups 69 Changing Maximum Users Displayed Per Page 70 Tuning Custom Summary Group and User Thresholds 71 Section 6: Managing Summary Group and User Level Notifications 73 Assigning Summary Group and User Level Notifications 73 Assigning Notifications 74 Example User Level Notification 76 Assigning SNMP Trap Notifications 77 Assigning HP Operations Manager Notifications 79 Editing Addresses 82 Managing Notifications for an Address 83 Removing Notifications for a User/ Address 85 Section 7: Performing Mobile User Component Tuning 87 Adjusting the Thresholds for Monitored User Component Analyzers 88 Thresholds of Summary Group Analyzers 89 Setting Default Thresholds for Summary Group Analyzers 90 Section 8: Managing System Health Notifications 92 Configuration and Administration Guide 4

5 Table of Contents Assigning System Health Notifications 92 Assigning System Health Notifications 92 Viewing and Managing System Health Notifications 96 Section 9: SNMP Server Configuration and Interface 98 Section 10: BlackBerry Fix-It Configuration Settings 108 Configuring Fix-It for BES and Greater 108 Section 11: Configuring Enterprise Certificate Authorities 110 Enterprise Certificate Authority Integration Prerequisites 111 Configuring the Certificate Authority 114 Configure Good MSM to Access your CA 119 Creating an Identity Certificate 120 Creating a Wi-Fi Configuration 121 Creating a VPN Configuration 122 Creating an Exchange ActiveSync Configuration 123 Configuring a Certificate Authority on Windows Server Section 12: Using Maintenance/Holiday Mode (BlackBerry Only) 128 Enabling and Disabling Maintenance/Holiday Modes 129 Using Windows Task Scheduler to Schedule Maintenance/ Holiday Modes 130 Section 13: Installing the Good MSM PING Agent 137 Launching the Good MSM PING Agent on the Device 142 Appendix A: Tuning the Good MSM Environment 148 Tuning BES Group Thresholds 148 Delivery Time to Handheld Ignore 149 Delivery Time to Handheld Sensitivity 149 Percent Time to Handheld (Critical) 150 Hung Threads 150 Remaining Licenses 152 Message Pending Count (Server) 152 Minimum User Count 154 BES To Handheld Flows 154 Minimum Flows Per Hour 155 BES To Handheld Flow Buffer 155 SRP Error Duration 155 Minimum User Percentage with Rescan 157 Rate of BES Log Lines 158 Rate of BES Log Lines (Warning) 159 Rate of BES Log Lines (Critical) 159 Minimum Log Lines Per Sample 159 ActiveSync CAS Groups 163 Configuration and Administration Guide 5

6 Table of Contents Percent of Devices Getting CAS Responsiveness Error (Warning) 163 Good Dynamics Good Proxy Servers 173 Good Proxy Server Down Duration Buffer 173 Good Proxy Server Minimum App Requests 173 Samples of Consecutive Zero App Requests 173 Percent of App Servers Failed to Connect (Warning) 174 Percent of App Servers Failed to Connect (Critical) 174 Samples of Over-the-Threshold of Failed App Server Connections 174 Minimum Hourly App Server Connections 174 Good Dynamics Good Proxy Clusters 174 Good Proxy Server Down Duration Buffer 174 Good Dynamics Good Control Servers 175 Good Control Server Down Duration Buffer 175 Good Dynamics Applications 175 Samples of Consecutive Zero App Requests 175 Good Dynamics Minimum App Requests 176 Good Dynamics GEMS Servers 176 Good Enterprise Mobility Server (GEMS) Down Duration Buffer 176 EWS Notification Zero Activity Duration Buffer 177 EWS Notification Minimum Hourly Activity Volume 177 Presence Zero Activity Duration Buffer 177 Appendix B: Using Multiple Admin Services 179 Creating Multiple Admin Services 179 Appendix C: Good MSM Utilities 181 BT-DB-BR: Database Backup and Recovery Utility 181 Backing Up the Database 181 Scheduling Regular Backups 183 Database Recovery 184 Using the Tune.exe Utility 185 GetBTLogs Utility 186 BTCertificates 188 Configuration and Administration Guide 6

7 01 Good MSM Overview Good MSM is a robust mobile device monitoring system that monitors and reports on ActiveSync, Good, and BlackBerry Enterprise Server use across an enterprise. Good MSM can detect and alert administrators about impending outages, decreased performance, or slowdowns in systems, and provide cross-tier root cause. The Configuration and Administration Guide provides system level procedures for deploying and managing Good MSM, including creating custom mobile user groups, setting Service Level Agreements, creating, modifying, and assigning notifications based on real-time monitoring of mobile devices, and configuring associated analyzers to correlate user-level experience to the underlying infrastructure components. This guide contains the following sections: Good MSM Overview Mapping User Roles Configuring the Initial Settings to Run Good MSM Enabling Data Analysis by Deploying the Good MSM Infrastructure Managing Mobile Users Custom Summary Groups Managing Summary Group and User Level Notifications Performing Mobile User Component Tuning Managing System Health Notifications SNMP Server Configurations Setting BlackBerry Fix-It Configuration Settings Using Maintenance/Holiday Mode Installing the Good MSM PING Agent Appendix A: Tuning the Good MSM Environment Appendix B: Using Multiple Admin Services Appendix C: Using the Good MSM Database Backup Utility Configuration and Administration Guide 7

8 BoxTone Oveview Good MSM provides an Admin Console as the interface for performing System Administrator tasks. This chapter contains the following sections: Logging into the Admin Console Logging Out of the Admin Console Admin Console Interface Required Workflow Action Step Description Installation Run through the workflow for a single server or dual server 1 installations. Patch 2 Apply the latest patch from Good MSM. Launch the desktop Admin 3 Open the Admin Console to configure role-based administration. Console Map user roles 4 Map user roles to Windows Security groups. Open the Good MSM Web Console 5 Proceed through the workflow based on the modules your corporation has licensed. Configuration and Administration Guide 8

9 BoxTone Oveview Launching the Admin Console To log into the Good MSM Admin Console: 1. Double-click the Good MSM Admin Console icon. By default, the Admin Console should launch automatically without requiring AD credentials to gain access. However, if the console does require a login, use pa/admin credentials to log in to the Admin Console. 2. In the Good MSM Admin Console Login window, enter the information from the table below. Field User Name Description Administrator s user name. The default user name is pa. Use this user name when logging in for the first time. Note: This user name can be changed to a unique identifier after the initial login. Password Administrator s password. The default password is admin. Use this password when logging in for the first time. Note: This password can be changed to a unique password after the initial log on. Domain Name Specifies the location of the Good MSM schema that retains system data. Note: This field only appears if you are logging into the Admin Console from a user or local machine that is not mapped to the Administrator role. See Chapter 4 for more details. 3. Click the OK button.! Note: If you log in and are not a member of the Administrator Group or an administrator on the local machine or domain, a modified login window appears with a Domain Name drop-down list. You must then log in as an administrator to access the Admin Console. Configuration and Administration Guide 9

10 BoxTone Oveview Logging Out of the Admin Console 1. Click Exit from the System menu A Confirmation dialog box opens. 2. Click Yes to exit. The Admin Console will close. Configuration and Administration Guide 10

11 BoxTone Oveview Admin Console Interface The Admin Console interface conforms to standard Windows Graphical User Interface (GUI) conventions. The following figure shows the Admin Console and its components, which are described in the following sections. Menu Bar The Menu bar is located at the top of the Admin Console window. Each item in the menu bar has a pop-up menu associated with it through which System Administrators can perform tasks. The menu bar is composed of the following four menu items: System Menu View Menu Tools Menu Help Menu System Menu Use the System menu to manage the environment and operations of the Admin Console. Configuration and Administration Guide 11

12 BoxTone Oveview The following table describes the options in the System menu. Option Refresh Settings Import Analyzer Exit Description Update Good MSM model from Information Database View the Environment Settings box. Import new Analyzers into Good MSM. From the submenu, select either From Database or From File. Exit the Good MSM Admin Console. View Menu Use the View menu to hide or show Admin Console toolbars. The following table describes the options in the View menu. Option Tree Description Show/hide the hierarchy of components of the mobile user environment. Configuration and Administration Guide 12

13 BoxTone Oveview Option Surveyor Status Bar Main Toolbar Chart Toolbar Zoom Toolbar Layout Toolbar Admin Toolbar Description Show/hide the Surveyor panel. Show/hide the Status bar. Show/hide the Main toolbar. Show/hide the Chart toolbar Show/hide the Zoom toolbar Show/hide the Chart toolbar Show/hide the Admin toolbar.! Note: If an option has a check mark to the left of it, it means the item is currently shown. Tools Menu Use the Tools menu to access the User Control Panel and Notification Control Panel to manage Good MSM user notifications. The following table describes the options in the Tools menu. Option Users... Notification... Roles... Description Opens the User Control Panel window that lists all users and contact information used to notify them. Note: If you are using Windows Authentication to manage users, this option will become unavailable. Opens the addresses window for assigning notification to model objects Opens the Map Role window for assigning roles to Windows Security Groups. Configuration and Administration Guide 13

14 BoxTone Oveview Help Menu Use the Help menu to access information about the Admin Console.. Click on the About Good MSM Admin Console option to view the About Good MSM Admin Console window. Toolbar The Admin Console toolbar, located above the Surveyor Panel, contains shortcut buttons to frequently performed features through the Admin Console menu bar. Configuration and Administration Guide 14

15 BoxTone Oveview Shortcut Button Description Update the Object Control Panel using the latest information in the Database. Show/hide the Object Control Panel Expand the tree hierarchy of the Object Control Panel. Collapse the tree hierarchy of the Object Control Panel. Launch the User Control Panel. Note: If you are using Windows Authentication, this icon will become permanently inactive, since users are managed through Windows. Launch the Map Role window. Launch the Addresses window to view and configure a listing of notifications by message recipient. Launch the Notifications window to view and configure Good MSM System Health notifications. Launch the System Health HP Notification window to configure notifications to be sent to the HP Operations Manager (HPOM) using the Good MSM /HPOM connector which can be purchased separately. Note: See Chapter 8 for more information on System Health notifications. Launch the System Health SNMP Notification window to view and configure a listing of SNMP System Health notifications. Note: See Chapter 8 for more information on System Health notification Object Control Panel The Object Control Panel, on the left side of the Admin Console, displays the components of the mobile user environment as a tree hierarchy (tree). If the Object Control Panel does not display, click the Show/Hide shortcut on the Main toolbar. Configuration and Administration Guide 15

16 BoxTone Oveview Using the Object Control Panel, the administrator can perform the following tasks: Manage mobile users and components. Deploy and configure analyzers on infrastructure components. Status Bar The Status bar, located at the bottom of the Admin Console window, displays the status of the current Admin Console session and its connection to the Good MSM Broker Server. Configuration and Administration Guide 16

17 02 Mapping Good MSM User Roles This chapter describes how to manage user access and roles using the Good MSM Admin Console. Default Windows Authentication to Manage Users By default, Windows Authentication is automatically enabled to manage users. Instead of manually adding and managing users within the Good MSM system, existing Windows users are mapped to a group as part of a normal workflow to give them access to the Good MSM system. Default Windows Authentication allows multiple approved users to have access to the Administrator role by adding them to an Administrators group (the Good MSM user management system only allows for one administrator user).additionally, Windows Authentication will leverage your predefined security and password aging policies. Configuring Role-Based Administration To map Good MSM roles to Windows Security Groups: 1. Click on the Map Role button in the Toolbar. Configuration and Administration Guide 17

18 Mapping BoxTone User Roles 2. In the Mapped Windows Security Group column, click on the Browse button. 3. Enter the name of a group in the field. These groups can be domain groups or local groups comprised of other groups. Click on the Check Names button to check the name of the group.! Note: For easier administration, Good MSM recommends using local groups. Add users to the appropriate mapped groups to give them access to Good MSM with the appropriate role. 4. Click OK.! Note: You can also type the group names into the Mapped Windows Security Group fields to the right of the Good MSM roles without looking the group up first. Configuration and Administration Guide 18

19 Mapping BoxTone User Roles The access privileges associated with each role are defined in the following table. Role Administrator BESOperations AdvancedMessagingDesk MessagingDesk AssetManager HelpDesk MobileDeviceUsers USSDeviceOwner Description Allows access to all Good MSM consoles and features including the Admin Console, Ops Console, Ops Dashboard, Help Desk Console, and Analysis Console. Can create users and assign roles to users. The local Administrators group on the Good MSM application server will always have access to this role. Allows access to the Ops Console, Ops Dashboard, Help Desk Console, and Analysis Console. Allows full access to the Help Desk Console including the Detail Information and History pages and additional user information (Analysis Console). Allows full access to the Help Desk Console including the Detail Information and History pages. Allows access to the Asset Management reports. Note: This role only becomes available if the Asset Management component is installed. Allows access to the Help Desk Console User Diagnostic page. Allows Admin users to sync Active Directory user accounts and associate BES and Good users with AD user accounts. Allows access to the User Self-Service portal.! Note: If you are not a local or domain administrator, you cannot map the Good MSM Administrator role to a group of which you are not a member. Configuration and Administration Guide 19

20 Mapping BoxTone User Roles 5. Once you have mapped all roles to Windows groups, click OK. The Admin Service is stopped and restarted If you receive a message stating that the Admin services failed to restart, they should be manually restarted for Windows Authentication to take effect.! Note: Since Windows Authentication is applied by default, the Policy icon on the toolbar will now be permanently inactive, as user access will now be managed via Windows group membership. The Use Windows Authentication checkbox at the top of the Map Role window will also be inactive. In the future, when a user logs into the Admin Console, the system will run two tests to decide whether the user should have access: 1. Is the user a member of the mapped Good MSM Admin group? 2. Is the user an administrator on the local machine? Or: Is the user a domain administrator? If the user passes both of these tests, the Admin Console will open. If the user fails both tests, the following Login window opens. Custom Summary Groups Configuration and Administration Guide 20

21 03 Configuring the Initial Settings to Run Good MSM This section will lead you through the initial settings required to run Good MSM software for the first time. All other settings may be modified or set at a later date. Though most settings reside within the Good MSM Settings page, some actions such as mapping user/ group roles and loading analyzers must be taken within the Admin Console desktop application. After successfully completing the installation process, configuring Good MSM settings is the next step. Configuration Progress Meter As you enable various settings and proceed through the setup, the configuration meter will track the progress in real-time and keep a running list of the settings left to configure. Any setting that has not been edited from the default settings will appear as Settings Remaining to Complete to provide the opportunity to completely customize your environment. Each individual panel will also contain a progress bar that indicates the completion percentage for settings configured in that section. Configuration and Administration Guide 21

22 Configuring Initial Settings Panel Progress Bar Each individual panel will also contain a progress bar that indicates the completion percentage for settings configured in that section. Partially completed sections or sections with incorrect data will not count towards your completion percentage. Saving Settings Settings may be modified after the initial configuration. Any updates made must be saved first and then applied in order to implement the changes. If a setting has been applied, a check mark will appear in front of it. If an asterisk appears in front of the setting, then the setting has been saved. An exclamation indicates an error has been detected in the setting configurations. Licensing Upon the first visit to this console, licensing details will be expanded to show the licensed platforms and modules. Settings Overview Each tab under settings includes several subsections to be customized. In some instances, the default settings will be acceptable for your enterprise. However, it is important to check that all settings have been configured to best support the needs of your organization. A progress bar or meter will be located in the right-hand corner of each section to demonstrate the percentage of that section that has been configured. Global Settings Include Global settings are required and must be configured before running Good MSM for the first time. However, it is recommended that all settings be configured before running Good MSM, as this will optimize use of the system. Attempts to run Good MSM without configuring these settings will fail and potentially cause system issues. Configuration and Administration Guide 22

23 Configuring Initial Settings Device Management Settings configured in this section will affect the types of compliance alerts received and ensure that you have the proper certifications to run Good MSM and connect to the required external resources. Platform Configurations In this section you will select servers and set paths to logs to include in monitoring based on the platforms licensed. Settings configured here will be displayed under the Operate Tab. Service Desk and User Self-Service Configure settings for the Service Desk and User Self-Service Portal on this page. Enterprise Information These are the settings for corporate branding, support contact information and other enterprise settings. Settings configured here will used by various components of Good MSM. Advanced Settings Use these settings to configure local and remote log collector instances. Configuration and Administration Guide 23

24 Configuring Initial Settings License Details The configurations page will display a summative panel showing the enabled platforms from Good MSM. This panel will only be expanded on the first visit. In subsequent visits to this page, the panel will be contracted. Press edit to disable or enable platforms. In addition to providing an overview of licensing details, use this panel to enter key information provided by Good MSM to access new licensed modules. The licenses enabled in this panel may change the configurations available throughout the MSM Admin page. License keys from earlier releases may not be reused. Good MSM will issue a new key for any upgrades or licensing changes. If your licensing changes after installation, use the Change License Key button to update the Good MSM Settings page with the details of your new licensing.! Note: Licensing also determines the range of settings available to you by Good MSM. This guide was constructed to cover the configuration process for all licensed modules. If options appearing in the guide are not available to you on the Good MSM Settings page, it is likely that your enterprise has not licensed that module from Good MSM. Configuration and Administration Guide 24

25 Configuring Initial Settings Global Settings There are three sections to configure within the Global Settings panel. These settings are required and should be configured prior to running Good MSM for the first time. SMTP / Notifications Active Directory Sync/ User Mapping Group Filters SMTP / Notifications Upon first login, the Notifications window will open. This is a one-time configuration required to issue Good MSM system health alerts and other status notifications based on settings configured on this page. Once a problem is detected, the Good MSM system will send an alert to the address listed below. System health alerts will range by degree of severity and provide links to detailed system health data and recommendations for issue resolution. Use an address that is recognized by your system to avoid having health alerts be redirected to a spam folder. To initiate system health notifications, complete the fields below. 1. Enter the SMTP Server host name and TCP Port. By default, Port 25 will be listed in the field below. 2. Choose an address to receive system health notifications. 3. The system will generate notifications from the address listed in this field.! Note: If the Notification screen is accessed through the Admin screen in the Global Settings menu, you will only have the option to Apply Settings or select Cancel. The back button will not be available. notifications must be completed before continuing through the initial configuration. Configuration and Administration Guide 25

26 Configuring Initial Settings Active Directory (AD) Syncing What do we sync from Active Directory? Good MSM syncs the AD users and groups required for managing devices and applying policies based on user groups. This includes: Recursive AD user objects mapped to the mobile users group. Basic information for all AD group objects in the forest. The group objects information is required to populate the group cache so that we can select groups to watch and assign policies. Full recursive membership information for any group that has a policy assigned to it, or has been selected as a watch group. All Exchange AD objects in the forest to determine exchange server information or configuration. Full AD user information for any user found in the CAS logs. Sync processes There are 4 sync processes: On-demand Sync - Good MSM discovers users on demand when the full sync has not been run Delta Sync Runs every 5 minutes to detect changes for users, groups, and group filters Full Sync Runs once a day to sync users, groups, Exchange servers and devices. Optimized Sync- Expedites the syncing process by only allowing servers and selected user groups to be included in the sync. In this mode, ActiveSync pairing information is only synchronized for members of the Mobile Device Users role.! Note: Changing the mobile device owner s group will also initiate a full sync. Configuration capabilities for the sync Group filter configuration is the only configuration that is built into the product. AD attributes included in the sync a. User name, domain, SID, GUID, distinguished name, canonical name, organizational unit, san account name, exchange server host name, display name, mail, first name, last name, linked account SID, linked account SAM account name, linked account domain, mail nick name, manager, physical office, principal name, title, company, department, street address, postal code, city, state, country, home phone, mobile phone, legacy exchange DN, when accessed, when created, when changed b. Group domain, name, SID c. Exchange name, GUID, domain, FQDN, version, roles d. Domain name, NetBIOS, FQDN, SID Configuration and Administration Guide 26

27 Configuring Initial Settings User and Group Sync (Requires AD Syncing) Before proceeding with User and Group sync, ensure that user and group designations have been mapped accordingly. Map user roles through the Admin Console. Immediately following the Good MSM installation, the Admin Console icon will appear on the desktop. Once the Admin icon is pressed, the console will open directly to the Map User Roles window. Create user and group roles before running the sync within the web console. Several licensed modules will require Active Directory (AD) syncing as part of system configuration. Membership data is cached within Good MSM to view group data and manage group policies. Authorized mobile users from these groups will be synchronized with Good MSM. While caching, User Sync options will appear as inactive. Once caching completes, the options will return to an active state. If user roles and group designations need to be modified after the initial setup, return to the Admin Console to adjust the mappings. User and Group Sync (Optional AD Syncing) If Active Directory syncing is optional for your environment, caching will commence after the slider is moved to enable syncing. User and Group assignments and designations should be made using the Admin Console on the application. server. Membership data is cached within Good MSM to view group data and manage group policies. 1. Move the slider from No to Yes. 2. Press Apply to enforce the user and group syncing Configuration and Administration Guide 27

28 Configuring Initial Settings What is Optimized Active Directory (AD) Sync Mode? Optimized AD Sync expedites the syncing process by only syncing information that is pertinent for your environment, such as servers and selected user groups. Optimized sync is highly recommended for large deployments without Security Management. In larger deployments, the full sync may take a longer time to complete. Infrastructure Elements Included in the Sync Discovered Servers User and Groups (The groups selected by the IT Admin will be included in the Optimized Sync). This mode will automatically allow the group cache sync and the exchange server sync to be turned on and complete. Infrastructure Elements not included in the Sync Non-Good Work ActiveSync (AS) devices will not be synced with the system even if they are syncing through CAS Group details for non VIP Users on Service Desk AS actions are disabled on Service Desk Reports will not have the data we typically pull from AD! Note: When running Optimized Sync Mode, some information will be limited or unavailable across various dashboards. Device reconciliation may be limited further resulting in incomplete pairings in Service Desk. Devices running Good Dynamics will display all information and remain searchable on Service Desk. This mode will not work for customers with Security Management. Configuring AD Optimized Sync Mode To configure AD Optimized Sync Mode, complete the steps below. 1. After Install has completed, open the Command Prompt 2. CD to <install_drive>\boxtone\utilities\ ADSyncMode 3. Type EnableADOptimizedMode.bat 4. If you wish to enable VIP alerting, map the Mobile Device Users group to your VIP/Monitored users instead of mapping them to all mobile users. 5. Log into the MSM Web Console and navigate to the Good MSM Admin page. 6. Follow the onscreen instructions to enable Optimized AD Sync. 7. Log into the Admin Console and load the user analyzers Configuration and Administration Guide 28

29 Configuring Initial Settings VIP groups will not be included in the sync (and monitoring) unless this option is configured on the System Operations panel. 8. Press Edit 9. Turn VIP User AD Sync on (if disabled) and press Save. VIP users should be mapped to the Mobile Device Users group instead of the Domain Users group. See Section 5: Creating Custom Groups to learn how to create/edit a VIP Group. Configuration and Administration Guide 29

30 Configuring Initial Settings Group Filtering Group Filtering allows mapped groups to be selected and then cached within Good MSM. The Mobile Device Users Role should have been set within the Admin Console. Group policies, profiles, and app sets can be applied to policy groups. Watch groups will be monitored for data analysis purposes throughout the various Good MSM dashboards. Limit the number of cached groups for usability and performance considerations. Device Management Panel There are eight sub-sections to configure within the Device Management panel. Settings available are contingent upon the modules you have licensed from Good MSM. Security Management Hosts Device Identity Certificates Apple Push Notification Service Certificate Android Security Management Servers SSL Certificates Security Management Activation Compliance Threshold DMZ Apache Configuration Configuration and Administration Guide 30

31 Configuring Initial Settings Security Management Hosts To configure Security Management, set up a host for the activation server and a host for the management server. Each host should be configured in the perimeter network if the DMZ setting is there and mapped to a local IP address. Local IP addresses may be selected from the drop-down menu onscreen. This will only be applicable if Security Management has been licensed from Good MSM. Device Identity Certificates Device Identity Certificates allow Good MSM to securely identify each device. When a device enrolls in security management, Good MSM uses a device identity certificate to be a unique identifier. The certificate captures device information, company name, and country information. In most cases, the default entries for this field will be acceptable. However, to modify these entries, use the fields below. 1. Edit or update company information in the Company Name box. 2. Select the appropriate country from the drop down menu. Configuration and Administration Guide 31

32 Configuring Initial Settings 3. Press Save to apply the changes. Apple Push Notification Service (APNs) Certificate ios Device Management requires an APNs certificate to communicate with Apple s Push Notification Service. This certificate is issued by Apple through the Push Certificates Portal using a Certificate Signing Request (CSR). Configuration and Administration Guide 32

33 Configuring Initial Settings Android Security Management To add a new Android Security Management server, press Add Server. Enter the Host, port, associated , password and domain for this module. Importing SSL Certificates Select a certificate obtained from a trusted certificate authority to be used when a device accesses the activation server. Use the buttons to Import a PKCS #12 file or select Import Separate Files to individually upload the SSL certificate file, key file, and chain file. Base Requirements for Importing SSLs The certificate must be issued by a CA trusted by Apple. Click the embedded link onscreen to learn more about trusted CAs ( Certificate and Security Management Naming Conventions The DNS names for the device activation server hostname and device management server hostname depend on your conventions and IT policy for naming hosts. For instance, the device activation server hostname may be Good MSM -dom-enroll.asia.company.com, or similar. Likewise, the device management server hostname may be Good MSM -dom-mdm.asia.company.com. Whoever manages the DNS for the asia.company. com or company.com domain can probably recommend what hostnames to use. Using a simple <prefix>. asia.company.com DNS name will allow you to use a wildcard SSL certificate for *.asia.company.com for mutiple installs. The common name (CN) and/or subject alternative name of the certificate must include device activation server hostname (Good MSM -dom-enroll.asia.company.com) or the wild card name (*.asia. company.com). Configuration and Administration Guide 33

34 Configuring Initial Settings Passwords Passwords will always be required for PKCS #12 files. For individual file imports, a password will only be required if an encyrpted key file is uploaded. The PKCS#12 file must contain a key and the matching certificate. In some instances, it will also include the chain certificate file (a group of intermediate certificates). The chain certificate file is optional because the PKCS #12 typically includes the key and all relevant certificates. If your PKCS#12 file does not include the intermediate certificates, you may import them as a separate chain file using the designated field onscreen. In addition to.pfx and.p12 files, the following certificate file types are also accepted :.pem,.cer,.crt, der, and.key. The permitted files types are listed above each field. If an accepted file type is uploaded to the wrong field, the import will be unsuccessful. Configuration and Administration Guide 34

35 Configuring Initial Settings Security Management Activation The Security Management activation should serve as an introduction to Security Management services. This should include instructions for enrollment, a brief description of what Security Management entails, required support contact information, and the URL to visit in order to enroll devices. Test the URL to ensure the link is active before sending the to users. Complete the form to provide instructions to users who wish to enroll in Good MSM Security Management. Configuration and Administration Guide 35

36 Configuring Initial Settings Compliance Threshold Compliance alerts provide information about devices that violate the established compliance rules at any point while the device is syncing with system resources. If this threshold is exceeded, the Compliance Engine and automated compliance actions will be disabled and a system health alert will be triggered. After adjusting the compliance percentage, press Save to accept the changes. After arranging thresholds and settings on this screen, you will have access to customize the Compliance rules and corresponding actions to take against a device when it is in violation of the rules. Settings can be adjusted by navigating to the Configure Tab on the web console and pressing Device Configurations on the submenu. Various compliance charts will be available on the Configure Dashboard. Use this page to view real-time compliance data for all devices enrolled in Good MSM. DMZ Apache Configuration If you have licensed the Mobile Device Management module, you must configure the MDM gateway server in the Demilitarized Zone (DMZ) portion of the network. The gateway server provides an additional layer of security by proxying management communication for any devices that are outside of the enterprise firewall (e.g cellular-connected devices). The following configuration steps are necessary for the MDM gateway server. Download and install apache on the MDM Gateway server per the Good MSM System Requirements. Use the Good MSM Settings Page to download the Apache configuration files (dmz-server.zip) and copy it to the MDM gateway server. 1. Unzip the DMZ-server.zip Apache file 2. Stop the Apache Service Configuration and Administration Guide 36

37 Configuring Initial Settings 3. Copy the conf. folder from the DMZ server.zip and replace the conf.folder in the existing Apache installation folder 4. Restart the Apache services Platform Configuration Panel There are four sub-sections to configure within the Platform Configuration panel. Settings available are contingent upon the modules you have licensed from Good MSM. BlackBerry Enterprise Server 5.x Configuration BlackBerry Configuration Database BlackBerry Enterprise Servers Logs Good for Enterprise (GFE) Configuration Good Mobile Control Database (s) Good Mobile Control Web Services Good Mobile Control Messaging Servers Logs Good Dynamics Configuration Good Control Database(s) Good Proxy Logs Microsoft Exchange ActiveSync Configuration BlackBerry Enterprise Server (BES) 5 Configuration Provide information on the BES servers included in Good MSM monitoring. Once a server is added, all devices in that database will be monitored for device, connection, messaging or other system issues. Servers will be auto-discovered by Good MSM. Highlight a server from the list by clicking in the row and press the database Configuration and Administration Guide 37

38 Configuring Initial Settings hostname to modify any of the configuration database settings. To remove a server from monitoring, press the gray X. Monitoring for the users and servers in that domain cease once the domain is removed. BlackBerry Configuration Database Settings If the desired server does not appear, press Add database and manually enter the Database hostname, the database instance name, the named instance and the port number. Press Save to add a new BES domain to monitoring. Configuration and Administration Guide 38

39 Configuring Initial Settings! Note: If Windows Authentication has been selected, the fields pertaining to SQL Authentication will be not be available. BES Logs Data captured from monitored logs is used to compile metrics for devices on the BES servers. Log files are monitored in real-time. Servers appearing below have been discovered from your BES Configuration Database. If the log share has not been configured for a particular server, it will not be included in the monitoring. Additionally, users with devices provisioned to that server will not appear in searches or drill-down results. Ensure that paths to the logs are correct and press Save. Good Mobile Control Databases GMM servers are auto-discovered from Good Mobile Control (GMC). Once a server is added, all devices in that database will be monitored for device, connection, messaging and/or other system issues. Highlight a server from the list and press add server. If the desired server does not appear, press Add Server and manually enter the Database hostname, the database instance name, the named instance and the port Configuration and Administration Guide 39

40 Configuring Initial Settings number. By default, the SQL server database engine will be pre-populated to listen on port To accommodate dynamic port configurations, clear the pre-populated port number and leave the field blank. Complete the fields for Database Hostname, Name and Instance Name. This action will allow an available port to be dynamically assigned by SQL. Configuration and Administration Guide 40

41 Configuring Initial Settings Good Mobile Control Web Services Good MSM requires the access configurations for GMC Web Services in order to perform Fix-it Actions in Service Desk and User Self-Service. Servers should be auto-discovered from the Good Mobile Control Database. To enter host, port, or user credentials for web services, press the link under GMC Web Services Host. The link will open a pop-up window containing the GMC web services host settings. Configuration and Administration Guide 41

42 Configuring Initial Settings Data captured from monitored logs is used to compile metrics for devices on the GMM servers. Log files are monitored in real-time. Device limits default to 1000, which is the recommended number per server. The bar graph next to default limit displays the current capacity percentage for each listed server. Good Dynamics (GD) Server Configuration Provide information on the GD servers included in Good MSM monitoring. Servers will be auto-discovered by Good MSM.Highlight a server from the list and press add server. If the desired server does not appear, press Add Server and manually enter the database, authentication, Database hostname, the database instance name, the named instance and the port number. Configuration and Administration Guide 42

43 Configuring Initial Settings Good Enterprise Mobility Server (GEMS) Configuration Provide information on the GEMS database host names/instances included in Good MSM monitoring. Servers will be auto-discovered by Good MSM. Highlight a server from the list and press add server. If the desired server does not appear, press Add database and manually enter the database, authentication, Database host name, the database instance name, the named instance and the port number. In order to provide monitoring of the GEMS application server and detect errors in the notification workflow used to inform users that new messages are available when the Good Work app is in the background, or in a suspended state Configuration and Administration Guide 43

44 Configuring Initial Settings Good Proxy Logs Data captured from monitored logs is used to compile metrics for devices on the GD servers. Log files are monitored in real-time. If the log share has not been configured for a particular server, it will not be included in the monitoring. Additionally, users with devices provisioned to that server will not appear in searches or drill down results. Microsoft Exchange Client Access Server Configuration Good MSM automatically discovers Exchange servers within your environment. If your company has licensed Incident Management, you will be required to use both of the fields below to include servers in monitoring. Configuring monitored CAS servers is a required action that must be completed prior to running Good MSM for the first time. W3SVC is required to monitor the CAS transaction logs. HTTP Error logs are required to provide real-time comprehensive error detection and alerting services. If Incident Management has not been licensed, the HTTPERR log field will not appear in this panel. The following is required for Good MSM to read the CAS W3SVC and HTTPERR logs: Microsoft Exchange CAS W3SVC and HTTPERR log folders must be shared (Exchange IIS logs) Good MSM service account requires read access to the log folder Validate CAS W3SVC and HTTPERR logs are accessible from the Good MSM server Logging should be configured as follows: o Format: W3C o Encoding: UTF-8 o Rollover schedule: Daily Ensure the paths to the CAS transaction logs are correct before saving the settings. If a server is selected, a corresponding path to the logs must be provided. Configuration and Administration Guide 44

45 Configuring Initial Settings! Note: Fields for HTTPERR Logs Share Path will only appear if Good MSM Incident Management is licensed. Press Save to enforce the settings. Support Settings Panel There are two sub-sections to configure within the Service Desk and User Self-Service panel. Settings available are contingent upon the modules you have licensed from Good MSM. USS Server Configuration & Device Instruction Good Mobile Messaging Load Balancing User Self-Service (USS) Server Configuration USS is an online portal that allows users to complete a range of corrective actions on their devices without contacting the Service Desk or a Good MSM Administrator. From this window, establish the host name for USS web services. The modules and platforms licensed will change the range of options and workflows for corrective actions on user devices from the USS portal. Press Save to continue. Configuration and Administration Guide 45

46 Configuring Initial Settings Operations Settings Use this panel to group ActiveSync servers within large deployments or to optimize viewing on the dashboard. 1. To group servers, download the configuration. 2. Next to each server, in the Group_Name column add the group the server belongs to. 3. After you have added all necessary servers and group names, upload the new configuration and close the panel. 4. These changes should be visible in the ActiveSync Dashboard. Configuration and Administration Guide 46

47 Configuring Initial Settings Connection Source Monitoring Settings In the Good MSM settings page, users will now have the option to disable Connection Source monitoring within their environments. It may be advantageous to disabling connection source monitoring in some environments to help minimize load processing on the system. This option is not recommended for Exchange 2013 deployments. Configuration and Administration Guide 47

48 Configuring Initial Settings USS Device Instructions When a user deactivates a corporate-owned device, they will need instructions and procedures for returning and fully decommissioning the device Deactivation instructions should apply to both corporate-owned/managed devices and users with personal devices (BYOD). However, users with their own devices should only be required to deactivate the device to remove it from monitoring and access to corporate resources. For other scenarios, Administrators can force devices into retirement and remove them from monitoring. Enter a subject and press save to continue. Configuration and Administration Guide 48

49 Configuring Initial Settings GFE Load Balancing As users are added to GFE, prioritized rules must be configured to determine where the devices will be provisioned. Preferred Server Allocate preferred servers for different AD groups and set the priority. Users with several group memberships will be assigned to the server attached to the first group they are listed in. Preferred Rule Add preferred rules for watch groups. Watch groups are monitored in dashboards, Service Desk and in available reports. Profiles, policies and app sets applied cannot be applied to Watch groups. Global Default If the servers listed above are unavailable, or if the users are not members of any of the groups above, the devices for those users will be provisioned on the server selected below. Configuration and Administration Guide 49

50 Configuring Initial Settings Unused Servers Servers in this category are not governed by any known rules or policies. Enterprise Information Panel There are three sub-sections to configure within the Enterprise Information panel. Settings available are contingent upon the modules you have licensed from Good MSM. Custom Branding Support Contacts User Agreement Custom Branding Good MSM USS portal, application catalog and enrollment application can be customized to include your corporate brand colors and logos to create a look that is consistent with your brand identity. Configuration and Administration Guide 50

51 Configuring Initial Settings Use the framework below to tailor the user interface on listed applications. Support Contacts Complete this form to provide multiple corporate support resources to users. Configuration and Administration Guide 51

52 Configuring Initial Settings Advanced Settings Advanced Log Collection enables large companies to deploy multiple log collectors on remote servers for geographic distribution or to accommodate restricted access. To create a new/remote instance 1. To add a local instance press the Add Log Collector Instance button 2. To add a remote instance press the Add Remote Log Collector Instance button. 3. Enter an instance name that will be easy for you to remember and recognize. 4. Local instances will also require the domain and user name, in addition to a password. Remote instances just require the name. 5. Press Save. 6. The instance will appear in the list. To access the binaries, press the download Configuration Template. Configuration and Administration Guide 52

53 Configuring Initial Settings Configuring Remote Log Collectors Use the instructions below to configure your remote log collectors.! Note: Remote logs collector must be created prior to configuring the logs. 1. Add the remote log collector instances via the Advanced Settings Panel in the Good MSM Admin page. 2. Download the Configuration Template 3. Map the remote instances and provide the log paths Once the template has been uploaded, the local instances will be configured and restarted by MSM and they will start reading the configured logs! Note: You can also switch local log collector ownership in this file, due to performance reasons you may want to switch and distribute accordingly for performance benefits. You can also create local log collector instances to distribute the load 4. For remote instances you need to download the binaries and configure them on the remote server. 5. Download the instances and copy them to remote machine (use the button next to the instance)! Note: If you tune your RLCs before this, they will inherit the tuned settings. If you execute Tune.exe then will you create log collectors settings that will be inherited.(may not be able to copy within the DMZ server) 6. Next you will need to create the Good MSM Log Collector service 7. Open the CMD prompt as an Administrator 8. Enter the Change Directory command for the remote log collector folder (sample command below) *<smpl-fldr-rlc is just a place holder for your actual remote log collector folder, enter your RLC folder name>*: cd smpl-fldr-rlc \GoodMSM_Log_CASInstanceSMPL 9. Change directory to bin \smpl-fldr-rlc \GoodMSM_Log_CASInstanceSMPL>cd bin 10. Enter the following command: \smpl-fldr-rlc \GoodMSM_Log_CASInstanceSMPL> bin > install.bat 11. Open BoxTone BES log collector properties in Windows Services panel 12. Navigate to the Log On tab Enter the account name Enter the password Confirm the password Press Apply 13. Restart the services Configuration and Administration Guide 53

54 Configuring Initial Settings These files can also be found under \\BoxTone\Utilities\RemoteLogCollectorBinaries folder If you have RLCs and are applying the latest patch or service release to your system, the patch will place a patch file in zip format which should be extracted on the remote log collectors running on remote servers and they should be restarted. Using the Template Mapping Instances 1. Download the template 2. List all instances in the mapping 3. By default, all instances will be mapped to the default instance. Change the instances under the Log_ Collector_Instance column. 4. Save the template, and then upload it. 5. Once new instances have been added, they will now appear in the Log Collector instances Panel featured on the following page. Removing Instances 1. Press the X at the end of the line (in the panel) and this will remove this instance. Configuration and Administration Guide 54

55 Configuring Initial Settings Press view all to see the full list of Log Collector Instances. Log Collector instances may not be edited from this panel. To edit or modify log collector instances return to the Advanced Log Collector Settings panel. Configuration and Administration Guide 55

56 Configuring Initial Settings Maintenance Panel To prevent workflow or performance issues due to expired certificates, use the Maintenance panel to replace or renew certificates before they expire. It will not appear in the settings page otherwise. Thirty days before your certificate expires, you will start receiving system health notifications at the address listed in Global Settings. These notifications will increase in frequency as the expiry date approaches.! Note: Even though you may have initially configured your certificates in the Device Management panel, certificate renewals or replacements must be completed in the Maintenance panel. SSL Certificate: This certificate is used during enrollment. Upload a new certificate from the third-party vendor of your choice. MDM Certificate: This is primarily used for Security Management/Mobile Device Management. It allows the devices to check in. If this certificate is allowed to expire, devices will no longer be managed. Internal Certificate: Used by internal components on the MSM server. If this certificate is allowed to expire, GFE Fix-It actions will be unavailable in the Service Desk and User Self-Service consoles. Renew SSL Certificate Importing SSL Certificates Select a certificate obtained from a trusted certificate authority to be used when a device accesses the activation server. Use the buttons to Import a PKCS #12 file or select Import Separate Files to individually upload the SSL certificate file, key file, and chain file. Base Requirements for Importing SSLs The certificate must be issued by a CA trusted by Apple. Click the embedded link onscreen to learn more Configuration and Administration Guide 56

57 Configuring Initial Settings about trusted CAs ( Select Replace to upload a new certificate. As long as the certification has not already expired, the system will always prompt you with this message before allowing you to upload a new SSL certificate. After pressing replace, the following screen will appear. Select Import PKCS#12 file or Import Separate Files to continue the process. Certificate and Security Management Naming Conventions The DNS names for the device activation server hostname and device management server hostname depend on your conventions and IT policy for naming hosts. For instance, the device activation server hostname may be Good MSM -dom-enroll.asia.company.com, or similar. Likewise, the device management server hostname may be Good MSM -dom-mdm.asia.company.com. Whoever manages the DNS for the asia.company. com or company.com domain can probably recommend what host names to use. Using a simple <prefix>. asia.company.com DNS name will allow you to use a wildcard SSL certificate for *.asia.company.com for mutiple installs. The common name (CN) and/or subject alternative name of the certificate must include device activation server hostname (Good MSM-dom-enroll.asia.company.com) or the wild card name (*.asia. company.com). Passwords Configuration and Administration Guide 57

58 Configuring Initial Settings Passwords will always be required for PKCS #12 files. For individual file imports, a password will only be required if an encrypted key file is uploaded. The PKCS#12 file must contain a key and the matching certificate. In some instances, it will also include the chain certificate file (a group of intermediate certificates). The chain certificate file is optional because the PKCS #12 typically includes the key and all relevant certificates. If your PKCS#12 file does not include the intermediate certificates, you may import them as a separate chain file using the designated field onscreen. In addition to.pfx and.p12 files, the following certificate file types are also accepted :.pem,.cer,.crt, der, and.key. The permitted files types are listed above each field. If an accepted file type is uploaded to the wrong field, the import will be unsuccessful. Renew MDM Host Certificate This certificate allows post-enrollment communication between devices and the MDM server. Should the expiry date on the certificate lapse, enrolled devices will no longer be under management. Press Generate Certificate to create a new MDM Host Certificate. Renew Internal Certificate The Internal server certificate enables communication between different components on the Good MSM server. If this certificate is allowed to lapse, GFE Fix-it Actions in User Self-Service and Service Desk will be unavailable until this certificate is renewed. Press Renew Now, to generate a new internal certificate. Configuration and Administration Guide 58

59 Configuring Initial Settings If you are using a DMZ, Good MSM recommends updating your DMZ configuration after any of the certification renewals or replacements. To do so, select the Renew DMZ apache configuration files link. Renew DMZ Apache Configuration The following configuration steps are necessary for the MDM gateway server. Use the Good MSM Settings Page to download the Apache configuration files (dmz-server.zip) and copy it to the MDM gateway server. 1. Unzip the DMZ-server.zip Apache file 2. Stop the Apache Service 3. Copy the conf. folder from the DMZ server.zip and replace the conf.folder in the existing Apache installation folder 4. Restart the Apache services Configuration and Administration Guide 59

60 04 Enabling Data Analysis by Deploying the Good MSM Infrastructure Complete the following steps to load the Mobile User analyzers in the Good MSM infrastructure and enable components to monitor. Loading the analyzers is required to start the analysis process for mobile users and components. After the analyzers are successfully loaded, Good MSM collects information about each mobile user in the environment and performs analyses to identify potential abnormalities with their mobile service. Configuration and Administration Guide 60

61 Deploying the BoxTone Infrastructure Using the Object Control Panel, the administrator can perform the following tasks: Manage mobile users and components. Deploy and configure analyzers on infrastructure components. Status Bar The Status bar, located at the bottom of the Admin Console window, displays the status of the current Admin Console session and its connection to the Good MSM Broker Server. 3. In the Object Panel, right-click the object to be deployed. 4. Click Deploy Infrastructure.! Note: Good MSM does not recommend loading all carrier analyzers in large environments, as this will include roaming carriers. To optimize the load on the Good MSM System, Good MSM recommends only loading carrier analyzers for the top carriers in your environment. Good MSM does not recommend monitoring a carrier with less than 25 devices associated with it. Configuration and Administration Guide 61

62 Deploying the BoxTone Infrastructure The Analyzer Control View window for the component opens and displays all analyzers. The following table describes each of the buttons in the Control View window. Component Adjust Variables Description Adjust the variables for the selected analyzer(s). Note: This is not used for most analyzers and will be grayed out by default. Set Sample Rates Refresh all status Load All Unload All Set the sample rates for the selected analyzer(s). Good MSM does not recommend updating this value. Refresh the status of all analyzers in the Analyzer Control View window. Load all analyzers displayed in the Analyzer Control View window. This deploys all analyzers that monitor mobile users. Unload all analyzers displayed in the Analyzer Control View window. Loading Analyzers Perform one of the following tasks to load the analyzers: To load all analyzers displayed in the Control View, click the Load All button. This deploys all analyzers Configuration and Administration Guide 62

63 Deploying the BoxTone Infrastructure that monitor mobile users. To load a single analyzer, right-click the row containing the UID of the analyzer and select Load from the right-click menu. The status changes from Loading to Loaded when completed. Unloading Analyzers Perform one of the following tasks to unload the analyzers: To unload all analyzers, click the Unload All button. To unload a single analyzer, right-click the row containing the UID of the analyzer and select Unload from the right-click context menu. Multiple analyzers can be selected by pressing the <Ctrl> key and left-clicking. Configuration and Administration Guide 63

64 05 Custom Summary Groups This chapter describes how to manage summary group users in the Good MSM system. Custom Summary Groups gather mobile users with similar profiles for monitoring purposes into a single object, such as your organization s VIP level executives. A Custom Summary Group can also represent a single mobile user who requires special attention, such as a corporate officer or a member of the Executive Management team. The following tasks are used to manage mobile users through the Mobile Users object in the Object Control Panel. Creating and Modifying Custom Summary Groups Changing Maximum Users Displayed Per Page Tuning Custom Summary Group and User Thresholds The Mobile Users object displays under the Enterprise object in the Object Control Panel tree and represents the mobile users in the network. The All Users object is the default profile that represents the server objects that support the mobile users. Creating and Modifying Custom Summary Groups Summary Groups are created by default for monitored components, i.e. users on monitored servers. Additional Summary Groups can be created through the following actions: Configuration and Administration Guide 64

65 Custom Summary Groups Syncing AD Groups Creating BB Custom Summary Groups Custom Summary Groups display under the Mobile Users object as shown below. If you have the Good MSM Asset Management module and enabled the active directory group sync during the installation, Good MSM will automatically create summary groups for you synchronized AD groups. Creating Custom Summary Groups To create a Custom Summary Group: 1. In the Object Control Panel, right-click Mobile Users. 2. Point to Add New Object to Mobile users on the right-click menu. 3. Select Add New Custom Summary Group from the sub-menu. Configuration and Administration Guide 65

66 Custom Summary Groups The Create Group window opens. The following table describes the components of the Create Group window. Button Edit Menu Group Name Field Users List Group Members List Description Edit group properties Edit group properties to specify the number of users to display in the Users List. Lists the existing mobile users. Lists the members you add to the new summary group. Select All Button Selects all user names in a list. >> Adds users to the Group Members list from the Users list. << Removes users from the Group Members list to the Users list. Page Number Name Search Field Indicates the number of pages containing user names. Searches for users whose first or last names contain any one letter entered as a search criteria, which is not case sensitive. Configuration and Administration Guide 66

67 Custom Summary Groups 4. Type a name for the user group in the Group Name field. 5. From the Users List, press the <CTRL> key and select the user names to add to the user group. Once selected, the user names are highlighted in the Users List. 6. Click the Add button. The selected users are displayed in the Group Members List! Note: The Delete User option is not available for the Administrator ( pa ) account. Configuration and Administration Guide 67

68 Custom Summary Groups 7. Click OK to save the Group. 8. Expand the Mobile Users object to view the newly added Custom Summary Group. The newly added Customer Summary Group displays under the Mobile Users object.! Note: After a Custom Summary Group is created, the analyzers for the group must be loaded by rightclicking the group and selecting Deploy Infrastructure. See Loading Analyzers for information on how to deploy analyzers. Configuration and Administration Guide 68

69 Custom Summary Groups Adding Users to Custom Summary Groups To add a user to an existing Custom Summary Group: 1. In the Object Control Panel, expand the Mobile Users object to display all users. 2. Right-click on the Custom Summary Group to which you want to add a user. 3. Select Edit Properties and users for from the right-click menu.! Note: When adding users to custom summary groups that were created with AD group sync, these users will remain in the group when the group sync next occurs. Users that are removed will be added back the next time group sync occurs. The Edit Group dialog box opens. 4. In the Edit Group dialog box, enter the name or letters in the name in the Name Search field. 5. Click Search. The Users List is populated with users that match the search criteria. Configuration and Administration Guide 69

70 Custom Summary Groups 6. In the Users list, select a user to add to the Group or press the <Ctrl> key and select multiple users to add to the Custom Summary Group. 7. Click the Add button The users selected appear in the Group Members list. 8. Click OK to save the selected users to the Custom Summary Group. Changing Maximum Users Displayed Per Page The number of users that display on a page can be adjusted at any time while creating a new user group, or editing an existing user group. To adjust the maximum number of users displayed per page: 1. Click on the Edit menu and select Properties The User Group Properties dialog box opens. Configuration and Administration Guide 70

71 Custom Summary Groups 2. In the User Group Properties dialog box, type the maximum number of users to display per page. 3. Click OK. The maximum number of users that display on a page is adjusted. Tuning Custom Summary Group and User Thresholds You can tune the thresholds of Custom Summary Groups and individual users. By default, the thresholds for a user are defined in the default group thresholds set under the All Users group. Any changes made to the All Users group thresholds will affect the user unless the user is added to a Custom Summary Group and the group thresholds are adjusted. At this point, any changes to the All Users group thresholds will no longer affect the user.! Note: See Appendix A: Tuning the Good MSM Environment for more information on specific thresholds. To adjust Custom Summary Group thresholds: 1. In the Object Panel, right-click the Custom Summary Group object for which you want to adjust thresholds. 2. Click Adjust Thresholds. The Configure Users window opens. Configuration and Administration Guide 71

72 Custom Summary Groups! Note: To view a description of any of the threshold variables, click on the column name. A description displays in the lower section of the Configure Users dialog. 3. In the Value column, click the threshold to change. The thresholds are color-coded. 4. Enter the new value. See Appendix A: Tuning the Good MSM Environment for more information on specific thresholds and scenarios. 5. Click OK to close the window Configuration and Administration Guide 72

73 06 Managing Summary Group and User Level Notifications This chapter describes how to assign and manage Summary Group and User Level notifications. There are three types of notifications in the Good MSM system, described in the following table. Types of Good MSM notifications. Notification Type Summary Group User Level System Health Description Summary group notifications are sent for objects discovered in Good MSM. There are three default summary groups: BES Summary Group, Carrier Summary Group, and Mail Server Summary Group. Alerts are sent when the state of the summary group degrades based upon the average state of users within the group or specific error events are detected. These are notifications that are sent for individual users. Good MSM will only send individual notification for users that are members of a Custom Summary Group (see "Creating and Modifying Custom Summary Groups" for more information). These refer to problems or changes with the Good MSM system itself. When a monitored event is detected, Good MSM sends a system health notification to subscribed users to alert them to the issue. For more information on System Health notifications. Assigning Summary Group and User Level Notifications Summary Group and User Level notifications can be configured using the Good MSM Admin Console and sent via three protocols: notifications SNMP Trap Notifications HP Operations Manager (HPOM) notifications (requires purchase of Good MSM /HPOM connector) Summary Group and User Level notifications are mapped from an object on the Object Control Panel to Configuration and Administration Guide 73

74 Managing Group and User Notifications individual addresses. You can also assign these notifications to a Custom Summary Group. Assigning Notifications To assign an notification: 1. From the Object Control Panel, right-click on the object for which you want to add a notification.! Note: Objects that you can add notifications for include Custom Summary Groups, BES Groups, Carrier Groups, Domino Groups, or Exchange Groups. To subscribe to notifications for more than one object at a time, select multiple objects by pressing the <Shift> or <Ctrl> keys and left-clicking with your mouse. 2. Click Add Notification The Notification dialog box opens. Configuration and Administration Guide 74

75 Managing Group and User Notifications The following table describes the fields in the Notification dialog box. Field Target List Notification address Notification Type Subscribe to clearing event Description Object for which the user(s) will receive the notification Note: This field is automatically populated based on the selected object. If you have selected more than one object, all objects selected will appear in this field. address or distribution list address to which the notification is assigned. Note: Only one address at a time can be added to this field. Level of notification. Select whether or not the notification is configured to send clearing events. 3. Enter the address of the person who will receive the notification Or: Enter an distribution list address to send the notification to a group. 4. Select the type of notification that will be sent. Field Unavailable Critical Warning Description The object is no longer available. The object is under critical condition and may cease to function shortly. If notification is set to this level, alerts will also be sent when an object s state changes to unavailable. Good MSM recommends using critical as the default notification level. The object may experience problems if no action is taken. If notification is set to this level alerts will also be sent when the object s state changes to critical or unavailable. Good MSM does not recommend setting notification at this level. The following table describes the Notification Levels listed in the Notification Type drop- down list. (Optional) Check the Subscribe to clearing events check box. The following table describes the check boxes in the Notification dialog box. Check Box Description Configuration and Administration Guide 75

76 Managing Group and User Notifications Subscribe to clearing events These events send a notification when an object returns to normal. Good MSM recommends subscribing to clearing events. 5. Click OK to add the notification(s) to the address. The following sections show example user level and server (BES) notifications. See Chapter 8 for an example of a system health notification. Example User Level Notification The following notification shows an example of a user level notification.! Note: Notifications will appear in plain text. If users receive the notification on a desktop or laptop computer, and have a valid account for the Good MSM Ops Dashboard, they can click on the Metric Details link to view further information about the notification via the Good MSM web consoles. Configuration and Administration Guide 76

77 Managing Group and User Notifications Example Server (BES) Notification The following notification shows an example of a server level notification.! Note: Notifications will appear in plain text. If users receive the notification on a desktop or laptop computer, and have a valid account for the Good MSM Ops Dashboard, they can click on the Metric Details link to view further information about the notification via the Good MSM web consoles. Assigning SNMP Trap Notifications Alerts about select objects can be sent as SNMP Traps to the SNMP Trap Receiver Host and Port configured during installation or via the Good MSM Broker Server s notification.properties configuration file. To assign SNMP trap notifications: 1. From the Object Control Panel, right-click on the object for which you want to add an SNMP Trap notification. Configuration and Administration Guide 77

78 Managing Group and User Notifications! Note: Objects that you can add notifications for include Custom Summary Groups, BES Groups, Carrier Groups, Domino Groups, or Exchange Groups. To subscribe to notifications for more than one object at a time, select multiple objects by pressing the <Shift> or <Ctrl> keys and left clicking. 2. Click Add SNMP Trap Notification. The SNMP Notification dialog box opens. The following table describes the fields in the SNMP Notification dialog box. Field Target List Notification Type Description Object for which the user(s) will receive the notification. TNote: This field is automatically populated based on the selected object. If you have selected more than one object, all objects selected will appear in this field. Level of notification. See Table 6-3 for more details. Configuration and Administration Guide 78

79 Managing Group and User Notifications Field Subscribe to clearing event Description Select whether or not the notification is configured to send clearing events. 3. Select the type of notification that will be sent. 4. (Optional)Check the Subscribe to clearing events check box. See Table 6-4 for more details. 5. Click OK to add the SNMP Trap notification(s).see Editing the SNMP Trap Notification Properties File for information on configuring the notification.properties file. Assigning HP Operations Manager Notifications HP Operations Manager (HPOM) notifications allow you to forward alerts to HPOM to be reviewed by your organization network operations team.! Note: HPOM notifications require the optional purchase of the Good MSM Connector for HP Operations Manager. To assign HP Operations Manager notifications: 1. From the Object Control Panel, right-click on the object for which you want to add an HP Operations Manager notification.! Note: Objects that you can add notifications for include Custom Summary Groups, BES Groups, Carrier Groups, Domino Groups, or Exchange Groups. To subscribe to notifications for more than one object at a time, select multiple objects by pressing the <Shift> or <Ctrl> keys and left clicking. 2. Click Add HP Operations Manager Notification. Configuration and Administration Guide 79

80 Managing Group and User Notifications The HP Notification dialog box opens. The following table describes the fields in the HP Notification dialog box. Field Target List Notification Type Subscribe to clearing event Description Object for which the user(s) will receive the notification. Note: This field is automatically populated based on the selected object. If you have selected more than one object, all objects selected will appear in this field. Level of notification. Select whether or not the notification is configured to send clearing events. 3. Select the type of notification that will be sent. 4. (Optional) Check the Subscribe to clearing events check box. See Table 6-4 for more details. 5. Click OK to add the HP Operations Manager notification(s). Viewing and Managing Notification Settings Good MSM allows different users to be assigned different notifications. You can view all notifications for users from one location. To view the notifications assigned to users: Configuration and Administration Guide 80

81 Managing Group and User Notifications 1. Click on the Notifications by Recipient button in the Admin toolbar. This window contains a list of all the addresses that have notifications added to them. You can also see the number of notifications that are assigned to each address in the column on the right. 2. Right-click on an address to view a right-click menu. The following table describes the options in the Addresses window right-click menu. Field Edit address Manage notifications Description Change the address that received notifications. Manage notifications for the address. Configuration and Administration Guide 81

82 Managing Group and User Notifications Field Copy all notifications for this Remove all notifications for this Description Copy all notifications from one address to another address. Remove all notifications from an address. The following sections describe how to manage addresses and notifications. Editing Addresses If you want to change the address that receives the assigned notification(s), you can edit it from the Addresses window. To edit an address: 1. From the Addresses window, right-click on the address you want to edit. 2. Click Edit address. The Edit address dialog box opens. 3. Edit the address. 4. Click OK. Configuration and Administration Guide 82

83 Managing Group and User Notifications Managing Notifications for an Address You can view, edit, and delete notifications for an address from one location. To manage notifications: 1. From the Addresses window, right-click on the address with the notifications assigned that you want to manage. 2. Click Manage notifications. The Notifications window opens, displaying the user s notifications. The following table describes the column headings in the Notifications window. Field Target Object Notification Description Object for which the user(s) will receive the notification. Level of notification. address or notification list to which the notification is assigned. Configuration and Administration Guide 83

84 Managing Group and User Notifications Field Clearing Event Description Whether or not the notification is configured to send clearing events. 3. Right-click on a notification. The following table describes the options in the Notifications window right-click menu. Option Remove notification Edit notification Description Remove the notification from the address. View the Notification dialog box to edit the notification. See Assigning Summary Group and User Level Notifications for more details. 4. Click Close to exit the Notifications window. Copying Notifications to Another Address To copy notifications from one address to another: 1. From the Addresses window, right-click on the address from which you want to copy notifications. 2. Click Copy all notifications for this . Configuration and Administration Guide 84

85 Managing Group and User Notifications The Edit address dialog box opens. 3. Enter the address to which you want to copy the notifications. 4. Click OK. The new address is added to the Addresses window. Removing Notifications for a User/ Address You can remove all notifications from an address at any time.! Note: If you just want to remove one or two notifications, it is better to remove them from the Notifications window. See Managing Notifications for an E- mail Address for more details. To remove all notifications from an address: 1. From the Addresses window, right-click on the address from which you want to remove all notifications. Configuration and Administration Guide 85

86 Managing Group and User Notifications The address is removed from the Addresses window. Configuration and Administration Guide 86

87 07 Performing Mobile User Component Tuning The Mobile User Components object represents the infrastructure elements of the mobile user system. Good MSM discovers these components automatically. After discovery, they display in the Admin Console as a child element under Mobile User Components. Viewing Mobile User Components To view the Mobile User components: 1. Expand the Mobile User Components list in the Object Control Panel. The Mobile User Components object displays. 2. Click on the plus sign (+) to the left of the Mobile User Components object to expand the tree structure. The list of Mobile User Components displays. Configuration and Administration Guide 87

88 Performing Mobile Component Tuning Mobile User Components are defined in the following table. Field ActiveSync (AS) CAS Groups AS Connection Source Groups AS MBX Groups BES Groups Carrier Groups Domino Groups Exchange Groups Description Contains all of the Client Access Servers in your network. Contains all of the device connections grouped by carrier or proxy. Contains the AS mailbox servers in your environment. Contains BlackBerry Exchange Servers (BES) that support the wireless environment. Contains the carriers responsible for transmitting wireless data in the enterprise. Examples are Verizon, Nextel etc. Contains the Domino servers in your network. Contains the Exchange servers in your network. Adjusting the Thresholds for Monitored User Component Analyzers Summary group analyzers automatically monitor users with like attributes as a group. Current Summary Group Analyzers are created to monitor the following group types: AS Connection Source Groups: Groups that monitor connections by carrier or proxy. BES Groups: Groups that monitor users on a single BES. CAS Groups : Groups that monitor users on a single CAS. Mail Server Groups: Group that contains all users on a single mail server. Groups can exist for ActiveSync Mailbox (MBX), Domino or Exchange Mail servers. Carrier Groups: A group that contains users whose handheld devices are connected via a single Configuration and Administration Guide 88

89 Performing Mobile Component Tuning wireless carrier. Users may often switch between carriers as the roam across different geographical locations.! Note: Updating the default thresholds ONLY affects the thresholds for new analyzers. Thresholds of Summary Group Analyzers! Note: See Appendix A: Tuning the Good MSM Environment for more information regarding the tuning of specific thresholds. 1. Right-click the Summary Group to be modified. 2. Click Adjust Thresholds The Configure Managed Object Tweakables window opens. 3. Select the specific summary analyzer to edit and find the threshold to change. Modify the value as Configuration and Administration Guide 89

90 Performing Mobile Component Tuning appropriate.! Note: To view a description of any of the threshold variables, click on the column name. A description displays in the lower section of the Configure Managed Objects Tweakables dialog box. 4. Click OK to set the threshold. Setting Default Thresholds for Summary Group Analyzers Default thresholds will only be used for new Summary Groups that are identified and created. Changing the default thresholds will not change the thresholds for existing BESs.! Note: See Appendix A: Tuning the Good MSM Environment for more information regarding the tuning of specific thresholds. To configure the Good MSM software to better monitor your environment: 1. Right-click the Summary Group that you want to modify the thresholds of and select Adjust Default Thresholds. Configuration and Administration Guide 90

91 Performing Mobile Component Tuning! Note: Updating the default thresholds only affects the thresholds for new analyzers. The Configure Managed Object Default Tweakables dialog box opens. 2. Select the threshold(s) to modify, and change it to a value that is appropriate within your environment. Click OK.! Note: To view a description of any of the threshold variables, click on the column name. A description displays in the lower section of the Configure Tweakables dialog box. Configuration and Administration Guide 91

92 08 Managing System Health Notifications This chapter describes how to manage system health notifications. The Good MSM Controller monitors the Good MSM services health and sends notification when it is unable to automatically correct a problem. Assigning System Health Notifications System health notifications can be sent via three protocols: System health notifications SNMP system health notifications HP Operations Manager (HPOM) system health notifications You can add, view, edit, and delete System Health notifications for an address. Assigning System Health Notifications To assign a system health notification: 1. From the Object Control Panel, right-click on the Global object. 2. Click Add New System Health Notifications.! Note: You can also click on the System Health Notification icon on the Admin Console toolbar, then click New. Configuration and Administration Guide 92

93 System Health Notifications The System Health Notification dialog box opens.. 3. Enter the address of the person who will receive the system health notifications. Or: Enter an distribution list address to send the system health notification to a group.! Note: Only one address at a time can be added to this field. 4. (Optional) Check the Subscribe to clearing events check box. The following table describes the check boxes in the Notification dialog box. Check Box Subscribe to clearing events Description These events send a notification when an object returns to normal. Good MSM recommends subscribing to clearing events. 5. Click OK to add the system health notification(s) to the address. The following section shows an example of a system health notification. Example System Health Notification The following notification shows an example of a system health notification. Configuration and Administration Guide 93

94 System Health Notifications Assigning HP Operations Manager (HPOM) System Health Notifications To assign HP Operations Manager system health notifications: 1. From the Admin toolbar, click on the HP Operations Manager System Health Notifications button. The System Health HP Notification dialog box opens.! Note: You can also access the System Health HP Notification dialog box by right- clicking on the Global object, then clicking Add/Update HP Operations Manager System Health Notifications. 2. (Optional) Check the Subscribe to clearing events check box. 3. Click OK to add the HP Operations Manager system health notification(s). 4. To verify the addition of the HPOperations Manager item, click on the Addresses icon.the HPOperationsManager item is added to the Addresses window. Configuration and Administration Guide 94

95 System Health Notifications Assigning System Health SNMP Notifications To assign System Health SNMP notifications: 1. From the Admin toolbar, click on the SNMP System Health Notifications button. The System Health SNMP Notification dialog box opens.! Note: You can also access the System Health SNMP Notification dialog box by clicking on the rightclick on the Global object, then clicking Add/Update SNMP System Health Notifications. 2. (Optional) Check the Subscribe to clearing events check box. 3. Click OK to add the System Health SNMP notification. 4. To verify the addition of the SNMP item, click on the Addresses icon. Configuration and Administration Guide 95

96 System Health Notifications The SNMP item is added to the Addresses window. See Editing the SNMP Trap Notification Properties File for information on configuring the notification. properties file. Viewing and Managing System Health Notifications You can view a list of all system health notification subscriptions from one location. To view the notifications assigned to users: 1. Click on the System Health Notifications button in the Admin Toolbar. The System Health Notifications window opens.! Note: You can also access the list of system health notifications in the Notifications window by rightclicking on the Global object and clicking Manage System Health Notifications. The following table describes the column headings in the Notifications window. Field Description Target Object Object for which the user will receive the notification. Notification Level of notification. address to which the notification is assigned. Configuration and Administration Guide 96

97 System Health Notifications Field Clearing Event Description Whether or not the notification is configured to send clearing events. Correlated Events Whether or not the notification is configured to send correlated events. New button Add a new system health notification. 2. Right-click on a notification. The following table describes the options in the Notifications window right-click menu. Remove notification:remove the notification from the address. Edit notificationview the System Health Notification dialog box to edit the system health notification. See Assigning System Health Notifications for more details. 3. Click Close to exit the Notifications window. Configuration and Administration Guide 97

98 09 SNMP Server Configuration and Interface This chapter describes how to make changes to Simple Network Management Protocol (SNMP) server configurations. Editing the SNMP Trap Notification Properties File Editing the SNMP Trap Notification Properties File If you are adding a new recipient host for SNMP traps, you can use the SNMP Trap Notification Properties file to modify SNMP Trap destinations and modify SNMP Trap Notifications target host or target ports.! Note: For information on setting up SNMP Trap notifications, see Chapter 6 and Chapter 8. Modifying SNMP Trap Notifications Target Host or Target Port To modify the host or port to which SNMP traps will be sent: 1. Using a text editor, open the notification.properties file located in <%Good MSM InstallHome%>\ jboss\server\default\conf\. 2. Locate the SNMP Notification section (at the bottom). Configuration and Administration Guide 98

99 SNMP Server Configurations 3. Modify the SNMP Trap Notification parameters as described in the following table: Field snmptargetconfigs mibfile enabled versionpre2c Description The host name and port to which the SNMP traps will be sent. You can add additional Trap recipients (in host:port format), separated with commas as seen above.note: The default port for an SNMP Trap receiver is 162. File that provides the MIB definition for Good MSM SNMP traps. Allows you to turn SNMP traps on or off. Enter true to turn the Trap notifications on, or enter false to turn the Trap notifications off. Allows you to send Traps in an older format if required by your network monitoring tool set. Enter true to use an older Trap format. 4. Confirm that the SNMP is enabled and configured correctly. 5. Restart JBOSS if you made changes to the configuration file Finding your MIB File 1. Navigate to > Disk (X:)\BoxTone\jboss\server\default\conf\ 2. Scroll down until you see Good-MSM-MIB Configuration and Administration Guide 99

100 Tuning Thresholds and the Relationship with SNMP Notifications Learning to tune thresholds is valuable to create optimal alerting for monitored environments. Incorrect settings will result in environments that spawn too many alerts, or fail to provide timely notifications about critical system issues. Striking the correct balance with tuning is key to maintaining a healthy environment and preventing sustained system outages and issues. This document also provides insight into the rules/metric event messages that will be sent after the thresholds have been tuned within your environment. There are four components involved in tuning alerts: analyzers, tuning thresholds, rules, and alerts. Learning how these key components work together will improve the quality of monitoring in your environment. Analyzer: allows the data from user groups, server groups, and mailbox components in the environment to be monitored. Threshold: values used to adjust alerting rules in the environment Rule/Metric: policies that govern the variables/alerts that will be triggered based on the tuned settings. Alert: Notification about possible issues detected in the logs such as abnormal activities and patterns Developing the SNMP Interface The table below documents the SNMP interface, all headings can be directly mapped to the bind variables in the MIB file. Use the Event Source Type, Metric, Event Severity and Event Message fields to inform SNMP development efforts. Some alerts (e.g., Num Good Proxy Errors, Number of GEMS User Events) are generated based on a number or percentage of events detected in the logs of the source system (e.g, Good Proxy Logs). These are designed to capture repeated errors, high percentages of errors, percentage of users with errors, and other aggregations that may be indicative of a problem. When these aggregate alerts are generated, the resulting and SNMP trap also contain a concatenated string of all of the events that triggered the alerts. Sample Notification Ex. The Good Proxy <GoodProxyServerHost> has experienced a high percentage of application server connection errors for the last <numminutes> minutes. These errors may result in app service errors for users connecting to these application servers. <FailedAppServerConnectionsInPercent> % of <TotalAppServerConnections> connection attempts have failed which meets or exceeds the warning threshold of <warningthreshold> %. The aggregate alert also inherits the maximum severity of the aggregated events. Each event source type (analyzer) includes several metrics or rules. Some event source types may only contain one metric. Each metric may contain a full host of severities ranging from warning to unavailable. If this is the case, the corresponding messages will be present next to explain the event severity. 93

101 Analyzer/ Metric Severity/ Severity Message/ Event Message Event Event Source Severity Type Good Events Good Application Group Total App Requests Critical The <ApplicationName> application has not received any application requests for the last <numzerorqstminutes> minutes. This may indicate a decrease in app activity or an availability issue. This server normally receives <avgapprequests> requests each 3 minute sample at this hour. Possible Action: Ensure that network connectivity between the Good Proxy servers and external networks is functioning properly. Warning The <ApplicationName> application has received fewer application requests than normal. This may indicate a decrease in app activity or an availability issue. This server normally receives <avgapprequests> requests each 3 minutes sample at this hour. The last 3 minute sample showed only <TotalAppRequests> requests. Possible Action: Ensure that network connectivity between the Good Proxy and external networks is functioning properly. Good Proxy Cluster Group Total App Requests Critical The Good Proxy cluster <GPSClusterName> has not received any application requests for the last <numzerorqstminutes> minutes. This may indicate a decrease in app activity or an availability issue. This cluster normally receives <avgapprequests> requests each 3 minute sample at this hour. Possible Action: Ensure that network connectivity between the Good Proxy servers and external networks is functioning properly. For Good Proxy servers configured for Direct Connect, please see GP Direct Connect guide Warning The Good Proxy cluster <GPSClusterName> has received fewer application requests than normal for this hour in the last <numanblrqstminutes> minutes. This may indicate a decrease in app activity or an availability issue. This cluster normally receives <abnlapprequests> requests each 3 minutes sample at this hour. The last 3 minute sample showed only <TotalAppRequests> requests. GPS Cluster Available Unavailable Critical All <NumOfDownGPS> of the servers in the Good Proxy cluster <GPSClusterName> have been Unavailable for <nminutes> minutes. The affected servers are <GPSList>. Please check the details of the affected server for possible actions. <NumOfDownGPS> of <NumOfTotalGPS> servers in the Good Proxy cluster <GPSClusterName> have been Unavailable for <nminutes> minutes. The affected servers are <GPSList>. Please check the details of the affected server for possible actions. 94

102 Analyzer/ Metric Severity/ Severity Message/ Event Message Event Event Source Severity Type Warning 1 of <NumOfTotalGPS> servers in the proxy cluster <GPSClusterName> has been unavailable for <nminutes> minutes. The affected server is <GPSList>. Please check the details of the affected server for possible actions. Unavailable The only server in the Good Proxy cluster <GPSClusterName> has been Unavailable for <nminutes> minutes. The affected server is <GPSList>. Please check the details of the affected server for possible actions. Warning The Good Proxy cluster <GPSClusterName> does not contain any member servers. Good Proxy Server Group Proxy Server Host Availability Critical Good Proxy host <GoodProxyServerHost> has not been reached for <numdownminutes> minutes. This will increase the load on other Good Proxy servers and may impact response times and service quality. Possible Action: Ensure that the Good Proxy host is up and connected to the network. If the host is available, ensure that there are no network issues or firewall rules preventing Good MSM from reaching the host via WMI. Proxy Server Window Service Availability Critical Good Proxy Server is not running on <GoodProxyServerHost>. This will increase the load on other Good Proxy servers and may impact response times and service quality. Possible Action: Ensure that the Good Proxy Server service is running on the host. If the service is not running or does not stay running, check the Application log in Windows Event Viewer for errors related to the Good Proxy Server service. Ensure that anti-virus services are not preventing the Good Proxy Server service from starting. Escalated_Proxy_Log_Errors Critical Combined Log Events Failed App Server Connection In Percent 95

103 Analyzer/ Metric Severity/ Severity Message/ Event Message Event Event Source Severity Type Critical The Good Proxy <GoodProxyServerHost> has experienced a high percentage of application server connection errors for the last <numminutes> minutes. These errors may result in app service errors for users connecting to these application servers. <FailedAppServerConnectionsInPercent> % of <TotalAppServerConnections> connection attempts have failed which meets or exceeds the critical threshold of <criticalthreshold> %. The application servers with the highest number of connection errors occurring through this Proxy Server are (Application Server, Error Count for Past 15 minutes, Last Error) : <App Server List>. Possible Action: Have the application owner for the affected application servers check that they are running correctly. If the application servers are running correctly, check that network connectivity between the Good Proxy servers and application servers is working correctly. Warning The Good Proxy <GoodProxyServerHost> has experienced a high percentage of application server connection errors for the last <numminutes> minutes. These errors may result in app service errors for users connecting to these application servers. <FailedAppServerConnectionsInPercent> % of <TotalAppServerConnections> connection attempts have failed which meets or exceeds the warning threshold of <warningthreshold> %. The application servers with the highest number of connection errors occurring through this Proxy Server are (Application Server, Error Count for Past 15 minutes, Last Error) : <App Server List>. Possible Action: Have the application owner for the affected application servers check that they are running correctly. If the application servers are running correctly, check that network connectivity between the Good Proxy servers and application servers is working correctly. TotalAppRequests Critical The Good Proxy <GoodProxyServerHost> has received fewer application requests than normal for the last <numanblrqstminutes> minutes. This server normally receives an average of <abnlapprequests> requests every 3 minute sample at this hour of the day. The last 3 minute sample showed only <TotalAppRequests> requests. Possible Action: Ensure that network connectivity between the Good Proxy and external networks is functioning properly. For Good Proxy servers configured for Direct Connect, please refer to the GD Direct Connect documentation for detailed configuration guidance Warning The Good Proxy <GoodProxyServerHost> has received no application request in last <numzerorqstminutes> minutes. This server normally receives an average of <avgapprequests> requests every 3 minute sample at this hour of the day. Possible Action: Ensure that network connectivity between the Good Proxy and external networks is functioning properly. For Good Proxy servers configured for Direct Connect, please refer to the GD Direct Connect documentation for detailed configuration guidance. Good Users Exchange GFE_User_Errors 96

104 Analyzer/ Metric Severity/ Severity Message/ Event Message Event Event Source Severity Type Most Critical Event Combined User Events Good for Domino Summary Group High Availability/Monitor Primary GMM Critical The GMM Server <GroupName> has failed over from the primary machine <GoodServerHost> to the standby machine <GoodStandbyServerHost>. Primary Services Availability/NumServiceAvailabilityErrors Most Critical Event The Sevice Status for <GroupName> at <GoodServerHost> : Standby Services Availability/NumServiceAvailabilityErrors Most Critical Event The Sevice Status for <GroupName> at <GoodStandbyServerHost> : Escalated_GMM_Log_Errors Most Critical Event Combined Server Events GDToHHFlows Unavailable The number of mail flows from GOOD Server <GroupName> at host > GoodServerHost> to handheld has been 0 consecutively for at least <warningthreshold> samples, and also it has been below normal baseline range consecutively for at least <abnl_warningthrshld> samples, while the average amount of flows at this hour is <avgflowperhour>. Critical The GOOD Server <GroupName> at <GoodServerHost> is running and accessible, but Good MSM has detected 0 mail flows for the last <thresholdminutes> minutes. Normally <thresholdflows> mail flows would be expected in this amount of time. For this hour of the day, Good MSM has learned that an average of <avgflows> flows usually occur every 3 minutes. For an individual 3 minute sample period, Good MSM has observed that flows can normally range from <abnlflows> per sample up to <abnhflows> per sample. Warning The GOOD Server <GroupName> at <GoodServerHost> is running and accessible, but Good MSM has detected 0 mail flows for the last <thresholdminutes> minutes. Normally <thresholdflows> mail flows would be expected in this amount of time. For this hour of the day, Good MSM has learned that an average of <avgflows> flows usually occur every 3 minutes. For an individual 3 minute sample period, Good MSM has observed that flows can normally range from <abnlflows> per sample up to <abnhflows> per sample 97

105 Analyzer/ Metric Severity/ Severity Message/ Event Message Event Event Source Severity Type Primary GMMS Memory/GMMSProcTotalMem Critical The GMM Server <GroupName> has consistently been running at high RAM value ( <GMMS_RAM_ToDangerLevel> % of <GMMS_RAM_DangerLevel> MB) for the last <numminutes> minutes. When GMMS is running at <GMMS_RAM_DangerLevel> MB, it is considered critical. Standby GMMS Memory/GMMSProcTotalMem Critical The GMM Server <GroupName> has consistently been running at high RAM value ( <GMMS_RAM_ToDangerLevel> % of <GMMS_RAM_DangerLevel> MB) for the last <numminutes> minutes. When GMMS is running at <GMMS_RAM_DangerLevel> MB, it is considered critical. Primary Host Availability/GoodServerHostAvailable Unavailable The Good Server host <GoodServerHost> has not been reachable for <GoodServerHostDownCount> samples. The host may be unavailable, or a network issue may be preventing Good MSM from reaching the host. Standby Host Availability/Good Server Host Available Unavailable The Good Server host <GoodStandbyServerHost> has not been reachable for <StandbyHostDownCount> samples. The host may be unavailable, or a network issue may be preventing Good MSM from reaching the host. Good for Exchange Summary Group GDToHHFlows Unavailable The GMMS <GroupName> at <GoodServerHost> is running and accessible, but Good MSM has detected no device sync activity for the last <thresholdminutes> minutes. Normally <thresholdflows> sync activities would be expected in this amount of time. For this hour of the day, Good MSM has learned that an average of <avgflows> sync activities usually occur every 3 minutes. For an individual 3 minute sample period, Good MSM has observed that flows normally range from <abnlflows> per sample up to <abnhflows> per sample. Critical The GMMS <GroupName> at <GoodServerHost> is running and accessible, but Good MSM has detected no device sync activity for the last <thresholdminutes> minutes. Normally <thresholdflows> sync activities would be expected in this amount of time. For this hour of the day, Good MSM has learned that an average of <avgflows> sync activities usually occur every 3 minutes. For an individual 3 minute sample period, Good MSM has observed that flows normally range from <abnlflows> per sample up to <abnhflows> per sample Warning The number of items syncing from GMMS <GroupName> at host <GoodServerHost> to handheld has been 0 consecutively for at least <warningthreshold> samples, and also it has been below normal baseline range consecutively for at least <abnl_warningthrshld> samples, while the average amount of flows at this hour is <avgflowperhour>. GEMS User 98

106 Analyzer/ Metric Severity/ Severity Message/ Event Message Event Event Source Severity Type GEMS User Errors Most critical event Combined User Events GEMS Group GEMSWindowServicesAvailable Unavailable Critical GEMS host <GEMSHost> has not been reached for <num_down_minutes> minutes. Possible Action: Ensure that the GEM Server host is up and connected to the network. If the host is available, ensure that there are no network issues or firewall rules preventing Good MSM from reaching the host via WMI. The Windows service <Caption> is not running on <GEMSHost>. Possible Action: Ensure that the service is running on the host. If the service is not running or does not stay running, check the Application log in Windows Event Viewer for errors related to this service. Ensure that anti-virus services are not preventing the service from starting. CAS Events CAS Summary Group CAS Host Availability Unavailable The server <CASHost> has not been reachable for <CASHostDownCount> samples. The host may be unavailable, or a network issue may be preventing MSM from reaching the host. Escalated_CAS_ Log_Errors Most Critical Event <List of Server Events> CASLogging Rate/NumLogLinesPerDevice Unavailable The ActiveSync Server <GroupName> has not generated any device activity log lines in the last <thresholdmins> minutes. Normally <thresholdloglines> device activity log lines would be expected in this amount of time. For this hour of the day, Good MSM has learned that an average of <totalloglinespersample> device activity log lines occur every 3 minutes, and it can normally range from <abnlloglinespersmpl> to <abnhloglinespersmpl> per 3 minute sample. Ensure that the Good MSM application server is able to access the log share for <GroupName>. If the log share is accessible the lack of activity indicates that ActiveSync devices are not actively syncing with this server. Ensure that IIS services are running and responsive on this server and that devices are able to connect to this server 99

107 100

108 Analyzer/ Metric Severity/ Severity Message/ Event Message Event Event Source Severity Type Warning The number of users on the ActiveSync Mailbox Exchange Server GroupName with service errors has exceeded the warning threshold of warningthreshold. Here is the list of errors and number of users with that error: <user list> CASUserGroup ActiveSync_User_ Errors Most Critical Event Combined User Events BES Events BES User Domino Support Number of User Events Most Critical Event Combined User Events HHFlashFreeMB Warning The users BlackBerry smartphone is low on available memory ( HHFlashFreeMemory / of memory available). As a smartphone runs low on memory (approximately 1.4 MB of free memory) it may begin deleting out-of-date calendar entries messages and call logs. Low memory may also slow the performance and responsiveness of the BlackBerry smartphone. Memory is consumed by media files (e.g. pictures music video) applications as well as your data (messages calendar entries and contacts). To free additional memory on the users smartphone instruct the user to transfer media files to a media card or delete any unneeded media files remove any rarely used applications and/or purge older messages and calendar entries. For step-by-step instructions look-up this user in the Good MSM Help Desk; BlackBerry Mobile Data Service Availability 101

109 Analyzer/ Metric Severity/ Severity Message/ Event Message Event Event Source Severity Type Unavailable Mobile Data Service is unavailable BES User Exchange Support Number of User Events Most Critical Event Combined User Events HHFlashFreeMB Warning The users BlackBerry smartphone is low on available memory ( HHFlashFreeMemory / of memory available). As a smartphone runs low on memory (approximately 1.4 MB of free memory) it may begin deleting out-of-date calendar entries messages and call logs. Low memory may also slow the performance and responsiveness of the BlackBerry smartphone. Memory is consumed by media files (e.g. pictures music video) applications as well as your data (messages calendar entries and contacts). To free additional memory on the users smartphone instruct the user to transfer media files to a media card or delete any unneeded media files remove any rarely used applications and/or purge older messages and calendar entries. For step-by-step instructions look-up this user in the Good MSM Help Desk; UserName - UserName Address - AddressWarningThreshold - UserAdjustables[tweakRow LOW_HH_FLASH_MEMORY_WARNING] MBBES - BESNam Server - MailServerNameCarrier - CarrierName BESDominoSummaryGroup BESHostAvailable Unavailable The BES host BESHost has not been reachable for 0 samples. The BES host may be unavailable or a network issue may be preventing Good MSM from reaching the BES host Critical The BES host BESHost has not been reachable for BESHostDownCnt> 1 samples. The BES host may be unavailable or a network issue may be preventing Good MSM from reaching the BES host. Unavailable Critical The Standby BES host StandbyBESHost has not been reachable for 0 samples. The Standby BES host may be unavailable or a network issue may be preventing Good MSM from reaching the Standby BES host. The Standby BES host StandbyBESHost has not been reachable for StandbyBESHostDownCnt <> 1 samples. The Standby BES host may be unavailable or a network issue may be preventing Good MSM from reaching the Standby BES host. BESToHHFlows Critical BES <GroupName> at <ActiveBESHost> is running and accessible, but Good MSM has detected 0 mail flows for the last <thresholdminutes> minutes. Normally <thresholdflows> mail flows would be expected in this amount of time. For this hour of the day, Good MSM has learned that an average of <avgflows> flows usually occur every 3 minutes. For an individual 3 minute sample period, Good MSM has observed that flows can normally range from <abnlflows> per sample up to <abnhflows> per sample. 102

110 Analyzer/ Metric Severity/ Severity Message/ Event Message Event Event Source Severity Type Warning The number of mail flows from BES <GroupName> at <ActiveBESHost> to handheld has been 0 consecutively for at least <warningthreshold> samples, and also it has been below normal baseline range consecutively for at least <abnl_warningthrshld> samples, while the average amount of flows at this hour is <avgflowperhour>. Escalated_BES_Log_Errors Most Critical Event Combined server events Escalated_SRP_Log_Errors Unavailable strdownerrs <tmpstr> Critical strcriticalerrs <tmpstr> Warning strwarnerrs <tmpstr> Licenses Remaining Critical Warning You currently have <LicensesRemain> licenses remaining which is less than the Critical threshold of <criticalthrsld>. You currently are using <license_used> CALs from a total pool of <license_total>. You currently have <LicensesRemain> licenses remaining which is less than the Warning threshold of <warningthrsld>. You currently are using <license_used> CALs from a total pool of <license_total>. NumBESMachines/High Availability Warning For HA BES deployment there should have two BES hosts. For non-ha there should have one primary BES host. However we detected NumRows(HABESTable) BES hosts. HA rule will not fire. NumLogLinesPerUser Critical For the last <nsamplethreshold> * <samplerate> / 60.0 minutes BES <GroupName> at <ActiveBESHost> has generated an abnormally high amount of log lines - more than <criticalthreshold> times the expected amount. In the last sample <NumOfLogLines> Good MSM monitored log lines have been generated at an average rate of <LogLinesPerUser> log lines per user. Abnormally large amounts of log lines may indicate that a problem is occurring on the BES that is causing excessive activity or error rates. Utilize the Good MSM consoles to investigate further. 103

111 Analyzer/ Metric Severity/ Severity Message/ Event Message Event Event Source Severity Type Warning For the last <nsampletwk> * <samplerate> / 60.0 minutes BES <GroupName> at <ActiveBESHost> has generated an abnormally high amount of log lines - more than <warningthreshold> times the expected amount. In the last sample <NumOfLogLines> Good MSM monitored log lines have been generated at an average rate of <LogLinesPerUser> log lines per user. Abnormally large amounts of log lines may indicate that a problem is occurring on the BES that is causing excessive activity or error rates. Utilize the Good MSM consoles to investigate further. Critical For the last num min minutes BES <GroupName> at <ActiveBESHost> has generated an abnormally high amount of log lines - more than <LoggingRateCritical> times the expected amount. In the last sample <NumOfLogLines> Good MSM monitored log lines have been generated at an average rate of <LogLinesPerUser> log lines per user. Abnormally large amounts of log lines may indicate that a problem is occurring on the BES that is causing excessive activity or error rates. Utilize the Good MSM consoles to investigate further. Warning BES <GroupName> at <ActiveBESHost> has not generated any Good MSM monitored log lines for the last <thresholdmins> minutes. Normally <thresholdloglines> monitored log lines would be expected in this amount of time. For this hour of the day, Good MSM has learned that an average of <totalloglinespersample> monitored log lines usually occur every 3 minutes, and it can normally range from <abnlloglinespersmpl> per sample up to <abnhloglinespersmpl> per sample. Good MSM generally monitors for message flows, status indicators and errors but has not detected any of these expected log lines. This may indicate that the BES is not providing any service to its end users. Utilize the Good MSM consoles to investigate further. NUmServiceAvailabilityErrors Most Critical Event The Service Status for BES <GroupName> at <ActiveBESHost> : NUmServiceAvailabilityErrors-Standby Services Availability Most Critical Event The Service Status for BES <GroupName> at <ActiveBESHost> : NumUsersWithHungThread Critical Warning criticalthreshold or more users on BES GroupName at ActiveBESHost have hung threads for longer than AdjustableTable[0, HungThreadDurationThrshld] minutes. [These users are: UserList] The number of users on BES GroupName whose Hung Thread Duration is greater than groupthreshold minutes is above the warning threshold of AdjustableTable[0, HungThreadCountWarning] users. [These users are: UserList] PercentUsersWithHighDeliveryTimeToHH**** Critical The percent of CurrUserCount total users on BES GroupName with delivery time to handheld greater than <DlvryTimeToHHThrshld. seconds is regularly above the baselined threshold of <threshold percent> and is above the critical threshold of criticalthreshold percent. [These users are: UserList] Warning The percent of CurrUserCount total users on BES GroupName with delivery time to handheld greater than groupthreshold seconds is regularly above the baselined threshold of <threshold percent>. These users are: <user list> 104

112 Analyzer/ Metric Severity/ Severity Message/ Event Message Event Event Source Severity Type PercentUsersWithMsgPendingCount Critical Warning <CurrUserCount> * <PercentUsersWithMsgPendingCount> / of <CurrUserCount> total users on BES <Name> at <ActiveBESHost> with Message Pending Counts higher than <groupthreshold> is above the baselined threshold of <pvalue> percent <NumUsersWithHighPendingCount> of <CurrUserCount> total users on BES <Name> at <ActiveBESHost> with Message Pending Counts higher than AdjustableTable[0, <MsgPendingCntThrshld> is above the baselined threshold of <pvalue> percent. Critical Warning <NumUsersWithHighPendingCount> of <CurrUserCount> total users on BES <Name> at <ActiveBESHost> with Message Pending Counts higher than <groupthreshold> is above the baselined threshold of * <numuserpendmsgcntcritical> / <CurrUserCount> percent. <NumUsersWithHighPendingCount> of <CurrUserCount> total users on BES <GroupName> at <ActiveBESHost> with Message Pending Counts higher than <groupthreshold> is above the baselined threshold of * <numuserpendmsgcntwarning> / <CurrUserCount> percent. TotalMessagesPending Critical The total message pending for <BESHost> is regularly above the critical threshold of <TotalMsgsPendingCritical>]. This could be an indicator of a wireless carrier failure (affecting many users at once) a RIM service failure a network failure causing an SRP connect failure between the BES Server and RIM a problem with the BES SQL Server database or hung worker thread(s) causing delays in message delivery and eventually a BES Messaging Agent restart on the BES Server. Check (1) whether the RIM Service is up (e.g. ping srp.na.blackberry.net) (2) whether a large number of users on the same wireless carrier are down (3) whether the SRP connection between the BES server and RIM and (4) the SQL connection are up by going to the BlackBerry Server Configuration console BlackBerry Router tab and clicking Test Network Connection button and then the Database Connectivity tab and clicking the Test SQL Server Connection button and (5) look in the BES server Messaging Agent logfile for log entries with phrase No Response for a specific worker thread and a specific user name. Warning The total message pending for <BESHost> is regularly above the critical threshold of <TotalMsgsPendingCritical>. This could be an indicator of a wireless carrier failure (affecting many users at once) a RIM service failure a network failure causing an SRP connect failure between the BES Server and RIM a problem with the BES SQL Server database or hung worker thread(s) causing delays in message delivery and eventually a BES Messaging Agent restart on the BES Server. Check (1) whether the RIM Service is up (e.g. ping srp.na.blackberry.net) (2) whether a large number of users on the same wireless carrier are down (3) whether the SRP connection between the BES server and RIM and (4) the SQL connection are up by going to the BlackBerry Server Configuration console BlackBerry Router tab and clicking Test Network Connection button and then the Database Connectivity tab and clicking the Test SQL Server Connection button and (5) look in the BES server Messaging Agent logfile for log entries with phrase No Response for a specific worker thread and a specific user name. BES Exchange Summary Group BES Host Available-Primary Unavailable The BES host <<<<BESHost has not been reachable for 0 samples. The BES host may be unavailable or a network issue may be preventing Good MSM from reaching the BES host. Critical The BES host BESHost...>>>>>>>>> has not been reachable for BESHostDownCnt <> 1 samples. The BES host may be unavailable or a network issue may be preventing Good MSM from reaching the BES host. Bes Host Available-Standby 105

113 Analyzer/ Metric Severity/ Severity Message/ Event Message Event Event Source Severity Type Unavailable The Standby BES host <StandbyBESHost has not been reachable for 0 samples. The Standby BES host may be unavailable or a network issue may be preventing Good MSM from reaching the Standby BES host. Critical The Standby BES host <StandbyBESHost has not been reachable for StandbyBESHostDownCnt <> 1 samples. The Standby BES host may be unavailable or a network issue may be preventing Good MSM from reaching the Standby BES host. BES to HH Flows Unavailable BES <GroupName> at <ActiveBESHost> is running and accessible, but Good MSM has detected 0 mail flows for the last <thresholdminutes> minutes. Normally <thresholdflows> mail flows would be expected in this amount of time. For this hour of the day, Good MSM has learned that an average of <avgflows> flows usually occur every 3 minutes. For an individual 3 minute sample period, Good MSM has observed that flows can normally range from <abnlflows> per sample up to <abnhflows> per sample. Critical BES <GroupName> at <ActiveBESHost> is running sdfsdagfsand accessible, but Good MSM has detected 0 mail flows for the last <thresholdminutes> minutes. Normally <thresholdflows> mail flows would be expected in this amount of time. For this hour of the day, Good MSM has learned that an average of <avgflows> flows usually occur every 3 minutes. For an individual 3 minute sample period, Good MSM has observed that flows can normally range from <abnlflows> per sample up to <abnhflows> per sample. Warning The number of mail flows from BES <GroupName> at <ActiveBESHost> to handheld has been 0 consecutively for at least <warningthreshold> samples, and also it has been below normal baseline range consecutively for at least <abnl_warningthrshld> samples, while the average amount of flows at this hour is <avgflowperhour> Licenses Remaining Critical You currently have <LicensesRemain> licenses remaining which is less than the Critical threshold of <criticalthrsld>. You currently are using <license_used> CALs from a total pool of <license_total>. Warning You currently have <LicensesRemain> licenses remaining which is less than the Warning threshold of <warningthrsld>. You currently are using <license_used> CALs from a total pool of <license_total>. Warning For HA BES deployment there should have two BES hosts. For non-ha there should have one primary BES host. However we detected NumRows(HABESTable) BES hosts. HA rule will not fire. NumBESSvcErrs Most Critical Event <List of current server events> Unavailable BES <GroupName> at <ActiveBESHost> has not generated any Good MSM monitored log lines for the last <thresholdmins> minutes. Normally <thresholdloglines> monitored log lines would be expected in this amount of time. For this hour of the day, Good MSM has learned that an average of <totalloglinespersample> monitored log lines usually occur every 3 minutes, and it can normally range from <abnlloglinespersmpl> per sample up to <abnhloglinespersmpl> per sample. Good MSM generally monitors for message flows, status indicators and errors but has not detected any of these expected log lines. This may indicate that the BES is not providing any service to its end users. Utilize the Good MSM consoles to investigate further. 106

114 Analyzer/ Metric Severity/ Severity Message/ Event Message Event Event Source Severity Type Critical For the last <nummin> minutes, BES <GroupName> at <ActiveBESHost> has generated an abnormally high amount of log lines - more than <criticaltweak> times the expected amount. In the last sample, <NumOfLogLines> Good MSM monitored log lines have been generated at an average rate of <LogLinesPerUser> log lines per user. Abnormally large amounts of log lines may indicate that a problem is occurring on the BES that is causing excessive activity or error rates. Utilize the Good MSM consoles to investigate further. Warning For the last <nummin> minutes, BES <GroupName> at <ActiveBESHost> has generated an abnormally high amount of log lines - more than <warningtweak> times the expected amount. In the last sample, > NumOfLogLines> Good MSM monitored log lines have been generated at an average rate of <LogLinesPerUser> log lines per user. Abnormally large amounts of log lines may indicate that a problem is occurring on the BES that is causing excessive activity or error rates. Utilize the Good MSM consoles to investigate further. Most Critical The Service Status for BES <GroupName> at <ActiveBESHost> Event NUmSRPSrvErrs Most Critical List of current events Event Critical <criticalthreshold> or more users on BES <Name> at <ActiveBESHost> have hung threads for longer than threshold minutes. These users are: <user list> Warning The number of users on BES <Name> at <ActiveBESHost> whose Hung Thread Duration is greater than <HungThreadDurationThrshld> minutes is above the warning threshold of <warningthreshold> users. These users are: <UserHungThreadList> Warning The number of users on BES <Name) at ActiveBESHost whose Hung Thread Duration is greater than <HungThreadDurationThrshld> minutes is above the warning threshold of <warningthreshold> users. These users are: <UserHungThreadList> PercentUsersWithHighDeliveryTimetoHH Critical Warning The percent of CurrUserCount total users on BES GroupName at ActiveBESHost with delivery time to handheld greater than AdjustableTable[0, DlvryTimeToHHThrshld] seconds is regularly above the baselined AdjustableTable[0, DlvryTimeToHHThrshld] of localvalue percent and is above the critical AdjustableTable[0, DlvryTimeToHHThrshld] of criticalthreshold percent. These users are: UserList The percent of CurrUserCount total users on BES GroupName at ActiveBESHost with delivery time to handheld greater than <DlvryTimeToHHThrshld> seconds is regularly above the baselined <DlvryTimeToHHThrshld> of localvalue percent. These users are: UserList PercentUsersWithMsgPendingCount 107

115 10 BlackBerry Fix-It Configuration Settings This chapter describes how to configure the BlackBerry User Administration Tool to allow Good MSM Fix-It actions for a BES domain. Before you can use Fix-It actions on user devices from the Service Desk Console, you must create a configuration for the BlackBerry domain associated with users displayed in the Service Desk Console.! Note: Fix-It actions links will not be displayed in the Server Desk Console Actions Panel until the BlackBerry domain has been configured. Configuration may be different depending on the version you are using. The following sections describe the how to set up system prerequisites, how to configure the domain, and how turn off the Fix-It Configuration settings. Configuring Fix-it for BES Configuring Fix-It for BES and Greater This section explains the additional steps needed to configure One-Click Fix-It to work with BES or greater domains.! Note: Good MSM version 5.0 or greater is required for the Good MSM software to monitor a BES 5.x deployment. Configuration and Administration Guide 108

116 BB Fix-It Configuration Settings Prerequisites The Good MSM Primary Admin and Good MSM Secondary Admin (and any Good MSM LoadBalancer) services should be configured to run using the Good MSM service account (BTAdmin). This account should be assigned the Enterprise Manager role defined via the BAS. This is required to enable the BES 5.x domain for fix-it actions. Installing BlackBerry User Administration Tool Download and install the appropriate 5.x version (Exchange or Domino) of the BlackBerry User Administration Tool on the Good MSM Server (the Good MSM Application server for dual server deployments). Note: The location of the BlackBerry User Administration Tool may change depending on the BES version (the above link is for version 5.0). Contact RIM for the exact location of these files. During the installation, you will be prompted to enter the DNS name of the BlackBerry Administration Service (BAS). This is the BAS managing the domain against which you wish to perform fix-it actions. Complete the User Administration Tool installation. Configuration and Administration Guide 109

117 11 Configuring Enterprise Certificate Authorities Good MSM Security Management allows you to import and view security certificates required for security management to function for ios devices. It is important to understand the following before configuring Good MSM to support your internal CA environment. Good MSM automatically discovers enterprise Certificate Authority (CA) servers that are members of the same domain as the Good MSM server. Good MSM automatically validates certificate templates installed on the CA so that only templates appropriate to the specific use case of the client authentication are exposed. Good MSM does not require SCEP to be turned on at the CA server itself, and does not that the CA server be directed exposed to devices. Good MSM acts as a registration authority, and sets up its own SCEP server to handle the process of issuing authentication certificates to a device that requires provisioning to access an enterprise CA server. Only the Good MSM server needs to talk directly to the CA server and it does so using a secure protocol other than SCEP. Good MSM does more than simply remove the authentication certification from the device when it is retired; Good MSM revokes the certificate. This means, if it is restored via a backup, the CA server will reject the certificate when the user attempts to use it to access a corporate wi-fi network. Good MSM automatically renews a certificate before it expires based on the expiration date. Configuration and Administration Guide 110

118 Enterprise Certificate Authorities Enterprise Certificate Authority Integration Prerequisites In order to configure Good MSM to deliver certificates to ios devices, an authoritative Microsoft PKI infrastructure needs to be in place. The following tables provides a detailed overview of Good MSM s requirements. Prerequisite CA Environment Requirement The Good MSM server and Microsoft CA PKI infrastructure must be members of the same domain. The CA must have access to directory services and be able to issue and manage certificates The CA must have the ability to issue its own self signed certificates. The CA must have the ability to create a new private key in order to generate and issue certificates to a client The CA must have the ability to configure a cryptographic service provider and pick a hash algorithm that will create a new private key with a specific key length Field Common Name Certificate Authority Validity Period and Renewal Good MSM Service Account Registration Authority (RA) Description The CA must have the ability to configure the CA name. This is required to specify a Common Name (CN) with distinguished name prefixes.good MSM recommends creating a CA Common Name specific to the Good MSM installation The CA validity period must be renewed before it expires. If not, all certificates that have been issued must be reissued. Be sure to set your CA validity period to give you enough time to renew. The Good MSM service account must have the following permissions to the Certificate Authority: Read Certificates Issue Certificates Manage Certificates Request Certificates Good MSM functions as the Registration Authority for certificates. The Good MSM RA uses two sets of credentials for signing and encryption. Good MSM uses CEP for encryptions and the Exchange Enrollment Agent (Offline Requests) for signing the certificates. Both the CEP and Exchange Enrollment agent templates must be configured and published for the Good MSM service to pick up and validate the services. Configuration and Administration Guide 111

119 Enterprise Certificate Authorities Field CEP Encryption Template Description The Good MSM service account must have read and enroll permissions to the CEP Encryption Template Exchange Enrollment Agent (Offline Requests) The Good MSM service account must have read and enroll permissions to the Exchange Enrollment Agent Wi-Fi Templates Permissions The Good MSM Service account must have read and enroll permissions to Wi-Fi templates. Wi-Fi Templates: Configuration Requirements Wi-Fi Templates should be configured as follows: The Wi-Fi template must be configured to have the subject name supplied in the request. The Wi-Fi template must have the application policy of at least one authorized signature set to certificate request agent for issuing certificates. This policy must be set for reenrollment. The Wi-Fi template must be published before the Good MSM service will be able to pick up and use the template. Wi-Fi Access Points The Wi-Fi Access Point must be configured to communicate with the Active Directory Domain that contains the CA via Radius.Users that will access the Wi-Fi Access Point must be a member of a group that has permission to access the AP. Good MSM supports WPA2- Enterprise EAP-TLS Exchange Templates Permissions The Good MSM Service account must have read and enroll permissions to Exchange templates. The Exchange template can be very similar to Wi-Fi templates Exchange Templates: Configuration Requirements Exchange Templates should be configured as follows: The Exchange template must be configured to have the subject name supplied in the request. The Exchange template must have the application policy of at least one authorized signature set to Configuration and Administration Guide 112

120 Enterprise Certificate Authorities certificate request agent for issuing certificates. This policy must be set for re-enrollment. The Exchange template must be published before the Good MSM service can pick up and use the template. VPN Templates Permissions The Good MSM Service account must have read and enroll permissions to VPN templates. The VPN template can be very similar to Wi-Fi templates VPN Templates: Configuration Requirements VPN Templates should be configured as follows: The VPN template must be configured to have the subject name supplied in the request. The VPN template must have the application policy of at least one authorized signature set to certificate request agent for issuing certificates. This policy must be set for re-enrollment. The VPN template must be published before the Good MSM service can pick up and use the template. Field VPN Connection Types Description Good MSM supports Cisco Any Connect and Juniper SSL Either Cisco or Juniper connection must be configured to support certificate based authentication. Depending upon the connection type appropriate VPN client must be installed on the device to connect to the VPN payload. Configuration and Administration Guide 113

121 Enterprise Certificate Authorities Configuring the Certificate Authority The following section describes how to configure a CA within your environment. As certificate management is an integral part of an enterprise s overall security infrastructure, Good MSM strongly recommends reviewing CA documentation from Microsoft before making any changes to your internal CA environment. Grant the Good MSM Service Account rights to the CA Follow these steps to configure the new CA in the Good MSM certificate management workflow: 1. Right-click CA, choose Properties. 2. Select the Security tab. 3. Add Good MSM service account and select the following rights: Read Issue and Manage Certificate Request Certificate Grant the Good MSM service account rights to Exchange Enrollment Agent (Offline Request) and CEP Encryp- Configuration and Administration Guide 114

122 Enterprise Certificate Authorities tion Services. Follow these steps to allow the Good MSM MDM server to act as a Registration Authority on behalf of the CA: 1. Go to Certificate Templates under the Active Directory Certificate Services. 2. Right-click Exchange Enrollment Agent (Offline Request). 3. Select the Security tab. 4. Add Good MSM service account and set the Read and Enroll rights. 5. Right-click CEP Encryption. 6. Select the Security tab. 7. Add Good MSM service account and select the Read and Enroll rights. Configuration and Administration Guide 115

123 Enterprise Certificate Authorities Publish the CEP Encryption and Exchange Enrollment Agent (offline request) templates Follow these steps under the CA that was created within the domain to publish the CEP Encryption and Exchange Enrollment Agent templates: 1. Right-click the list of Certificate Templates and select New. 2. Choose Certificate Template to Issue. 3. In the dialog, select the CEP Encryption and Exchange Enrollment Agent(offline request) templates. 4. Click OK. Create Wi-Fi CA templates Configuring the Certificate Authority Follow these steps on your CA to create a template that will create identity certificates provide the rights to authenticate users to a Wi-Fi network: Create CA templates 1. Click Certificate Templates under the Active Directory Certificate Services. 2. Right-click User, then choose Duplicate template. You will be prompted to select a user template type. Configuration and Administration Guide 116

124 Enterprise Certificate Authorities 3. Select Windows 2003 Server, Enterprise Edition. 4. Provide the template display name. 5. Select the Security tab. 6. Add Good MSM service account and select the Read and Enroll rights. 7. Select the Subject Name tab and select Supply in the request. Configuration and Administration Guide 117

125 Enterprise Certificate Authorities 8. Select the Issuance Requirements tab. Set the This number of authorized signatures field to Set the Application Policy field to Certificate Request Agent Publish template Follow these steps on your CA to publish the templates you created: 1. Right-click the list of Certificate Templates and select New. 2. Choose Certificate Template to Issue. 3. Select the Wi-Fi template you created above 4. Click OK. Configuration and Administration Guide 118

126 Enterprise Certificate Authorities Configure the Good MSM Service Account to be a restricted CA manager Follow these steps on your CA to allow the Good MSM Service Account to be a restricted CA manager: 1. Right-click the CA and choose Properties. 2. Select the Certificate Managers tab. 3. Choose Good MSM service account in the list of Certificate Managers. 4. In the Certificate Templates field, select All and click Remove. 5. Click Add... and add the Wi-Fi certificate template that was created above. 6. Click OK. Create VPN CA templates Follow the steps under Create Wi-Fi CA templates. Create Exchange CA templates Follow the steps under Create Wi-Fi CA templates. Configure Good MSM to Access your CA To configure Good MSM to use your CA, follow these steps: 1. Log into the Good MSM web console. 2. In the menu under the Security tab, select Certificates. 3. Highlight the name of the CA you wish to configure under Certificate Authorities. The CA being used in this example is named demo-demo-dc-ca. Configuration and Administration Guide 119

127 Enterprise Certificate Authorities 4. Request the Encryption certificates into Good MSM by clicking Request in the Encryption row. 5. Click Request in the Signing row. 6. Once the requests have been completed, refresh your browser. Creating an Identity Certificate Before you create a Wi-Fi device configuration that will authenticate with certificates, Good MSM must be configured to use the Identity Certificate that was created on your CA. To do this, follow these steps: 1. In the menu under the Security tab, select Device Configurations. 2. Select a Device Configuration and click Edit. 3. Select Identity Certificate in the Add Configuration box. Good MSM automatically populates the fields with a simple Display Name, the Certificate Authority, and the Certificate Template to use. You can configure the subject template to match a key value pair to track the user. In the example below, the user s CN is matched to their Principle name. Configuration and Administration Guide 120

128 Enterprise Certificate Authorities Creating a Wi-Fi Configuration After adding the Identity Certificate, you must configure a Wi-Fi configuration to use the identity certificate. To do this, follow these steps: 1. In the Add Configuration box under Device Configuration, select Wi-Fi. 2. Enter the SSID for the Wi-Fi network. 3. Check the Hidden Network and Automatically join the network checkboxes, if appropriate in your environment. 4. In the Security Types field, select WPA / WPA2 Enterprise. 5. Check the TLS checkbox. 6. Select the Identify Certificate configured above. 7. (Optional) In the Trusted Certificate Names field, add the list of server certificate common names that will be accepted. For example wpa.example.com. If the server presents a certificate not in this list, it is not trusted. 8. You can check the Allow trust exceptions checkbox if appropriate in your environment. Good MSM does not recommend this option. 9. Configure the Proxy Type as appropriate in your environment. Configuration and Administration Guide 121

129 Enterprise Certificate Authorities 10. After setting up the Wi-Fi configuration, click Save & Publish to deploy the configuration. For more information on creating device configurations, see Device Configurations. Creating a VPN Configuration After adding the Identity Certificate you must configure a VPN configuration to use the identity certificate. To do this, follow these steps: 1. In the Add Configuration box, select VPN. 2. Enter the connection name for the VPN network in the Connection Name field. 3. In the Connection Type field, select VPN AnyConnect. 4. In the Server field, enter the server domain name. 5. In the User Authentication field, select Certificate. 6. In the Identify Certificate field, select the identity certificate you just configured. 7. (Optional)To restrict access, enable the VPN On Demand field and provide the server domain names. The following fields are optional: Group Name Proxy Type Configuration and Administration Guide 122

130 Enterprise Certificate Authorities Creating an Exchange ActiveSync Configuration After adding in the Identity Certificate you must configure an configuration to use the identity certificate. To do this, follow these steps: 1. In the Add Configuration box, select Enter the account name for the network in the Account Name field. 3. In the CAS Server for Exchange 2010 field, enter the exchange server name that supports certificate based authentication. 4. In the User Authentication field, select Certificate. 5. In the Identify Certificate field, select the identity certificate configured above. Configuration and Administration Guide 123

131 Enterprise Certificate Authorities Configuring a Certificate Authority on Windows Server 2008 The following section provides a brief overview of how a CA is configured in a Windows 2008 Environment. This is only an example of one method that can be followed to configure a CA. Before you configure a CA within your environment, you should work with the various stakeholders within your organization to identify your overall requirements and a certificate infrastructure should be designed to meet those needs. Follow these steps to configure Windows Server 2008 to act as a Certificate Authority: 1. Open Server Manager. 2. In the Server Manager, click Role, then Add Roles. 3. In the Wizard, select Active Directory Certificates Services. 4. Select Certification Authority. 5. Select Enterprise Configuration and Administration Guide 124

132 Enterprise Certificate Authorities! Note: If Enterprise is grayed out, please refer to the following Microsoft KB article to enable this setting: 6. Select Root CA. Configuration and Administration Guide 125

133 Enterprise Certificate Authorities 7. Select Create a new Private Key. The next screen lists various Cryptographic Service Provides (CSP). 8. Select the hash algorithm that works best in your environment. Good MSM supports all algorithms supported by the Microsoft CA. 9. Enter the common name that will be used to identify the CA. This name will be synchronized with Good MSM and appear in the Good MSM UI. Configuration and Administration Guide 126

134 Enterprise Certificate Authorities 10. Configure the Expiration date of the CA. 11. Click Next until the installation finishes. 12. Select Close. 13. Close and re-open the Server Manager application. The CA role you just added appears. Configuration and Administration Guide 127

135 12 Using Maintenance/Holiday Mode (BlackBerry Only) Good MSM establishes and maintains a baseline for normal behavior on your system. However, during certain times such as holidays and periods of scheduled maintenance, normal behavior may vary from the established baseline, triggering an alert. Using Maintenance/Holiday mode enables you to override notifications and suppress baseline information in order to keep the baseline accurate. This chapter describes how to use Maintenance and Holiday modes to temporarily disable notifications. This chapter also describes how to use third-party utilities, such as the Windows Scheduled Task Utility, to disable and enable notifications based on your company calendar and/or maintenance schedule. Good MSM notifications are calculated on two items: 1. Specific events that have been identified to cause a BES outages (such as the BES Dispatcher service being down) 2. Baselined Metrics; those events based on a disproportional number of users having degraded service. For example, Good MSM may determine that on Tuesdays at 10:00 AM, 20 percent of your user base may have one or more pending messages. Good MSM would send an alert if there was a 10:00 AM time period on Tuesday when 50 percent of the users had one or more pending messages as this would be an unexpected amount. Maintenance Mode: Disables all notification types described above, including those relating to specific events and those calculated via a learn timeline. Holiday Mode: Disable notifications created based on learned baseline metrics (see the second example above). For example, if Christmas day (December 25) occurred on a Thursday, you would expect less than normal mail flow and a higher level of pending messages for users. Holiday mode allows you to prevent notifications from being sent on days when smartphone usage is expected to be less than normal. You can only use one of these modes at a time. Configuration and Administration Guide 128

136 Maintenance/Holiday Mode! Note: You must manually disable Maintenance and Holiday modes after you enable them (unless it is disabled using Windows Task Scheduler). Good MSM will continue to disable notifications indefinitely for an object until the mode is disabled Enabling and Disabling Maintenance/Holiday Modes! Note: In addition to using the command prompt, you can use third-party utilities to schedule these modes. See Using Windows Task Scheduler to Schedule Maintenance/Holiday Modes for more details. To put BES, carriers, and/or mail servers in maintenance or holiday mode: 1. Open a DOS command prompt. 2. Change directory to <%Good MSM InstallDirectory%>\MaintenanceWindow\bin>. 3. Execute one of the commands in the following table: Parameter Enable Maintenance Mode Enable Holiday Mode Disable Maintenance Mode Disable Holiday Mode Description enablemaintenancemode bes=your_bes carrier= your_carrier mail_server=your_mail_server enableholidaymode bes=your_bes carrier= your_carrier mail_server=your_mail_server disablemaintenancemode bes=your_bes carrier= your_carrier mail_server=your_mail_server disableholidaymode bes=your_bes carrier= your_carrier mail_server=your_mail_server The following table describes the parameters that can be used when entering or exiting maintenance or holiday modes. These parameters are not case-sensitive. Parameter bes=your_bes Description Enter the name of the BES in your environment that you want to place in maintenance/holiday mode. Replace your_bes with the name of the BES. If you want to put all BES into maintenance or holiday mode, enter bes=all.note: Separate multiple BES using commas. Place BES containing special characters within quotation marks. Configuration and Administration Guide 129

137 Maintenance/Holiday Mode Parameter carrier=your_carrier mail_server= your_mail_server Description Enter the name of the carrier(s) in your environment that you want to place in maintenance/holiday mode. Replace your_carrier with the name of the carrier. If you want to put all carriers into maintenance or holiday mode, enter carrier=all.note: Separate multiple carriers using commas. Place carriers containing special characters within quotation marks. Enter the name of the mail server(s) in your environment that you want to place in maintenance/holiday mode. Replace your_mail_server with the name of the mail server. If you want to put all mail servers into maintenance or holiday mode, enter mail_server=all.note: Separate multiple mail servers using commas. Place mail servers whose names contain special characters within quotation marks. A success message opens on the command prompt. Using Windows Task Scheduler to Schedule Maintenance/ Holiday Modes You can use third-party utilities, such as the Windows Scheduled Task Wizard, to run the Maintenance/Holiday mode commands. This allows you to enable and disable these modes ahead of time. To schedule a task in Windows Task Scheduler to enable Maintenance or Holiday mode: 1. Click Start > Settings > Control Panel. 2. Double-click Scheduled Tasks. 3. Double-click Add Scheduled Task. Configuration and Administration Guide 130

138 Maintenance/Holiday Mode The Scheduled Task Wizard opens. 4. Click Next. Configuration and Administration Guide 131

139 Maintenance/Holiday Mode 5. Click Browse. 6. Navigate to <%Good MSM InstallDirectory%>\maintenancewindow\bin. 7. Click the applicable file to enable or disable the desired mode. The following table describes the files in the maintenancewindow\bin directory. File Description enablemaintenancemode Select to schedule a task to enable Maintenance mode. enableholidaymode Select to schedule a task to enable Holiday mode. Configuration and Administration Guide 132

140 Maintenance/Holiday Mode File disablemaintenancemode disableholidaymode Description Select to schedule a task to disable Maintenance mode. Select to schedule a task to disable Holiday mode. 8. Click Open. 9. Using the option buttons, select the time you want to schedule the task. 10. Click Next. 10. Enter the time when the task will execute. Note: The appearance and function of this window differs depending on the Task Options you selected previously. 11. Click Next. 12. Enter the user name (btadmin) and password Configuration and Administration Guide 133

141 Maintenance/Holiday Mode 13. Click Next. A Summary window opens. 14. Click the Open advanced properties for this task when I click Finish option. 15. Click Finish. The Task Properties window opens. Configuration and Administration Guide 134

142 Maintenance/Holiday Mode In the Start in field, enter the pass parameters for the mode. If setting Start In you do not have to set the full path for Run. 16. (Optional) Add comments for the task being created. 17. Click OK.! Note: If you set up a scheduled task to enable Maintenance or Holiday mode, you must set up a coordinated disable task to prevent the mode from running indefinitely. Identifying Components that are in Maintenance or Holiday Modes You can identify a component s mode from the Ops Dashboard. Any component in Maintenance or Holiday mode will be displayed in italic fonts. Additionally, you can drill down and view the details for a specific BES, carrier, or mail server to see whether it is in Maintenance or Holiday mode. To check whether a component is in Maintenance or Holiday mode: 1. Log onto the Ops Dashboard. 2. Click on a BES, carrier, or mail server name. 3. Click on the Events tab. The name of the Events tab will differ depending on the component you selected. In the above figure, the Carrier Events tab was selected. Configuration and Administration Guide 135

143 Maintenance/Holiday Mode In the above figure, you can see in the Event Time column when the maintenance mode for the carrier started and stopped. Configuration and Administration Guide 136

144 13 Installing the Good MSM PING Agent Good MSM is capable of testing whether a specific BlackBerry device is currently able to send and receive messages. The Good MSM PING Agent performs this testing by attempting to send both a PIN-to-PIN message to the device as well as an . It then determines whether these messages were delivered and automatically replied to successfully. Good MSM uses a dedicated BlackBerry to perform these tests. This chapter describes the setup procedure for the dedicated BlackBerry with the Good MSM PING agent. This procedure assumes the person setting up the Good MSM handheld PING Agent is: Familiar with installing Blackberry/mobile application on BlackBerry devices Has basic familiarity with Good MSM System Requirements To install the Good MSM PING agent, the following is required: A provisioned, dedicatde BlackBerry device running a minimum of version 4.1.x firmware! Note: The device on which the PING agent will be installed must be a dedicated device and should not be an actual user s device. Since the PING agent reads and deletes s on the device, it will interfere with receiving s on a shared user account. The device should always be plugged in and not rely on battery power. The Good MSM PING Agent files are located on the Good MSM application server in the following directory: <%Good MSM InstallDirectory%>\HHAgent\blackberry. Configuration and Administration Guide 137

145 BoxTone PING Agent Installing Good MSM PING Agent on a BlackBerry Device To install the Good MSM PING agent on a dedicated BlackBerry device use the BlackBerry Desktop manager: 1. Connect the BlackBerry device to the machine that has the BlackBerry Desktop Manager installed. 2. Make the BlackBerry agent files accessible to the BlackBerry Desktop Manager (copy the files if needed). 3. Launch the BlackBerry Desktop Manager. Once it successfully connects to the device, the status displays as Connected. The Application Loader Wizard opens to the Communication Port Selection screen.! Note: The first time the device is being connected, a prompt to pick up the connection type or automatically detect the communication port may display. If known, select the connection type or check the Detect communication port and click Next. Configuration and Administration Guide 138

146 BoxTone PING Agent 4. Click the Application Loader icon on the desktop to launch the Application Loader Wizard. The BlackBerry Desktop Manager opens. 5. Click Start under Add / Remove Applications. The BlackBerry Desktop Manager displays applications currently installed. Configuration and Administration Guide 139

147 BoxTone PING Agent 6. Click Browse and navigate to the folder that contains the PING Agent files. 7. Select the pin2pin.alx file. 8. Click Open. The PING Agent is added to the list of BlackBerry applications available. Configuration and Administration Guide 140

148 BoxTone PING Agent 9. Click to select the pin2pin check box. 10. Click Next. The Summary screen opens listing the pin2pin application. 11. Click Finish. The PING Agent is installed on the BlackBerry and a confirmation message displays. Configuration and Administration Guide 141

149 BoxTone PING Agent 12. Click Main Menu or close the Application Loader. Launching the Good MSM PING Agent on the Device Once Good MSM MDS configuration is complete, the next step is to configure the PING Agent with Good MSM host name and port number. This allows communication between Good MSM Services and the Good MSM PING Agent via MDS (Mobile Data Service). The configuration can be done by entering the values directly on the device or using a custom IT policy. To set the configuration directly on the device, launch the PING Agent as follows: 1. Go to the home screen of the dedicated BlackBerry device on which the Good MSM PING Agent has been installed. 2. Scroll to the Good MSM PING agent and click on it to launch it If this is the first time the agent is being run, the following prompt displays. Configuration and Administration Guide 142

150 BoxTone PING Agent 3. Check the Don t ask this again for all http connections check box. 4. Select Allow this connection. This allows the application to accept incoming HTTP requests from the Good MSM Admin service. If this is the first time the PING Agent is being run, the following prompt displays. 5. Check the http connections to xxxx check box. 6. Select Allow this connection. This allows the pin2pin application to send data to the Good MSM Admin service! Note: In the above example, xxxxx is the name of the Good MSM Server. It will be replaced by the actual Good MSM server name at the customer deployment. In cases where IT policy is not used for configuring the agent, the value will be null. If the IT policy is not in use, a configuration screen will be shown at the startup. Configuration and Administration Guide 143

151 BoxTone PING Agent The following table describes the fields in the Good MSM Pinger Settings screen. Good MSM Pinger Settings screen fields are shown below. Parameter Description Server Host Enter the Good MSM server host name. Server Port Enter the Good MSM server port. In most cases, this will be 80. Use HTTPS check box PIN from Name Ping Subject Ping Message Body Check to configure the Pinger to use HTTPS. Enter the PIN from Name. Enter the subject you want to use for the PING test. Enter the message you want to use for the PING test. 7. Exit the Pinger Settings screen, and click Save when prompted. Configuration and Administration Guide 144

152 BoxTone PING Agent You will be prompted to restart the Good MSM Pinger. You must restart the PING Agent before the new settings will be enabled. 8. Manually restart the PING Agent. 9. Upon restart, you will see the same configuration screen again (see Figure 15-14). Press the Escape key to close the configuration screen.! Note: When you are finished, you should turn the PING Agent off. You should not shut down the dedicated BlackBerry smartphone by pulling out the battery. Configuration and Administration Guide 145

153 BoxTone PING Agent Validate the Good MSM PING Agent Setup Execute the PING test from the Good MSM Help Desk Console to validate if the Good MSM PING Agent is set up properly. 1. Launch the Good MSM Operations Dashboard and use the User Search Bar to search for a user. This user s device should be working for a successful initial test. 2. Click the user name to drill into the details and ping test for the user. 3. Click PING to execute the test. Green lines confirm a successful test (if the user s device is in coverage). When a PING Test is executed, it progresses through a number of stages as indicated by several types of lines described in the Help Desk Console Guide. If a PING test is successful, the status line turns green. If a test fails, the status line turns red.! Note: If the PING button is dimmed, it indicates that the device is not associated with the user or that the device is not operative and the PING Agent is not available for use. If the PING Agent detects problems, a report is generated on the Device Status tab. Configuration and Administration Guide 146

154 BoxTone PING Agent Configuration and Administration Guide 147

155 Appendix A Tuning the Good MSM Environment This appendix provides the system defaults for each threshold (setting) and explains how to adjust the values within the defined range. Tuning Terms Sample Period. By default, the sample rates for Good MSM are comprised of 3 minute or 180 second intervals. For example, if the default threshold is set to 3, an alert will be triggered after 9 minutes or 540 seconds. Percentage. Refers to the users or devices impacted by the threshold. Threshold. This refers to the value/setting/tweakable being tuned or adjusted. Tuning BES Group Thresholds BES to Handheld Delivery Time Default Behavior: Good MSM will alert you if an abnormal percentage of users or 60 percent of the users on this BES have total delivery times longer than three (3) minutes, whichever value is greater. Good MSM will also ignore any message that takes longer than 15 minutes when calculating the percentage of users. Slow delivery times will need to occur four out five samples to avoid alerting on latency hiccups that clear soon after. Delivery Time to Handheld Threshold Default Behavior: This threshold is used to define what is considered a slow/high delivery time. The default value is 180 seconds (three minutes). This threshold is used in conjunction with the Delivery Time to Handheld Sensitivity threshold. You will be alerted if a certain percentage of users (defined by the sensitivity threshold) have total delivery times greater than this value. Scenario #1 Your company has an internal SLA of two minutes. You need to be alerted if a certain percentage of users are experiencing delivery time longer than two minutes. Adjust the delivery time to handheld threshold to 120. Scenario #2 For whatever reason, it is normal for messages to take three to four minutes to get delivered to user s devices. Therefore, the default value of 180 seconds (three minutes) is too low and you are getting Configuration and Administration Guide 148

156 Appendix A:Tuning Thresholds alerted even though this is considered normal for your environment. For this scenario, adjust the threshold to 300 seconds (five minutes). Delivery Time to Handheld Ignore The purpose of this threshold is to basically ignore pending messages when calculating total delivery time. Good MSM will track the total delivery time of each messages sent to a user s device. So, if a user turns off their device at 9:00 PM, a message is delivered shortly afterwards and then the device is turned on at 7:00 AM the next day, the total delivery time will be 10 hours. Any message that takes longer than the ignore value (900 seconds or 15 minutes by default) will not be included when calculating the number of users that have slow delivery times. Scenario #1 It is rare in your environment for messages to take longer than five minutes to get delivered to the user s devices. Any message that takes longer than five minutes is most likely a pending message. Adjust this threshold down to ignore those messages. Setting this to 300 will ignore those messages that take longer than five minutes. Scenario #2 It is normal in your environment for messages to take over 15 minutes to get delivered to user s devices. You want to increase the ignore threshold so it will include these when calculating total delivery time. Setting this to 1200 would include these messages, and would ignore any over 20 minutes. Delivery Time to Handheld Sensitivity Default Behavior: This threshold considers the amount of users that are experiencing delivery delays. This is used in conjunction with the delivery time to hh threshold. Good MSM baselines the average percentage of users and with high delivery times. Setting the sensitivity lower means that more users will be experiencing delays before sending an alert. Setting the sensitivity higher will mean that an alert will be sent with fewer users having latency issues.! Note: Be sure to set the Percent Time to Handheld value to the desired value before adjusting Delivery Time to Handheld Critical Sensitivity. Scenario #1 You rarely experience latency in your environment and you need to be alerted quickly if a small percentage of users are experiencing delivery delays. For example, adjust the sensitivity higher to eight (8).! Note: Be sure to lower the value of Percent Time To Handheld Critical to the desired value. Scenario #2 You have sporadic latency in your environment. You want to wait until almost half of your users are experiencing latency before you get an alert. For example, adjust the sensitivity down to three (3). Configuration and Administration Guide 149

157 Appendix A:Tuning Thresholds! Note: This can also be accomplished by setting the value of Percent Time to Handheld Critical to the desired percentage of users. Percent Time to Handheld (Critical) Default Behavior: The purpose of this threshold is to be used as a throttle, to limit any noisy alerts due to sporadic issues with delivery times. This threshold is used with the Delivery Time to Handheld Threshold. Good MSM will send a critical alert when the percentage of users with slow delivery times is greater than the value specified in the Delivery Time to Handheld Threshold. By default Good MSM will send a critical alert when 60 percent of the users on this BES have total delivery times greater than three (3) minutes. While the Delivery Time to Handheld Sensitivity uses baselined data when evaluating users with slow delivery times, the Percent Time to Handheld Critical is used to send an alert as soon as the percentage of users with slow delivery times has been exceeded (regardless of whether the percentage of users with slow delivery times is normal or not). Scenario #1 You rarely experience latency in your environment and you need to be alerted if a small percentage of users are experiencing delays, whether the baselined data is normal or not. Adjust this value down to the desired percentage of users. For example, set this value to 10 to send a critical alert when 10 percent of the users on this BES have slow delivery times. Scenario #2 You have some sporadic latency in your environment. You want to wait until 70 percent of your users are experiencing latency before Good MSM sends a critical alert. Adjust this value to 70. Hung Threads Default Behavior: Good MSM will set a BES summary group to warning if 10 or more users have hung threads longer than 20 minutes. Good MSM will send a critical alert if 33 or more users have hung threads longer than 20 minutes. Hung Thread Count (Critical) Good MSM will send a critical alert when the number of users in this BES Group have hung threads longer than the duration set in Hung Thread Duration (see Hung Thread Duration ). Depending on your environment and the total number of users in the particular BES group, you may want to set this higher or lower. Scenario #1 You frequently have some hung threads in your environment for whatever reason (large mailboxes, BES and mail server are on separate networks, etc). You want to wait until more than one third of your users on this BES have hung threads before receiving an alert. Set the value to a third of total user count on this BES. For example, You have 300 users on this BES, so set the threshold to 100. Configuration and Administration Guide 150

158 Appendix A:Tuning Thresholds Scenario #2 You rarely experience any hung threads in your environment. You want to be alerted when only a few users have hung threads. Lower the threshold to the desired number of users. For example, set the threshold to 10. Hung Thread Count (Warning) Default Behavior: Good MSM will display the state of the BES Group in the Good MSM Console to warning when the number of users (default 10) in this BES group have hung threads longer than the duration set in Hung Thread Duration (see below). Since Good MSM recommends critical level notifications, adjusting this metric will only change the appearance of the BES Group in the Good MSM Console (unless warning level notifications have been configured, in which case will cause a warning notification to be sent). Scenario #1 You frequently have some hung threads in your environment and you want to increase the number of users with hung threads warning metric. Adjust the number to the desired number of users before this BES Group is shown in a warning state in the Good MSM Console. Generally this number is set to half of the number set for the Hung Thread Count Critical Threshold. For example, Hung Thread Count Critical is set to 200 users. Set the Hung Thread Count Warning Threshold to 100 users. Scenario #2 You rarely have hung threads in your environment and you want the Good MSM Console to display the BES Group in warning when only a few users have hung threads longer than the duration set in the Hung Thread Duration (see Hung Thread Duration ). Generally, this number is set to half of the number set for the Hung Thread Count Critical Threshold. For example, Hung Thread Count Critical is set to 10 users. Set the Hung Thread Count Warning Threshold to five users. Hung Thread Duration Default Behavior: This metric is the duration of the hung thread in minutes (default 20 minutes) before setting the BES Group state to either warning or critical, depending on the number of users with hung threads (see Hung Thread Count (Critical) or Hung Thread Count (Warning) ). Scenario #1 You frequently have some hung threads in your environment and you let the controller restart itself after 60 minutes to clear the hung threads. You can turn off hung thread alerts by setting the duration to 70 minutes. Scenario #2 You have some hung threads in your environment but they generally clear up after 30 minutes. Set the threshold to 40 minutes to ignore these hung threads. Scenario #3 You rarely have any hung threads in your environment and you want to be notified as soon Good MSM detects hung threads when number of users set to Hung Thread Count Critical is exceeded, or display the BES Group in a Warning state when the Hung thread Count Warning threshold is exceeded. Set the threshold to 10 minutes. Configuration and Administration Guide 151

159 Appendix A:Tuning Thresholds Remaining Licenses Default behavior: Good MSM will send a critical alert when there are five or fewer remaining licenses on a BES. Good MSM will show a BES in a warning state when there are 50 or fewer remaining licenses. Remaining Licenses (Critical) This metric is the amount of remaining licenses left (default is five) before Good MSM will send a critical alert. Adjust the metric to the appropriate number of remaining licenses to when you want to be alerted. Scenario #1 You have a lengthy procurement process, so you will need to know in advance when to order additional BES licenses. Adjust this threshold higher so you will get an alert sooner when the server is close to being out of licenses. For example, set the threshold to 50. Scenario #2 You can order licenses quickly, and do not want to be alerted until there is only one remaining license. For example, set the threshold to one (1). Scenario #3 You do not ever want to be alerted on remaining licenses. Set this threshold to minus one (-1) to turn off this metric. Remaining Licenses (Warning) This metric is the amount of remaining licenses left (default is 50) before Good MSM sets the state of the BES to warning. Adjust this metric to the appropriate number of remaining licenses to when you want the BES to appear in a warning state. Scenario #1 You have a lengthy procurement process, so you will need to know well in advance when to order additional BES licenses. Adjust this threshold higher so you will see the BES in warning sooner when the server is close to being out of licenses. For example, set the threshold to 100 Scenario #2 You can order licenses quickly, and don t want the BES to be in a warning state until there is only a few remaining licenses. For example, set the threshold to five (5). Scenario #3 You do not ever want the BES to be displayed in a warning state regarding remaining licenses. Set this threshold to minus one (-1) to turn off this metric. Message Pending Count (Server) Default Behavior: Good MSM will send a critical alert if the total pending message count on a BES is over 100,000 messages in the last four out of five samples. Good MSM will set the state of a BES to warning if the Configuration and Administration Guide 152

160 Appendix A:Tuning Thresholds total pending message count on a BES is over 6,300 messages in the last four out of five samples. Message Pending Count (Critical) Adjust this threshold to alert you if the total number of pending messages ( is the default) exceeds this number.! Note: is also the maximum number for this threshold. Therefore, this threshold can only be adjusted lower. Scenario You typically do not have a lot of pending messages in your environment or you frequently purge any older pending messages. You want to be alerted sooner if the number of pending messages start to increase on the BES. For example, set the threshold lower to Message Pending Count (Warning) Adjust this threshold to set the state of the BES to warning if the total number of pending messages exceed this amount. Scenario #1 You typically do not have a lot of pending messages in your environment or you frequently purge any older pending messages. You want the BES to be in a warning state if the number of pending messages start to increase on the BES. For example, set the threshold lower to Scenario #2 You typically have a lot of pending messages on your BES for whatever reason and you want to increase the total number of pending messages before the BES is considered in a warning state. For example, increase the threshold to Message Pending Count (User) Default behavior: Good MSM will send an alert if a certain percentage of users have one or more pending message. Message Pending Count Threshold This metric defines the number of pending messages (default is one) a user has before being evaluated in the percentage of users that have pending messages.! Note: The minimum value is also one, therefore this threshold can only be adjusted higher than the default. Good MSM recommends leaving the value at one. Configuration and Administration Guide 153

161 Appendix A:Tuning Thresholds Scenario Your users frequently have one to five pending messages at any given time due to carrier coverage issues, etc. You want to increase the number of pending messages a user has before being evaluated in this group. For example, Increase the threshold to six (6). Message Pending Count Sensitivity Default Behavior: This metric will affect whether Good MSM sends a critical alert when there is a high percentage of users that have pending message counts greater than the Message Pending Count Threshold (default is one). This value can be increased or decreased, depending on whether you want a larger or smaller percentage of users having pending messages before Good MSM sends an alert. Scenario #1 Your users rarely have pending messages. You want to be alerted if a small percentage of users on this BES have pending messages greater than the Message Pending Count Threshold value (default is one). For example, adjust the sensitivity to seven or eight. Scenario #2 Your users frequently have some pending messages at any given time and you want to wait until a larger percentage of users on this BES have pending messages greater than the Message Pending Count Threshold value (default is one). For example, adjust the sensitivity down to two or three. Minimum User Count Default Behavior: A summary group must have 25 or more users in the group before evaluating all the percentage-based summary rules (i.e., BES to Handheld Delivery Time rule and Message Pending Count (User) rule). This is because smaller groups tend to have relatively larger variations in metrics that are calculated in user percentage. Adjust this metric up or down to include a larger or smaller number of users in this group before evaluating baselined events. Scenario # 1 You have an BES server that only has 15 users on the server. You want Good MSM to evaluate the baselined events for this summary group. For example, adjust the threshold down to 15. Scenario #2 You have many BES in your environment. You only want Good MSM to evaluate the baselined events for the BES groups that have more than 25 users. For example, adjust the threshold up to 50. BES To Handheld Flows Default Behavior: Depending on the average number of flows per hour, Good MSM will send an alert if a BES has not sent any messages to any users for a certain period of time. Configuration and Administration Guide 154

162 Appendix A:Tuning Thresholds Minimum Flows Per Hour Default Behavior: This metric is the minimum number of flows per hour (for that hour of the day) before the analyzer will start analyzing no message flows. For example, a BES sends out less than 100 s between 2 AM and 3 AM, which is below the default 100 Minimum Flows Per Hour. In this case, the analyzer will ignore any lack of message flows for this BES for that hour of the day.! Note: Good MSM does not recommend setting this threshold lower than the default 100, as this can result in false positive alerts. Scenario You have one or more BESs that do not have a lot of users, or do not have a lot of message flows (or sporadic message flow). You are receiving zero BES to Handheld flow alerts, but it is not an problem, there were not any s sent during that time. You want Good MSM to ignore any hour that has less than 250 message per hour (average). For example, set the threshold to 250. BES To Handheld Flow Buffer Default Behavior: Depending on the average number of flows per hour, Good MSM will send an alert after a certain number of samples containing no message flow. For example, if the average number of flows for the hour is 2500, Good MSM will send an alert after a smaller number of samples (three or four). If the average number of flows is much lower like 500, Good MSM would send an alert if there has been no message flows after seven or eight samples. So the higher the average number of message flows per that hour, the sooner Good MSM would send an alert. The Buffer simply adds the desired number of samples to this sliding scale before sending an alert. The sample rate is three (3) minutes, so each number adds another three (3) minutes. So instead of sending an alert after three samples of no message flow, if you entered two for this threshold, it would wait until there has been no message flow after five samples instead.! Note: The default is zero, therefore this threshold can only be increased from the default. Scenario You typically have a lot of traffic flow at any given time. However, there are occasions that it is normal to have periods where there just is not any message flow. You want Good MSM to wait a bit longer before sending an alert regarding zero message flows. For example, enter three (3) into the buffer so it will wait an extra nine minutes before sending an alert. SRP Error Duration Default Behavior: Good MSM will send an Unavailable alert if it detects that the SRP connection is down. Configuration and Administration Guide 155

163 Appendix A:Tuning Thresholds SRP Error Duration Down Buffer Default Behavior: This value represents the number of samples in which the SRP connection is continually down before Good MSM sends an alert. The purpose of this metric is to suppress alerts for SRP hiccups where the connection is down only for a few minutes. The default sample rate is three minutes. For example, if you enter a one (1), the SRP connection would need to be down longer than three minutes before Good MSM sends an alert. If you enter two (2), the SRP connection would need to be down longer than six minutes before Good MSM sends an alert.! Note: Since the default value is zero, this metric can only be increased. Scenario #1 You have somewhat frequent SRP drops where the SRP connection is down for three or four minutes. You want to wait until the SRP connection is down for at least six minutes before Good MSM sends an alert. Set this value to two (2). BES Services Down Duration Buffer Default Behavior - By Default, Good MSM will send an unavailable alert if the BlackBerry host is unavailable or if any of the core BES Services are unresponsive. Tuning BES Group Thresholds BES Services Down Duration Buffer Default Behavior: This value represents the number of samples in which the host or services are continually unresponsive before Good MSM sends an alert. The purpose of this metric is to suppress alerts for network glitches, or BES reboots. For example, if you enter a one (1) here, the BES server or the BES services will need to be unavailable longer than three minutes before Good MSM sends an unavailable alert. If you enter a two (2) here, the BES server or the BES services will need to be unavailable longer than six minutes before sending an alert.! Note: Since the default value is zero, this metric can only be increased. Scenario #1 You have some network glitches in which the BES is not responsive to pings, or you frequently reboot your BESs and you do not want Good MSM to alert you that the server is unavailable for these reboots. For example, set this value to two (2). The server would need to be unresponsive longer than six minutes before Good MSM would send an alert. Configuration and Administration Guide 156

164 Appendix A:Tuning Thresholds Users and Messages with Rescans Default Behavior: Good MSM will start evaluating rescan activity if 25 percent or more users are getting 25 percent or more of their messages delivered via rescan.! Note: Good MSM will not evaluate the rescan rule if the BES or the message agent was restarted in the past 30 minutes. Good MSM will send a critical alert if 50 percent of users on this BES have message delivered via rescan longer than 24 minutes (eight samples). Minimum User Percentage with Rescan Default Behavior: Good MSM will start evaluating user and message rescan activity when the percentage of users and messages delivered via rescan exceeds this number. By default, Good MSM will not start evaluating rescan activity until at least 25 percent of the users on this BES have rescan activity. This is to conserve processing power and increase performance. This metric can be adjusted up or down. Scenario #1 You rarely have rescan activity in your environment and you want Good MSM to start evaluating rescan activity when a smaller percentage of users (and a smaller percentage of overall messages delivered via rescan) are experiencing rescans. For example, adjust this threshold down to 10 so that Good MSM will start evaluating rescan activity when 10 percent of the users on this BES are getting their messages delivered via rescan and 10 percent of the messages on this BES are getting delivered via rescan. Scenario #2 You frequently have rescan activity and you want to wait until a larger percentage of users are experiencing rescan activity and a larger percentage of the messages on this BES are getting delivered via rescan before being alerted by Good MSM. For example, adjust this threshold up to 40 so that Good MSM will wait until at least 40 percent of the users on this BES are getting their messages delivered via rescan before it starts evaluating rescan activity. Percent of Users Getting Rescans Default Behavior: Good MSM will send a critical alert if the percentage of users that are getting their messages delivered via rescan exceeds this value longer than the duration specified by Rescan Message Sensitivity. By default Good MSM will send a critical alert if more than 50 percent of users have rescan activity longer than 24 minutes (eight samples). Scenario #1 You rarely have rescan activity in your environment and you want Good MSM to send a critical alert when a smaller percentage of users are getting messages delivered via rescan. For example, adjust this threshold down to 25 so that Good MSM will send a critical alert when 25 percent of the users on this BES have rescan activity longer than the duration defined in Rescan Message Sensitivity (default = eight samples or 24 Configuration and Administration Guide 157

165 Appendix A:Tuning Thresholds minutes). Scenario #2 You frequently have rescan activity in your environment and you want Good MSM to wait until a larger percentage of users on this BES are experiencing rescan activity before sending a critical alert. For example, adjust this metric up to 60 so that Good MSM will wait until at least 60 percent of the users on this BES are experiencing rescan activity longer than the duration defined in Rescan Message Sensitivity (default = eight samples or 24 minutes) before sending a critical alert. Rescan Message Sensitivity Default Behavior: The value defines the number of samples of detected rescan activity before sending a critical alert (depending on the percentage of users experiencing rescan activity, defined in Percent of Users Getting Rescans). The default value is eight samples. Each sample is three minutes. Scenario #1 You rarely have rescan activity in your environment and you want Good MSM to alert you sooner when the percentage of users (defined in Percent of Users Getting Rescans) are experiencing rescan activity. For example, adjust the threshold down to three (3) so that Good MSM will send an alert if the percentage of users (defined in Percent of Users Getting Rescans) have rescan activity longer than three samples (nine minutes). Scenario #2 You frequently have rescan activity and you want Good MSM to wait longer before sending a critical alert when the percentage of users (defined in Percent of Users Getting Rescans) are experiencing rescan activity. For example, adjust the threshold to 10 so that Good MSM will wait until the percentage of users (defined in Percent of Users Getting Rescans) are experiencing rescan activity greater than 30 minutes before sending a critical alert. Rate of BES Log Lines Default Behavior: Good MSM baselines the number of loglines a BES creates during a given time period (hour of the day) and evaluates the current rate of BES loglines against what Good MSM has learned to be normal for the BES. By default, Good MSM will set the state of a BES to warning if the rate of BES Log Lines per user exceeds 10 times the average number of log lines per user for five samples (15 minutes). Good MSM will send a critical alert if the rate of BES Log Lines per user exceeds 15 times the average number of log lines per user (if above the minimum 200) for five samples (15 minutes). Good MSM will send an unavailable alert if there are zero log lines for 4 samples (12 minutes). In order to reduce false alerts on a BES that does not normally have a lot of usage, Good MSM will not monitor the number of loglines on a BES when the average number of loglines for the hour is less than that identified in the Minimum Log Lines/Sample threshold (which is set to 200 by default). Configuration and Administration Guide 158

166 Appendix A:Tuning Thresholds Rate of BES Log Lines (Warning) Default Behavior: Good MSM will set the state of a BES to warning if the rate of BES Log lines per user exceeds the average number of log lines per sample times this value for the number of samples defined in Samples of High Volume Log Lines (Default is 5 samples, or 15 minutes). Scenario #1 - Your BES logs typically log at a standard rate and you want Good MSM to set the state of the BES to warning when smaller peaks of excessive logging occur. In this example, adjust this threshold down to five so that Good MSM will set the state of the BES to warning when the rate of log lines exceeds five times the average per user for the number of samples defined in Samples of High Volume Log Lines (Default is 5 samples, or 15 minutes). Scenario #2 - Your BES logs frequently experience periods where activity spikes. To prevent these alerts you want Good MSM to wait until the rate log lines per user greatly exceed the average before setting the state of the BES to warning. In this example, adjust the threshold to 20 so that Good MSM will set the state of the BES to warning when the rate of log lines exceeds twenty times the average per user for the number of samples defined in Samples of High Volume Log Lines (Default is 5 samples, or 15 minutes). Rate of BES Log Lines (Critical) Default Behavior: Good MSM will set the state of a BES to critical if the rate of BES Log lines per user exceeds the average number of log lines per sample times this value for the number of samples defined in Samples of High Volume Log Lines (Default is 5 samples, or 15 minutes). Scenario #1 - Your BES logs typically log at a standard rate and you want Good MSM to set the state of the BES to critical when smaller peaks of excessive logging occur. In this example, adjust this threshold down to five so that Good MSM will set the state of the BES to critical when the rate of log lines exceeds five times the average per user for the number of samples defined in Samples of High Volume Log Lines (Default is 5 samples, or 15 minutes). Scenario #2 - Your BES logs frequently experience periods where activity spikes. To prevent these alerts you want Good MSM to wait until the rate of log lines per user greatly exceed the average before setting the state of the BES to critical. In this example, adjust the threshold to 20 so that Good MSM will set the state of the BES to critical when the rate of log lines exceeds twenty times the average per user for the number of samples defined in Samples of High Volume Log Lines (Default is 5 samples, or 15 minutes). Minimum Log Lines Per Sample Default Behavior: This threshold defines the minimum number of log lines per sample (3 minutes) required before the analyzer rule begins analyzing log line data. Setting the threshold too low can result in false Configuration and Administration Guide 159

167 Appendix A:Tuning Thresholds positives as insufficient volume of may not provide enough data for baseline calculation. Scenario #1 - You don t have many users on the BES (example: less than 100 users) therefore the default threshold of 200 can be too high to detect excessive BES logging. In this example you would decrease the threshold to 150 log lines per sample to compensate for low log volume due to low user count on the BES. Scenario #2 - You have more than 1000 users on the BES and high log volume and may be receiving false positives for excessive BES logging during periods where low logging may often be expected (evenings/ weekends). In this example you would increase the minimum number of log lines to 300 log lines per sample so that there will need to be at least 300 logs lines per sample before the analyzer rule starts evaluating excessive log line data. Samples of High Volume Log Lines Default Behavior: This threshold defines the number of consecutive sample periods (each sample is 3 minutes) of excessive BES Logging needed before sending warning/critical events. The default is 5 samples (15 minutes) of sustained excessive BES Logging before an event is generated. Scenario #1 - You rarely have excessive BES logging and you want to be alerted sooner than 15 minutes. In this example you would decrease the threshold to 3 (samples) to generate an alert if there is excessive BES logging sustained for 9 minutes or longer. Scenario #2 - Your environment sporadically experiences excessive BES logging. In many cases the logging alerts clear within 20 minutes. In this example you would increase the threshold to 7 (samples) so that excessive BES logging would need to be sustained for longer than 21 minutes before an event is generated. Samples of Zero Log Lines Default Behavior: This threshold defines the number of consecutive samples (default is 4, or 12 minutes) when the BES logs zero lines before an unavailable alert is generated. Scenario #1 - You have a high volume of BES logging in your environment and you want to be alerted sooner if the BES is not logging any log lines. In this example you would decrease the threshold to 2 so an unavailable event will be generated if there are no log lines on the BES for 2 samples (6 minutes). Scenario #2 - You have a low volume of BES logging (small number of users on the BES) and having no log lines is not unusual for short periods of time in your environment. In this example you would increase the threshold to 7 so an unavailable event isn t generated until the BES logs 0 log lines for a period of 21 minutes or longer. Configuration and Administration Guide 160

168 Appendix A:Tuning Thresholds Percent Directory Lookup Errors Default Behavior: Good MSM will send a critical alert if 20 percent of the users on the BES are experiencing directory lookup errors. Scenario #1 You rarely experience directory lookup errors in your environment. You want to be alerted sooner if there are any lookup errors. For example, set this threshold to 10 so you ll be alerted if 10 percent of your users on this BES are experiencing directory lookup errors. Scenario #2 For whatever reason, you frequently experience directory lookup errors in your environment. You want to wait until a larger percentage of users are experiencing directory lookup errors before Good MSM sends a critical alert. For example, set this threshold up to 40 to be alerted when 40 percent of the users on this BES are experiencing directory lookup errors. Percent Mail Server Access Errors Default Behavior: Good MSM will send a critical alert if 20 percent of the users on the BES are experiencing mail server access errors. Scenario #1 You rarely experience mail server access errors in your environment. You want to be alerted sooner if there are any mail server access errors. For example, set this threshold to 10 so you ll be alerted if 10 percent of your users on this BES are experiencing mail server access errors. Scenario #2 For whatever reason, you frequently experience mail server access errors in your environment. You want to wait until a larger percentage of users are experiencing mail server access errors before Good MSM sends a critical alert. For example, set this threshold up to 40 to be alerted when 40 percent of the users on this BES are experiencing mail server access errors. Percent Calendar Errors Default Behavior: Good MSM will send a critical alert if 10 percent of the users on the BES are experiencing calendar type errors. Scenario #1 You rarely experience calendar errors in your environment. You want to be alerted sooner if there are any calendar errors. For example, set this threshold to five (5) so you ll be alerted if five percent of your users on this BES are experiencing mail server access errors. Scenario #2 For whatever reason, you frequently experience calendar errors in your environment. You want to wait until a larger percentage of users are experiencing calendar errors before Good MSM sends a critical alert. For example, set this threshold up to 25 to be alerted when 25 percent of the users on this BES are experiencing calendar errors. Configuration and Administration Guide 161

169 Appendix A:Tuning Thresholds Users with From HH Errors Default Behavior: Good MSM will send a critical alert if 10 users on the BES are experiencing errors when trying to send messages from their devices. Scenario #1 You rarely experience issues with users sending messages from their devices in your environment. You want to be alerted sooner if only a few users are experiencing errors when trying to send messages from their devices. For example, set the threshold to five (5) to be alerted when five users are experiencing errors when trying to send messages from their device. Scenario #2 For whatever reason, your users frequently experience issues trying to send messages from their devices. You want to wait until a larger number of users are having this issue before Good MSM sends a critical alert. For example, set this threshold to 20 to be alerted when 20 users on the BES are experiencing errors when trying to send messages from their device. Configuration and Administration Guide 162

170 Appendix A:Tuning Thresholds ActiveSync CAS Groups CAS Services Down Duration Buffer Default Behavior: This value represents the number of samples in which the CAS host or IIS services are continually unresponsive before Good MSM sends an alert. The purpose of this metric is to suppress alerts for network glitches, or CAS reboots. For example, if you enter a one (1) here, the CAS server or the CAS services will need to be unavailable longer than three minutes before Good MSM sends an unavailable alert. If you enter a two (2) here, the CAS server or the CAS services will need to be unavailable longer than six minutes before sending an alert. The default value is 1. The threshold adjusts the number of consective samples that the CAS Services are down. As the value is increased, more consecutive violating samples than the default setting (one sample) are required to trigger an CAS Service unavailable event. Min = 1, Max = 20 Scenario #1 You have some network glitches in which the CAS is not responsive to pings, or you frequently reboot your CASs and you do not want Good MSM to alert you that the server is unavailable for these reboots. For example, set this value to two (2). The server would need to be unresponsive longer than six minutes before Good MSM would send an alert. Minimum User Count Default Behavior: This value represents the minimum number of impacted users required before an alert for a CAS problem is sent. A summary group should have 25 or more users in the group. This is because smaller groups tend to have relatively larger variations in metrics that are calculated in user percentage. Increase or decrease this metric to include a larger or smaller number of users in this group before evaluating baselined events. The default value is 25. Min = 1, Max = 100 Scenario # 1 You have a CAS server that only has 15 users provisioned on the server. You want Good MSM to evaluate the baselined events for this summary group. For example, adjust the threshold down to 15. Scenario #2 You have many CAS in your environment. You only want Good MSM to evaluate the baselined events for the CAS groups that have more than 25 users. For example, adjust the threshold up to 50. Percent of Devices Getting CAS Responsiveness Error (Warning) Default Behavior. This value represents the percentage of devices experiencing server responsiveness errors between the device and the CAS required to trigger a warning alert. Server responsiveness errors may occur Configuration and Administration Guide 163

171 Appendix A:Tuning Thresholds when the ActiveSync Application pool is experiencing an excessive workload which may generate error messages (i.e. Too many jobs queued, Server Error Retry Later, and App Pool Timer). The default value to trigger a warning alert is 25 percent of users. Min = 1, Max = 100 Scenario 1 You rarely experience server responsiveness errors in your environment. Therefore, you would like to receive a warning before the problem impacts many users in your environment. To receive a warning sooner, lower the default value to 5. Once 5 percent of devices are affected, you will receive a system warning alert. Scenario 2- Your environment frequently experiences server responsiveness errors. You only want to be warned once 60 percent of the devices in your environment have been impacted. Increase the percentage of devices required to trigger a warning alert. Once 60 percent of devices have been impacted, you will receive a system alert. Percent of Devices Getting CAS Responsiveness Error (Critical) Default Behavior: Good MSM will generate a critical alert when 50 percent of devices on the CAS experiencing server responsiveness errors exceeds this number. Server responsiveness errors may occur when the ActiveSync Application pool is experiencing an excessive workload which may generate error messages (i.e Too many jobs queued, Server Error Retry Later, and App Pool Timer).The default value to trigger a critical alert is 50 percent of devices. Min = 1, Max = 100 Scenario 1 You rarely experience server responsiveness errors in your environment. So you would like to be alerted as soon as server responsiveness becomes a problem. To receive alerts sooner, lower the default value to 10. Once 10 percent of devices are affected, you will receive a system alert. Scenario 2- For whatever reason, your environment frequently experiences server responsiveness errors. You only want to receive alerts once the majority of devices have been impacted. To receive alerts later, increase the default value to 75. Once 75 percent of devices have been impacted, you will receive a system alert. Percent of Devices Getting Application Availability Error (Warning) Default Behavior- Application Availability errors may occur when the ActiveSync Application Pool is not responding which may generate varied errors (i.e. App Offline, App Shut down, Disabled, and Server Error). Good MSM will generate a warning alert when 25 percent of devices on the CAS receive errors when attempting to access an application. Once the percentage of devices receiving this error exceeds the default value of 25 percent, the system will trigger a warning alert. Min = 1, Max = 100 Scenario #1- Devices on your CASs seldomly receive application availability errors. Therefore, you would like to be informed before application availability impacts too many users decreasing the quality of service. Set your warning threshold to 5 percent to receive an alert as soon as this error impacts 5 percent or more users. Configuration and Administration Guide 164

172 Appendix A:Tuning Thresholds Scenario #2- Devices on your CAS experience application availability errors often. Therefore, you would like to be informed once 40 percent of devices areimpacted. Set your warning threshold to 40 percent to receive an alert as soon as this error impacts 40 percent or more users. Percent of Devices Getting Application Availability Error (Critical) Default Behavior- Application Availability errors may occur when the ActiveSync Application Pool is not responding which may generate varied errors (i.e. App Offline, App Shut down, Disabled, and Server Errors). Good MSM will generate a critical alert when 50 percent of devices on the CAS experiencing application availability error exceeds this number. Min = 1, Max = 100 Scenario #1- Devices on your CASs seldomly receive application availability errors. Therefore, you would like to be informed before application availability impacts too many users decreasing the quality of service. Set your critical threshold to 20 percent to receive an alert as soon as this error impacts 20 percent or more users. Scenario #2- Devices on your CAS experience application availability errors often. Therefore, you would like to be informed once 70 percent of devices have been impacted. Set your warning threshold to 70 percent to receive an alert as soon as this error impacts 70 percent or more users. Percent of Devices Getting CAS Connectivity Error (Warning) Default behavior: Good MSM will generate a critical alert when 25 percent of devices on the CAS are experiencing server connectivity errors, such as dropping and/or rejecting connections from clients. Min = 1, Max = 100 Scenario #1 CAS connectivity issues are isolated in your environment. To learn about devices experiencing CAS connectivity issues earlier, lower the threshold to alert to 2 percent. Once 2 percent of devices are affected, you will receive a warning message. Scenario #2- For whatever reason, your environment frequently experiences server responsiveness errors. You only want to receive alerts once the majority of devices have been impacted. To receive alerts later, increase the default value to 75. Once 75 percent of devices have been impacted, you will receive a system alert. Percent of Devices Getting CAS Connectivity Error (Critical) Default Behavior: Good MSM will generate a critical alert when 50 percent of devices on the CAS are experiencing server connectivity errors, such as dropping and/or rejecting connections from clients. Min = 1, Max = 100 Configuration and Administration Guide 165

173 Appendix A:Tuning Thresholds Scenario # 1 CAS connectivity issues are isolated in your environment. To learn about devices experiencing CAS connectivity issues earlier, lower the threshold to alert to 2 percent. Once 2 percent of devices are affected, you will receive a warning message. Scenario # 2- For whatever reason, your environment frequently experiences server responsiveness errors. You only want to receive alerts once the majority of devices have been impacted. To receive alerts later, increase the default value to 75. Once 75 percent of devices have been impacted, you will receive a system alert. Percent of Devices Getting External Resource Error (Warning) Default Behavior: Good MSM will generate a warning alert when 25 percent of devices on the CAS are experiencing errors connecting to Active Directory and/or forwarding requests to remote CAS servers not configured with SSL. Min = 1, Max = 100 Scenario 1#- External resource errors are infrequent in your environment. Therefore, it is important to be alerted as soon as users a small percentage of users are experiencing issues. Adjust the threshold down to 15 percent to receive warning alerts sooner. Scenario 2#- External resource errors are common your environment. Therefore, you would prefer to be alerted once 35 percent of your users are experiencing issues. Adjust the threshold up to 35 percent to receive warning alerts later. Percent of Devices Getting External Resource Error (Critical) Good MSM will generate a critical alert when 50 percent of devices on the CAS are experiencing errors connecting to Active Directory and/or forwarding requests to remote CAS servers not configured with SSL. Min = 1, Max = 100 Scenario 1#- External resource errors are infrequent in your environment. Therefore, it is important to be alerted as soon as users a small percentage of users are experiencing issues. Adjust the threshold down to 15 percent to receive critical alerts sooner. Scenario 2#- External resource errors are common your environment. Therefore, you would prefer to be alerted once 35 percent of your users are experiencing issues. Adjust the threshold up to 35 percent to receive critical alerts later. Configuration and Administration Guide 166

174 Appendix A:Tuning Thresholds High Command Volume Default behavior-this value represents the number of commands allowed per hour. Any device which has hourly command volume exceeding the default value of 100 will trigger a critical event for the device. Min = 1, Max = 1000 Scenario #1- Between the hours of 7:30 and 10:00 each morning, users in your environment typically have high hourly command volume. Since higher command volume is normal for your environment during the morning, it may be necessary to increase the command volume to 250 commands per hour to avoid receiving spurious alerts. If a device exceeds this threshold, it will trigger a system alert. Scenario # 2 You seldomly see users with high command volume in your environment. Any user with high command volume could potentially create undue loads on the server, resulting in performance implications for the rest of the users provisioned to that server. You need to be alerted as soon as any device exceeds the threshold. Decrease the default value to 75 commands per hour to be alerted earlier. Minimum Log Lines/Sample Default Behavior: This threshold defines the minimum number of log lines per sample (3 minutes) required before the analyzer rule begins analyzing log line data. The Analyzer will evaluate the logging activity during periods when the normal hourly average exceeds this value. Setting the threshold too low can result in false positives as insufficient volume of may not provide enough data for baseline calculation. The default value is 200. Min = 1, Max = Scenario #1 - You have very few users on the CAS (example: less than 100 users); therefore, the default threshold of 200 can be too high to detect excessive CAS logging in your environment. In this example, you would decrease the threshold to 100 log lines per sample to compensate for low log volume due to low user count and activity on the CAS. Scenario #2 - You have more users on your CAS than typical environments and high log volume is common. You may be receiving false positives for excessive CAS logging during periods where low logging may often be expected (evenings/weekends). In this example, you would increase the minimum number of log lines to 550 log lines per sample before the analyzer rule starts evaluating excessive log line data. Samples of Zero Log Lines Default Behavior: This threshold defines the number of consecutive sample periods (default is 4, or 12 minutes) when the CAS logs zero lines on a monitored server before an unavailable alert is generated. The default value is 4. Min = 1, Max = 20 Configuration and Administration Guide 167

175 Appendix A:Tuning Thresholds Scenario #1 - You have a high volume of CAS logging in your environment and you want to be alerted sooner if the CAS is not logging any log lines. In this example you would decrease the threshold to 2 so an unavailable event will be generated if there are no log lines on the CAS for 2 samples (6 minutes). Scenario #2 - You have a low volume of CAS logging (small number of users on the CAS) and having no log lines is not unusual for short periods of time in your environment. In this example you would increase the threshold to 7 so an unavailable event isn t generated until the CAS logs 0 log lines for a period of 21 minutes or longer. ActiveSync Connection Source Groups Samples of Zero ActiveSync log events Default Behavior: This threshold defines the number of consecutive samples (default is 5, or 15 minutes) when the CAS logs zero lines before an unavailable alert is generated. Min = 1, Max = 100 Scenario #1 - You have normal volume of CAS log events for most connection sources in your environment and you want to be alerted sooner if the CAS is not displaying any log events. In this example, you would decrease the threshold to 2 so an unavailable event will be generated if there are no log events on the CAS for 2 samples (6 minutes). Scenario #2 - You have a low volume of CAS log events and having no log events is not unusual for short periods of time in your environment. In this example, you would increase the threshold to 8 so an unavailable event isn t generated until the CAS logs 0 log events for a period of 24 minutes or longer. Samples of Abnormally Low Devices Default Behavior: The number of sample periods in which an abnormally low number of devices connect to the connection source. The default value for this is 5. Min = 1, Max = 100 Scenario #1 - Most connection sources in your environment have a moderate number of devices connecting to them. You want to be alerted sooner if the CAS is displaying disproportionately low numbers of device connections. In this example, you would decrease the threshold to 4 so an alert will be generated if there are too few device connections on the CAS for 4 samples (12 minutes). Scenario #2 In your environment, it is not unusual to have fewer device connections for certain connection sources. In this example, you would increase the threshold to 15 so an alert for low device connections will not be generated until the CAS logs 0 connections for a period of 45 minutes or longer. Configuration and Administration Guide 168

176 Appendix A:Tuning Thresholds Samples of Zero Activities Default behavior: This number defines the sample periods with zero activities logged for the connection source. After 5 sample periods or 15 minutes, an alert will be sent to the administrator. Min = 1, Max = 100 Scenario #1 - You have a normal activity volumes for most connection sources in your environment and you want to be alerted sooner if the CAS is not displaying any connection source activities. In this example, you would decrease the threshold to 4 so a zero activity alert will be generated if there aren t any connection source activities on the CAS for 4 samples (12 minutes). Scenario #2 In your environment it is not unusual to have no activity for certain connection sources. In this example, you would increase the threshold to 11 so an alert for zero connection source activity isn t generated until the CAS logs 0 activities for a period of 33 minutes or longer. ActiveSync Mailbox (MBX) Groups Minimum User Count Default behavior: This value represents the minimum number of users required to attribute any user level problems to the possible MBX problems. A summary group should have 25 or more users in the group. This is because smaller groups tend to have relatively larger variations in metrics that are calculated in user percentage. Increase or decrease this metric to include a larger or smaller number of users in this group before evaluating baselined events.. Min = 1, Max = 100 Scenario #1 You have a CAS server that only has 15 users on the server. You want Good MSM to evaluate the baselined events for this summary group. For example, adjust the threshold down to 15. Scenario #2 You have many CAS in your environment. You only want Good MSM to evaluate the baselined events for the CAS groups that have more than 25 users. For example, adjust the threshold up to 50. User with Service Errors Count (Critical) Default Behavior: Good MSM will send a critical alert when 33 users (default value) begin to experience service errors. Min = 1, Max = 10,000 Scenario #1- Service errors are uncommon in your environment. Decrease the number of users with service errors to 15 to receive critical alerts earlier. Configuration and Administration Guide 169

177 Appendix A:Tuning Thresholds Scenario #2- Service errors occur frequently in your environment. Increase the default number of users with service errors to 75 to avoid triggering alerts for behavior that is common in your environment. User with Service Errors Count (Warning) Default behavior-send a warning alert when the number of users in this group with service errors exceeds 10 (Default Value). Scenario #1- Service errors are uncommon in your environment. Decrease the number of users with service errors to 5 to receive warning alerts earlier. Scenario #2- Service errors occur frequently in your environment. Increase the default number of users with service errors to 50 to avoid triggering warning messages for behavior that is common in your environment. Min = 1, Max = GOOD Groups GOOD Services Down Duration Buffer Default Behavior: This value represents the number of samples in which the host or services are continually unresponsive before Good MSM sends an alert. The purpose of this metric is to suppress alerts for network glitches, or Good server reboots. For example, if you enter a one (1) here, the Good server or the Good services will need to be unavailable longer than three minutes before Good MSM sends an unavailable alert. If you enter a two (2) here, the Good server or the Good services will need to be unavailable longer than six minutes before sending an alert. Scenario #1 You have some network glitches in which the host not responsive to pings, or you frequently reboot your Good servers and you do not want Good MSM to alert you that the server is unavailable for these reboots. For example, set this value to two (2). The server would need to be unresponsive longer than six minutes before Good MSM would send an alert. GOOD Services High RAM Duration Buffer Default Behavior: The threshold adjusts the number of consecutive samples that the Good Services RAM usages are dangerously high. As the value is increased, more consecutive violating samples than the default setting (5 samples) are required to trigger an Good Service critical event. Min = 1, Max = 20 Scenario 1#- RAM usage is uncommonly high within your environment. To avoid receiving spurious alerts for Configuration and Administration Guide 170

178 Appendix A:Tuning Thresholds normal behavior in your environment, increase the number of violating samples to 10 samples or 30 minutes before an alert is triggered. Scenario 2#- RAM usage by Good Services is uncommonly high within your environment. To avoid receiving spurious alerts for normal behavior in your environment, increase the number of violating samples to 10 samples or 30 minutes before an alert is triggered. GOOD Server To Handheld Flow Buffer The tuning threshold is for adjusting toward less sensitive rule on the GDToHHFlows metric. As the value is increased, more consecutive violating samples than the default setting are required to trigger an unavailable, critical or warning event. Min = 0, Max = 5 Depending on the average number of flows per hour, Good MSM will send an alert after a certain number of samples containing no message flow. For example, if the average number of flows for the hour is 2500, Good MSM will send an alert after a smaller number of samples (one or two). If the average number of flows is much lower like 500, Good MSM would send an alert if there has been no message flows after four or five samples. So the higher the average number of message flows per that hour, the sooner Good MSM would send an alert. The Buffer simply adds the desired number of samples to this sliding scale before sending an alert. The sample rate is three (3) minutes, so each number adds another three (3) minutes. So instead of sending an alert after three samples of no message flow, if you entered two for this threshold, it would wait until there has been no message flow after five samples instead.! Note: The default value is zero, therefore this threshold can only be increased from the default. Scenario You typically have significant traffic flow at any given time. However, there are occasions that it is normal to have periods where there just is not any message flow. You want Good MSM to wait a bit longer before sending an alert regarding zero message flows. For example, enter three (3) into the buffer so it will wait an extra nine minutes before sending an alert. Minimum Flows Per Hour Default Behavior: This is the minimum hourly flow average required for the Analyzer to perform analysis on overall flow throughput. The Analyzer will look to detect at lack of outbound message flow through the GMM server when the normal hourly average exceeds this value. For example, a GMM sends out less than 100 s between 2 AM and 3 AM, which is below the default 100 Minimum Flows Per Hour. In this case, the analyzer will ignore any lack of message flows for this GMM for that hour of the day.setting the value too low can cause false positives as insufficient volume will not provide enough of a baseline for comparison. The default value is 100. Min = 1, Max = Scenario- You have one or more GMMs that has very few users, or has low message flow volume (or sporadic Configuration and Administration Guide 171

179 Appendix A:Tuning Thresholds message flow). You are receiving zero GMM to Handheld flow alerts, but it is not an problem, there were not any s sent during that time. You want Good MSM to ignore any hour that has less than 250 message per hour (average). For example, set the threshold to 250. Percent GOOD Users Paused Errors Default Behavior: A critical alert will be generated when 20 percent of users are paused for an extended period of time. Min = 1, Max = 101 Scenario #1- You seldomly see users paused in your environment. You do not want to wait until 20 percent of your users are in a paused state before receiving a system alert. Adjust the threshold lower to receive an alert before a significant percentage of users have been impacted. Scenario #2- Users are paused frequently in your environment for any number of reasons. Since this is a normal occurrence, you do not want to receive alerts until 40 percent of users are in a paused status. Percent GOOD Users Mailbox Errors Default Behavior: Good MSM will trigger a critical alert generated when 20 percent of the users with mailbox errors on exceeds this value. Min = 1, Max = 101 Scenario #1-Typically, up to 25 percent of your users may experience mailbox errors for any number of reasons. Therefore, the default value of 20 percent is too low and will trigger spurious alerts for regular occurrences in your environment. Increase the default value to 25 to avoid unnecessary alerts for normal behaviors within your environment. Scenario #2- Users in your environment seldomly experience mailbox errors for any reason. Therefore,you want to be alerted as soon as 5 percent of users have mailbox errors. Decrease the percentage of users to 5 percent to receive alerts earlier. Minimum Device Count Default Behavior: The minimum number of devices required to attribute any device level problems to the possible GD Server problems. Min = 1, Max = 100 Scenario # 1 You have a GD server that only has 15 devices on the server. You want Good MSM to evaluate the baselined events for this summary group. For example, adjust the threshold down to 15. Scenario #2 You have many devices in your environment. You only want Good MSM to evaluate the baselined events for the GD groups that have more than 25 users. For example, adjust the threshold up to 50. Configuration and Administration Guide 172

180 Appendix A:Tuning Thresholds Good Dynamics Good Proxy Servers Good Proxy Server Down Duration Buffer Default Behavior: This value represents the number of samples in which the host or servers are continually unresponsive before Good MSM sends an alert. The purpose of this metric is to suppress alerts for network glitches, or Good Proxy server reboots. For example, if you enter a one (1) here, the Good Proxy server or the Good services will need to be unavailable longer than three minutes before Good MSM sends an unavailable alert. If you enter a two (2) here, the Good Proxy server will need to be unavailable longer than six minutes before sending an alert. Scenario #1 You have some network glitches in which the host not responsive to pings, or you frequently reboot your Good Proxy servers and you do not want Good MSM to alert you that the server is unavailable for these reboots. For example, set this value to two (2). The Proxy server would need to be unresponsive longer than six minutes before Good MSM would send an alert. Good Proxy Server Minimum App Requests Default Behavior: This value represents the number of minimum application requests allowed by the proxy server before the rule to monitor request volume engages. Min = 1, Max = Scenario #1 - You don t have many users on the Good Proxy Server (example: less than 100 users) therefore the default threshold of 200 can be too high to detect a low number app requests. In this example you would decrease the threshold to 150 app request volume per sample to compensate for low app request volume due to low user count on the Good Proxy Server. Scenario #2 - You have more than 1000 users on the Good Proxy Server and high app request volume and may be receiving false positives for excessive app requests during periods where low app request volume may often be expected (evenings/weekends). In this example you would increase the minimum number of app requests to 300 requests per sample so that there will need to be at least 300 requests per sample before the analyzer rule starts evaluating excessive app request data. Samples of Consecutive Zero App Requests Default behavior: This number defines the sample periods with zero requests logged for the apps. After 5 sample periods or 15 minutes, an alert will be sent to the administrator. Min = 1, Max = 20 Configuration and Administration Guide 173

181 Appendix A:Tuning Thresholds Scenario #1 - You have a normal activity volumes for most app requests in your environment and you want to be alerted sooner if the Good Proxy Server is not displaying any app request activities. In this example, you would decrease the threshold to 4 so a zero activity alert will be generated if there aren t any app request activities on the Good Proxy Server for 4 samples (12 minutes). Scenario #2 In your environment it is not unusual to have no activity for certain apps. In this example, you would increase the threshold to 11 so an alert for zero app requests activity isn t generated until the Good Proxy Server logs 0 app requests for a period of 33 minutes or longer. Percent of App Servers Failed to Connect (Warning) Default Behavior: This value represents the number of minimum app server connections. The rule to monitor app server connections will not engage if the warning number falls below this threshold. In this case the default value is 20. Min = 1, Max = 100 Percent of App Servers Failed to Connect (Critical) Default Behavior: This value represents the number of minimum app server connections. The rule to monitor app server connections will not engage if the warning number falls below this threshold. Min = 1, Max = 100 Samples of Over-the-Threshold of Failed App Server Connections Default Behavior: This value adjusts the number of consecutive samples that the percent of failed app server connections exceeds the threshold. Min = 1, Max = 20 Minimum Hourly App Server Connections Default Behavior: This value represents the minimum number of hourly app server connections. If the mininum number of app server connections is less than this threshold, the rule will not engage. Min = 1, Max = Good Dynamics Good Proxy Clusters Good Proxy Server Down Duration Buffer Default Behavior: This value represents the number of samples in which the host or servers are continually unresponsive before Good MSM sends an alert. The purpose of this metric is to suppress alerts for network Configuration and Administration Guide 174

182 Appendix A:Tuning Thresholds glitches, or Good Proxy server reboots. For example, if you enter a one (1) here, the Good Proxy Cluster or the Good services will need to be unavailable longer than three minutes before Good MSM sends an unavailable alert. If you enter a two (2) here, the Good Proxy server will need to be unavailable longer than six minutes before sending an alert. Min =1 Max =20 Scenario #1 You have some network glitches in which the host not responsive to pings, or you frequently reboot your Good Proxy servers and you do not want Good MSM to alert you that the server is unavailable for these reboots. For example, set this value to two (2). The Proxy server would need to be unresponsive longer than six minutes before Good MSM would send an alert. Good Dynamics Good Control Servers Good Control Server Down Duration Buffer Default Behavior: This value represents the number of samples in which the host or servers are continually unresponsive before Good MSM sends an alert. The purpose of this metric is to suppress alerts for network glitches, or Good Control server reboots. For example, if you enter a one (1) here, the Good Control server or the Good services will need to be unavailable longer than three minutes before Good MSM sends an unavailable alert. If you enter a two (2) here, the Good Proxy server will need to be unavailable longer than six minutes before sending an alert. Min =1 Max =20 Scenario #1 You have some network glitches in which the host not responsive to pings, or you frequently reboot your Good Proxy servers and you do not want Good MSM to alert you that the server is unavailable for these reboots. For example, set this value to two (2). The Proxy server would need to be unresponsive longer than six minutes before Good MSM would send an alert. Good Dynamics Applications Samples of Consecutive Zero App Requests Default behavior: This number defines the sample periods with zero requests logged for the apps. After 5 sample periods or 15 minutes, an alert will be sent to the administrator. Scenario #1 - You have a normal activity volumes for most app requests in your environment and you want to be alerted sooner if there aren t any app request activities. In this example, you would decrease the threshold to 4 so a zero activity alert will be generated if there aren t any app request activities for 4 samples (12 minutes). Configuration and Administration Guide 175

183 Appendix A:Tuning Thresholds Scenario #2 In your environment it is not unusual to have no activity for certain apps. In this example, you would increase the threshold to 11 so an alert for zero app requests activity isn t generated until 0 app requests are logged for a period of 33 minutes or longer. Good Dynamics Minimum App Requests Default Behavior: This value represents the number of minimum application requests allowed by the proxy server before the rule to monitor request volume engages. Scenario #1 - You don t have many users, (example: less than 100 users) therefore the default threshold of 200 can be too high to detect a low number app requests. In this example you would decrease the threshold to 150 app request volume per sample to compensate for low app request volume due to low user count on the Good Proxy Server. Scenario #2 - You have more than 1000 users on the Good Proxy Server and high app request volume and may be receiving false positives for excessive app requests during periods where low app request volume may often be expected (evenings/weekends). In this example you would increase the minimum number of app requests to 300 requests per sample so that there will need to be at least 300 requests per sample before the analyzer rule starts evaluating excessive app request data. Good Dynamics GEMS Servers Good Enterprise Mobility Server (GEMS) Down Duration Buffer Default Behavior: This value represents the number of samples in which the host or servers are continually unresponsive before Good MSM sends an alert. The purpose of this metric is to suppress alerts for network glitches, or GEMS reboots. For example, if you enter a one (1) here, the GEMS or the Good services will need to be unavailable longer than three minutes before Good MSM sends an unavailable alert. If you enter a two (2) here, the GEMS will need to be unavailable longer than six minutes before sending an alert. Min =1 Max =20 Scenario #1 You have some network glitches in which the host not responsive to pings, or you frequently reboot your GEMS and you do not want Good MSM to alert you that the server is unavailable for these reboots. For example, set this value to two (2). The GEMS would need to be unresponsive longer than six minutes before Good MSM would send an alert. Configuration and Administration Guide 176

184 Appendix A:Tuning Thresholds EWS Notification Zero Activity Duration Buffer Default Behavior: This value represents the number of consecutive samples that no EWS Notification Activity was detected before a warning alert was sent. Two more samples of no activity will escalate this event to critical status. Default =5, Min =1, and Max =20 EWS Notification Minimum Hourly Activity Volume Default Behavior: This value represents the minimum number of EWS Notification activities required for the EWS notification rule to be fired. Default =300, Min =1, and Max = Presence Zero Activity Duration Buffer Default Behavior: This value adjusts the number of consecutive samples that the presence service has no activity before a warning alert is sent. Two more samples of no activity will escalate the event to critical. Default =5, Min =1, and Max =20 Configuration and Administration Guide 177

185 Appendix B Using Multiple Admin Services In a large deployment, more people will use Good MSM services such as Ops Dashboard and the Help Desk Console. By default, the Good MSM installer creates two copies of the Good MSM Admin Services. You can create additional Admin Services to help support the added load. Creating Multiple Admin Services To create multiple Admin Services: 1. Open a DOS command prompt. 2. Enter <%Good MSM InstallDirectory%>\utilities\ ruby-util-scripts.! Note: For Dual Server installs, this directory is on the Good MSM Application Server 3. Execute the scripts admin_service_change.rb and pass the total number of Admin Services required. For example, to create a total of six Admin Services, (adding four to the existing two) execute the following: admin_service_change.rb 6! Note: Good MSM does not recommend creating more than six Admin Services without consulting the Good MSM Client Services team. The additional services will be added and start. You can view the added services in the Services screen. Configuration and Administration Guide 179

186 Configuration and Administration Guide 180

187 Appendix C Good MSM Utilities BT-DB-BR: Database Backup and Recovery Utility This appendix describes how to use the Good MSM Database Backup Utility. This utility uses the Oracle Data Pump utility to perform complete backups of your Good MSM repository. This utility provides the following capabilities: The Good MSM Backup Utility is located in the following directory: <%BoxTone InstallDirectory%>\utilities\BT-DB-BR. There are two separate folders in this directory: backup and recovery.! Note: The files created by the backup utility can be large. Make sure the drive selected has enough available space to hold the files created by the utility. If possible the backup directory should be on separate physical drives from repository s data files to reduce possible IO contention. Before starting the backup, create a directory to export the backup files (for example, E:\BoxTone Data) Backing Up the Database Run the backup via the command line with a single option representing the location where the files created by the backup directory should be placed. To backup the database manually you will have to execute start_box_bkup.bat <backup file path> Critical.! Note: Critical is an optional parameter which can be used to complete a partial data backup. 1. From the command prompt, set your working directory to the following directory: <%BoxTone InstallDirectory%>\utilities\BT-DB-BR\backup. 2. Run the backup batch file with a single option identifying the directory that the files should be backed up to using the following syntax (the following example assumes the data will be backed up to E:\BoxTone Data): <%BoxTone InstallDirectory%> utilities\bt-db-br\backup> start_box_bkup.bat E:\BoxTone Data Configuration and Administration Guide 181

188 The backup may take up to three hours to complete, depending on the amount of data in the database. The following table lists the files that will be created. BoxTone _Backup.log BoxTone _DP_DATA_ <DATE>.DMP BoxTone _DP_DATA_ <DATE>.log BoxTone _DP_MD <DATE>.DMP BoxTone _DP_MD <DATE>.log jobs_script.sql User_script.sql Log file containing data on the last run backup job. Contains the actual data from the database. Note: <DATE> is replaced with the current data in the following format: MM_DD_YYYY (for example BoxTone _DP_ DATA_09_01_2008.DMP). Log file containing the results of the data backup.note: <DATE> is replaced with the current data in the following format: MM_DD_YYYY (for example, BoxTone _DP_DATA_09_01_2008.log). Meta data from the database containing information about the table configurations, indexes, and triggers.note: <DATE> is replaced with the current data in the following format: MM_DD_YYYY (for example, BoxTone _DP_MD09_01_2008.DMP). Log file containing the results of the metadata backup.note: <DATE> is replaced with the current data in the following format: MM_DD_YYYY (for example, BoxTone _DP_MD_09_01_2008.log). Script containing the BoxTone database jobs such as the warehouse jobs. Script that recreates the BoxTone user account and gives the required rights. 3. Once the backup job has finished, Good MSM recommends that you backup the files to off-server media. Multiple copies of files that have the current date in the file name will be created and are not deleted by the backup script. Be sure to monitor and delete these files to ensure your drive is not filled to capacity by the backup script. Configuration and Administration Guide 182

189 Scheduling Regular Backups The backup scripts can be scheduled using the Schedule BTBackup utility. Be sure to schedule the backup during non-business hours to avoid impact on the system. The application can be found at the following location BoxTone\utilities\BT-DB-BR\Backup\ScheduleBTBackup. 1. Select Critical, Full, or both Critical and Full backups by checking the box next to schedule to enable the options below. (Select critical to take complete a partial data backup.) 2. Choose daily, weekly or monthly backups. 3. Schedule the run time. 4. Next complete the designated fields in the Notifications section. By default, you will only receive an notification if the backup fails unless you uncheck that box. 5. Select a designated backup location. 6. Press Schedule. Configuration and Administration Guide 183

190 Database Recovery! Note: Before running the recovery, the BoxTone database recovery will delete all data within the database and restore it with the data in the backup files. To recover the database files: 1. Ensure that a full backup set is stored locally on the server. File names can be found in the table on page 182. Make sure all files were created during the same backup run so they are synchronized. 2. Stop all BoxTone services on the application server. 3. Set your working directory to the directory which contains the recovery files:<%boxtone InstallDirectory>\utilities\BT-DB-BR\recovery. 4. Run the following command to start the recovery process: imp_boxtone.bat <BACKUPLOCATION> BoxTone _DP_MD<DATE>.DMP BoxTone _DP_DATA_<DATE>.DMP <BoxTone ORACLE USER PASSWORD> 5. Where <BACKUPLOCATION> is replaced with the directory that contains the backed up data and <DATE> is replaced with the date contained within the backup files. For example:imp_boxtone.bat E:\BoxTone Data BoxTone _DP_MD09_01_2008.DMPBoxTone _DP_DATA_09_01_2008.DMP BoxTone The recovery time may take up to three hours depending on the amount of data being restored. Upon completion, a success message will open. 6. Restart the BoxTone services. Configuration and Administration Guide 184

191 Using the Tune.exe Utility 1. Login to the Good MSM application server using the service account 2. Tune.exe is installed on Good MSM and can be found by navigating to the following location (in dual server configurations, it can be found on the Application Server) \BoxTone\utilities\tuning 3. Based on the Database server s total RAM, choose from 8G_DB.ini, 16G_DB.ini, 32G_DB.ini,64G_ DB.ini, or 128G_DB.ini and edit as necessary.! Note: The tuning files contain the recommended base settings. Modifications to any parameter without consulting Good Support may result in an inoperative system. Please contact Good Support for additional assistance. 4. Open a CMD window using the Run as Administrator option and CD to \BoxTone\utilities\tuning 5. Execute the following: 6. Tune.bat <config>.ini (where <config> is 8G_DB or 16G_DB, etc)! Note: Running Tune.exe will shut down all MSM application services, make the necessary configuration changes and then restart the MSM application services. 7. Copy db.sql to a temporary location on the MSM Database server 8. Copy extenddbf.sql to the \BoxTone\database directory on the Good MSM Database server. You may overwrite the existing file. 9. Right-Click on \BoxTone\Utilities\BTServices\BoxToneServices.exe and Run as administrator 10. Click the Stop BoxTone Services button 11. Login to the Good MSM database server using the service account 12. Open a CMD window using the Run as administrator option and CD to the temporary location containing db.sql 13. Enter the following commands: 1. SET ORACLE_SID=boxtone 2. Sqlplus /nolog 3. Connect / as sysdba 5. Sqlplus /nolog 6. Connect / as sysdba 7. Startup; 8. Exit 14. From the same CMD window, change directory (CD) to the \BoxTone\database directory 15. Run ExtendDBF.bat 16. Login to the Good MSM application server using the service account 17. Right-Click on \BoxTone\Utilities\BTServices\BoxToneServices.exe and Run as administrator 18. Click the Start BoxTone Services button 19. If any settings have been adjusted, run Tune.bat again to apply changes. Configuration and Administration Guide 185

192 GetBTLogs Utility GetBTLogs is used to collect the log and config files for the major components of BoxTone. To use GetBTLogs to collect log files: 1. Navigate to the \\boxtone\utilities\getbtlogs directory 2. Run the GetBTLogs.exe as administrator 3. Select All Logs or Latest Logs! Note:If Latest Logs is selected, log files will only be collected for the number of days that you specify.! Note: If All Logs is selected, only 30 days worth of entries for the Application and System event logs will be collected (if so chosen) 4. Select whether you want to include Config Files 5. Select the components you would like to collect logs for 6. Supply an Output Location (or use the browse button)! Note The utility requires 5g of free disk space in the location you specify for the output! Note: If you select all logs for all days, 10g of free disk space will be required for the utility to run. 7. Select Auto FTP to have the created zip file automatically uploaded to the BoxTone FTP site! Note: ZIP file must be under 500mb for this option to work. You must provide an address to use the Auto FTP option. 8. Select Get Logs 9. The log files will be collected to the location specified and compressed once complete! Note: If 7zip does not exist in the expected location, the collected files will be left in the directory specified in the Output Location. 10. As the utility is run, new ZIP files will be created. Be sure to delete previous ZIP files to conserve disk space Configuration and Administration Guide 186

193 To use GetBTLogs to clear log files: 1. Switch the radio button to All Logs 2. Uncheck the Include Config Files checkbox 3. Select the checkboxes for the components that you want to clear the logs for 4. Click the Clear Logs button. You will be warned that all logs for the specified module will be permanently deleted.you will also be instructed to stop services before proceeding. Once logs are cleared, you will be prompted to start ALL BoxTone and Oracle services. Configuration and Administration Guide 187

194 BTCertificates BTCertificates is used to create keys and CSRs for APNs, USS, Enrollment, and Core. CSRs and keys are used to get signed certs from third party signing authorities or an internal signing authority. In addition the utility can be used to convert a PEM file to a P12 file as is needed for the APNs certificate. To begin using the BT Certificates utility perform the following: 1. Navigate to the \BTCertificates directory 2. Run BTCertificates.exe as administrator To create a CSR file perform the following: 3. Choose the radio button for the type of CSR you are looking to create (APNs, Enrollment, USS, or Core) 4. Fill out the appropriate fields 5. Enter a location to output the CSR 6. Click the Create button To convert a PEM file to a P12 file perform the following: 1. Enter the location for the PEM file 2. Enter the location for the APNs Key file 3. Enter the password for the P12 file 4. Confirm the password for the P12 file 5. Click the Convert button.! Note: P12 files will be created in the same directory where the PEM file is located Configuration and Administration Guide 188

195 Configuration and Administration Guide Version Copyright 2015 by Good Technology. All rights reserved. Trademarks Good is a registered trademark of Good Technology Incorporated. Microsoft and Microsoft Windows are registered trademarks of Microsoft Corporation. All other product names used are trademarks of their respective owners. Notice The material in this document is for information only and is subject to change without notice. While reasonable efforts have been made in the preparation of this document to assure its accuracy, Good Technology Inc. assumes no liability resulting from errors or omissions in this document, or from the use of the information contained herein. Good Technology Inc. reserves the right to make changes in the product design without reservation and without notification to its users. Edition July Mobile Service Manager