Intellipool Network Monitor Intellipool AB

Transcription

1 Intellipool Network Monitor 3.0

2 Intellipool Network Monitor All rights reserved. No parts of this work may be reproduced in any form or by any means - graphic, electronic, or mechanical, including photocopying, recording, taping, or information storage and retrieval systems - without the written permission of the publisher. Products that are referred to in this document may be either trademarks and/or registered trademarks of the respective owners. The publisher and the author make no claim to these trademarks. While every precaution has been taken in the preparation of this document, the publisher and the author assume no responsibility for errors or omissions, or for damages resulting from the use of information contained in this document or from the use of programs and source code that may accompany it. In no event shall the publisher and the author be liable for any loss of profit or any other commercial damage caused or alleged to have been caused directly or indirectly by this document. Printed: januari 2006 in Härnösand, Sweden

3 Contents I Table of Contents 0 Part I Introduction 2 1 Copyright notice End user license... agreement 4 Part II Before you install 8 1 Calculating memory... usage 9 2 Software and... hardware requirements 10 3 Service logon... account 11 4 GSM Modem/Phone... configuration 12 Part III Running the startup guide 17 1 Step Step Step Step Configuration... done 21 Part IV Basic usage 23 1 Login page The index page Networks, objects... and monitors 26 4 Entering the... license key 26 5 Creating an object Adding monitors... to an object 30 7 Configuring an... action list 33 8 Object information... page 33 9 Monitor information... page Dependency... tree 37 Part V Advanced topics 41 1 Account manager Auto scan Compiling custom... MIB files 42 4 Operator and... operator groups 44 5 Program settings Schedules Maintenance schedule I

4 II Intellipool Network Monitor Event schedule... Operator schedule System administration Change web interface... port number Enable secure... HTTP Enabled/disable... testing, actions or statistical storage Init.cfg parameters... Restrict access... to web interface Safely shutting... down INM Setting system... administrator message System logging Working with... object templates 62 9 Reports Customized reports... Report templates... Quick reports Part VI Monitor reference and configuration exampels 1 Bandwidth monitor CPU load monitor Example DHCP monitor Disk size monitor DNS monitor Environment... monitor 75 7 Event log monitor Example File check monitor Example FTP monitor HTTP monitor ICA monitor IMAP4 monitor INM monitor LDAP monitor Lua script monitor Mail QOS monitor Memory usage... monitor 89 Example Network interface... load monitor NNTP monitor ODBC monitor Example Ping monitor POP3 monitor... 96

5 Contents III 23 Process monitor RDP monitor Sensatronics... device monitor Service monitor SMTP monitor SNMP monitor Example SNMP trap monitor SSH2 monitor SSH2 script... monitor Swap size monitor Syslog monitor TCP port monitor Telnet monitor Temptrax monitor Text file scan... monitor TFTP monitor Windows performance... monitor 115 Example... Part VII Action reference Clear event... log Execute command... via SSH Execute Windows... command HTTP Get/Post List reset Net Send Paging via PageGate Send mail SNMP Set Send SMS Wake-on-LAN Windows service... control 123 Part VIII Distributed testing Communication... between server and gateway Time synchronization Server configuration Gateway configuration Assigning objects... to a gateway Auto scan III

6 IV Intellipool Network Monitor 7 Action lists Troubleshooting Part IX LUA Index 133 0

7 Section I

8 2 1 Intellipool Network Monitor Introduction Welcome to the Intellipool Network Monitor documentation. This document is written for the experienced system administrator who is familiar with Windows, Unix, networking and monitoring technologies. In this documentation we will refer to Intellipool Network Monitor with the abbreviation INM. This documentation covers the following editions of Intellipool Network Monitor.

9 Introduction Copyright notice Intellipool Network Monitor Copyright Intellipool AB. SSH2 support powered by sshlib, Copyright (C) by Bitvise Ltd, portions Copyright (C) by Wei Dai. All rights reserved The software contains proprietary information of Intellipool AB; it is provided under a license agreement containing restrictions on use and disclosure and is also protected by copyright law. Reverse engineering of the software is prohibited. Due to continued product development this information may change without notice. The information and intellectual property contained herein is confidential between Intellipool AB and the client and remains the exclusive property of Intellipool AB. If you find any problems in the documentation, please report them to us in writing. Intellipool AB does not warrant that this document is error-free. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopying, recording or otherwise without the prior written permission of Intellipool AB. Intellipool AB PO. Box 277 SE Härnösand Sweden +46 (0) Website:

10 4 1.2 Intellipool Network Monitor End user license agreement This license agreement is a binding contract between you (natural person or legal entity) and Intellipool AB, and applies to the software product from Intellipool AB specified above. By installing, producing copies or otherwise using this software, you are accepting the terms of this license agreement, and thereby consenting to be bound by it. If you do not accept the terms of this license, you are not entitled to install or use this software. 1. Licensed Product The Licensed Product consists of the software program in a machine-readable form, including specifications and other electronic documentation, as indicated above. 2. Grant of license This License Agreement gives the licensee a non-exclusive right to use the Licensed Product pursuant to the terms and conditions of this Agreement. 3. License fee The rights granted under this License are conditioned on the licensee having paid the license fee for the Licensed Product, pursuant to the terms and conditions applied by the licensor at the time in question. 4. Free versions of the software The terms and conditions of this license agreement shall also apply to users who are given access to the free version of the software product supplied by the Licensor. 5. Scope of the License The Licensee shall be entitled to install one copy of the Licensed Product on a single computer, which is used to provide users within the organisation of the Licensee with access to the functions of Licensed Products. A few copies of the Licensed Product may be made for security- and archive-related purposes. Copies of the Licensed Product produced in this manner shall be subject to the terms and conditions of this Agreement. The Licensee may not, by itself or through another, use, copy or otherwise transfer or use the Licensed Product, in whole or in part, other than as set forth in this License Agreement. The Licensee may not, by itself, nor through another, discover, decompile or otherwise use the code to the Licensed Product to any extent not expressively allowed pursuant to law. The Licensee may not, directly or indirectly, with or without consideration, sublicense, lease, lend or otherwise allow anyone but the Licensee to control or use the Licensed Product. Production of copies of the Licensed Product for private use is thus not allowed. The assignment of any and all rights pursuant to this License Agreement may only be done with the written consent of the Licensor. 6. Licensor s right to the Licensed Product The rights granted by this license shall not be construed to mean that the Licensor s rights, including copyright and patent rights, where applicable, to the Licensed Product are being transferred to the Licensee. Nor do the rights granted by this license mean a transfer to the Licensee of title to the Licensed Product or to the medium on which the Licensed Product

11 Introduction 5 are made accessible to the Licensee. 7. The Licensee s duty to inspect and right to rescind The Licensee, upon receiving the Licensed Product, has an obligation to check its functions and quality. If the Licensee finds that the Licensed Product do not fulfil the functions specified by the Licensor in the documentation included with the Licensed Product pursuant to section one, the Licensee shall be entitled to rescind the License Agreement. This right to rescission is conditioned upon the Licensor receiving a written notice within thirty (30) days of the date of delivery. In the case of a rescission, the Licensor shall immediately refund the license fee. The Licensee shall not have the right to interest on this amount. In the event the Licensed Product has been sold through a distributor, the distributor shall be responsible to effect a refund of the license fee. 8. Right to cure defects, etc. The Licensor shall cure deviations from the software specification of the Licensed Product, provided that the deviations affect the use of the Licensed Product to a significant degree. The Licensor may, in conjunction with this, choose to upgrade the Licensee s version of the software. 9. Limitation of liability Beyond what is stipulated in the above provisions, the Licensor shall have no liability for the functioning or quality of the Licensed Product, since any defects are fully regulated through this Agreement. Thus, the Licensor shall not be obligated, under any circumstances, to pay damages on account of a defect in the Licensed Product. In addition, the Licensor shall have no liability for damage or injury, whether direct or indirect, which may have been sustained by the Licensee, regardless whether such damage or injury consists of lost revenues or additional expenses, such as lost or damaged data or the liability to reimburse a third party. 10. Confidentiality The Licensed Product contains business and trade secrets belonging to the Licensor. These have been made accessible to third parties only through this License Agreement. The Licensee is therefore under an obligation not to make the Licensed Product accessible to others without the written consent of the Licensor, and to take all reasonable actions to prevent third parties from accessing the business and trade secrets that the Licensed Product contain. The licensee is responsible for ensuring that the relevant staff receive instruction in this matter, and are obligated to abide by the rules for using the Licensed Product. The Licensee s obligation to maintain confidentiality shall continue to apply after the right to use the Licensed Product pursuant to this Agreement ceases due to cases of rescission or termination, or through assignment. The obligation to maintain confidentiality continues for a period of five years. In the case of copies maintained on file, pursuant to law, the obligation to maintain confidentiality shall continue as long as the Licensee shall keep the copy on file. The Licensee shall be obligated to store Licensed Product in a secure manner during the

12 6 Intellipool Network Monitor period of the license, so as to prevent dissemination of the Licensed Product. 11. Damages, etc. In the event the Licensee shall violate any term of this Agreement that is of material importance to the Licensor, the Licensee shall indemnify the Licensor for its damage, regardless of whether or not the Licensor shall choose to rescind this Agreement. If, as a result of the breach of contract, an unauthorized person shall gain access to information regarding all or part of the Licensed Product, and this shall adversely affect the opportunities of the Licensor to market and grant licenses for the Licensed Product, the damage in each individual case shall be deemed to be equal to five Basic Amounts for National Insurance, unless damage in excess of that amount is proved. If the Licensee s breach of contract consisted of producing unauthorized copies, or parts thereof, the Licensee shall not only be obligated to pay the license fees for the unauthorized copies produced, but shall also be obligated to compensate the Licensor for any additional damage or injury. 12. Term of the License, termination Upon payment of the license fee, the rights granted under this license shall continue indefinitely. At any time during the term of this license, the Licensee shall be entitled to terminate this Agreement. This termination shall not entitle the Licensee to a refund of any part of the license fee paid. The Licensor shall be entitled to terminate this License Agreement upon immediate notice in the event the Licensee shall violate any of the terms of the Agreement. The rights granted under this license shall automatically terminate when the Licensed Product is no longer in the possession of the Licensee. Upon the termination of this Agreement, the Licensee shall be obligated to immediately destroy the Licensed Product, including both the software itself and copies thereof and the specifications and other documentation. 13. Publicity The Licensed Product may be distributed through one or more distributors, in one or more countries throughout the world (each a Distributor, and collectively, the Distributors). By clicking the 'I Accept' button, installing, copying or otherwise using copies of the Licensed Product, Licensee grants INTELLIPOOL and the Distributors a limited, revocable, non-exclusive right and license to use Licensee s trademarks, tradenames and tradedress for the sole purpose of informing the public that Licensee uses the SOFTWARE, so long as the Licensee continues to use the Licensed Product and/or has not revoked such license in writing. 14. Disputes Disputes regarding the interpretation and/or application of this Agreement shall, in all cases, be determined by a Swedish court according to Swedish law.

13 Section II

14 8 2 Intellipool Network Monitor Before you install We recommend that you complete the following pre-installation checklist before installing INM. 1. Make an estimation of the number of objects and agents INM will monitor and using the numbers provided in the "Memory usage" section, calculate the estimated memory usage of INM. Check that the host machine has enough free memory to run INM. 2. Check that the host machine meets the software and hardware requirements. 3. Make sure that a Windows account to be used by INM have the right privileges 4. If SNMP will be used, install and start the Windows SNMP service on the INM host machine 5. If ODBC logging will be used, create a ODBC system data source on the INM host machine. 6. If a GSM phone will be used, install it and verify that it is responding correctly with a terminal program When completed you are ready to install INNM. After installing INM and connecting to the web interface for the first time, consult the chapter "Running the startup guide 17 ".

15 Before you install Calculating memory usage To calculate the average agent/object memory usage the following numbers can be used. Type Size (bytes) Agent 2048 Agent statistical data Object 512 The INM executable consumes 13 mb. Example This example assumes 2 active data inputs per agent. To estimate the memory need of a 1000 agent, 100 object INM installation. Agent size = 1000 x ( (16000 * 2)) = 33.2 mb Object size = 100 * 512 = = 50 kb INM executable = 11 mb Total memory consumption 33.2 mb + 11 mb + 50 kb = Mb This value does not include error logs and other parameters.

16 Intellipool Network Monitor Software and hardware requirements Recommended software and hardware requirements Operating system Windows 2000 SP 4, Windows 2003 or Windows XP with the latest service pack Hardware Intel Pentium III 800 MHz or AMD Athlon/Duron 800 MHz 128 Mb memory 20 Mb free disk space Network interface card Browser supported Microsoft Internet Explorer 6.0 with SR1 or greater Opera 6.0 or greater Firefox 1.0 or greater The following features must be enabled in your browser settings. Accept third party cookies Java script enabled Cookies are needed to keep track of the user session. Java scripts are used by the web interface and must be enabled.

17 Before you install Service logon account INM executes as a Windows service on the host machine and must be granted a Windows account with permission to access other Windows machines. We recommend that a special user account is created for the INM service, the account must have permission to access the following items on a remote machine. The following rights must be granted the new account 1. Act as part of operating system 2. Allow log on locally 3. Log on as a service 4. Profile system performance 5. Profile single process The account password should be set to Password never expires. To verify that the account can access the resources need for INM to operate follow these steps. 1. Login on the INM host machine with the account created for INM 2. Start Perfmon.exe 3. Try to add a counter from a remote machine you wish to monitor with INM 4. If step 3 works continue with next step, otherwise check the account settings an begin from step 1 5. Open a file explorer window and try to access a default share of the machine you wish to monitor by typing the UNC path (e.g. \\remotemachine\c$) 6. If you are asked to enter a user name and password to gain access you need to check the account settings and begin from step 5. When the account have passed the test above configure the INM service to use that account instead of the local account.

18 Intellipool Network Monitor GSM Modem/Phone configuration The action Send SMS can send an SMS through a GSM modem connected to the INM host machine. You will need to configure INM to use the GSM modem before you can use this action. 1. Open the program settings page 2. Select the serial port the GSM modem is connected to. 3. (Optional) Enter the PIN code to unlock the SIM card 4. Click on the "Save" button to store the new settings. Most current GSM modems/phones that supports text mode SMS can be used with INM. GSM modem installation checklist 1. Connect the phone cable to one of the INM host computers serial ports 2. Install the modem driver for your phone (if needed) 3. With a terminal program connect to the phone. 4. Try to send a SMS by typing the following ATZ AT+CMGF=1 AT+CMGS= PHONENUMBER INM SMS TEST Press CTRL-Z 5. The SMS should now be sent, remember to replace PHONENUMBER with the number of the receiving phone and keep the quote signs (e.g ). On the last line you should press the CTRL-Z key combination. 6. The phone should answer with CMGS followed by a number indicating the ID of the sent SMS. 7. The phone is now ready for use by INM. CMS Error codes 8 Operator determined barring 10 Call barred 21 Short message transfer rejected 27 Destination out of service 28 Unidentified subscriber

19 Before you install 29 Facility rejected 30 Unknown subscriber 38 Network out of order 41 Temporary failure 42 Congestion 47 Resources unavailable, unspecified 50 Requested facility not subscribed 69 Requested facility not implemented 81 Invalid short message transfer reference value 95 Invalid message, unspecified 96 Invalid mandatory information 97 Message type non-existent or not implemented 98 Message not compatible with short message protocol state 99 Information element non-existent or not implemented 111 Protocol error, unspecified 127 Interworking, unspecified 128 Telematic interworking not supported 129 Short message Type 0 not supported 130 Cannot replace short message 143 Unspecified TP-PID error 144 Data coding scheme (alphabet) not supported 145 Message class not supported 159 Unspecified TP-DCS error 13

20 14 Intellipool Network Monitor 160 Command cannot be actioned 161 Command unsupported 175 Unspecified TP-Command error 176 TPDU not supported 192 SC busy 193 No SC subscription 194 SC system failure 195 Invalid SME address 196 Destination SME barred 197 SM Rejected-Duplicate SM 198 TP-VPF not supported 199 TP-VP not supported 208 D0 SIM SMS storage full 209 No SMS storage capability in SIM 210 Error in MS 211 Memory Capacity Exceeded 212 SIM Application Toolkit Busy 213 SIM data download error 255 Unspecified error cause 300 ME failure 301 SMS service of ME reserved 302 Operation not allowed 303 Operation not supported

21 Before you install 304 Invalid PDU mode parameter 305 Invalid text mode parameter 310 SIM not inserted 311 SIM PIN required 312 PH-SIM PIN required 313 SIM failure 314 SIM busy 315 SIM wrong 316 SIM PUK required 317 SIM PIN2 required 318 SIM PUK2 required 320 Memory failure 321 Invalid memory index 322 Memory full 330 SMSC address unknown 331 No network service 332 Network timeout 340 NO +CNMA ACK EXPECTED 500 Unknown error 512 User abort 15

22 Section III

23 Running the startup guide 3 17 Running the startup guide After installing INM and connecting to the web interface for the first time the startup guide will help you get INM ready for usage. A link to the web interface can be found in the Intellipool Network Monitor program folder in the start menu. 3.1 Step 1 Administrator settings 1. Enter the account information of the default INM operator. Enter the username and password of the operator, note that the username and password is case sensitive. Optionally configure an address for this operator, the address will be used when INM is sending alarm notifications or reports. 2. Clicking next will create the default operator that you will use to logon to INM after completing the startup guide. Step one of the setup guide

24 Intellipool Network Monitor Step 2 Automatic network detection 1. INM can automatically detect objects in your network. The automatic network detection process will start as a background process and will take about 10 minutes to complete depending on the network setup. 2. You can optionally specify a Windows account if the INM service account does not have sufficient access rights. 3. If you want to skip this step, uncheck the "Auto detect my network" checkbox and click "Next" to continue. Step two of startup guide

25 Running the startup guide Step 3 Mail settings 1. In order to send alerts, reports and other messages you need to configure the server settings. Two servers can be configured, a primary server and a secondary backup server that will be used in case the primary server is unreachable. Optional authentication can be configured both for the primary and secondary server. 2. If you want to skip this step and configure these parameters later click "Next" to continue. Step three of the startup guide

26 Intellipool Network Monitor Step 4 Confirmation 1. The final step of this startup guide is confirming the information you have filled in previous pages. If you want to change any of the information, click on the "Previous" button to go back. Note that once the automatic network detection is started you will not be able to go back to that page. 2. By clicking on the "Finish" button you will be redirected to the login page and asked for the username and password that you entered in the first page. Final step of the startup guide

27 Running the startup guide Configuration done The basic configuration of INM is now completed. If you started an auto detection of your network it will run in the background. INM will now redirect you to the login page.

28 Section IV

29 Basic usage 4 23 Basic usage This section describes the basic ways of working with INM. It is designed as a "How-To" guide and is organized roughly in the order that you would perform the tasks. The topics in this section are intentionally kept as brief as possible. The focus is on how to do what you need to do. More detailed information on many subjects is provided in the Advanced topics section and in other areas.

30 Intellipool Network Monitor Login page Open the login page by clicking on "Open Intellipool Network Monitor" in the program group "Intellipool network monitor" on the start menu. Make a note of the URL that is displayed in the browser if you need to access the web interface from another computer. Enter the username and password of the operator created in the startup guide and click the "Login" button to proceed to the index page. The login page

31 Basic usage The index page The index page is shown after a successful login. It contains system status-information and the latest messages in the system log. At the top of the page several menus are displayed. Index page Settings menu The Settings menu contains links to pages associated with system wide configuration. Such as the system administration page where you can enter the license key. Networks, objects and monitors menu These contains links to browse and create new networks, objects and monitors. In the following section called "Networks, objects and monitors" the relation between these different entities are described in detail. Help menu The help menu contains links to the documentation you are reading now as well as links to the Intellipool forum and knowledge base. My settings The My settings page contains settings private to the currently logged on operator, such as page refresh time and contact information. Logout Clicking on the Logout link will end the user interface session.

32 Intellipool Network Monitor Networks, objects and monitors Networks, objects and monitors are associated in a hierarchy where networks is the top most entity, followed by objects and then monitors. Networks Networks is an organizational unit that collects objects into logical groups. Networks can be compared with folders in a file system. Objects An object represents a computer or other any other device that can be addressed by an IP number or host name. An object contain settings that are common to all monitors. Object templates An object template serves as a base model for other objects. Object templates are not counted as real objects in the license quota. Monitors A monitor tests a specific function in an object. For each test, a monitor is capable of recording statistical data and if the test fails it can trigger an alarm. If a monitor fails a test it will first enter failed state. After a number of consecutive failed tests it will enter alarm state. When entering alarm state the monitor will execute a number of actions specified in something called the alarm action list. 4.4 Entering the license key The license key is entered in the System admin page. The System admin page can only be accessed by operators that have the system admin flag set in the operator property page.

33 Basic usage 27 System administration page 1. Open the system admin page 2. Enter the license key into the license key field. 3. Press the validate button If you get a message that the license key in invalid please check that you entered the license key correctly. If you get a message stating that the license key have expired, you will need to renew the license key.

34 Intellipool Network Monitor Creating an object As described previously an object is the representation of a workstation, server or some other network capable device. Each object contains information that its monitors will use, such as IP address or host name. To create a new object click on "new object" in the object menu and select the "New empty object" template. Object property page Enter the basic information about the object as outlined in the table below, leave all other parameters. Click save to create the object. Basic object properties Name Name of object. Address The address of the object. IP number or any name that can be resolved by a DNS.

35 Basic usage System type Select an operating system type. If unknown choose the "Unknown" type. Selecting the correct OS type is especially important for using all Unix monitors. Description Description of the object. Free text This is a free text field that can contain information about this object such as placement or administrator. It's possible to have this text included in alarm s. Network Select the network that this object should be a member of. The default network is selected by default. 29

36 Intellipool Network Monitor Adding monitors to an object After creating an object you will be redirected to the object information page. From the object information page you can add a new monitor to the object. To add a new monitor click "New monitor" in the monitor list section in the page. Monitor selection page Select the type of monitor you wish to add to the object and click the "Ok" button. The first time you add a new monitor it's important that you only select one monitor from the list. A more advanced usage of this page is selecting several monitor types and then configuring and activating each separably. After clicking on the "Ok" button, you will be directed to the monitor property page where you can configure the monitor.

37 Basic usage 31 Monitor property page Review the properties outlined in the table below and leave all other values to their default settings. When you are done editing the monitor properties click on the "Save" button to add the Monitor. Note that the image above only shows the generic and advanced properties of the monitor. Depending on which Monitor you selected, Monitor specific properties will also be shown. Field Required Description Name Yes Display name of the monitor Test interval Yes Time in second between tests Alarm generation Yes How many consecutive failed tests until the first alarm is generated

38 32 Intellipool Network Monitor Alarm delay Yes Time in seconds between tests while the agent is in alarm state.

39 Basic usage Configuring an action list An action list is composed of one or more actions that can be executed when a monitor enters, or exits, alarm state. An action list can be used in two different ways. Alarm action list Alarm action lists are assigned to objects (and possibly monitors) and works as a "to-do" list in event of an alarm. Each action in the list has an alarm number and is executed when the alarm number of the monitor equals its alarm number. The alarm number is simply how many times an monitor has failed a test since the first alarm was triggered. Restart action list Restart action lists are optional, but can be assigned to objects and also monitors. The actions in a restart list are executed when a monitor switches from alarm state to ok state. The alarm number of the actions does not matter. All actions in the list are executed in a sequence. Example of an action list for a Windows service monitor 1. Send to operator group 2. Send SMS to operator 3. Restart service 4. Send to operator. Action list example In our example, each action is placed on a different alarm number. This makes it possible to configure an action list that escalates its efforts to correct the situation. Note that it's not at all necessary to have a separate action list per object. You can, and will probably use, the same action list for many objects while in some situations you will want to use a specific list for a particular object or monitor. 4.8 Object information page The object information page shows information and the status of an object. This page can be accessed from the object list or the network information page by clicking on the name of the object. There are links to different functions in the "Object information" section that can

40 34 Intellipool Network Monitor be used to perform common tasks for this particular object. Object information page Deactivate/Activate Deactivate or activate testing for all monitors that belongs to the current object. If the object is deactivated, it will "gray out" the status icon of the object. Delete Deletes the object and all monitors contained in the object. Make template Makes a copy of the object and converts the copy into a object template. Properties Opens the object property page. Search log Shows log information for this object.

41 Basic usage Monitor information page The monitor information page shows the status of a single monitor. This page can be accessed from the monitor list or the object information page by clicking on the name of the monitor. Monitor information page Current status The current status sections shows the result of the latest test. If the test failed detailed information describing the reason for the failure will also be displayed in this section. Real-time graphs The real-time graphs shows recent sampled data from the monitor. The graph time span is configurable from the monitor properties page, and can range from 12 hours to 1 month. Properties Opens the monitor property page. Test now The "Test now" command forces the monitor to be tested immediately. Deactivate/Activate Deactivate or activate monitor tests. If the monitor is deactivated, it will "gray out" the status

42 36 Intellipool Network Monitor icon of the monitor. Search log Shows log information for the current monitor. Delete Deletes the monitor.

43 Basic usage Dependency tree Monitors can be organized into dependency trees when you want to test monitors in a specific order. The dependency trees makes sure that only the first monitor to enter alarm state will execute its alarm action list. Dependency trees can be useful when you want to test a chain of monitors, and you want the most significant monitor to send the alarm and not the following monitors in the chain. Creating a dependency tree is very simple, and is done by first selecting one or more monitors you want to be dependant on another monitor and clicking on the "Create dependency" link in the header. This can be done from the Monitor list page. Monitor list page In the next page you will choose one monitor that the previously selected monitor(s) will be dependant of. INM will automatically create a dependency tree for you when you click the "ok" button.

44 38 Intellipool Network Monitor Select monitor selection page The completed dependency tree shows the order of testing by indenting the monitors in levels. Each level will be tested separately, and testing of a level will stop if its dependent monitor enters alarm state.

45 Basic usage Finished dependency tree 39

46 Section V

47 Advanced topics 5 41 Advanced topics This section describes more advanced features of INM. 5.1 Account manager The account manager is the central repository that holds all logon information needed by the monitors. Both Windows accounts and other accounts used by the SSH2 client can be managed by the account manager. Its only needed to assign an account to a Windows monitors if the service account that INM is executing under does not have the proper access rights to perform the test. Permission to create, modify and delete accounts Only operators with account modify permission can change, delete or create new accounts. This setting is adjusted in the operator settings page. Permission to assign accounts Permission is based on what operator group is assigned to the account. The operator need to be a member of the operator group that the account is assigned to in order to use the account. An account is only visible to the operator group that its assigned to. The account can only be used with monitors assigned to the same operator group. 5.2 Auto scan Auto scan is a process that can automatically detect objects and add monitors. To speed up the auto scan process the IP number is first tested by sending a ping. If the remote host does not respond to a ping message the IP number will not be considered. To start an auto scan, open up the network information page of the network you wish to add the detected objects to. Click on the "auto scan" command in the header.

48 42 Intellipool Network Monitor Auto scan page 1. Enter the sub net and the IP range 2. Select the type of monitors you wish to include in the auto scan, reducing the number of monitor types selected will significantly reduce the time it takes to scan the selected IP range. 3. Click "Yes" to start the auto scan. Note that the auto scan will run in the background and you can continue to use the interface while it completes. 5.3 Compiling custom MIB files In the "Intellipool Network Monitor" program group in the start menu you can find the INM MIB compiler. Using the MIB compiler you can compile text MIB file into the binary format that INM can read. Compiling MIB files requires understanding how they are organized and relates to each other. A number of different RFC documents outline the fundamental base all other MIB files are drawn from. This is an example of the compile order of a CISCO product MIB. 1. SNMPv2-SMI.mib 2. SNMPv2-TC.mib 3. SNMPv2-MIB.mib 4. RFC1213-MIB.mib 5. IF-MIB.mib 6. CISCO-SMI.mib 7. CISCO-PRODUCTS-MIB.mib

49 Advanced topics CISCO-TC.mib The first 5 files in this example are common for most product MIB files and are included in the default INM binary MIB file. All of these files need to be compiled on the same time, otherwise the MIB compiler will fail due to unresolved symbols. Contents of the default INM MIB file The default INM MIB file that is included in the installation contains the following base OID (Object Identifier). iso.org.dod.internet.directory iso.org.dod.internet.mgmt iso.org.dod.internet.experimental iso.org.dod.internet.private iso.org.dod.internet.security Compiling a MIB file Intellipool MIB compiler 1. Start Intellipool MIB compiler and click on the "Load" button. 2. Locate the default INM MIB file in the mibs directory and double click on it. 3. Check the box "Use base mib when compiling".

50 44 Intellipool Network Monitor 4. Click the "Compile" button and select your text MIB files 5. When the compile is finished save the file in the INM mibs directory and restart INM. It's recommended that you use the browse function to review the compiled MIB before saving it into the mibs directory. 5.4 Operator and operator groups Operators can be a member of one or more operator groups. Objects are assigned an operator group, and this group will receive notifications in the event of an alarm condition monitors in that object. Operator and access control Each operator have a set of access flags that determine what the operator is allowed to view and edit. It's possible to partition INM so that one operator can't access another operators objects, networks or reports. By checking the "Group object" flag the operator will only be able to access objects that are assigned to the operators group. 5.5 Program settings GSM phone COM port If you want to use the Send SMS action you need to connect a GSM phone to the INM host machine. The selection list shows the current com ports installed on the INM host machine. Select the com-port that the phone is attached to. PIN Code Optional PIN code field. Some GSM phone requires INM to send the PIN code before sending a message. Enter the 4 digit PIN code in this field. SMTP server The SMTP server is used when sending notifications to users. Enter the address to the SMTP server you want to use. Note that the SMTP server must be able to accept all the addresses you are planning to use. This is the primary SMTP server that normally will be used. SMTP Server username and password Username and password for the primary SMTP server, if authentication is required. SMTP server 2 The secondary SMTP server is used when INM cannot connect to the primary SMTP server. SMTP Server username and password Username and password for the secondary SMTP server, if authentication is required. Return address Most SMTP servers are configured to only accept incoming s with a valid return address. Since INM is unable to receive s you must define an account that can receive

51 Advanced topics 45 s that could not be delivered. SMTP HELO ID If needed, a custom HELO identifier can be specified for the SMTP servers here. Test interval The default test interval in seconds. INM will use this value as the default test time for agents created with auto scan and will be inserted in the "Test interval" field when you create a new agent. Alarm generation The default alarm generation count. INM will use this value as the default alarm generation count for agents created with auto scan and will be inserted into the "Alarm generation" field when you create a new agent. Alarm delay The default alarm delay in seconds. INM will use this value as the default alarm delay time for agents created with auto scan and will be inserted into the "Alarm delay" field when you create a new agent. Alarm message The default alarm message setting enables you to customize the information sent to an operator upon an alarm. Into the text you can insert flags that are expanded when the message is sent. %T Current time %O Object name %O2 Object free text field. This can contain custom information such as documentation link. %D Object destination/address %A Monitor name %E Monitor alarm message %E2 Monitor alarm message without timestamp %L Distribution list %X Dependency tree status %S Object description %N Network name

52 46 Intellipool Network Monitor %G Include real-time chart in mail (if available) %K The most recent time the agent was ok %F The most recent time the monitor was in alarm state %R Operator group of the monitor object %I Network contact information Restart message The default restart message setting enables you to customize the information sent to an operator upon a restart of an agent. Into the text you can insert flags that are expanded when the message is sent. %T Current time %O Object name %O2 Object free text field. This can contain custom information such as documentation link. %D Object destination/address %A Monitor name %E Monitor alarm message %E2 Monitor alarm message without timestamp %L Distribution list %X Dependency tree status %S Object description %N Network name %K The most recent time the agent was ok %F The most recent time the monitor was in alarm state %R Operator group of the monitor object

53 Advanced topics %I Network contact information %C Status report for latest test performed 47 Acknowledge message The default acknowledges message enables you to customize the message sent to other operators when you acknowledge an alarm. Into the text you can insert flags that are expanded when the message is compiled and sent. %T Current time %O Object name %D Object destination/address %A Monitor name %N Network name %S Object description %P Current operator, the operator who acknowledged the alarm Alarm subject The default alarm subject enables you to customize the subject line in the message sent upon an alarm. Into the subject line you can insert flags that are expanded when the message is sent. %T Current time %O Object name %D Object destination/address %A Monitor name %N Network name Restart subject The default restart subject enables you to customize the subject line in the message sent upon a restart. Into the subject line you can insert flags that are expanded when the message is sent. The restart subject line can use the same flags as the alarm subject line. Acknowledge subject The default acknowledge subject enables you to customize the subject line in the

54 48 Intellipool Network Monitor message sent upon acknowledge of an alarm by an operator. Into the subject line you can insert flags that are expanded when the message is sent. The acknowledge subject line can use the same flags as the alarm subject line. Syslog server Check this flag to start the internal syslog server. The server will start (or stop) when you save the settings. The internal syslog server must be started before using syslog agents. Syslog server port The port number the syslog server will listen on for syslog messages. If the server already is running you need to stop and start the server to apply the new port number. Syslog server PTTL (Packets time to live) The syslog server stores the entire syslog message for a period of time so the syslog agents can fetch the messages from the server when they are tested. The packet time to live value should be greater than the test time of all the syslog agents otherwise the agents might miss packets. The packets will be deleted from the internal syslog server according to the time to live value if a syslog agent does not retrieve them. IP connection list In this field you can specify which IP number range is allowed to connect to the INM web interface. If the field is empty no restrictions applies. If you should enter an invalid IP range you can always connect to the interface from the INM host machine. Example Allows every client with an IP number in-between and including this range to connect. More rules can be added below the first line. Example Allows a single host to connect. XML server Starts or stops the internal XML server. The XML server can be used with the INM agent. The XML server must be start if you want to monitor INM with another INM host. XML server port Port number used by XML server. To apply a new port number when the server is start you need to first stop the server and then start it. Login notice Shows a custom login notice at the login page. Telnet login prompt Some agents and actions can use Telnet instead of SSH2. INM needs to know the format of the telnet server login prompt. Specify one or more possible login prompts that exist on the

55 Advanced topics 49 different monitored machines. Separate multiple entries with a comma. Telnet password prompt Some agents and actions can use Telnet instead of SSH2. INM needs to know the format of the telnet server password prompt. Specify one or more possible password prompts that exist on the different monitored machines. Separate multiple entries with a comma. Telnet prompt Some agents and actions can use Telnet instead of SSH2. INM needs to know the format of the telnet server command prompt. Specify one or more possible command prompts that exist on the different monitored machines. Separate multiple entries with a comma. Backups Check this flag to enable automatic backup of the INM configuration repository. Backup interval Select the frequency of the automatic backups. Each backup will create a new backup file in the directory /nxdbackup in the INM root directory. 5.6 Schedules Schedules are used to control the work hours of operators, execute actions on a given time and to define scheduled downtime of objects. The schedule page is divided into three parts: operator, maintenance and event schedules Maintenance schedule Maintenance schedules can be used to plan downtime of an object or a monitor, during the maintenance no tests will be performed by the select objects monitors. The maintenance schedule can be a single maintenance period or a repeating maintenance period. The single period maintenance mode defines an absolute period by date, time and length of maintenance period. The repeating maintenance period can be configured to a certain day in the week, last day in month, fixed day interval or fixed days in month.

56 50 Intellipool Network Monitor Maintenance schedule Event schedule Event schedules can be used to automate routine tasks that needs to be performed daily, weekly. An event can start execution of an action on a single occasion or on a repeating schedule.

57 Advanced topics 51 Scheduled event selection page Send mail Send mail to operator, group or other recipient. Send SMS Send SMS to operator, group or other recipient. GSM Phone/Modem must be installed and configured to use this event. Paging via PageGate Page operator or group via Pagegate Execute windows command Executes a Windows command on the INM host machine. It is not possible to execute the command on a remote Windows computer with this event. Execute command via SSH2 Executes a command on a remote machine. There must be an SSH2 server running on the remote machine. Windows service control The events can start, stop, pause and restart windows services running on any machine in the accessible network. Clear event log Clear the event log on a Windows host. Event log name should not contain the "Log" postfix for the standard event logs system, application and security.

58 52 Intellipool Network Monitor Wake-on-lan Sends a broadcast packet to a network interface card ordering the host machine to start. The host bios must support WOL and the network interface card must support AMD Magic Packet standard. HTTP Post The event can perform a HTTP request that can be used to call a CGI script or custom software. Trigger agent test This event can trigger an active or deactivate agent to perform a test. Agents part of a dependency tree cannot be triggered. Refresh uptime statistics The event refreshes the periodical uptime statistics for all agents that store agent status statistics. The result can be viewed in the agent uptime list page. Generate a report Generates a report and sends it to recipient, ftp and/or UNC directory. Export report The event exports the raw data that is used to generate a report to an external database or file Operator schedule Operator schedules can be used to control the work hours of an operator. The operator will receive notifications from INM on the hours that are defined in the operator schedule. If no schedule is defined the operator will always receive notifications. The period that marks the work hours of an operator in a schedule is called blocks. A block is defined as a period of days and contains a set of rules that controls on which hours the operator is on duty in the block. Several blocks can be stacked together to compose a schedule that has alternating work hours for an operator. Example. An operator can work between and every weekday except Saturday and Sunday in the first block that runs for a week (7 days). In the next block the operator is scheduled between and every weekday except Saturday and Sunday. The active period for the schedule must specify an start day and optionally a end date. The end date of the schedule is the date when the schedule stops being active, if no end date is specified the schedule will be repeated. Each operator that is scheduled is marked with a icon in the operator list page. To add a new schedule click the "New schedule" link on the operator schedule task bar.

59 Advanced topics 53 Click the "Save" button to save the schedule and return to the schedule list page. Open up the schedule by clicking on the name of the schedule. Operator schedule Click on the command "Add block" in the block list header. Specify the length of this block and click on the "Save" button. When returning to the operator schedule page click "Add rule" to proceed to the block definition page.

60 54 Intellipool Network Monitor Select the days, time and operators that should be affected by this rule. Click on the "Save" button to save this rule. The finished operator schedule will set operator Robert on duty between and every weekday. 5.7 System administration Change web interface port number The init.cfg file in the INM directory contains the configuration parameter that tells the web server what port number to use. Locate the line "WEBSERVER_PORT" and change it to a free port number you wish to use instead. You do not need to restart INM to make the changes take affect, INM monitors the file for changes and will automatically reload the file and make the necessary changes.

61 Advanced topics Enable secure HTTP The built-in web server can use SSL to encrypt all information sent from the web server to the web browser. To enable SSL use the "SSL Setup utility" installed in the INM program folder. When SSL is enabled you cannot connect to the interface using an un-encrypted connection. Configuring the web server 1. Start the SSL Setup utility in the Intellipool Network Monitor program menu 2. Verify that the path in the field "INM directory" is the path to the INM installation you wish to configure 3. Select a certificat from the list 4. Press the "Enable SSL" finish the configuration 5. Close the utility and restart INM To disable the SSL encryption, press the "Disable SSL" button in step 4. Note that the port used for INM will not change when enabling SSL. If the port number used by INM is 8080 the correct URL to access INM from the local machine will be after SSL is enabled. Creating a certificate for data encryption 1. Click on the button "Generate certificate" 2. In the field "Certificate subject" enter the fully qualifaied name of the INM host machine 3. Enter the number of month this new certificate should be valid 4. Click on the "Create" button The certificate that this tool generates will not be a valid certificate for server identification since it will not have a valid CA (Certificate Authority) field. It will still be valid for encryption and as secure in that respect as a purchased certificate. Using your own certificate 1. Open the Management consol (MMC) 2. Add a certificate snap-in for the "Computer account" 3. Select the "Personal" node under "Certificates" 4. In the context menu select "All tasks"->"import.." 5. Follow the steps provided by the wizard to import the certificate When the certificate is installed, use the "INM SSL Setup" utility to select and enable SSL Encryption. Troubleshooting If INM fails to respond after you restarted the service

62 56 Intellipool Network Monitor 1. Check if the INM log file contains any information indicating a failure starting the web sever 2. Check that the URL used is correct, example (use the port number you configured when installing INM) 3. The certificate used must be accessible by the user account assigned to INM, logon with the account assigned to INM and start the INM SSL Setup utility and check if the certificate is visible in the list Enabled/disable testing, actions or statistical storage On the system administration page you can temporarily disabled testing, execution of action and storage of statistical data.

63 Advanced topics 57 System administration page Enable/disable tests This function enables (enabled by default) or disables all testing done by INM. The state of the flag is saved in the settings file Enable/disable actions This function enables (enabled by default) or disables all execution of actions. The state of the flag is saved in the settings file Enable/disable statistical storage This function enables (enabled by default) or disables all storage of monitor statistics. The state of the flag is saved in the settings file

64 58 Intellipool Network Monitor Rebuild statistical database If any of the statistical database files are damaged this function can be used to attempt to re-create the files and remove bad data. This function can take some time to execute Init.cfg parameters The init.cfg file contains a number of different configuration parameters. They are described below with their respective default values. Web server Web server port number, this is the port number the web server will listen on for incoming connections from a browser WEBSERVER_PORT = 8080 The language used in the web interface, default English (ENG), optional French (FRA) WEBSERVER_LANGUAGE = ENG The web server can use SSL to encrypt information, this parameter specifies the certificate name, default blank. Use the INM SSL configuration utility to select and configure SSL options. WEBSERVER_CERT= Enables web server SSL mode, default disabled (0), enabled (1) WEBSERVER_SSL=0 SSH2 SSH2 client timeout time in milliseconds, default value (25 seconds) SSH2_TIMEOUT=25000 Tracelevel can be used to debug the ssh2 connection, default set to (0), valid range 0 to 4 (max output) SSH2_TRACELEVEL=0 Misc INM resolves all object host names into IP addresses, this feature can be turned of if there is problems with the local DNS, default enabled (1), optionally disabled (0) OBJECT_IP_CACHE=1 This parameter can be used to delay the start of agent tests when INM is starting up, values in seconds, default 0. It can be useful for reducing machine boot time stress by delaying the start of INM agent tests. DELAY_TEST_START=0 To set the operator session timeout value, in minutes. If no timeout is wanted, set value to 1 OPERATOR_SESSION_TIMEOUT=20

65 Advanced topics Restrict access to web interface The web server can be configured to only accept connection from a range of IP numbers. Information how to configure the IP numbers accepted by the web server can be found in the program settings page. By default the web server accepts all incoming connections. IP connection list In this field you can specify which IP number range is allowed to connect to the INM web interface. If the field is empty no restrictions applies. If you should enter an invalid IP range you can always connect to the interface from the INM host machine. Example Allows every client with an IP number in-between and including this range to connect. More rules can be added below the first line. Example Allows a single host to connect Safely shutting down INM The system administrator page provides a function to safely shutdown INM. The system admin page can only be accessed by operators that have the system admin flag set in the operator property page.

66 60 Intellipool Network Monitor System administration page Setting system administrator message On the system admin page you can enter a message displayed to all operators on the index page. Enter the message and click the "Save message" button to save the message. To remove the message clear the message text and click "Save message".

67 Advanced topics 61 System administration page System logging INM can store log information to a number of external log systems. The XML log is enabled by default and cannot be disabled. XML log file Windows event log ODBC datasource Syslog server To change or enable one or more of these alternatives open the program settings page. Make the necessary adjustments to the log settings section and click "save" to save the changes.

68 62 Intellipool Network Monitor XML log file The log file is placed in the directory "logs" and is named systemlog.xml. The style sheet used by the XML file is called systemlog.xsl. Event log INM will store information into the Windows Event log under the Application log folder. ODBC log The ODBC log can create a database or you can specify an already created database to place the log table log into. The ODBC data source must be of System datasource type. The log table is created with the following fields: Field Length Type Time 64 Char Object 64 Char Agent 64 Char Text 255 Char No index is created for the table log. Syslog INM can send log information to a syslog daemon. You have to specify destination and port to a host that have a syslog server running. The INM syslog client is using the UDP protocol and port 514 by default. Syslog address The address of the syslog server receiving the log information. Syslog port The port number of the syslog server. 5.8 Working with object templates Object templates can significantly reduce the time it take to create and edit large number of objects in a configuration. From an object template a new object can be created, the new object will be linked to the template in the way that when the changes are made to the object template it will propagate to the derived object. Parameters such as the name and IP number will still be unique to the derived object while parameters such as system type will be controlled by the object template. Monitors will be copied from the object template to the object and updated when changed. The derived object may contain monitors unique to that particular object, not linked to monitors in the object template.

69 Advanced topics 63 Creating an object template Creating a object template can be done in two different ways, creating a new object template or use the "Make template" command in the object list page to copy an already created object to a object template. The procedure to create an object template with out using the "Make template" command is exactly the same as creating a new object. New object template Object template property page contains most of the fields as the object property page except fields that are unique, such as host name / IP number. Linking an object to an object template Already created objects can be linked to a object template using the "Link" function in the object list page. First select an object to link, click the "Link" command in the header and select the object template to link to. If INM is unable to find a close match to a monitor it will not link it to a monitor in the template. Unlinking an object from an object template You can unlink an object from an object template by selecting the object and clicking on the "Unlink" command in the object list header. 5.9 Reports INM is capable of generating statistical reports from stored monitor data. You have two options while working with reports in INM, either you make a Report template or a

70 64 Intellipool Network Monitor Customized report. To generate reports very quickly, there is a "Quick report" command available as well Customized reports Customized reports A customized report will be a specialized report for one or few monitors. To begin creating a customized report, open the Report list page from the Settings menu. The report list page is shown below. Report list page Click on the "New customized report" link. The property page for the new report will be shown. Enter a name for this report, for example "Daily disk usage" and click the "Save" button. Report property page Your report has been created in the "Customized reports" section. Now let's define the content of the report. Click on the reports name in the Customized report list section. INM will open the Report info page shown below. Report info page Let's add a daily disk usage graph to this report. Click the "Add graph" link in the Items section.

71 Advanced topics 65 In the graph property page that will open, set the following parameters: Period Choose "Current day" Data type Choose "Disk size : Free disk space" Click the "Save button" and you will be redirected back to the Report info page. Now, for a Customized report, we will need to specify which monitors that should be shown in the graph. This step is what differentiates a Customized report and a Report template. If we are using a Report template we will not do this final step of specifying the monitors in the graph. By using Customized reports you can create very specialized reports mixing data from various sources. To continue, click on the Graph you just added in the "Items" section. INM will open the Graph info page shown below. Click on the "Add input" link. INM will display a window containing all disk-size monitors you have running on your INM system. If you do not have any disk-size monitors the list will be empty. Choose one (or several at once, by holding down the Ctrl key while selecting) from the list and click "Save". The monitors will now be added to the graph and listed in "Data inputs" section. You are now ready to view this report. From the report info page you can

72 66 Intellipool Network Monitor view the report directly in the browser by selecting the "View" command. From the report list page, you can view the report by clicking on the icon in the list Report templates Report templates As mentioned, the big difference between a Customized report and a Report template, is that for a Report template, you never add specific monitors into a graph. Report templates can be thought of being 'applied to' a specific object, where monitors in that object are automatically matched to existing graphs in the Report template. This also means, that a Report template can't be viewed directly as it is, but needs to be viewed from an object. In any object that can use a particular Report template, the template can be viewed from the "Related reports" section in the object info page. INM should have automatically created a couple of Report templates for you. If you click on the template called "Daily", for example. You will see a long list of graphs in that report, all of different types. When you view this Report template, from an Object info page, INM will automatically add applicable monitors to the graphs in the template. Another important feature is, that graphs that do not apply to a specific object will simply be removed from the resulting report Quick reports Sometimes you want to quickly compare data from different monitors at a specific time. For example, you are to investigate a particular alarm and want to see what happened with, for example the cpu load and free memory of the object around the time of the alarm. It would be possible to create a customized report for this purpose, but there is a much quicker way and that is to use the "Quick reports" command. Basically, you choose one or more monitors from either the "Object info" page or the "Monitor list" page, and choose the "Quick report" command. In the example below one CPU load and one Free memory monitor have been selected. After clicking on the "Quick report" command, INM will show the layout of the report. In some cases you can choose what kind of data you want to see in the graph (for example in the case of a Ping monitor, you can choose either Roundtrip time or Packetloss), as well as the unit of the data.

73 Advanced topics 67 Select the time period and click "Ok" to view your report. After viewing the report, it's also possible to save it as a Customized report. Enter a name in the text box, click the "Save" button and the report will be stored under Customized reports.

74 Section VI

75 Monitor reference and configuration exampels 6 Monitor reference and configuration exampels 6.1 Bandwidth monitor 69 The monitor measures the transfer speed between INM and an object. The test measure the time it takes to downloads the specified amount of data from the Chargen service running on the object. Parameters Transfer speed Minimum transfer speed in Kbit/sec, if the transfer speed goes below this value the test will fail. Port number The port number of the chargen service Data size Size of data (in Kbytes) to receive in the test. This value should be sized depending on the connection speed, for faster connections the size should be larger to obtain more accurate test results. The Chargen service must be installed and running on the object, Microsoft supplies a charge server for Windows in the "Simple TCP/IP Services" package. The Chargen service uses port 19 (TCP) by default. Note that the transfer speed is in kilobit per second. If this monitor is created by an auto scan process it is deactivated by default.

76 Intellipool Network Monitor CPU load monitor The monitor monitors CPU usage. Parameters CPU number The number of the CPU on the host. Zero based index. Maximum load The maximum allowed CPU load in percent. Detailed report The alarm report will contain all processes and their current CPU usage. Logon account Select one of the pre-defined accounts created in the account manager to use for authentication or click the account manager button to create a new logon account. Notice that you will need appropriate access to manage logon accounts. Operator rights can be changed in the operator settings page.

77 Monitor reference and configuration exampels Example CPU usage can be monitored in a couple of different ways, depending on what type of machine is monitored. Windows example 1. Make sure the objects system type is set to a Windows version 2. Open the object information page and click on Add monitor 3. Select the CPU monitor 4. Enter the max CPU usage in percent 5. Enter a zero based CPU number, or the string _Total, this value can also be enumerate by clicking on the button next to the filed. 6. Check the box "Detailed report" to get a list of processes running and their CPU usage in the event of an alarm. 7. Click save to create the monitor. Linux/Unix example This monitor uses the SSH2 protocol to perform the test, there must run a SSH2 server on the the monitored machine. 1. Make sure the objects system type is correctly set to the operating system running on the monitored machine 2. Open the object information page and click on Add monitor 3. Select the CPU monitor 4. Enter the max CPU usage in percent 5. Enter a zero based CPU number 6. Select an logon account to use when login on the monitored host, create a new if needed. 7. Click save to create the monitor

78 Intellipool Network Monitor DHCP monitor The DHCP monitor can verify that a DHCP server is able to lease IP addresses to clients. The monitor returns the retrieved address to the DHCP server immediately after it received the address. It is very important that the INM host machine is not using DHCP for its own network interface card. If the host machine use DHCP the result could be that INM is releasing the IP address belonging to the machine. INM uses the MAC address of the first installed network card to request an IP address from the DHCP server.

79 Monitor reference and configuration exampels Disk size monitor The monitor monitors free disk space on a Windows or Unix host. The monitor can also monitor a Windows disk using an alternative method that requires a share be specified as Disk name instead of a volume. The monitor does not support enumeration of shares. The alternative method can be used if the diskperf subsystem is disabled on the monitored machine. Parameters Free disk space Minimum size left on volume Presentation unit Select the unit to use in the real-time chart. Logon account Select one of the pre-defined accounts created in the account manager to use for authentication or click the account manager button to create a new logon account. Notice that you will need appropriate access to manage logon accounts. Operator rights can be changed in the operator settings page. Windows specific properties - Edit to test Windows machine Disk name The name of the disk to monitor. Use Windows share If checked the test is performed using a Win32 API function instead of Windows performance API. Unix specific properties - Edit to test Unix machine Disk name The name of the disk to monitor. SSH2 port Port number of SSH2 server Use telnet Makes the monitor use the telnet protocol instead of SSH2, remember to set the correct port number.

80 Intellipool Network Monitor DNS monitor The monitor connects to a specified DNS server and tries to translate a specified address into another address form. The entered address can be in number form ( ) or in the name form ( Parameters Name The address to use for translation test. To test more than one addresses at the time separate the addresses with a semi colon in this field.

81 Monitor reference and configuration exampels Environment monitor The monitor uses an EM1 device to measure temperature, humidity and wetness. The EM1 device supports up to 4 groups of probes. More information about the EM1 device can be found at Sensatronics web site, Parameters Select Model Currently only EM1 available Select scale Select the temperature scale to use, note that the scale cannot be changed once selected. Select port Port number the device listens to. Group properties Min/Max temp Mn and max temperature thresholds for this probe. Temp. Location Description of the probe Enabled Check to enable measurements from this probe Min/Max humidity Mn and max humidity thresholds (in percent) for this probe. Hum. Location Description of the probe Enabled Check to enable measurements from this probe Min/Max wetness Mn and max wetness thresholds (in percent) for this probe. Wet. Location Description of the probe Enabled Check to enable measurements from this probe

82 Intellipool Network Monitor Event log monitor The monitor reads the event log and search for messages that matches the entered parameters. Only event log entries created after the previous test is included in the current test therefore should the event log monitor always be configured with alarm generation set to one (1). The monitor will always restart on the next test after an alarm since it uses the information from the previous test to determine the status of the event log. You should assign an empty restart list to monitors of this type to avoid unnecessary restart messages. Parameters Event ID Event id number. To include all event id s, specify 1 in this field. Event type The type of event the monitor should search for. Log name The name of the log to scan. Source string The source of the event. Include string(s) If one or more strings exists in the event record message text the record is included in the test (if the other criteria s is meet). Exclude string(s) If one or more strings exists in the event record message text the record is NOT included in the test (if the other criteria s is meet). Include message If checked the message text is include into the error report. Ignore open errors Check this flag to ignore errors generated when the monitor failed to open the event log. This option can eliminate alarms if the host of the event log is down. Logon account Select one of the pre-defined accounts created in the account manager to use for authentication or click the account manager button to create a new logon account. Notice that you will need appropriate access to manage logon accounts. Operator rights can be changed in the operator settings page.

83 Monitor reference and configuration exampels Example Example 1 The message text of the event record should contain the user name Administrator but not the username Robert. Set include string to Administrator Set exclude string to Robert Example 2 The message text of the event record should not contain the user name Robert. Leave include string blank Set exclude string to Robert. To extract the message text from the event log record INM needs to read information from the DLL or application file that contains the event log record definition. This is done in 3 steps. 1. INM searches the local computer for the file, if found step 3 2. INM searches the monitored computer for the file 3. Opens the file and reads the event log record information If INM does not find the requested DLL, then the include/exclude test will be skipped. Message files can be copied into the INM host machines system directory or the INM root directory to speed up the search. The monitor automatically excludes all log items that is logged by Intellipool Network Monitor to avoid a monitor/log loop behavior.

84 Intellipool Network Monitor File check monitor The monitor can check a file for modifications on both Unix and Windows hosts. The Unix part uses SSH2 to connect to the host machine. The monitor saves the information about the size of the file and the date/time each test it performs, therefore should the event log monitor always be configured with alarm generation set to one (1). The monitor will always restart on the next test after an alarm since it uses the information from the previous test to determine the status of the file. You should assign an empty restart list to monitors of this type to avoid unnecessary restart messages. Parameters Path Path and filename (for example \\mymachine\c$\test.txt). Note that this is an absolut path, not relative to the object. Date Checks if the file is modified. Larger size Checks if the file grows in size Smaller size Checks if the file decreases in size Not changed The test will fail if the file has not changed since the last test. Logon account Select one of the pre-defined accounts created in the account manager to use for authentication or click the account manager button to create a new logon account. Notice that you will need appropriate access to manage logon accounts. Operator rights can be changed in the operator settings page.

85 Monitor reference and configuration exampels Example The file check monitor can be used to monitor file changes. The monitor can determine if a file have changed, grow or shrink in size. It can also detect if a file does not change if you wish to watch a file that should be updated periodical. The monitor can monitor files both on Windows machines and Unix machines. When monitoring a file on a Windows machine standard filesystem functions are used to access the file. When monitoring a file on the on a Unix machine the monitor connects and logs on to the machine via SSH2 and uses standard command line to get the current status of the file.

86 Intellipool Network Monitor FTP monitor The FTP monitor checks if a FTP server responds to a login and a directory search. The purpose of the directory search is to verify that the storage backend is working properly. If no username or password is provided a simple connection test is preformed. Parameters Port number The port number the FTP server is configured to use.

87 Monitor reference and configuration exampels HTTP monitor The HTTP monitor can test a HTTP server connection and validate the content of the received page. It can verify that the content delivered by the HTTP server is the same as the previous test. It can also search for a string in the content and verify links on the web pages. The monitor needs to execute one test before it shows the link it can verify in the property view. To reset the checksum test (if the page has been updated) open the monitor property page and uncheck the checksum flag and save it, then open the monitor property page again and check the checksum flag and save the monitor. Parameters Port number Port number used to connect to the HTTP server. Page URL The complete URL of the page to download. Search String The string the HTTP monitor will search for in the downloaded page Custom cookie A custom cookie can be added to the HTTP request, format of string "name=value" Checksum A flag that instructs the monitor to calculate a checksum for the downloaded page and store it for future tests. Verify links The option to verify links on the web page will be shown after the first test is completed. To enable verification of a link check the corresponding checkbox. Custom host Optional host header field to support name based virtual hosts User monitor Custom user monitor string, if left blank the default "intellipool network monitor" user monitor string will be used. Use secure HTTP Enables support for secure communication via SSL or TLS. Ignore CN check If checked the monitor will not try to validate the common name (CN) of the certificate. Ignore date check If checked the monitor will not try to validate the expiry date of the certificate.

88 82 Intellipool Network Monitor Ignore CA check If checked the monitor will not try to validate the certificate authority (CA) of the certificate. Cert Store. Name of the system certificate store. Should only be used with the secure HTTP option. Cert Subject String in subject line of certificate. Should only be used with the secure HTTP option. Proxy server Address of a proxy server Proxy port Proxy server port number

89 Monitor reference and configuration exampels 6.11 ICA monitor The monitor checks that a service using the ICA protocol responds to connection attempts. Parameters Port number Port number of service using the ICA protocol. 83

90 Intellipool Network Monitor IMAP4 monitor The monitor tests if it can login and select a mailbox. The purpose of the test is to verify that the authentication and storage part of the IMAP4 server is working. If no username or password is provided a simple connection test is preformed. Parameters Port number The port number of the IMAP4 server. Inbox name The name of the users inbox.

91 Monitor reference and configuration exampels INM monitor The monitor checks that an Intellipool Network Monitor server is running. The monitor connects to the XML server running on the remote installation of Intellipool Network Monitor. Parameters Port number Port number to use when connecting to the remote INM server.

92 Intellipool Network Monitor LDAP monitor The monitor checks if a LDAP server is responding to directory lookup requests. Parameters Domain name LDAP domain name.

93 Monitor reference and configuration exampels Lua script monitor The monitor executes a LUA script loaded from the \script folder in the INM directory. Using the INM LUA IDE (Integrated Development Enviroment) that can be downloaded from Intellipools web site for free users can develop their own monitors. More information about the script language LUA can be found on the offical LUA web site, found at Parameters Script file Select one of the script files in the list. The selected script file will be executed each test. Arguments Optional field to pass arguments to the script.

94 Intellipool Network Monitor Mail QOS monitor The monitor can test the ability of a mail server to send and receive mail. Statistics about round trip time, time to send and login time can be collected. The object of the monitor should be the machine hosting the POP3 server. The monitor is able to attach an EICAR test file to verify the functionality of a anti-virus scanner in the receiving server. The file must be added to the root of the INM directory before the option can be selected. More information of EICAR and the standard anti-virus test can be found on Parameters Mail test timeout The maximum time in seconds the monitor waits for the mail to arrive at the POP3 server. SMTP port Port number of SMTP server SMTP Server Address of SMTP server POP3 port Port number of POP3 server Mail address Mail address to be used in test. Note that the mail address must exist on the POP3 server and must be of a domain that is accepted by the SMTP server. Username Username of mail account (POP3) Password Password of mail account (POP3)

95 Monitor reference and configuration exampels 6.17 Memory usage monitor The monitors free memory in a Windows or Unix machine. Parameters Minimum free size The smallest free size of the memory in megabytes. Logon account Select one of the pre-defined accounts created in the account manager to use for authentication or click the account manager button to create a new logon account. Notice that you will need appropriate access to manage logon accounts. Operator rights can be changed in the operator settings page. Windows specific properties Process report List all processes and their memory usage in alarm report Unix specific properties SSH2 port Port number of SSH2 server Use telnet Makes the monitor use the telnet protocol instead of SSH2, remember to set the correct port number. 89

96 90 Intellipool Network Monitor Example Memory usage can be monitored in a couple of different ways, depending on what type of machine is monitored. Windows example 1. Make sure the objects system type is set to a Windows version 2. Open the object information page and click on Add monitor 3. Select the Memory size monitor 4. Enter a value in MB in the field Free memory, this value should be the minimum free size 5. Check the box "Process report" to get a list of processes and their memory usage in the event of an alarm 6. Click save to create the monitor. Linux/Unix example This monitor uses the SSH2 protocol to perform the test, there must run a SSH2 server on the the monitored machine 1. Make sure the objects system type is correctly set to the operating system running on the monitored machine 2. Open the object information page and click on Add monitor 3. Select the Memory size monitor 4. Enter a value in MB in the field Free memory, this value should be the minimum free size 5. Select an logon account to use when login on the monitored host, create a new if needed. 6. Click save to create the monitor SNMP example Free memory can be measured with the SNMP monitor as well. You will need to have a MIB file from the manufacturer of the equipment to extract the OID for the free memory counter from the MIB browser, or have a complete numeric OID. This example assume that the value returned by the OID is free memory in percent ( 0 %- 100 %). 1. Open the object information page and click on Add monitor 2. Select the SNMP monitor 3. Enter the OID in the OID 1 field or browse for the OID in the MIB browser by clicking on the button next to the OID field 4. Enter a % sign in the unit field 5. Check the box Ignore protocol error 6. Enter a compare value to representing the minimum free memory in percent, for example Select Integer as value type 8. Select greater as operation 9. Click save to create the monitor

97 Monitor reference and configuration exampels 6.18 Network interface load monitor The monitors the current network traffic load of a network interface card (NIC). Parameters NIC name The full name of the NIC. Max bytes per second The maximum number of bytes the NIC is allowed to transfer per second. Logon account Select one of the pre-defined accounts created in the account manager to use for authentication or click the account manager button to create a new logon account. Notice that you will need appropriate access to manage logon accounts. Operator rights can be changed in the operator settings page. 91

98 Intellipool Network Monitor NNTP monitor Connects and checks status of a NNTP (Network News Transport Protocol) server. Parameters Port number The port number the NNTP server is configured to use.

99 Monitor reference and configuration exampels ODBC monitor Monitors a ODBC database. The test verifies that the ODBC data source can be opened and accessed. The monitor can also execute SQL statements and compare the result to a predefined value. Parameters Data source name The name of the database that will be used in the test. This must be a system data source SQL query Optional SQL query to execute No rows fail Test will fail if no rows is returned by query Compare value User defined compare value, only numerical values are valid Operation Operation used to evaluate the returned result and the predefined compare value

100 94 Intellipool Network Monitor Example To monitor databases use the ODBC monitor. You will need to create a system DSN (datasource) before using this monitor, INM is a service and cannot access any other type of DSN. Consult the Windows help on creating a system DSN. 1. Open the object information page and click on Add monitor 2. Select the ODBC monitor 3. Enter the name of the DSN in the field datasource name 4. Enter a username and password if needed. This is optional, username and password can be specified directly in the DSN. 5. If you wish to execute a query, enter the query in the field SQL query. The query must return a numeric value. 6. (Optional) To make a comparison of the return value, enter the compare value and select an operation. The result of the operation should be boolean false to make the test fail. 7. Click save to create the monitor.

101 Monitor reference and configuration exampels Ping monitor The monitor uses the ICMP protocol to verify that the object responds to ping packets within a pre-defined time. The monitor can also calculate packet loss and round trip time during the test. The monitor will only trigger on packet loss level if the round trip time is within the specified range. Note that the ping protocol is one of the protocols with lowest priority in a network and some host does not respond to ping packets by default. Parameters Timeout value Largest round trip time the monitor will wait for the ping packet to return from the host. Specified in milliseconds Packet loss Max packets lost when transmitted to host. Specified in percent of total sent packages. Packets to send The number of packets to send each test. A higher value will yield a more exact packet loss and round trip time values. Include trace If checked a trace route log is included in the alarm message. Alt. IP Secondary IP to test. The monitor can ping an alternative IP number in the same test.

102 Intellipool Network Monitor POP3 monitor The monitor connects to a POP3 mail server and verifies that it can logon to the server and check for mail (without affecting the status of the mailbox). The purpose is to verify that the POP3 authentication and the storage system of the POP3 server is working. If no username or password is provided a simple connection test is preformed. Parameters Port number The port number the POP3 server is configured to use.

103 Monitor reference and configuration exampels 6.23 Process monitor The monitor can verify that a process is running on an object. Windows specific properties Process name The name of the process to monitor. Logon account Select one of the pre-defined accounts created in the account manager to use for authentication or click the account manager button to create a new logon account. Notice that you will need appropriate access to manage logon accounts. Operator rights can be changed in the operator settings page. Unix specific properties Process name The name of the process to monitor. Logon account Select one of the pre-defined accounts created in the account manager to use for authentication or click the account manager button to create a new logon account. Notice that you will need appropriate access to manage logon accounts. Operator rights can be changed in the operator settings page. SSH2 port Port number of SSH2 server Use telnet Makes the monitor use the telnet protocol instead of SSH2, remember to set the correct port number. 97

104 Intellipool Network Monitor RDP monitor The monitor verifies that a terminal server using the RDP 5.0 protocol is responding to connection attempts. Parameters Port number The port number the terminal server is configured to use.

105 Monitor reference and configuration exampels Sensatronics device monitor The Sensatronics device monitor is a dynamic monitor created specifically to support new and future devices from Sensatronics Inc. Refer to the documentation of the device how to use this monitor.

106 Intellipool Network Monitor Service monitor The monitor verifies that one or more Windows services are running. Parameters Service name Name of the service to monitor. Separate multiple service names with a comma. This field can be enumerated by pressing the enumeration icon to the right of the field. Logon account Select one of the pre-defined accounts created in the account manager to use for authentication or click the account manager button to create a new logon account. Notice that you will need appropriate access to manage logon accounts. Operator rights can be changed in the operator settings page.

107 Monitor reference and configuration exampels SMTP monitor The monitor checks that it can connect to an SMTP server and that the SMTP server returns a valid return code. Parameters Port number The port number the SMTP server is configured to use.

108 Intellipool Network Monitor SNMP monitor The monitor performs SNMP requests using the specified OID and compares the returned value with a predefined value. A compare operation controls how the two values are compared. If the compare operation evaluates to false the test is considered as failed. For example, if the compare value is set to 50 and the compare operation is set to "greater", the test will fail if the returned value is less then 50 the test will evaluate to false and the monitor will fail the test. Parameters Community SNMP community to use OID OID (Object identifier) to get value from. Se note below on semantics of the OID. Press the "Select" button to open the MIB browser. OID 2 Optional OID to get value from and combine with first OID. Press the "Select" button to open the MIB browser. Combine operation Optional operation used when getting 2 OIDs. The OIDs can be combined into a final result by using the add, subtract, divide or multiplicative operation. If the OID is the type Counter32 or Counter64 the value will be divided with the last test value and the time between the tests to obtain a delta over time value before the combine operation is performed. This makes it possible, for example, to make a sum of the octets transferred on a router interface per second. Divisor A value that the result will be divide with. Can be used to scale values. Compare value User defined compare value, only numerical values are valid. Compare operation Operation used to evaluate the returned result and the predefined compare value. Unit Unit of the measured value. Used in presentation only.

109 Monitor reference and configuration exampels Ignore protocol errors 103 Makes the monitor only generate an alarm based on a failed value comparisons. All other errors such as protocol errors are ignored Example Example CPU usage can be measured with the SNMP monitor. You will need to have a MIB file from the manufacturer of the equipment to extract the OID for the CPU usage counter from the MIB browser, or have a complete numeric OID. This example assume that the value returned by the OID is a usage percentage ( 0 %- 100 %). 1. Open the object information page and click on Add monitor 2. Select the SNMP monitor 3. Enter the OID in the OID 1 field or browse for the OID in the MIB browser by clicking on the button next to the OID field 4. Enter a % sign in the unit field 5. Check the box Ignore protocol error 6. Enter a compare value to act as the highest allowed CPU usage, for example Select integer as value type 8. Select less as operation 9. Click save to create the monitor

110 Intellipool Network Monitor SNMP trap monitor The monitor receives trap messages from SNMP monitors on remote hosts. The monitor will only receive messages that originate from the objects IP address. The include and exclude filter strings is matched against information in the current loaded MIB file. If the trap contain an OID that's not in the current MIB the match of the strings will fail. Parameters Community SNMP community to use Include string(s) If one or more strings exists in the description of the OID received the record is included in the alarm. Exclude string(s) If one or more strings exists in the description of the OID received the record is NOT included in the alarm.

111 Monitor reference and configuration exampels 6.30 SSH2 monitor The monitor verifies that a SSH2 server is responding to user login attempts. This monitor does not support the older SSH1.x protocol. Parameters Port number The port number the SSH2 server is configured to use. 105

112 Intellipool Network Monitor SSH2 script monitor The monitor can execute a command or script on a SSH2 host and compare the returned value with a predefined string using a compare type. If the compare operation evaluate to false the monitor will generate an alarm. Parameters Command A command to execute on the host. Compare value User defined compare value, only numerical values are valid. Compare operation Operation used to evaluate the returned result and the predefined compare value. Use telnet Use the telnet protocol instead of SSH2 Port number The port number the SSH2 server is configured to use. Ignore protocol errors Makes the monitor only generate an alarm based on a failed value comparisons. All other errors such as protocol errors are ignored.

113 Monitor reference and configuration exampels 6.32 Swap size monitor Monitors swap space usage on the object. Parameters Minimum free size The smallest free size of the specified swap file in percent. Windows specific properties Swap file name The name of the swap file to monitor. Detailed error report List all processes and their memory usage in error report Logon account Select one of the pre-defined accounts created in the account manager to use for authentication or click the account manager button to create a new logon account. Notice that you will need appropriate access to manage logon accounts. Operator rights can be changed in the operator settings page. Unix specific properties Logon account Select one of the pre-defined accounts created in the account manager to use for authentication or click the account manager button to create a new logon account. Notice that you will need appropriate access to manage logon accounts. Operator rights can be changed in the operator settings page. SSH2 port Port number of SSH2 server Use telnet Makes the monitor use the telnet protocol instead of SSH2, remember to set the correct port number. 107

114 Intellipool Network Monitor Syslog monitor The syslog monitor can intercept syslog message sent to INM from one or more syslog hosts. The monitor can be configured to receive different types of messages. More than one syslog monitor can be added to each object to receive different combinations of messages. Before you create an monitor of this type you need to start the internal syslog server. If another Syslog service is executing on the INM host machine the result is unpredictable. Parameters Include string(s) Filter away messages not containing these strings. Separate multiple strings with a comma Exclude string(s) Message not included if it not contains one of the string specified in this field. Separate multiple strings with a comma

115 Monitor reference and configuration exampels TCP port monitor The purpose with this monitor is to verify that a number of ports are open or closed depending on the use. In its default state the monitor is going to trigger an alarm if the port can be opened, if the invert flag is checked the monitor is going to trigger an alarm if the port is closed. The port range can be in the following format: The monitor will scan ports between and including 21 to ,21-23 The monitor will scan port 80 and ports between and including 21 to 23. The monitor can check up to 100 ports. Parameters Port number range Ports to scan. Invert function Check this option if you want to make the test verify that certain port is open instead of closed.

116 Intellipool Network Monitor Telnet monitor The monitor verifies that a telnet server is responding. Parameters Port number The port number the telnet server is configured to use.

117 Monitor reference and configuration exampels 6.36 Temptrax monitor The monitor can measure temperature using a TempTrax 2000 precision digital thermometer. The monitor supports up to 16 probes. Parameters Model Select the Model F for the serial port model and Model E for the Ethernet connected model. Scale Select the temperature scale to use, note that the scale cannot be changed once selected. TempTrax port The port number used by the Model E version (default 80) Select com port The serial port used by the Model F version. Max Temp Max temperature in the scale selected. Min Temp Min temperature in the scale selected. Location Location string that will be included in alarm text. Enabled Check to enable measurements from this probe 111

118 Intellipool Network Monitor Text file scan monitor The monitor can read a text file and check for if new lines in the file contains one of the specified strings. The monitor generates an alarm if the specified search criteria are meet. Parameters Path Path and file name of the file to scan. Formatting flags can be inserted into this field, see below. Search string The string to search for, separate multiple search strings with a comma. Formatting flags can be inserted into this field, see below. Invert Function The monitor will generate an alarm if the file has not changed since last test. Note that the search string is not used when this option is used. Field formatting flags The following flags can be inserted into the text and expanded at test time %a Abbreviated weekday name %A Full weekday name %b Abbreviated month name %B Full month name %c Date and time representation appropriate for locale %d Day of month as decimal number (01 31) %H Hour in 24-hour format (00 23) %I Hour in 12-hour format (01 12) %j Day of year as decimal number ( ) %m Month as decimal number (01 12) %M Minute as decimal number (00 59)

119 Monitor reference and configuration exampels %p Current locale s A.M./P.M. indicator for 12-hour clock %S Second as decimal number (00 59) %U Week of year as decimal number, with Sunday as first day of week (00 53) %w Weekday as decimal number (0 6; Sunday is 0) %W Week of year as decimal number, with Monday as first day of week (00 53) %x Date representation for current locale %X Time representation for current locale %y Year without century, as decimal number (00 99) %Y Year with century, as decimal number %z Time-zone name or abbreviation; no characters if time zone is unknown 113

120 Intellipool Network Monitor TFTP monitor The monitor tests if a TFTP server is responding to a RRQ operation. The purpose of the test is to verify that the TFTP server is running. The monitor tries to download a file named INM this file does not have to exist for the test to succeed. The monitor merely checks that the TFTP server is responding in the correct way to such request. Parameters Port number The port number the TFTP server is configured to use.

121 Monitor reference and configuration exampels Windows performance monitor The monitor can test Windows performance object and compare the returned value with a predefined value. A compare operation controls how the two values are compared. If the compare operation evaluates to false the test is considered as failed. For example, if the compare value is set to 50 and the compare operation is set to "greater", the test will fail if the returned value is less then 50 the test will evaluate to false and the monitor will fail the test. Parameters Logon account Select one of the pre-defined accounts created in the account manager to use for authentication or click the account manager button to create a new logon account. Notice that you will need appropriate access to manage logon accounts. Operator rights can be changed in the operator settings page. Leave the field blank to use the current service account access rights. Object Name of the performance object. This value can be enumerated by using the enumeration window. Counter Name of the counter attached to the object. This value can be enumerated if a valid object has been specified. Instance Instance name, this value can be enumerated if valid object and counter has been previously specified. Some objects does not have any instances ( for example the "System" object). Object2 The following fields works can be used to retrieve a secondary value in the same test for the purpose to combine the two values into a single value that can be divided and compared. The combine operation determine the way the two values are combined. Counter2 Same as counter Instance2 Same as instance

122 116 Intellipool Network Monitor Combine operation Optional operation used when getting 2 values. They can be combined into a final result by using the add, subtract, divide or multiplicative operation. Compare value User defined compare value, only numerical values are valid. Divisor A value that the retrieved value will be divided with before the comparison. If the monitor get 2 values by using the secondary object,counter and instance fields the division takes place after the combine operation have been performed. Compare operation Operation used to evaluate the returned result and the pre-defined compare value. Unit Unit of the measured value. Used in presentation only Example Example The Windows Performance Monitor can be used to track memory usage of a process. The most suitable counter to use to estimate process memory usage is the "private bytes" counter. The value of the counter is best described as memory that cannot be shared by another process. 1. Open the object information page and click on Add monitor 2. Select the WinPerf monitor 3. Object field Process 4. Counter field = Private Bytes 5. In the instance field enter the name of the process you wish to monitor memory usage. 6. Enter 1024 in the divisor field 7. Enter KB in the unit field 8. Enter 1 in the compare value field 9. Select integer as value type 10.Select not equal as operation 11.Click save to create the monitor The object, counter and instance field can be enumerated using the enumeration window.

123 Section VII

124 118 7 Intellipool Network Monitor Action reference All actions have the alarm number parameter in common. The alarm number indicates when the action is going to be triggered. First time an monitor enters an alarm state actions with alarm number one will be triggered, next test that the monitor fails the actions with alarm number two will trigger. Multiple actions can be assigned the same alarm number. The current alarm number of an monitor will reset when a monitor test succeed. 7.1 Clear event log The action clears an event log on a specified Windows host. 7.2 Host Host name or IP number. Clears the event log on this host. Leave blank to use the address of the calling object. Log name Name of the log to clear. Ex. Application Filename Saves the log to this file before clearing it. Works only if the event log is located on the INM host machine. Execute command via SSH2 The SSH2 action can be used to execute a command on a host via SSH2 connection. If the telnet protocol is used instead of SSH2 the telnet default parameters must be properly set in the program settings page. Parameters Command to execute. In the command field flags can be inserted, the flags are expanded when the action is executed. Following flags are valid: %O (Object name) %A (Monitor name) %S (Object description) Host Host name or IP address of the SSH2 server. Leave blank to use the address of the calling object. Port Port number of the SSH2 server Username Username

125 Action reference 7.3 Password Password Use telnet Use the telnet protocol instead of SSH Execute Windows command The action executes a command on the INM host machine. The command cannot be an interactive command that needs any interaction with a user. The action can fail if the user assigned to the INM service not has the rights to execute the command. Command Command to execute. Ex. ipconfig Parameters Parameter of the command. Ex. /all. In the parameter field flags can be inserted, the flags are expanded when the action is executed. Following flags are valid: %O (Object name) %A (Monitor name) %S (Object description) 7.4 HTTP Get/Post The action can perform a HTTP request that can be used to call a CGI script or custom software. URL The URL can be an absolute URL or leave the server address empty to use the address of the monitor parent object /page.cgi Port Port number (default port 80) Get/Post Select method to use in request

126 120 Intellipool Network Monitor Parameters Enter the parameters to use in the request in the form of "name=value". Specify only one parameter per row. Flags can be inserted into the text and will be expanded when the action is executed, following flags are valid: %T Current time %O Object name %D Object destination/address %A Monitor name %E Monitor error message %E2 Monitor error message, no time stamp %L Distribution list %X Dependency tree status %S Object description %N Network name %I Network contact information 7.5 SSL Check the flag to use SSL, remember that you have to set the SSL port number. Username Optional field for username if the server requires authentication. Password Optional field for password if the server requires authentication. List reset The list-reset action, when executed, causes the execution to restart from the first action. The list-reset action can be used to get a loop behavior. 7.6 Net Send The net send action can be used to send messages to a Windows user, the message will be presented as a pop-up message box on the users computer. The action needs that the Messenger service is started on both the INM host and the users computer. User The Windows user to send the message to.

127 Action reference Host Optional host where the user is located. Only needed if no domain can resolve the username. Paging via PageGate The action can send a message to a Pagegate user. Operator group Sends the notification to the all members of the operator group. Operator Send the notification to the operator on duty. The operator on duty is determined by examining the current operator schedule. If no operator is on duty the notification is sent to the group manager. If no group manager is set the notification is sent to all members of the operator group. Recipient Optional Pagegate recipient. Short message If checked the following flags are omitted from the message %S (Object description) %L (Distribution list) %X (Dependency tree status) %E (Monitor error message) %I (Network contact information) 7.8 Send mail The action can send an to an entire operator group or (if operator schedule is used) the operator(s) on duty. An extra recipient can also be specified. Operator group Sends the mail to the all members of the operator group. Recipient Optional recipient mail address of the mail. Separate multiple recipients with a semi colon.

128 122 Intellipool Network Monitor Short message If checked the following flags are omitted from the message %S (Object description) %L (Distribution list) %X (Dependency tree status) %E (Monitor error message) %I (Network contact information) 7.9 SNMP Set Sends a SNMP set command to a SNMP enabled host, requesting to change a value identified by a OID (Object Identifier) Host Host name or IP number of the host. Leave blank to use the address of the calling object. Community SNMP community to use. OID Object Identifier Value Value to set Syntax type Type of value. Two options exists, string and integer type. Send SMS The action can send a SMS to an entire operator group or (if operator schedule is used) the operator(s) on duty. An extra recipient can also be specified. To use this action a SMS capable GSM phone must be installed and tested on the INM host machine, the COM port settings in Program settings page must be properly set. Operator group Sends the SMS to the all members of the operator group. Operator Send the SMS to the operator on duty. The operator on duty is determined by examining the current operator schedule. If no operator is on duty the SMS is sent to the group manager. If no group manager is set the mail is sent to all members of the operator group. Recipient Optional recipient phone number of the SMS.

129 Action reference Wake-on-LAN The Wake-on-LAN action (WOL for short) can start a host that is compliant with the WOL standard. Refer to the documentation of the host to determine if the action can be used. MAC The MAC-address of the interface to send WOL packets to. The format of the MAC string is AA-BB-CC-DD-EE-FF. Leave the field blank to use the MAC address of the parent object Packet count Number of times to send the WOL packet. Interval Delay between packets, in seconds. Windows service control The service action can be used to modify the state of a Windows service. Service name Name of the service Host Host name or IP number of the Windows host where the service is installed. Leave blank to use the address of the calling object. Username Optional Windows username, use if INM service account doesn't have the necessary credentials to access the object. Password Optional Windows password, use if INM service account doesn't have the necessary credentials to access the object.

130 Section VIII

131 Distributed testing Distributed testing Distributed testing makes it possible to monitor servers, routers and other network connected equipment that are inaccessible or only accessible trough low bandwidth connection. To accomplish this a gateway is installed in the remote network. The gateway will act on instruction from the master INM installation called the server. Example distributed testing configuration INM server The server contains the configuration and user interface. Remote objects are managed the same way as local objects making INM DE very simple to configure and administrate. INM Gateway A special configured version of INM that only acts on requests from the server. Except a small cache file gateways do not store configuration or statistics to disk, it s all sent as fast as possible to the server. The gateway can be installed on any available machine in the remote network and does not require a dedicated server.

132 126 Intellipool Network Monitor User interface changes When an object is assigned to a gateway there is no difference between a local object or a gateway object. Editing, test results, reports and enumeration works the same way for both local objects and objects assigned to a gateway. 8.1 Communication between server and gateway Communications is always initialized from the gateway to the server, the idea behind this solution is that more gateways then servers will be deployed and the user would only have to open one port on the server firewall to allow communication. If the gateway can not connect to the server it will start buffering test results while waiting for the server, the time the gateway will buffer data is configurable. Security and data integrity is achieved by using the state of the art communication protocol SSH2. The SSH2 protocol encrypts data with public key algorithms and protects connections from man-in-the-middle attacks. This is the same way VPN software establish secure tunnels over the internet. 8.2 Time synchronization INM will automatically adjust for time zone difference. The user must however ensure that the clock in the gateways are synchronized with the clock in the server. We recommend that server and gateways are synchronized with a time synchronizing service such as NTP (Network Time Protocol).Failure to synchronize time between server and gateway may lead to unpredictable results in alarm generation and statistical storage. 8.3 Server configuration This configuration guide assumes that you are familiar with INM. 1. Install INM and make sure to use the INM DE installer 2. Logon INM with an administrator that have the rights to change operator settings. 3. In the operator settings, give the current operator the right "Distributed testing" and save the operator. 4. In the settings menu, click on the "Distributed testing" menu. Enter the server parameters; IP number is what NIC that the server should bind to. This is not necessarily the IP that the gateway will be configured with, it can be an IP behind a NAT firewall and then the gateway should connect to the IP of the firewall that will then redirect to this server IP. The server configuration is now done and you can install a gateway. 8.4 Gateway configuration Before installing a gateway, make sure you have read the "Server configuration" topic. 1. Logon to the server and open the distributed testing page. 2. Create a gateway by clicking on the "Create gateway" link and specify the name,

133 Distributed testing 127 address and port. NOTICE The address and port number that the server is bound to may not be the same address and port the gateway should connect to if the firewall uses network address translation. You may need to configure the firewall to forward the incoming connection to the server. In this case you should specify the incoming IP number and port number of the firewall rule in the gateway configuration. 3. Save the gateway and open the INM root directory on the hard drive. The server will now have created a directory called "gateways" with a sub directory named as the gateway you just created. These files should be copied to the gateway root directory. 4. Install the gateway in the desired machine. 5. Copy the files created by the server to the gateway root directory and restart the gateway with the service control manager. The gateway is now ready for use. Remeber that if you change the gateway configuration you will need to move the files to the gateway and restart the gateway. 8.5 Assigning objects to a gateway Assigning objects to a gateway can be done either in bulk or one at the time. Gateway information page The gateway information page contains a section where you can search for objects to assign to the gateway. This section is called "Manage gateway objects". To assign one or more objects to a gateway enter a search term in the search text field and press the "search" button. Select the objects by and click the "assign selection" link in the header. The objects will be transferred to the gateway and resume testing on the gateway directly. Gateway information page To display the objects assigned to a gateway, click the "Show assigned to this gateway" link in the header. To remove an object from a gateway select it in the list and click the "Remove

134 128 Intellipool Network Monitor selection" link in the header. Object property page The second alternative to assign an object to a gateway is to use the object property page. Given proper access rights an operator can select if the object should be assigned to an object or the server. Object property page Restrictions to object assignment Objects cannot have monitors in a dependency tree before they are assigned to an gateway. Dependency between monitors can only be created after the object is assigned to a gateway and then only between monitors assigned to the same gateway. 8.6 Auto scan You can auto scan a remote network via the gateway. To start an gateway auto scan open the gateway information page and click on the "Start gateway auto scan".

135 Distributed testing 129 Gateway auto scan page 1. Specify what IP range you want to scan. 2. Select the monitors you want to include in the auto scan. 3. Select the network to assign the found objects to. 4. Click "Yes" to start the auto scan When the auto scan is done the objects detected during the auto scan will be added to a temporary section in the gateway information page. Unlike the normal auto scan the objects will not be added to the configuration automatically.

136 130 Intellipool Network Monitor Gateway autoscan done Adding objects to the configuration Select the auto scan objects you wish to keep in the configuration and click "Add object to configuration" in the header. Objects added to the configuration will be assigned to the gateway directly. Discard auto scan objects Select the auto scan objects you wish to discard and click "Delete object" in the header. 8.7 Action lists Action lists are executed differently if a monitor is assigned to a gateway. The actions send , send SMS and Pagegate are executed by the server, all other actions are executed by the gateway. The reason the server is executing these actions instead of the gateway is that the gateway lacks program settings such as server configuration. 8.8 Troubleshooting Review the gateway configuration, make sure that the correct IP number and port number have been entered. Make sure all the files in the server gateway configuration folder have been copied to the gateway gateway root directory. If you have reinstalled the server on a new machine the gateway configuration needs to be saved in order to update the public.key file. After the gateway configuration is saved, move the gateway configuration files to the gateway root directory and restart the gateway. If you changed the gateway configuration (IP number and port number) you will need

137 Distributed testing 131 to move the updated configuration files to the gateway and restart the gateway. Make sure that the gateway and server is the same version, the server will shutdown any gateway that does not match the server version number.

138 Section IX