Printed Documentation

Transcription

1 Printed Documentation

2

3 Table Of Contents General Information... 1 Welcome to Big Brother Windows Client... 1 Using the Configuration Editor... 1 Starting and Stopping the Client... 3 Setup on the Server... 3 About Quest Software... 3 Customer Support... 3 Copyright Information... 3 Acknowledgements... 3 Troubleshooting... 4 Status Logs Don't Appear on the Display Server... 4 Memory Leaks... 5 Perflib Errors... 5 Dr. Watson Errors or the Big Brother Client Hangs... 5 Conflicts with Oracle... 5 Conflicts with Lotus Notes... 6 CPU and PROCS Columns Are Not Generated... 6 Field Descriptions... 7 Activate Log... 7 BB Name Alias... 7 DISPLAY and PAGER Hosts... 7 DISPLAY and PAGER Hosts... 7 Commit Charge Thresholds... 8 CPU Color on Reboot... 8 CPU Default Thresholds... 8 CPU Reboot Message Duration... 8 CPU Warning When Computer Has Been Up... 8 Drive Default Thresholds... 8 Drives List... 8 Externals List... 9 Fully Qualified Domain Name... 9 Ignore Msgs... 9 IP Port Key Code Logs Timer Msg Levels Network interfaces NT Computer Name Page File Usage Page Levels Physical Memory Thresholds Processes List Reboot Warning Status Color iii

4 Printed Documentation Timer Saved Logs Location Send Notification Alerts Services List Set test Start Monitoring After WMI custom tests External Scripts Using External Scripts On the Client On the Server Creating External Scripts Sending Status Logs to the Server Sending a File to the Server Index iv

5 General Information Welcome to Big Brother Windows Client Big Brother Professional Edition (BBPE, or Big Brother) is a software tool for monitoring computers, other devices with an IP address, and processes. As long as the machines are connected to a network, the physical locations of the stations being monitored are not important. This lets you monitor computer networks remotely, 24-hours a day. Big Brother can generate a web page that can be viewed internally or externally and notify one or more people of the network status via or pager. Big Brother consists of two parts: a server and a client. The Big Brother server performs connectivity tests for various network services on each defined host. You must install the Big Brother client on any computer where you want to monitor internal resources like CPU, disks, memory, processes, services, and event logs. This help file describes how to configure the Big Brother client so it performs the tests and reports the results you want. For instructions on configuring the Big Brother server, and on using the Big Brother status display Web page, please see the Big Brother server help file, which is accessible from the status display. If you want to learn how to remotely deploy many clients at the same time, please consult the help file for the Big Brother Windows server. Copyright Quest Software, Inc All Rights Reserved. Using the Configuration Editor The Big Brother Client Configuration Editor lets you configure the various settings to suit your environment: you can list which disks, services, and processes to test, what test results cause the Big Brother server to send warning notifications, and more. You can start the Configuration Editor from the Windows Start menu by selecting Programs, Quest Software, Big Brother, Client, Configure. Here is a sample of the Editor's Screen display: 1

6 Printed Documentation There are individual topics describing each entry field and checkbox on the display. You can reach them through the table of contents or by typing the field name in the index. There are three buttons at the bottom of the screen: Start Service/Stop Service Either stops or starts the Big Brother client service. You can also start and stop the Big Brother client through the Windows Start menu. Save Saves the changes you have made. Quit Exits the Configuration Editor. 2

7 General Information Note. All settings are saved in the Windows Registry under the HKEY_LOCAL_MACHINE\SOFTWARE\Quest Software\Big Brother\bbnt key. The subkey names are similar to the prompts for the fields they store. The Big Brother client does not have to be restarted when changing the settings. Just save them and the next cycle will use the new values. Starting and Stopping the Client Big Brother provides two ways to stop or start the Big Brother client service: From the Start menu, select Programs, Quest Software, Big Brother, Client, then either Start or Stop. On the Configuration Editor, click Start Service or Stop Service. Setup on the Server You must define the client host on the appropriate Big Brother BBDISPLAY and BBPAGER server(s). (If you want the Big Brother server to perform network tests on this host, you must also define it on the BBNET server.) You must add it to the list of hosts in the etc\bb-hosts.cfg file on a Windows server or the etc/bb-hosts file on a UNIX server. You must do this even if you are installing the client on the same computer as the server software. Follow the instructions in the server help file for adding a host. If the client computer is DHCP enabled, you must use for its IP address when defining it in the bbhosts file on the Big Brother server. This causes the server to look up this host using only its computer name, not the IP address. If you are using external scripts on this host, there is additional setup needed on the server. Again, see the server help file for more information. About Quest Software Quest Software, Inc. delivers innovative products that help organizations get more performance and productivity from their applications, databases and Windows infrastructure. Through a deep expertise in IT operations and a continued focus on what works best, Quest helps thousands of customers worldwide meet higher expectations for enterprise IT. Quest s Windows Management solutions simplify, automate and secure Active Directory, Exchange and Windows, as well as integrate Unix, Linux and Java into the managed environment. Quest Software can be found in offices around the globe and at Customer Support Visit the support web site for current contact information and hours of operation: Copyright Information Copyright Quest Software, Inc All Rights Reserved. This help file contains proprietary information, which is protected by copyright. The software described herein is furnished under a software license or nondisclosure agreement. This software may be used or copied only in accordance with the terms of the applicable agreement. No part of this file may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying and recording for any purpose other than the purchaser s personal use without the written permission of Quest Software, Inc. Warranty The information contained in this help system is subject to change without notice. Quest Software makes no warranty of any kind with respect to this information. QUEST SOFTWARE SPECIFICALLY DISCLAIMS THE IMPLIED WARRANTY OF THE MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. Quest Software shall not be liable for any direct, indirect, incidental, consequential, or other damage alleged in connection with the furnishing or use of this information. Trademarks Quest Software, Foglight, Spotlight, and Big Brother are registered trademarks or trademarks of Quest Software. All other trademarks are the property of their respective holders. Acknowledgements 3

8 Printed Documentation SocketTools by Catalyst Development Corp. Portions of this software based on SocketTools(TM) licensed from Catalyst Development Corporation Regex++ library Copyright by Dr. John Maddock This excellent regular expression library written by Dr. John Maddock was used in the development of the Big Brother Professional Edition Server. Permission to use, copy, modify, distribute and sell this software and its documentation for any purpose is hereby granted without fee, provided that the above copyright notice appear in all copies and that both that copyright notice and this permission notice appear in supporting documentation. Dr. John Maddock makes no representations about the suitability of this software for any purpose. It is provided "as is" without express or implied warranty. Cryptographic routines This product includes cryptographic software written by Eric Young Numeric paging This product includes POWERP32.DLL, a product written by Ron Tanner of Tanner & Associates. SMS Messaging Portions copyright LANGNER Communications AG. All Rights Reserved. libcurl Copyright (c) , Daniel Stenberg, <daniel@haxx.se>. NET-SNMP Copyright 1989, 1991, 1992 by Carnegie Mellon University Copyright 1996, The Regents of the University of California Copyright (c) , Networks Associates Technology, Inc All rights reserved. Portions of this code are copyright (c) , Cambridge Broadband Ltd. All rights reserved. Copyright 2003 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, California 95054, U.S.A. All rights reserved. Copyright (c) , Sparta, Inc All rights reserved. Copyright (c) 2004, Cisco, Inc and Information Network Center of Beijing University of Posts and Telecommunications. All rights reserved. Copyright (c) Fabasoft R&D Software GmbH & Co KG, 2003 oss@fabasoft.com Author: Bernhard Penz Troubleshooting This topic describes some situations you may run into while configuring and using the Big Brother client. Click the symptom below to view the description. Note. You can have the client create a log file showing its activity; this can help in troubleshooting many problems. See Activate Log, Status logs don't appear on the display server Memory leaks Perflib errors Dr. Watson errors or the client hangs Conflicts with Oracle Conflicts with Lotus Notes The cpu and procs columns are not generated (or have stopped being generated) Status Logs Don't Appear on the Display Server If the status for tests run by this client do not show up on the Big Brother display, make sure the Big Brother client and Big Brother server are configured correctly. Make sure the IP address or host name defined in the BBDISPLAY field of the configuration editor is correct. Verify that the host name in the bb-hosts or bb- 4

9 General Information hosts.cfg file on the BBDISPLAY server matches the real host name of the client or the entry in the BB Name Alias field of the Configuration Editor. If the host names do not match, there should be log files for the host name as defined on the client in the bbvar/logs subdirectory on the BBDISPLAY server. The log file names contain both the host name and the column name. Use the host name from the log files in the bbhosts or bb-hosts.cfg file. If the status for tests run by this client show up purple on the Big Brother display, indicating status logs from this client aren't getting to the server, make sure the Big Brother client is running Memory Leaks There have been reports of memory leaks while running the Big Brother client. These leaks are caused by performance extensions in loaded DLLs. It also has been reported that the client does not start because of third-party performance DLLs. To find out which DLL is causing the problem: Disable all extensions by renaming them. Using Regedit, go to HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Services. Search for the string Performance. Rename each key found to xperformance. This should stop any memory leak. Set the Big Brother client Timer to five seconds. This will make any memory leak apparent more quickly. Re-enable one of the performance extensions by changing xperformance back to Performance. Wait about 15 minutes, then use the Task Manager to see if the Big Brother client's memory use has increased. If so, you've found a problem; disable that performance extension. Repeat the previous step for each of the disabled performance extensions. Check all the extensions even if you've already found one which causes the problem; there could be more than one. Change the Timer setting back to its regular value (the default is 300 seconds). We strongly suggest you read article Q at Article Q also applies in some situations. In our experience, problems have been noticed with tapiperf.dll, rasman.dll and perfctrs.dll. Perflib Errors Sometimes, you may find an entry similar to this in the event log: The Collect Procedure for the <service name> service in DLL <extension DLL name> generated an exception or returned an invalid status. Performance data returned by counter DLL will not be returned in Perf Data Block. Exception or status code returned is DWORD 0.. You can modify the verbosity of perflib message by editing the HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Perflib key. Changing the EventLogLevel value changes the verbosity of the error messages. You can also change the ExtCounterTestLevel value name to configure the level of checking performed. For more information, see articles Q and Q at Article Q also has information on perflib messages. Dr. Watson Errors or the Big Brother Client Hangs If you get Dr. Watson errors or the Big Brother client hangs, clear the Force Registry Close checkbox in the configuration tool. This causes the client to close the Performance registry key (from which performance data is retrieved); this sometimes corrects the problem. Microsoft documents that you do not have to close this key, but memory leaks may occur if you do not. Unfortunately, closing the Performance key can sometimes make the Big Brother client crash. This sometimes happens when Oracle runs on the same computer or the computer is in a cluster. Conflicts with Oracle When the Oracle Performance Monitor is installed, the Big Brother client and Oracle sometimes conflict over performance statistics. To remove the Oracle Performance Monitor, follow these instructions: 1. From the Start menu, select Programs, Oracle. This starts the Oracle Installer and displays the Software Asset Manager. 2. From the list of installed software on the right side of the dialog, select the Oracle 5

10 Printed Documentation Performance Utility. 3. Click the Remove button. 4. On the confirmation dialog, click Yes. 5. Exit the Oracle Installer. Tip. Renaming the Performance key to xperformance, as described in the Memory Leaks section, can also work in this situation. Conflicts with Lotus Notes The Big Brother client is also prone to conflicts with Lotus Notes. (Other applications have been reported to have the same issue.) If you are having problems on a computer with Notes installed, first determine if performance statistics are installed in Domino. To do so, start the Windows Performance Monitor Tool and check for an Object called Lotus Notes. If the object exists, you should remove it. To find out how to do this, go to Follow the directions in document #174802, "How to Remove the Notestat Key from the Windows NT Registry." You can find this document by searching for "notes stat." Tip. Renaming the Performance key to xperformance, as described in the Memory Leaks section, can also work in this situation. CPU and PROCS Columns Are Not Generated If the Big Brother Web page displays valid disk and msgs status, but not cpu or proc status, make sure the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\PerfProc\Performance\Disab le Performance Counters key is set to 0, and change it if it isn't. You can get more information at: On certain occasions, on Windows 2000 servers, the Windows kernel does not return valid performance data even if this key is set correctly. If you still aren't getting cpu or procs status logs for the client (or the entries have turned purple) check the Activate Log box in the Configuration Editor. If the numprocs or oldnumprocs values are very high in the generated trace log, your server cannot reliably return performance data for the CPU and process checks. 6

11 Field Descriptions Activate Log Checking this box causes the client to log the current cycle of the client s monitoring session to the C:\temp\bb.log file (if C:\temp does not exist, it places the file in the %TMP% or %TEMP% directory). This activity log can be useful in debugging if it appears one or more tests are not working correctly. BB Name Alias This must be the hostname as defined in the etc/bb-hosts or etc\bb-hosts.cfg file on the BBDISPLAY and BBPAGER servers. It must match the name on the server exactly. By default, this is the DNS hostname. If for some reason you do not want to use this name to identify this computer to Big Brother, type the hostname the client should use when sending its status logs. Be sure this exactly matches the hostname as defined on the Big Brother server(s). DISPLAY and PAGER Hosts The Big Brother client sends its status reports to one or more display (BBDISPLAY) and pager (BBPAGER) servers. In these two fields, you must enter the IP addresses or hostname for each BBDISPLAY and BBPAGER server the client should report to. If a server is both a BBDISPLAY and BBPAGER server, you must enter its hostname or IP address in both fields. To enter a hostname or the IP address for a BBDISPLAY server, type it in the field under DISPLAY hosts, then click Add. Repeat this for any additional BBDISPLAY servers.. To enter a hostname or the IP address for a BBPAGER server, type it in the field under PAGER hosts, then click Add. Repeat this for any additional BBPAGER servers. To remove a server from either list, select it from the drop down list and click Del. You can specify a different port number than the default port by adding it as a suffix to the IP address or hostname e.g :1985 If you specify an IPv6 address with a different port number than the default one, enclose the IPv6 address with "[]" e.g. [::1]:1985 This definition will connect to the IPv6 localhost on port 1985 DISPLAY and PAGER Hosts The Big Brother client sends its status reports to one or more display (BBDISPLAY) and pager (BBPAGER) servers. In these two fields, you must enter the IP addresses or hostname for each BBDISPLAY and BBPAGER server the client should report to. If a server is both a BBDISPLAY and BBPAGER server, you must enter its hostname or IP address in both fields. To enter a hostname or the IP address for a BBDISPLAY server, type it in the field under DISPLAY hosts, then click Add. Repeat this for any additional BBDISPLAY servers.. To enter a hostname or the IP address for a BBPAGER server, type it in the field under PAGER hosts, then click Add. Repeat this for any additional BBPAGER servers. To remove a server from either list, select it from the drop down list and click Del. You can specify a different port number than the default port by adding it as a suffix to the IP address or hostname e.g :1985 If you specify an IPv6 address with a different port number than the default one, enclose the IPv6 address with "[]" e.g. [::1]:1985 This definition will connect to the IPv6 localhost on port

12 Printed Documentation Commit Charge Thresholds These are the total memory (physical memory plus swap file) usage percentages at which the client will report warning (yellow) and panic (red) statuses. CPU Color on Reboot If the client computer is rebooted, the client adds a reboot warning to the CPU status message. It sets the status color to the color entered in this field. You can turn off the warning status after a reboot by setting the CPU reboot message duration field to 0. CPU Default Thresholds These are the CPU usage percentages at which the client will report warning (yellow) and panic (red) statuses. The number tested is the average CPU usage for the previous five minutes. CPU Reboot Message Duration This setting determines how long after a reboot the client will continue to report the status color set in the CPU color on reboot field. To completely disable the reboot warning status, set this field to 0. CPU Warning When Computer Has Been Up Enter the number of days the computer can be up without rebooting before Big Brother should report a problem on the CPU test. You can set the color for the client to report (this is usually red or yellow) in the and set status color to field below this one. If the CPU can be up indefinitely without worry, set this field to a very high number. Drive Default Thresholds These are the disk usage percentages at which the client will report warning (yellow) and panic (red) statuses. You can override these values for any individual drive by adding the drive to the Drives list. Drives List By default, the client monitors all fixed disks using the values in the Drive default thresholds field. In the Drives list, you can list network drives which the client should monitor. You can also tell the client to use different thresholds for individual drives, either network or fixed. If you define a network drive, it can be only monitored if you define if the BB client is started using the following command service to execute using a network aware account and that the network drive(s) are visible to that user. Select the drive letter from the pull-down menu to add it to the list. You can then follow it with the thresholds for yellow and red status, and optionally the color to report if the drive cannot be found. The format is: drive:yellow threshold:red threshold:color if missing For example: D:98:99 G:93:98:Y Z:101:101:R This monitors drives D, G, and Z. Drive D will report yellow at 98% capacity and red at 99%. Drive G will report yellow at 93%, red at 98%, and yellow if it cannot be found. Drive Z will never report yellow or red based on capacity (since the percentages are greater than 100), but will report red if it cannot be found. Any fixed drives not listed here will be monitored based on the default thresholds. As shown in the example, if you want a particular drive to always return green, even if it is completely full, just set both percentages over 100. If the Warning percentage is under 100 but the Panic percentage is over it, the drive may report yellow status, but never red. You may also specify the actual size instead of a percentage. Suffix the value with either K, M or G where to specify a valoue in kilobytes, megabytes or gigabytes. 8

13 Field Descriptions For example: D:98:99 G:2G:1G D drive will be tested against its percentages values while the G drive will be tested against the physical disk space remaining on that drive. Note that the value for the yellow threshold is greater than the value for the red threshold when using a physical value as it's testing the remaining disk space. Externals List In this field, enter the commands to use to run external scripts for the client to execute. Separate commands with semicolons (;). You can include arguments in any command. You can also specify how often to run the command (in seconds), by entering /INT=seconds at the end of the command. If you do not enter an interval, the client will execute the command every five minutes (300 seconds). Here is an example entry: C:\TEMP\TEST1.BAT -Q -R f /INT=600;C:\TEMP\TEST.BAT This runs the test1.bat script with the options listed every ten minutes and the test.bat script every five minutes with no options. Unless the directory where your scripts are stored is in the system PATH statement, be sure to enter the full path to the files, as shown. You can click the Add External button to browse the directory where your external scripts are located. When you select a script file, it is added to the list. For more information about external scripts, please see Using External Scripts. Fully Qualified Domain Name When this box is checked, the client includes the computer s fully qualified domain name (domain and machine name) in the status logs and alerts it sends to the server(s). For example, if the full hostname is my.host.com, checking this box send the entire name to the server; if you clear this box, the host name in status logs will just be my. This setting should match the setting for the same option on the Big Brother server. See the server help file for information about this option on the server. Ignore Msgs In this field, you can enter a list of semicolon (;) delimited strings identifying event log entries to ignore during the client s event logs check. BBNT will verify for the string(s) in the event log description and the event log source name. You can specify to ignore messages by: Source name (use exact text from the Source: field of the event log entry, it can be a subset of the text found) if you check for an event in the event log viewer, there's a "Source:" entry in the event log description. For example: "Source: Application Hang" If you want all messages from this Source error, then just enter Application Hang in the ignore messages text field of the BBNT GUI config editor, You can put multiple source names in, delimite by a semi-colon. Message content: Enter the full or partial phrase from the event log message text A pair of source name and event ID It's the same as the "Source" defintion but you also add an event ID to target a particular message. Ie. PatchLink Update Agent:1 ignore event id 1 from PatchLink Update Agent source. 9

14 Printed Documentation IP Port This is the IP port for the client to use to connect to the BBDISPLAY and BBPAGER servers. The default is This setting must match the port number being used on the server. Key Code If you want to use Big Brother's ability to encrypt the data sent from the client to the server(s), enter the shared secret key in this field. This must be exactly the same key entered in the appropriate file on the server. See the server help file for more information. Logs Timer This entry is how often (in seconds) the client will look in the Saved Logs Location directory for new log files created by external scripts. It sends the files it finds to the BBDISPLAY and BBPAGER hosts. Msg Levels This is for event log checking. You list the types of messages you want the client to report to the server, and how to report each type. Here is the format: Source:Level:Y/N:Time The Source is one of: SEC Security log SYS System log APP Applications log Any customer log created by Windows event log utility The Level is one of: ERR Error message WARN Warning message INFO Informational message SUCCESS_AUDIT Audit success message FAIL_AUDIT Audit fail message Y/N is either Y to indicate the message should send a red status and notification or N to send yellow status and no notification. Time is how many minutes to wait before expiring the entry; the default is 30. Put a space between each two message instructions. Here is a sample entry: SYS:ERR:Y:30 SYS:WARN:N:15 APP:ERR:Y:30 APP:WARN:N:15 MYLOG:ERR:Y:30 This tells Big Brother to: report red status and generate a notification for error messages in the system log (SYS:ERR:Y:30) or applications log (APP:ERR:Y:30), clearing the red status 30 minutes after the message in either case; report yellow status reset after 15 minutes and don t send a notification for warning messages in either of those logs (SYS:WARN:N:15 and APP:WARN:N:15). The also tells Big Brother to report red status and generate a notification for error messages in the MYLOG log file (MYLOG:ERR:Y:30), cleaning the red status 30 minutes after. If a message Source:Level pair is not specified, that type of message from that source is ignored. Network interfaces 10

15 Field Descriptions You can monitor the network interfaces of the computer by setting the "netdata" entry in the "Set test" box of the configuration editor: Then, you have to choose the network adapter from the list near the bottom of the configuration editor: When an adapter is chosen, default values are assigned to the adapter There are four values assigned. The first two are for the incoming % and the last two are for the outgoing %. The first value of each pair is the threshold to reach to set to yellow while the second one is the value for the threshold to generate a red status log. Make sure that you click on "Save" in the configuration editor to finalize the network adapter monitoring. Also note that you can monitor multiple interfaces and the interfaces are seperated by a colon (';') in the Network IFs field. Here's an example of the output of a netdata status log: 11

16 Printed Documentation You can also display a list of all network protocols running on the computer by setting the "netprotl" entry in the "Set test" box to "Perform": This will generate a status log that is always green and will look like the following status log: NT Computer Name The installation program fills this in with the Windows name of this computer. You can use this field to copy the configuration from this Big Brother client to another host by entering its remote computer name here and clicking Load. This copies most of the settings shown on the Configuration Editor--it does not copy the Saved Logs Location, Drives List, and Externals List fields. The remote computer must be using the same version of Big Brother. Tip. If you do not have permission to automatically connect to the remote server, a user/password prompt will appear. Enter a valid user ID for the other host. Page File Usage This is the usage percentages at which the client will report warning (yellow) and panic (red) statuses for pagefile usage. Page Levels 12

17 Field Descriptions This is a list of the status colors which will cause the client to send a notification request to the BBPAGER server. Put a space between each two colors. The default entry is: RED PURPLE You can turn notification alerts off completely for this client by clearing the Send Notification Alerts box. Physical Memory Thresholds These are the physical memory usage percentages at which the client will report warning (yellow) and panic (red) statuses. If you do not want warnings based on this test, set the percentages above 100. Processes List In this field, you can select the processes you want the client to monitor. Select the process from the pulldown menu at the right. This places the process name in the text field. Follow the name with Y to generate a notification and red status or N for no notification and yellow status, and the number of processes there should be with this name. The format is: process:y/n:number For example, enter svchost:y:3 to return a red status and generate a notification if there are not at least three instances of svchost.exe running. You need to include the process s extension only if it is.com. Separate each two processes with either a space or a tab; the entire string can be up to 1024 characters long. If you set the number to 0, Big Brother will check to make sure the process is not running; if it is, it will return either red or yellow status, depending on the Y/N setting. Only the existence of the process is checked, not whether it is running properly. You can also specify a test against the percentage of run time of a process within a BBNT cycle. There are two settings possible: CI for individual percentage and CC for cumulative percentage. An individual setting refers to the percentage of CPU cycles a single instance of a named process while a cumulative setting refers to the aggregate percentage of CPU cycles used by the same named process. For example: bbntcfg:y:1:ci5:cc20 The CI5 value will turn red if a single instance of bbntcfg uses more than 5% of CPU cycles or will turn red if all bbntcfg processes combined take more than 20% of CPU cycles. Reboot Warning Status Color Set the color the client's CPU test should report when the computer has not been rebooted for the number of days in the CPU Warning When Computer Has Been Up field. This would most often be red (panic) or yellow (warning). Timer This is how often the client performs each of its tests--the number of seconds between each monitoring cycle. The default is 300 (five minutes). You can set individual intervals for each external script the client runs. Saved Logs Location This is the directory where the client will look for status files created by external programs to be sent to the BBDISPLAY server. See Using External Scripts for more information on external status programs. Send Notification Alerts Check this box to have the client send an alert to the BBPAGER server when a test reports a status of a particular color. The colors to cause a notification in the Page Levels field; by default they are sent for red (panic) or purple (no report) status. 13

18 Printed Documentation You may want to clear this box when doing maintenance on the host so it does not generate extraneous notifications. Services List In this field, you can enter the Windows services you want to the client to monitor. The pull-down menu lists all running Windows services. Select each one you want Big Brother to monitor. In the text field, follow each service with the color to report if it is in the wrong state, the state it should be in, and whether to reset it if it is in the wrong state. The format is: name:y/r:r/s:y/n name is the name of the service. Enter Y to have the client report yellow if the service is in the wrong state, or R for red. Enter R if the service should be running, or S if it should be stopped. Enter Y to have Big Brother start or stop the service if it is in the wrong state, or N not to. Put a semicolon (;) between each two services. Here is an example: DHCP Client:Y:S:N;DNS Client:R:R:Y This causes the client to check to see if the DHCP Client service is stopped. If it isn t, it will report yellow, but will not try to stop it. It will check to see if the DNS Client is running. If it isn t, it will report red and try to start it. Set test This field is used to define the processing state of each internal test; cpu, disk, mem, msgs, netprol, pagefile, procs & services. Each test can be set to "Perform" which will execute each cycle and return the current status of the test, "Perform/Trend" to also send back performance/trending data, or set to "Always return green", which will always send a "green" status to the BB server, and lastly, the test can be set to "Disable" and in this state, the test will be skipped and no status will be sent to the BB server. Note that if you disable a test, make sure the remove the corresponding status log on the BB server otherwise the status log will turn to purple after it has expired on the BB server. The entries from the "Set test" box are saved in the Tests subkey in the BBNT registry location. A test may end with :T (Perform/Trend), :P (Perform), :G (Always green) and :D (Disable). Start Monitoring After After the service starts, the Big Brother client will wait this many minutes before performing the set of tests the first time. After the first set of tests, the amount of time between each performance of the tests is set by the Timer field. WMI custom tests The Big Brother Windows client can be configured to monitor specific values store in the Windows Management Instrumentation (WMI) database. You configure these tests using the BB client configuration editor. First, launch the BB client configuration editor, then select the "wmitest" entry in the "Set test" display box and click on the "Perform" button: 14

19 Field Descriptions When "Perform" or "Perform/Trend" is selected, the "WMI Test Config" is enabled and you can click on it to open a window to edit/add/remove new WMI tests in Big Brother. The window that opens is displayed below: Click on "Add" to open a new window to define the new test: 15

20 Printed Documentation You can define your test as: BB Test Name: the column name on BB display dashboard. Data Type: Numerical or String Threshold: click this field will allow you to define the threshold based on your Data Type WMI Query: the WMI query statement to get the performance data. If you defined a Numerical string, when you click in the Threshold field to define the values, a popup will appear: If you leave the "or" toggle box unchecked, you'll be asked to fill in the top part of the popup. The "Yellow value" is the threshold to reach to set the status to yellow and the "Red Value" is the threshold to reach in order to generate a red status. If you need to set both a minimun threshold and a maximum threshold for a value (say for a network interface where if there's no or little traffic, or the bandwidth are all used up, then you check the "or" box to be able to define both the minimum and maximum thresholds. In this case, note that a status will turn red if a test's value is below the "Red Min Value", it will turn yellow if the test's value is between the "Red Min Value" and "Yellow Min Value". The status will be green if the test's value is between the "Yellow Min Value" and "Yellow Max Value", it will turn to yellow if it's between the "Yellow Max Value" and "Red Max Value" and finally, the status log will be red is it's over the "Red Max Value". 16

21 Field Descriptions In the case of a "String" threshold, the following popup will appear when you click in the Threshold field: For string values, enter string(s) that must not be part of the test's returned string value. If a defined string value is found in the Yellow filed and no strings in the "Red String(s)" field are found then the status log will be defined as yellow. If any value in "Red String(s)" is found in the test's returned string value then the status log will be tagged as red. You can define multiple strings by delimiting them with a semicolon(';'). Notice that in the threshold field, the yellow and red string values are seperated with a colon (':'). Enter "none" if you don't need either a yellow or red value. Also, for numercal values, you can also tell BB to send performance/trending information back to the BB server if the "Trend" checkbox is checked. Here is the example to get the computer name: 17

22 Printed Documentation Notice that the "Trend" checkbox is disabled, while below, when a "Numerical" date type is defined, it becomes enabled. You can verify your settings by clicking on the Test Query button, and if a WMI query is returned successfully and you wish to save this test, click OK, the new test will be displayed into the previous "WMI Test Configuration" window, for example, for the previous setting, here's the entries if OK was clicked for both: 18

23 Field Descriptions The new test will be saved for the Big Brother client if you click the Save button as shown in the above image. Once you've added all your new tests, click Quit to close the above GUI. Finally, on the BB configuration editor main window, click Save : Now, you can either stop/start the BB client or wait for the next cycle to produce the new results. 19

24

25 External Scripts Using External Scripts In addition to the standard tests included with Big Brother client, you can have the client process execute any command. You can write external scripts which generate messages in a format the Big Brother server understands, then use the client to execute these scripts and send the results to the server. Using external scripts requires setup on both the client where the script is run and the Big Brother server(s) the client reports the results to. On the Client You need to: Create an external script which, when run, creates a file containing a properly formatted Big Brother status message in the designated directory. Use the Configuration Editor to set the directory where the Big Brother client will look for the status message files to send to the server. Use the Configuration Editor to tell the client what external scripts to run, and how often to run each one. You can also have the scripts run by the Windows scheduler. Note. Besides having the client send the results of external scripts to the server, you can use the bb.exe program to send messages directly to the BBDISPLAY and BBPAGER servers. On the Server You must assign an error ID number to the external script by adding a column name:id entry to the svcerrlist token in the bbwarnsetup.cfg file. The column name is determined by the name of the file containing the status message sent to the server. See the server help file for information about changing the svcerrlist token. Creating External Scripts An external script can be any type of executable file, such as a Perl script or a.exe file. To be usable by the Big Brother client, it must create a status log file in the directory named in the Saved Logs Location field of the Configuration Editor. The file must be named and have its contents formatted as described below. Note. You can have the client launch the script using a command line entered in the External Lists in the Configuration Editor, or have it started by the Windows scheduler or another method. The name of the file containing the status log for the external script determines the column name used for the results on the Big Brother display, so give the file the name you want to see on the display. The file must not have an extension; the client only sends files without an extension to the server. This means you have two ways to make sure the file isn't sent prematurely (after it's created but before the contents are complete): either create the file with an extension, then rename it after you've written the contents, or create it in a different directory, then move it to the Saved Logs Location when it is ready. After the client sends the file to the server, it deletes it. If you do not want this to happen, start the file name with a dash (-). This can be useful if you do not want the external script to return a purple status if it isn't performed; since the file remains in the directory, there is always a status to send to the server, even if the test has not executed again. The file must be a plain text file. It should contain only the results of the test. The first line must begin with the status color for the test (generally green, yellow, or red). The rest of the file may contain anything; you will see the contents of the file if you click the colored dot on the Big Brother display. Generally, we suggest you include the date, time, and host name on the first line, with subsequent lines describing the test results, like this: color Day date [hostname] results message results message... For example: 21

26 Printed Documentation red Thu 08 21:10: [xxx.domain.com] blah blah blah blah We strongly recommend you include the hostname on the first line, especially if the client computer uses DHCP. You can change the amount of time before the test results expire (and the test status shows purple), overriding the default value on the display server(s). Place a plus sign (+) and the amount of time before expiration immediately after the color in the log file. You can express the time in minutes (m), hours (h), or days (d). For example, to have this test not turn purple for 26 hours: green+26h Thu 08 21:10: [xxx.domain.com] blah blah blah blah Changing the expiration time can be useful for scripts you execute only once a day: backup checks, daily system checks, and so on. Also, you can send the status for a test performed on a different host by including the host name before the color, separated by a colon (:). This is useful if you are running tests for multiple hosts from the same Big Brother client. For example: some.host.anywhere:red Thu 08 21:10: [xxx.domain.com] blah blah blah blah This tells the server that this status is for some.host.anywhere, not for the current client host. Note. Some community-produced scripts are available on In most cases, these scripts contain a readme file that tells you how to install and configure them. These scripts are not supported by Quest Software. You can also send performance/trending data along with the status information. To learn how to create performance/trending data from your own external script, please consult the Big Brother Professional Edition server documentation. Note that this feature should only be applied when sending performance/trending data to a BB server that is at version level 4.20 and higher. Sending Status Logs to the Server Instead of, or in addition to, creating external scripts and having the Big Brother client service send their results to the server, you can manually send status messages to the server using the bb.exe program in the Big Brother \bin directory. bb.exe automatically sends the message to the servers entered in the DISPLAY hosts field of the Configuration Editor. To send a status message, use this format for the command: bb "status host.service color <rest of message>" host.service is the host name of this client followed by the name of the test this message is for (this is the column name on the Big Brother display). Color is the color to set the Big Brother display to. Rest of message is free-form text. The beginning of the line should be entered exactly as shown. There must be quotes before the word status and at the end of the message. Everything inside the quotes is displayed if you click the dot for this test on the Big Brother display page. Generally, the message includes the date and time, a summary of the status message, then a more detailed description, like this: bb "status host.service color date/time summary of message full message" For example: bb "status my.server.com.test green+26h Thu 08 21:10: Test is OK Subtest1 OK Subtest2 OK Subtest3 OK" 22

27 External Scripts As mentioned above, bb.exe sends the message to all entered display hosts. If the status color in the message is red or yellow, it also sends a page message to the servers defined in the PAGER hosts field. Sending a File to the Server You can also use bb.exe to send the contents of a file to the BBDISPLAY server(s). Use this format for the command: bb.exe f filename Filename is the path to a text file containing the message to send. If you use this format, be sure the contents of the file are in the correct format for the type of message you want to send. As when sending the message text, the contents of the file are sent to all servers entered in the DISPLAY hosts field of the Configuration Editor. 23

28

29 Index A Activate log...7 activity log...7 alerts--enabling and disabling...14 and set status color to...14 B BB Name Alias...7 bb.exe...22 bb.log file...7 BBDISPLAY servers...7 bb-hosts file...3, 7 BBPAGER servers...7 Big Brother overview...1 C colors for notifications...13 Commit Charge...8 Configuration Editor...1 copying configuration from another client...13 copyright information...3 CPU color on reboot...8 CPU test color on reboot...8 color when needing reboot...14 physical memory thresholds...14 setting thresholds...8 CPU test...8 CPU test...8 CPU test...8 CPU test...8 CPU warning when computer has been up...8, 14 D debugging log...7 debugging...4 disk test...8 Display hosts...7 DNS hostname...7 drive test adding network drives...8 setting thresholds...8 drive test...8 drive test...8 Drives default...8 E encryption events check ignoring messages... 9 setting message levels events check... 9 events check external scripts creating defining to Big Brother... 9 setting frequency... 9 external scripts Externals list... 9 F frequency of tests Fully Qualified Domain Name... 9 I Ignore msgs... 9 interval between tests IP Port K Key Code L Load button logs activity... 7 status for external tests creating... 21, 22 location status for external tests logs... 7 logs logs Logs Timer M Msg levels N network drives in drive test... 8 notification colors notifications enabling and disabling setting colors for notifications

30 Printed Documentation notifications...14 NT Computer Name...13 O Overview Big Brother...1 Configuration Editor...1 external scripts...21 Overview...1 P Page Levels...13 Pager hosts...7 panic level for commit charge...8 for CPU test...8 for drive test...8 for events test...10 for physical memory...14 for services test...15 panic level...8 panic level...8 panic level...8 panic level...10 panic level...14 panic level...15 Physical Memory...14 Processes list...14 Processes test...14 Q Quest Software copyright information...3 technical support...3 Quest Software...3 R rebooting CPU test color after...8 time allowed between...8, 14 rebooting...8 rebooting...8 rebooting...8 red level...8, 10, 14, 15 S scripts--external...21 Send Notification Alerts...14 sending log files to the server...22 server display... 7 pager... 7 sending log files to setup required for client... 3 server... 7 server... 7 Services list services test setting yellow and red levels commit charge... 8 CPU test... 8 drive test... 8 events test physical memory services test setting yellow and red levels... 8 setting yellow and red levels... 8 setting yellow and red levels... 8 setting yellow and red levels setting yellow and red levels setting yellow and red levels setup on the server... 3 Start Monitoring after starting the client delay before tests begin starting the client... 3 status logs stopping the client...3, 8, 14 T tests CPU... 8 drive... 8 external frequency of processes services threshold levels commit charge... 8 CPU test... 8 drive test... 8 events test physical memory services test threshold levels... 8 threshold levels

31 Index threshold levels...8 threshold levels...10 threshold levels...14 threshold levels...15 Timer...14 trademarks...3 troubleshooting...4 U user-defined tests...21 Using the Configuration Editor...1 W warning level events test...10 for commit charge... 8 for CPU test... 8 for drive test... 8 for physical memory for services test warning level... 8 warning level... 8 warning level... 8 warning level warning level warning level Y yellow level...8, 10, 14, 15 27