How To Use Vpi Eventcenter

Transcription

1 EVENT CENTER VPI 160 Camino Ruiz, Camarillo, CA (Voice) (Fax)

2 Contents Event Center - Overview Key Features Types of events logged Reading the Event Log Event Center Setup Event Log Settings Display Columns Dim Columns Log File Export Remote Log Setup Alarm Notifications Alarm Notification - Application Specific Local Pop-Up Message Local Audio Alarm Remote Net-Pop Message Copy to System Log Pager Notification Notification Script Notification SNMP Trap Alarm Notification - All Applications Appendix A Revision History Copyright 2008 VPI, Inc. The information contained herein is subject to change without notice. As the registered end user, you are free to make and use as many copies of this manual as you like, so long as it is used for internal purposes only and is not transmitted in any manner whatsoever to any individual, organization or corporate entity not specifically named in your End User License Agreement. VPI shall not be liable for technical or editorial errors or omissions contained herein. 2 Toc

3 Event Center - Overview Voice Print uses the Event Center to provide detailed information about system events and errors encountered by all Activ! Performance Suite applications. Key Features: Runs as a Windows NT/2000 service with over several event types from error, warning to notify and by agent. Supports up to 15 notification types. You can customize notification to your specific environment. Choose from Local or network pop-up messages, local audio alarm, or to notify you of a specific event or group of events. Copy events to the Windows NT/2000 event log, pager, or script. If you feel procedures specific to your environment are needed, we have provided you with an interface with which you can execute a Windows batch or Visual Basic Script per each notification type. This can include domain wide or user net send messaging. Types of events logged: General System Information Agent Login / Logout Search Activity Archive Events Channel Activity Remote Client Interaction Heartbeat Messages Pending messages from applications are stored in a queue that is checked every 500 milliseconds (scheduled maintenance and heartbeat checks are performed during this time as well) and saved to disk if any messages are pending. The Event Log is saved in the application directory (F:\Event Log) with the filename VP_Event.log. The log file is created only at service startup, or after scheduled maintenance. It is not rechecked each time messages are written. Unless it is otherwise needed, it is a good idea to delete the Event Log file during your normal system maintenance so the log file size doesn t become unmanageable. Overview 3

4 Reading the Event Log When an Event Center log file is double-clicked, it will be opened in the Event Viewer. The user doesn't have to open the viewer manually and use the "File Open" menu anymore. When a non-event Center log file is doubleclicked, it will be opened in the user's default application instead (usually Notepad). Also, there is an "Event Center" tab added to the right-click properties dialog of Event Center log files as well. This tab displays the log file s version, computer name, and total number of records, as well as whether the log contains client information related to security alerts. Every Event Log message is provided a category, timestamp, sub-system name, and a message. Example Message: INFO: 7/17/07 1:41:52 PM - Client Manager, Client ID: 0 Agent: 1 - Administrator - Terminated Connection. The Event Log displays several categories of Messages Types. They are as follows: INFO/GENERAL: General Information messages. Can be ignored. Example Message: Media Loaded, ID: 7, Ver: 2.5, App: Voice Print, Logger ID: 1 WARNINGS: Warning messages are used to present conditions which might become errors in the future but may still be corrected internally by Voice Print. Example Message: WARNING: 7/17/07 11:07:34 AM - Activity Timeout - Agent ID: 0001, Administrator 4 Reading the Event Log

5 ERRORS: Error messages are normally events which require user intervention of some type. For example, if the Archive Media becomes full and needs to be changed by the user, an error message is generated. Example Message: ERROR: 7/17/07 2:20:50 AM - Archive, UNABLE TO ARCHIVE CALLS AS SCHEDULED! No suitable archive media could be found. Check Archive Devices. Will Try Again Later. TRACE: Trace messages are used for problem resolution. Trace Events allow the user as well as Tech- Support personnel to gather more information about internal system activity. Example Message: TRACE: 7/17/07 1:57:01 PM - DB Access, Update Transactions DB Table Called... NOTE: Due to the large number of Trace Events generated by Voice Print, it is not recommended to log Trace Events unless directed to by Voice Print Technical Support. AGENTS: Agent messages show processes such as Agent ID, login, call searches and media reports. Example Message: 7/17/07 1:57:01 PM - Main, User Login - Agent ID: 0001, Administrator NOTIFICATIONS: Alarm notifications include such warning alarms as change media, buffer failure, and archive failure. Notification alarms require user intervention. FILTER: Filtering applies to any log file that is open in the Viewer. Multiple log files can be opened at the same time, each with its individual filter settings. This also applies to other features that affect the display, such as the Display/Dim Columns and Display Size features. Reading the Event Log 5

6 SEARCH: Search criteria will include only message types selected in the Include Message Types check boxes. This can be a handy tool when narrowing down data to pinpoint a specific problem. HEARTBEAT: The Heartbeat feature insures that the Main Application Thread is still executing. If this event is triggered it means that the Application Server has stopped. JUMP TO DATE: Jump to Date gives the user the ability to seek the Live Log display to a particular date/time without having to scroll manually. SECURITY ALERTS: This feature sends security alert audits to the Event Log Viewer and to remote Event Log Viewers to log suspicious security events (see Remote Log Setup). 6 Reading the Event Log

7 BOOKMARKS: By right clicking on any item in the Live Log area of the Log Viewer window you can create a bookmark (shortcut is Ctrl+F2). Once you ve created bookmarks you can toggle between them using the Bookmark icons. Display Size: You can change the display size to ether Normal (10pt) or Small (8pt) font by right clicking anywhere on the Live Log area of the Log Viewer window. Auto Scroll: Auto Scroll is an option to auto-scroll the Log Viewer to new records when they appear. Place the mouse anywhere within the Live Log window and right click and to select this feature. Reading the Event Log 7

8 Copy to Clipboard: By right clicking on any item in the Live Log area of the Log Viewer window you can select individual text or the entire viewer record and copy it to the Windows Clipboard. This information is useful for Tech Support troubleshooting. Toolbar: Toggles between Icon only and Icon with Text display. View Menu: To toggle from reading all messages to clearing all messages use the View drop down menu. 8 Reading the Event Log

9 Event Center Setup Event Log Settings Under the Options drop down menu there is a selection for Event Log Settings. These settings control how events are written to the Event Center Log file. To access the Event Log Settings feature, select Options > Event Log Settings. Purge Log File The Purge Log File setting automatically deletes messages from the Event Log File older than X number of days selected. The default is set for 10 days. If you choose to disable event log management, all selected events will be written to the log file indefinitely. Be careful when choosing to disable event log management due to the increase in size of the log file. Log File Directory The default directory for the Event Center Log is F:\Event Log. It is not recommended to change the default directory unless directed to by a Voice Print Technician. Events to Log Only events checked will be written to the event log. The events to select from are: Information Heartbeats Agent Events Warnings Notifications Internal Trace Errors Security Alerts Debug Trace Event Center Setup 9

10 Delete All Button The Delete All Button will delete ALL records in the event log file and the action cannot be reversed! If you need a backup before deleting the file, use the Log File Export feature. Display Columns By right clicking anywhere on the Event Center screen, a shortcut window will appear. The window allows you to clear all messages, select message types (i.e., General, Messages, etc.), and change your column display. This filter applies to any log file that is open in the Viewer. Multiple log files can be opened at the same time, each with its individual filter settings. To change the column display, select Display Columns and check or uncheck the following: Event Type Application Name Time Stamp Process Message 10 Event Center Setup

11 Dim Columns This filter assists in pinpointing certain events by dimming (faintly outlining) the Columns Text so when you re scrolling for errors it will be easier to locate. This filter applies to any log file that is open in the Viewer. Multiple log files can be opened at the same time, each with its individual filter settings. Column Types that are currently dimmable are: Event Type Image Application Name Time Stamp Process Log File Export You can create a backup or export a copy of All Applications or just the Event Center and Voice Print Server applications. Choosing Date/Time and Message Types will create a customized file. The export file format can be in either standard Event Center Log File format or Plain ASCII Text Files. A Process Name can be selected to be included with the export file. To access the Log File Export feature, select File > Export > Save As... -OR- Send To... Export Log: The "Compress Exported Log to.zip file" feature will export the log file as a ZIP file in the same name as specified for export. Event Center Setup 11

12 Remote Log Setup This feature allows the Administrator to send real time security alerts to a remote computer s Event Center. To do this, install the Event Center on the remote computer and assign a TCP Port. This will become the Listening Port on the Host computer. On the Host computer setup the following information: IP Address: The I.P. address of the remote computer Listening Port: The TCP Port of the remote computer Select the Test Now button to verify the connection. 12 Event Center Setup

13 Alarm Notifications Besides Archive and Buffer alarms available in the Voice Print Server program, the Event Center gives you much more flexibility when creating alarm notifications. Alarm notifications can be created for the following events: Database Error: Channel Error: Buffer Alarm: Archive Alarm: Unexpected Error: A critical error involving the Voice Print Database. A critical error involving the Channel Manager or one of the Channels. A critical error involving the Buffer Device(s). A critical error involving the Archiving Device(s). Voice Print uses this error when it encounters an unknown or unexpected critical error. Alarm Notification - Application Specific To setup Alarm Notifications, select Options > Alarm Notifications > Alarm Specific. Event Center Setup 13

14 Each event has it s own unique setting -OR- you can create defaults that can be used for all events. Default settings can be applied to the currently selected event. Check the event you want to keep track of and select one or several Notification Options. If you decide to Disable All Non-Notification Event Types you will receive the following warning. Local Pop-Up Message Local Pop-Up Messages will inform the Administrator of event errors. The messages will be in standard Windows pop-up message format. Local Audio Alarm Microsoft standard audio wav files will alert you of an event error. Simply browse and select a wav file that best suits the event error. Select the preview button to test the alarm. To use the alarm, select the Enable radio button, then select OK. Remote Net-Pop Message Remote Network Pop-Up Messages will inform the Administrator of event errors. The message will be in standard Windows Network pop-up message format. 14 Event Center Setup

15 The exact Network Machine ID has to be used. In the Domain box, type NetworkMachineID (where NetworkMachineID is the name of the computer). Select the Test Now button to verify you have the correct Machine ID. To use the alarm, select the Enable radio button, then select OK. Copy to System Log Copy the event error to the system log by simply selecting the Copy to System Log button. Pager Notification To use the Pager Notification, enter the exact port number and initialization string for the modem type, and then enter a pager number. Select the Test Now button to verify the modem/pager are working correctly. Event Center Setup 15

16 Notification 1. Enter SMTP Server Settings Host: Enter the server IP Address or Fully Qualified Domain name of your server (ex: mail.voiceprintonline.com). Reply To: Enter the address you wish the alarm notification to show who sent it. This could be any address, it should also mean something to you so when you get the , you will immediately know that it is an alarm notification. This address does not need to have a mailbox with most servers. Timeout: This setting will fail the attempted notification after it hits the timeout setting. (Default: 30 seconds). 2. If your server requires Authentication before it will accept , then setup the Server Requires login. NOTE: Most Public servers do not require Authentication, so only set this up if you are sure that you require authentication. User ID: Enter the Username. Password: Enter the Password associated with the username. 3. Click the Test Now button to test the new settings. NOTE: Most Servers will not forward so you will only want to define s that have the same domain name as the server. Click OK once you enter a valid address. Click OK and close the Server Setup by clicking OK. 16 Event Center Setup

17 4. Next we will setup . as the default for all alarm notifications. Click Options, Alarm Notification, All Applications. 5. Click the Notification button. 6. Enter the address, or addresses (separate addresses by using a comma, ). Click the Enable button if you want to enable this notification. Click Test Now to test the send successfully. Click OK to close the dialog box. 7. Next, click the Apply to All button to set the notification as the default for all alarms. Click Yes to the message box confirming that you want to apply the current settings to all applications. Click OK to close the User Defaults Setup dialog button. 8. Click Options, Alarm Notification, Application Specific. This is where you would change or disable alarm notifications per alarm notification type. TROUBLESHOOTING Contact the Voice Print Customer support help line at Event Center Setup 17

18 Script Notification Another feature for messaging an event is assigning a Windows batch or script alarm. Windows Script alarms have very low memory requirements and are ideal for both interactive and non-interactive scripting needs. Supported scripts are Visual Basic Scripting (VBScript) or JavaScript (JScript). Scripts are created and controlled by the user. The use of script alarms provides enormous advantages and enables almost unlimited functionality for notification. You can run complete procedures of any size, page multiple people, notify someone or groups of people anywhere on the network and run any application program or utility program. Please visit the Microsoft Windows Script Technologies Home Page for a comprehensive web site dedicated to Microsoft s scripting technologies and complete documentation for JScript, VBScript, Windows Script Host, Windows Script Components, Remote Scripting, Script Control, and Script Debugger. You can download the latest versions of JScript and VBScript, as well as updates and enhancements to other Microsoft scripting technologies. After you have created your windows script, simply enter or browse for the script name and add parameters as necessary. The Timeout window is the maximum time in seconds a script is permitted to run. A value of zero equals no time limit. Select the Test Now button to verify the script is working correctly. To use the alarm, select the Enable radio button, then select OK. 18 Event Center Setup

19 SNMP Trap Simple Network Management Protocol (SNMP) Traps are compliant with the SNMP Version 1 Specification. For details of the use of this feature please see Appendix A located at the end of this document. Event Center Setup 19

20 Alarm Notification - All Applications To setup Alarm Notification Defaults, select Options > Alarm Notifications To save time, use the Default Notification Options to apply the same default notifications for all events. This eliminates having to select each event individually to apply defaults. Select the Apply to All button followed by the OK button to overwrite the current settings for all registered applications. To make changes to a specific application or event, use the Alarm Notification - Application Specific Setup. 20 Event Center Setup

21 VPI Event Center SNMP Trap Data APPENDIX A VPI EventCenter can be configured to send SNMP Trap packets as part of its Event Notifications feature. The SNMP Traps are compliant with the SNMP Version 1 Specification. The following information describes the layout of a typical VPI EventCenter SNMP Trap data packet that is transmitted to an SNMP Manager that is configured in VPI EventCenter s Notification setup dialogs. Raw SNMP packet data Below is a sample data capture of the raw SNMP data that is broadcasted from VPI EventCenter when pressing the Test button in the SNMP setup dialog. SNMP Trap data packets sent during actual application notifications will follow this same layout. The data is divided into raw data (displayed in hexadecimal) and its textual representation. The greenish colored areas are the values belonging to the SNMP Trap header as defined in RFC The bluish colored areas are the values that VPI EventCenter includes as part of its specific Trap data. The values are specified in Abstract Syntax Notation Version 1 format D C A Ù...public CB B F B [email protected] A AE C B 2B F W F 06 0B 2B F W E E 74..VPI Event Cent B 2B F er w C 6F B...LogViewer B F F FF FF +...W FF B 2B F W... 00A E 6F F 6E Notification T 00B B 2B F est0'..+...w.. 00C This is a Te 00D E 4D st SNMP Trap Header Data Breakdown Below is a breakdown of the SNMP header data into its individual values. Each value includes the raw hexadecimal data followed by the interpretation of the data, as it will apply to any SMNP Manager application that will be receiving the SNMP Trap D9 ASN1 Type: Sequence (0x30) End Position: 217 bytes from this sequence Total Packet Length: 220 bytes Appendix A 21

22 ASN1 Type: Integer32 (0x02), Length: 1 byte SNMP Version-1 (0) VPI EventCenter currently supports SNMP v1 traps only C ASN1 Type: Octet String (0x04), Length: 6 bytes Community: public This value is user-configurable in VPI EventCenter s Notifications setup dialogs, and should be assigned to the same Community that the receiving SNMP Manager is configured for. A4 81 CB PDU Type: Trap-PDU B F6 57 ASN1 Type: Object ID (0x06), Length: 7 bytes Enterprise OID: (iso.org.dod.internet.private.enterprises.voiceprint) Voice Print has its own Enterprise Object ID that is registered with the Internet Assigned Numbers Authority (IANA). This OID is defined in the VPI.MIB file that is provided with EventCenter, and remains the same for every SNMP Trap packet that EventCenter transmits. Any SNMP Manager that loads the VPI.MIB file provided with EventCenter will be able to match incoming SNMP Trap packets with this OID in order to display Voice Print as being the sender B ASN1 Type: IPAddress (0x40), Length: 4 bytes Sender IP Address: This value specifies the IP address of the machine that is sending the SNMP Trap packet ASN1 Type: Integer32 (0x02), Length: 1 byte Generic Trap Type: 6 (Enterprise Specific) SNMP has several native trap types available for various purposes. This value is always set to 6 by VPI EventCenter, which specifies to SNMP Managers that any data contained inside the trap will be specific to the indicated Enterprise OID above, which in this case is Voice Print/EventCenter. 22 Appendix A

23 ASN1 Type: Integer32 (0x02), Length: 1 byte Specific Type: 0 ( voiceprint.software.eventcenter.eventnotif) The VPIEVENT.MIB file that is provided with VPI EventCenter designates that Enterprise-Specific Trap 0 is an eventnotif trap. Any SNMP Manager that loads the VPIEVENT.MIB file will be able to match incoming SNMP Trap packets with this Type value and display eventnotif as being the type of trap received A6 82 ASN1 Type: TimeTicks (0x43), Length: 3 bytes System UpTime: 0 days, 01:45:24 This value represents the time, in seconds, which the sending SNMP Agent has been running. VPI EventCenter sets this value to the duration that Microsoft Windows has been running. EventCenter Data Breakdown Below is a breakdown of the EventCenter-supplied portion of the SNMP Trap data into its individual values. Each value includes the raw hexadecimal data followed by the interpretation of the data, as it will apply to any SMNP Manager application that is receiving the SNMP Trap. The Enterprise-Specific Object IDs for each value are defined in the VPIEVENT.MIB file that is provided with VPI EventCenter. Any SNMP Manager that loads the VPIEVENT.MIB file will be able to match incoming SNMP Trap values with their respective OIDs in order to display the appropriate names ASN1 Type: Sequence (0x30), Length: 17 bytes 06 0B 2B F ASN1 Type: Object ID (0x06), Length: 11 bytes OID: ( voiceprint.software.eventcenter.applicationid) ASN1 Type: Integer32 (0x02), Length: 2 bytes Value: Each application that uses VPI EventCenter must register a unique numerical Application ID for itself when initializing VPI EventCenter so that it can know which application is posting which log messages and notification events. During an SNMP Trap notification event, this value will be set to the ID of the application that is triggering the event. Such Application IDs include 200 (VoicePrint Server), 102 (Activ!View Scheduler), 141 (Activ!Vault Archive Manager), etc. Appendix A 23

24 30 1F ASN1 Type: Sequence (0x30), Length: 31 bytes 06 0B 2B F ASN1 Type: Object ID (0x06), Length: 11 bytes OID: ( voiceprint.software.eventcenter.applicationname) E E ASN1 Type: Octet String (0x04), Length: 16 bytes Value: VPI Event Center Each application that uses VPI EventCenter should register a human-readable Name for itself so that VPI EventCenter can display the names of each application that posts a log message or notification event. During an SNMP Trap notification event, this value will be set to the Name of the application that is triggering the event, if one is available, or to the Application ID otherwise. This string value is has a variable length ASN1 Type: Sequence (0x30), Length: 24 bytes 06 0B 2B F ASN1 Type: Object ID (0x06), Length: 11 bytes OID: ( voiceprint.software.eventcenter.processname) C 6F ASN1 Type: Octet String (0x04), Length: 9 bytes Value: LogViewer Each application that uses VPI EventCenter can have multiple internal tasks, each one posting their own log messages and notification events to VPI EventCenter. During an SNMP Trap notification event, this value will be set to the Application-specific Name of the internal process that is triggering the event, if one is available. This string value will not exceed 25 characters ASN1 Type: Sequence (0x30), Length: 19 bytes 06 0B 2B F ASN1 Type: Object ID (0x06), Length: 11 bytes OID: ( voiceprint.software.eventcenter.logeventtype) F FF FF FF ASN1 Type: Integer32 (0x02), Length: 4 bytes Value: Every log message and notification event that is posted to VPI EventCenter has a numeric Type associated with it, to distinguish between information messages and error notifications, for example. VPI EventCenter currently provides 36 pre-defined numeric values which applications are free to use for registering and posting their specific log message and notification events with VPI EventCenter. 6 are set aside for log message types (error, info, debug, etc), 15 are set aside for registering error/recovery notifications, and 15 are set aside for registering heartbeat notifications. 24 Appendix A

25 During an SNMP Trap notification event, this value will be set to one of the following EventCenter-provided constant values for error/recovery or heartbeat notifications: Error/Recovery Notifications Notification # Notification # Notification # Notification #15 Heartbeat Notifications Hearbeat # Hearbeat # Hearbeat # Hearbeat # ASN1 Type: Sequence (0x30), Length: 32 bytes 06 0B 2B F ASN1 Type: Object ID (0x06), Length: 11 bytes OID: ( voiceprint.software.eventcenter.logeventname) E 6F F 6E ASN1 Type: Octet String (0x04), Length: 17 bytes Value: Notification Test Each application that uses VPI EventCenter can associate a human-readable Name and Description for each notification that it registers, which are displayed in the Notification setup dialogs. During an SNMP Trap notification event, this value is set to the Application-specific Name for the particular notification event that is being posted. This string value is variable in length ASN1 Type: Sequence (0x30), Length: 39 bytes 06 0B 2B F ASN1 Type: Object ID (0x06), Length: 11 bytes OID: ( voiceprint.software.eventcenter.logeventmessage) E 4D ASN1 Type: Octet String (0x04), Length: 24 bytes Value: This is a Test SNMP Trap During an SNMP Trap notification event, this value is set to the Application-specified text that describes the reason for the notification being posted. This is the same text that is displayed in the main VPI EventCenter LogViewer window. This string value will not exceed 200 characters. Appendix A 25

26 Alarm Notification Examples Alarm notifications are specific to individual client applications that Register themselves with the Event Center. This guide describes the alarms that Activ! Voice specifically uses, but other VPI products have their own individual alarm types. The following are some examples that Activ! Voice utilizes. VOICE PRINT DIGITAL VOICE LOGGER Error/Recovery Notifications Notification #1 Unexpected Error This error is used by Voice Print when it encounters an unknown or unexpected critical error. The Server requires user intervention to clear this error Notification #2 Archive Alarm A critical error involving the Archive Device(s) has occurred and requires user intervention Notification #3 Buffer Alarm A critical error involving the Buffer Device(s) has occurred and requires user intervention Notification #4 Channel Error A critical error involving the Channel Manager or one of the Channels has occurred and requires user intervention Notification #5 Database Error A critical error involving the Voice Print Database has occurred and requires user intervention Notification #6 Shutdown Voice Print has been terminated by User Request. Recording has Stopped Notification #7 Idle Alarm This error is used to report Channels which have not had any detectable activity for a specified interval. The specified Channels should be checked for errors or continuous recording. Heartbeat Notifications Hearbeat #1 Main Application This Heartbeat is issued every Five Minutes or less to ensure the Main application Thread is executing. If this event is triggered, Voice Print has Stopped. 26 Appendix A

27 Revision History Rev Level: Date: Description: Rev A: 12/14/07 Initial Release. Rev B: 01/11/08 Page 3: Page 4: Page 10: Page 11: Page 26: Section- Event Center Overview : Added clarification to Pending Messages and how they are written to the log. Section- Reading the Event Log : Rewrote the overview on how the log is utilized. Included a new feature Event Center Tab which is added to the right-click properties dialog of all Event Center log files. Section- Display Columns : Added clarification on how this filter functions. Section- Dim Columns : Added clarification on how this filter functions. Clarified that Alarm Notification Examples within the guide are specific to Activ! Voice only. Rev. History 27