Version TNT SOFTWARE. ELM Enterprise Manager. Getting Started T N. Software

Transcription

1 Version TNT OFTWARE ELM Enterprise Manager Getting tarted T N T oftware

2 TNT OFTWARE ELM Enterprise Manager 3.0 Getting tarted 2002 TNT oftware All Rights Reserved 2001 Main treet Vancouver, WA UA Phone Fax

3 Table of Contents Introducing ELM Enterprise Manager ELM Enterprise Manager Terminology...2 ELM Enterprise Manager Planning and erver izing...6 Networking and ecurity...7 ystem Requirements...8 ELM Enterprise Manager erver izing Guide...10 Configuring the ELM erver Database...15 ELM Enterprise Manager Architecture...18 ELM erver...18 ELM erver Database Engine...20 ervice Agents...21 Remote Agents...25 IP Agents...26 User Interface...27 Web Viewer...28 Installation...30 Installing the ELM erver...30 Installing the ELM Console...31 Installing ervice Agents...32 Installing ervice Agents Remotely...33 Installing Remote Agents...34 Installing IP Agents...35 Pre-Configured Items...37 i

4 Chapter Introducing ELM Enterprise Manager 3.0 ELM Enterprise Manager is a client/server application that automates a variety of the administrative functions required for monitoring and managing Windows-based servers and TCP/IP systems and devices. ELM Enterprise Manager provides real time monitoring, event collection and consolidation, health and performance monitoring and data collection, service and process monitoring, flat file monitoring, enhanced cluster monitoring, end-to-end monitoring for Microsoft Exchange erver, query-based monitoring of Microsoft QL erver, support for WMI, TCP port monitoring, and TCP/IP application-based monitoring of NMP, yslog, HTTP/HTTP, MTP, POP3, FTP and PING. ELM Enterprise Manager is essentially a rules-based management system (RBM). Using filters and rules, you decide which events and conditions trigger notification or corrective action (collectively referred to as "tification Methods"). In addition to executing tification Methods, ELM Enterprise Manager also includes data archiving and reporting, a flexible and easy-to-use user interface, and an integrated, customer-built knowledge base. ELM Enterprise Manager has a flexible architecture that enables you to deploy it in a manner that suits your organization's specific needs: The ELM erver contains various Engines that handle the processing of Filters, Rules, and tification Methods. In addition, the ELM erver performs monitoring of Remote Agents and IP Agents, executes scheduled reports, and receives NMP and yslog messages. The ELM Console, which provides remote access and configuration for administrators and other users of the application. Nearly all aspects of the erver and Agents can be configured using a remote ELM Console. ELM leverages the Microsoft Management Console platform to provide users with a customizable MMC snap-in (the ELM Console) that can be distributed to all administrators, Help Desk technicians and other support professionals within your organization. The XML Web Viewer provides a Web-based interface to erver data and Agents. ervice Agents reside on Windows workstations and ervers where they monitor the systems in real-time or at specified intervals. ervice Agents execute the configured Items at the specified intervals. 1

5 ELM Enterprise Manager Terminology The following terms are used in this document, in the ELM Enterprise Manager product documentation (EEMMMC.CHM) and in ELM Enterprise Manager. Term Description ELM erver The ELM server process (eemsvr.exe) and supporting modules (DLLs). This component is comprised of several engines that handle such tasks as creating and maintaining a database for data storage, archiving and reporting, managing Agents and Agent licensing, processing Event Filters and Rules, and executing tification Methods. The ELM server includes Receivers (NMP and yslog), it monitors Remote Agents and Remote IP Agents, and manages sessions with ELM Consoles. ELM erver Database The ELM erver database contains data collected from Agents (events and performance data), Alerts generated by Actions and the Alert tification Method, Knowledge Base Articles created by administrators and end-users, and when configured, ELM erver diagnostic events. The ELM erver can use Microsoft Access (runtime included), Microsoft QL erver 6.5 or later, or Oracle 8i or later as its database platform. The ELM erver database requires the MDAC 2.6 P1 or later and JET 4.0 P3 or later. ELM Console The ELM Console refers to the snap-in that resides in a Microsoft Management Console. The ELM Console is the primary user interface for the product. The ELM Console is freely distributable throughout your organization. Installing the ELM Console requires MMC 1.2 or later; you can save the ELM Console in MMC 2.0 format when running on Windows XP. Each snap-in can connect to multiple ELM ervers, and the ELM Console snap-in can be co-mingled with other MMC snap-ins to provide single-seat administration. Web Viewer The Web Viewer is an HTTP/XML-based interface to ELM erver Objects. It is implemented as COM objects within a set of Active erver Pages that run under Internet Information erver 4.0 or Internet Information ervices 5.x. The server side of the Web Viewer is installed using the setup package for ELM. The client side of the Web Viewer is any Javascript/XML-capable Web browser. The latest versions of Netscape and Internet Explorer support both Javascript and XML and will provide the richest Web Viewer experience. Because the client side is simply a Web browser, most organizations will not have to deploy any software to client machines in order to utilize the Web Viewer. ELM erver Objects Term Agent ervice Agent Description A system monitored by an ELM erver, or a system that transmits messages to an ELM erver. There are three types of Agents: ervice Agents, Remote Agents and Remote IP Agents. The ervice Agent process (tntagent.exe) and supporting modules. This component executes Items, collects data, transmits collected data to the ELM erver, and executes Actions. ervice Agents run as a service on the monitored Agent. ervice Agents are required in order to monitor event logs, health and performance and other subsystems in real-time. ervice Agents can only be run on Windows NT, Windows 2000 and Windows XP computers. 2

6 Remote Agent Remote (IP) Agent Alert Remote Agents are also called Agentless because unlike a ervice Agent, nothing is installed on the system being monitored. Remote Agents fall into two categories: Windows workstations and servers, and TCP/IP-based computers and network devices (Remote IP Agent). The actual monitoring functions for a Remote Agent execute within the ELM erver Process. As a result, Remote Agents cannot be monitored in real-time. In addition, Remote Agents add overhead to the ELM erver process (~10MB per Remote Agent, depending on what Items are used). Remote IP Agents are non-windows workstations and servers (e.g., Unix, Linux, NetWare, etc.) and TCP/IP-based devices (routers, switches, hubs) that send messages to the ELM erver, and/or can be pinged by the ELM erver. Remote IP Agents can be used for receiving NMP traps, TCP and UDP yslog Messages, as well as for monitoring TCP/IP-based application availability and quality of service (HTTP/HTTP, MTP, POP3, FTP, PING and any TCP Port). A special type of event that can be generated from a Item or by the Alert tification Method. Alerts are stored in the TNTAlerts database and displayed in the Alerts container within the ELM Console. By design, all entries in the TNTAlerts database are displayed in the Alerts container. Although you can change what columns are displayed in the Alerts container, you cannot filter or limit the number of Alerts displayed, unless you delete an Alert. Deleting an Alert from the Alerts container also permanently deletes the Alert from the ELM erver database. Event Filters Event Filters are displayed within the Event Filter container within the ELM Console. Event Filters are used to process incoming events to determine whether or not the event should be displayed in an Event View or a Personal View, and whether or not the event should cause a Rule to execute a tification Method. Event Filters can be used to isolate a single event or specific set of events, or to isolate all events except for a single event or specific set of events. You can create an unlimited number of Event Filters. Event An event can be a single record from a Windows event log, an NMP trap, a yslog message or an Alert from an ELM Agent. Event Views Event Views use one or more Event Filters to display some or all events. Events are stored in the TNTEvents table in the ELM erver database and displayed in one or more Event Views. Event Views are created as child objects within the Event Views container in the ELM Console. You can associate one or more Event Filters to filter what events are displayed, as well as limit the number of events displayed. All Event Views have a maximum size of 50,000 events. Knowledge Base Articles Item tification Methods Knowledge Base Articles are used to add notes and comments to Events. The notes, comments and event details that comprise the Knowledge Base Article are stored in the TNTKnowledgeBaseRecords table in the ELM erver database. Knowledge Base Articles are displayed in the Knowledge Base Article container in the ELM Console. Because Knowledge Base Articles are written by administrators/endusers, they represent information that is unique and valuable to your organization. A Item is the individual thing being monitored. Items are displayed within the Item container in the ELM Console. Items watch for conditions and thresholds, collect data, check Agent, system and application availability and verify quality of service. tification Methods are used to notify administrators/end-users or take corrective action. tification Methods are displayed within the tification Method container of the ELM Console. 3

7 Performance Data The ELM erver has a rich notification engine that can execute a variety of tification Methods. You can use beeps and sounds, electronic mail, numeric and alphanumeric pagers, NMP traps, yslog messages and scripts as tification Methods. Performance Data refers to the Performance Objects and Performance Object Counters that are displayed in the Performance Data container within the ELM Console. Performance Objects are published by the operating system, but software applications and by hardware devices. Performance Counters can be monitored for thresholds and collected for capacity planning purposes. You can also import performance counters for monitoring and collection from any Windows NT, Windows 2000 or Windows XP computer. Personal Views Reports Rules Receivers Personal Views are identical to Event Filters, except that they are tied to the specific administrator/end-user that created them. Unlike Event Views which are shared views, Personal Views are only visible in the ELM Console for the user who created them. Personal Views are created as child objects within the Personal Views container in the ELM Console. You can associate one or more Event Filters to filter what events are displayed, as well as limit the number of events displayed. All Personal Views have a maximum size of 50,000 events. Reports refer to report objects that perform database queries and return the results in a pre-designed format. The ELM erver includes a report engine that enables administrators/end-users to create reports without requiring any additional software. Reports are displayed in the Reports container within the ELM Console. Reports can be generated both on an ad hoc basis and at periodic intervals, and output to a variety of formats. Rules link Event Filters with tification Methods. When one or more Event Filters assigned to a Rule are matched, the tification Method(s) assigned to the Rule is/are executed. Rules are displayed in the Rules container within the ELM Console. Each Rule can have multiple Event Filters assigned to it, and each Rule can trigger multiple tification Methods. The ELM erver includes two receivers: an NMP trap receiver and a yslog message receiver. The NMP receiver can collect, filter and archive NMP traps with and without NMP Object IDs. The yslog receiver can receive both TCP and UDP yslog messages. Other Terms Term Actions Quality of ervice (Qo) Description Actions are a form of notification that is executed by a Item. As a result, Actions occur outside of the ELM erver's notification engine. There are four Actions that can be executed: generate Alert, generate application event log entry, send a Network Pop-up Message or execute a script. Quality of ervice deals with response times. It is a level of monitoring above general availability. Determining that a critical service or application is available is only one part of proactive monitoring. Ideally, you should also monitor the responsiveness or quality of service of your critical business applications. Many Items include quality of service monitoring that enables you to generate warning events or take corrective action when an Agent, TCP port or TCP/IP-based application does not respond within the quality of service threshold. 4

8 Wizards Creating new objects in ELM is accomplished through the use of Wizards. Each Wizard takes the administrator/end-user step-by-step through the creation of an object. Wizards are used to reduce the learning curve for ELM and increase usability. Wizards are launched whenever new object creation is invoked from within the ELM Console. At the end of each Wizard is an option to re-run the Wizard to create additional objects, making multiple object creation quick and easy. 5

9 Chapter ELM Enterprise Manager Planning and erver izing Before installing and using ELM Enterprise Manager, it's a good idea to spend some time planning your architecture. You'll want to consider the following questions: Which events do you want to collect? You decide which events are important to you. For example, to collect user logon events, you may decide to collect Audit uccess and Audit Failure events on your domain controllers, but only Audit Failure events on your member server. You can filter which events are collected based on a number of event criteria. This filtering happens at the Agent level which reduces the impact on the Agent, the ELM erver and the network. Which performance counter data do you want to collect? Windows NT, Windows 2000, and Windows XP provide extensive performance monitoring capabilities. On a typical server there are hundreds of different performance metrics that can be collected and analyzed. Many applications extend the list of published performance counters by including their own application-specific objects and counters. ELM Enterprise Manager comes with several pre-defined performance data collections sets, and you can create your own custom collection sets. How frequently do you want to collect data? Data can be collected in real-time (every second), or at periodic intervals. The frequency of data collection is directly related to both resource consumption (overhead) and database size. The more frequently you collect data, the higher your resource utilization and the larger your database becomes (unless you utilize the built-in aggregation/pruning features). Which database platform do you want to use? You can choose from Microsoft QL erver, Microsoft Access, and Oracle for storing events, Alerts, Knowledge Base Articles, and performance data. While Microsoft Access supports databases up to 2 GB in size, if you anticipate your database growing beyond 500 MB, we recommend using Microsoft QL erver or Oracle. Which notification methods work best for you? You might choose to send non-critical alerts by e- mail, and critical events by network message or pager. You can even use custom batch files as a notification method, which allows you to take action when a critical event occurs (such as restarting a failed service). What Type(s) and Class(es) of Agents do you want to use? ELM Enterprise Manager provides two primary types of Agents: a ervice Agent and a Remote Agent. Providing both Agent-based and Agentless monitoring enables you to tailor your architecture to suit your organizational needs. ELM Enterprise Manager Agent's are licensed according to class: Cluster Agent - Windows NT and Windows 2000 cluster nodes erver Agent - Windows NT erver, Windows 2000 erver and Windows 2000 Advanced erver Workstation Agent - Windows NT Workstation, Windows 2000 Professional, Windows XP Professional IP Agent - Computer or device that sends NMP traps, yslog messages, or is monitored via TCP/IP 6

10 Networking and ecurity Understanding how your network resources perform is essential to healthy network management. During the planning stage, some thought should be given as to how ELM Enterprise Manager will fit into your network. At a minimum, your network will have to meet certain requirements: Name Resolution Healthy name resolution is essential to a trouble-free network. A thorough understanding of the name resolution methods used by Windows operating systems is essential to optimizing network resources. An unreliable name resolution system can create the appearance of slow or unreliable network applications. ELM Enterprise Manager uses TCP/IP to communicate and depends on the operating system and configured name resolution (e.g., WIN and/or DN). ecurity ELM Enterprise Manager uses integrated Windows ecurity (NTLM or Kerberos depending on the erver and Agent O) for authenticating users. ome of the functions simply won't function (such as killing a task or managing services) unless you have administrative rights on the computer being monitored. ELM Enterprise Manager also supports object and item-level security through the snap-in UI. This means that you can apply Windows Access Control Lists (ACLs) to and object in your ELM Enterprise Manager hierarchy. DCOM Permissions Communication between the ELM erver and the ELM Console, and between the ELM erver and a Remote Agent is all DCOM-based. At each endpoint (ELM erver, ELM Console and Remote Agent), the ELM erver service account requires DCOM Allow Access permission. In addition, on each ELM Console, the account for the administrator using the ELM Console also requires DCOM Allow Access and DCOM Allow Launch permission. Firewalls and Port Blocking Because communication between an ELM erver and an ELM Console, or between an ELM erver and a Remote Agent, is COM-based, TCP port 135 (RPC endpoint mapper) needs to be open between the communicating end-points. In addition, DCOM also uses RPC dynamic port allocation. By default, RPC dynamic port allocation randomly selects port numbers above You can control which ports RPC dynamically allocates for incoming communication and then configure your firewall to confine incoming external communication to only those ports (and TCP/UDP port 135). For more information on DCOM and firewalls, see Microsoft's White Paper Using DCOM with Firewalls. MDN users can find this article here. Communication between an ELM erver and a ervice Agent occurs over raw TCP/IP sockets. By default, the ELM erver listens on TCP port 1251 and the ervice Agent listens on TCP port Network Bandwidth ELM Enterprise Manager makes very efficient use of network bandwidth. A detailed description of the network communication - at the packet level - between the various components of the ELM Enterprise Manager system follows: ELM erver <--> ervice Agent When an event occurs on a Windows system running a ervice Agent, the ervice Agent reads the new event and forwards it to each ELM Enterprise Manager erver monitoring it. When multiple events occur in rapid succession, the Agent will group the events together and send them within the same session to the monitoring erver. This behavior highly optimizes network communication. When a single event occurs, packet analysis demonstrates that a total of 21 packets are exchanged between the Agent and erver with a total size of 415 bytes. te: This measurement represents a single event with message text that is 300 bytes (the average size of an event log message). ELM erver <--> Remote Agent The amount of network traffic between an ELM erver and a Remote Agent depends in part on what Items are being used, the individual Item schedules (which determine the frequency of communication), and the amount of data to be collected (e.g., events and performance data). 7

11 erver <--> ELM Console The ELM Console communicates with the ession Manager component of the ELM erver process. This communication is completely COM-based, encrypted and authenticated. DCOM and RPC connections are made between the ELM erver and the ELM Console to facilitate the transfer of the encrypted data. The amount of data transmitted depends on a variety of things, including how much data is being sent to the ELM erver by ervice Agents, what containers are open in the ELM Console and so forth. ystem Requirements ELM Enterprise Manager 3.0 has the following minimum ystem Requirements: ELM erver The ELM erver can only be installed on a system that meets or exceeds the following specifications: Operating ystem Windows NT 4.0 Workstation w/p6a or later Windows NT 4.0 erver/enterprise w/p6a or later Windows 2000 Professional Windows 2000 erver/advanced erver Windows XP Professional oftware Microsoft Data Access Components 2.6 w/p1 or later Microsoft JET 4.0 ervice Pack 3 or later Hardware Intel Pentium II-233Mhz (or equivalent x86 CPU) or higher 64MB memory + 3MB for each ervice Agent 10MB of memory for each Remote Agent 50MB free disk space (does not include space consumed by database or backup config file) DCOM Permissions Network ELM erver service account requires Allow Access DCOM permissions TCP/IP te: When using the ELM erver on Windows NT Workstation, Windows 2000 Professional or Windows XP Professional, you will be limited in the number of Agents you can monitor. These operating systems have a hard-coded limit of 10 inbound TCP/IP socket connections. Therefore, you cannot monitor more than 10 Agents when your ELM erver is running on one of these three platforms. This number is reduced further if you are running any other TCP/IP-based socket applications that require inbound socket connections to your ELM erver computer. In this event, you must use a Windows server family product. The server-side of the Web Viewer component only runs on Internet Information ervices 5.0 (Windows 2000) or Internet Information ervices 5.1 (Windows XP). 8

12 ELM Console The ELM Console can only be installed on a system that meets or exceeds the following specifications: Operating ystem oftware Hardware Windows NT 4.0 Workstation w/p6a or later Windows NT 4.0 erver/enterprise w/p6a or later Windows 2000 Professional Windows 2000 erver/advanced erver Windows XP Professional Microsoft Management Console 1.2 or later Intel Pentium II-233Mhz (or equivalent x86 CPU) or higher 24MB memory DCOM Permissions Network ELM Console user requires DCOM Allow Launch and Allow Access permissions on the ELM erver computer TCP/IP ervice Agent A ervice Agent can only be installed on a system that meets or exceeds the following specifications: Operating ystem Network Windows NT Workstation 4.0 w/p4 or greater Windows NT erver 4.0 w/p4 or greater Windows NT erver Enterprise Edition w/p4 or greater Windows NT erver Terminal erver Edition w/p4 or greater Windows 2000 Professional Windows 2000 erver/advanced erver Windows XP Professional TCP/IP Remote Agent A Remote Agent can be used to monitor a system that meets or exceeds the following specifications: Operating ystem Hardware Network Windows NT Workstation 4.0 w/p4 or greater Windows NT erver 4.0 w/p4 or greater Windows NT erver Enterprise Edition w/p4 or greater Windows NT erver Terminal erver Edition w/p4 or greater Windows 2000 Professional Windows 2000 erver/advanced erver Windows XP Professional x86 or RIC (Alpha) platform TCP/IP 9

13 Web Viewer Client The Web Viewer can be accessed using a supported Web Browser that meets or exceeds the following specifications: Operating ystem oftware Windows 95 OR2 or later Windows 98 or later Windows Me Windows NT Workstation 4.0 w/p4 or greater Windows NT erver 4.0 w/p4 or greater Windows NT erver Enterprise Edition w/p4 or greater Windows NT erver Terminal erver Edition w/p4 or greater Windows 2000 Professional Windows 2000 erver/advanced erver Windows XP Home Edition Windows XP Professional Web browser with the following requirements: XML parser Javascript ELM Enterprise Manager erver izing Guide A common question regarding ELM ervers is "How many Agents can be supported?" Because of the dynamic nature inherent in monitoring computers, it is impossible to calculate a ratio of ELM ervers to Agents (e.g., the number of Agents per ELM erver). It really depends on how much data is collected from the Agent, and how frequently it is collected. General Factors While there is no exact formula that can be used to size an ELM erver, there are guidelines that can be used to determine what general specifications your ELM erver requires. The following are the results of a stress test that was performed against an ELM erver. These tests are not meant to imply any specific configuration parameters, nor do they represent the ideal configuration. Instead, they are meant to provide a guideline for sizing your ELM erver. Ultimately, the amount of resources required and consumed by your ELM erver will be determined by a number of factors, including: Number and Type of Agents monitored. This is especially important when using Remote Agents. All monitoring of and collection from Remote Agents occurs in the ELM erver process; therefore, the more Remote Agents you have and the more monitoring/collection your do on the Remote Agents, the more memory the ELM erver process requires. Number of Items used and Frequency of Data from Items. To a certain extent, the number of monitor items assigned to Agents, and the frequency at which data is generated from the assigned Items (e.g., data collection or state change data) determines how much memory will be required by the ELM erver. Number of Views and Filters Used. Each time event-related data is received, the ELM erver must process the incoming data against all Event Filters and enabled Rules. A large amount of data combined with a large number of Event Filters and Rules will cause the ELM erver to consume more memory. Due to the inherent dynamics involved with events, filters and rules, it is impossible to provide any usable formula to determine how much additional memory will be consumed. 10

14 Number of ELM Consoles connected to the ELM erver. Each ELM Console connection requires the ELM erver to create and maintain a persistent session with the ELM Console. The session is used to transmit data from the ELM erver to the ELM Console for display and editing purposes. Aside from the overhead involved in maintaining the session, additional ELM erver overhead is used for the transmission of data. On average, an ELM Console session causes the ELM erver to consume approximately 10MB of memory to maintain the session. Any additional memory requirements are determined by the amount of data transmitted to the ELM Console, as well as the number of ELM Consoles to which the data needs to be transmitted. Previewing and running reports. The Report Engine is a component of the ELM erver process. When you preview or run a report, the ELM erver does all of the work: it queries the ELM erver Database, it receives the database query results, it formats the results and it outputs the results to the specified output format. These operations are both CPU and memory-intensive, particularly when a large number of records are returned, or when a large database is queried. The above list is by no means exhaustive. It is meant to illustrate the types of activities that cause the ELM erver to consume resources. Below are the results of internal testing that was performed to gauge an ELM erver's resource consumption under heavy load on modest hardware. Test Results In a test lab, a single ELM erver running on moderate hardware has been shown to handle more than 40 events per second. This translates to approximately 5 million events per day. Table 1 below details the specifications of this test server for comparison purposes: CPU Memory Disk Database Network Pentium II - 400Mhz 256MB 8GB IDE HDD QL erver 2000 (local) 100MB Ethernet Table 1 - pecifications for test ELM erver The ELM erver in this stress test demonstrated a sustained value of 38 events per second, with frequent spikes of more than 40 events per second. Average resource utilization on the ELM erver during the test is detailed in Table 2 below. Virtual CPU Usage Working et I/O Reads I/O Writes Handles Threads Memory 15% 22MB 14MB Table 2 - Average Resource Utilization by ELM erver Performance was charted for an 8 hour period during which 7 ervice Agents were used to simulate several hundred Agents. In addition to transmitting an average of 7 events per second to the ELM erver, each ervice Agent was also executing additional monitor items and reporting to the ELM erver any state or status changes for those items. As shown in Chart 1 below, the ELM erver used an average of 15% of the overall CPU time, with a peak usage of just over 18%. 11

15 Chart 1 - ELM erver CPU Usage The two primary tasks performed by the ELM erver that are CPU-intensive were Beep tification Methods and storage to the ELM erver Database. Beep and ound File tification Methods in general have shown to use extra CPU time because of the processor interrupts that are generated when the sound-related tification Methods are executed. Other tification Methods, such as s, NMP traps, etc., are generally not CPU-intensive. Chart 2 indicates that the ELM erver consumed an average of 22MB of physical memory, with a maximum peak of 23MB of physical memory. Using Remote Agents would have increased the ELM erver's working set by an average of 5-10MB per Remote Agent. Chart 2 - ELM erver Physical Memory (Working et) 12

16 As shown in Chart 3, virtual memory (pagefile) usage by the ELM erver also remained low and steady at an average of 14MB. The stress test was done using QL erver for the ELM erver database. Had the database platform been Microsoft Access, the amount of virtual memory used by the ELM erver would have been higher, perhaps as much as double this value. Chart 3 - ELM erver Virtual Memory (Pagefile) As you can see from Table 2 above, the ELM erver itself is not I/O intensive. However, what Table 1 does not show is that the ELM erver's performance can be affected if there are I/O intensive operations occurring from another process running on the same server. For example, if your ELM erver Database is on the same computer as your ELM erver, database I/O operations could impact ELM erver performance. This is more evident when average speed IDE disk drives are used instead of fast CI hard drives. Other performance metrics were collected and reviewed, and found to unremarkable. These included: Page Faults/sec, which averaged less than 7 Threads, which averaged about 40 Handles, which averaged about 423 Network bandwidth consumption, which averaged less than 2% of available bandwidth Network bytes/sec, which averaged about 10K per second (this will be greater when the ELM erver Database is on a different server) Network packets/sec, which averaged about 26 packets per second (this will also be greater when the ELM erver Database is on a different server) Conclusions A single ELM erver running on very modest hardware can easily handle millions of events per day. The critical areas for server size are (in order of importance): Memory CPU Disk Network 13

17 Tables 3 and 4 below shows some final guidelines and recommendations for ELM erver specifications, based on a variety of configuration elements: Events/Day erver CPU(s) erver Memory erver Disk Network < 250, , , ,000-1,000,000 1,000,000-2,000,000 2,000,000-3,000,000 ingle Pentium II-233 or greater ingle Pentium II-400 or greater ingle Pentium III-500 or greater Dual Pentium II-400 or greater Dual Pentium III-633 or greater 64MB or more 128MB or more IDE or CI IDE or CI 10Mbps or greater 10Mbps or greater 192MB or more CI 10Mbs or greater 256MB or more 384MB or more CI CI 3,000,000-5,000,000 Dual P4-800 or greater 512MB or more CI 5,000,000-7,000,000 Dual P4-1Ghz or greater 768MB or more 7,000,000+ Quad PIII-633 or greater 1GB or more CI or Fibre Channel CI or Fibre Channel 10Mbps or greater 10Mbps or greater 100Mbps or greater 100Mbps or greater 100MBps or greater Table 3 - General erver izing Based on Collected Events/Days. of Agents erver CPU(s) erver Memory erver Disk Network < ingle Pentium II-233 or greater ingle Pentium II-400 or greater ingle Pentium III-500 or greater Dual Pentium II-400 or greater Dual Pentium III-633 or greater 64MB or more 128MB or more IDE or CI IDE or CI 10Mbps or greater 10Mbps or greater 192MB or more CI 10Mbs or greater 256MB or more 384MB or more CI CI Dual P4-800 or greater 512MB or more CI Dual P4-1Ghz or greater 768MB or more 500+ Quad PIII-633 or greater 1GB or more CI or Fibre Channel CI or Fibre Channel 10Mbps or greater 10Mbps or greater 100Mbps or greater 100Mbps or greater 100MBps or greater Table 4 - General erver izing Based on Number of Agents If you have any questions or comments about this guide, or if you would like assistance sizing your ELM erver or architecting your ELM-based solution, please contact TNT oftware's Product upport Group. 14

18 Configuring the ELM erver Database Out of the box, ELM creates a Microsoft Access database called ELM.MDB. Even if you cancel out of the Database Wizard that is launched during setup, an Access database called ELM.MDB will be created and used by the ELM erver. When configuring ELM for QL erver, MDE or Oracle, you must first create an empty database to house the collected data. Thereafter, the appropriate tables and columns will be automatically created. te You can use the following formula to determine how large your database will be once you start monitoring Agents and collecting event data:. Agents *. Days Events Retained *. Events/Day (per Agent) * 415 (bytes) = DB ize For example, if you are monitoring 10 Agents, and you need to keep events for 20 days, and each Agent generates approximately 1,000 events each day then your database will be approximately 70MB: 10 Agents * 20 Days * 1000 Events (per Agent) * 415 bytes = 83,000,000 bytes (or 83MB) Then, add 10% to this value to account for database overhead. In the above example the resulting disk space usage should be about 92MB. The above formula treats Alerts as Events for calculation purposes. However, the above formula does not include calculations for collected performance data or Knowledge Base Articles. It is impossible to determine the amount of space consumed by collected performance data because the number of counters, the value for the counters and the frequency of data collection cannot be adequately estimated. In addition, it is impossible to determine how many Knowledge Base Articles will be created, or how large each article will be. te that only ELM Enterprise Manager and ELM Log Manager can collect events and store Knowledge Base Articles, and that only ELM Enterprise Manager and ELM Performance Manager can collect and store performance data.» To configure to the ELM erver for Microsoft QL erver or MDE: 1. Create an empty QL erver or MDE database. 2. Create a Windows or QL erver user account and grant that account database owner (dbo) privileges to the database you created in tep Run the Database Configuration Wizard: a. In the Windows 2000 ervices MMC snap-in, double-click on the ELM erver service and navigate to the Database tab. If your ELM erver is running on NT 4.0, double-click the ELM applet in Control Panel. b. Click the Launch Wizard button to launch the Database Connection Wizard. Click Next to continue past the Welcome screen. c. The Database Type screen will appear. Use the drop-down list on this screen to select Microsoft QL erver. Click Next to continue. d. The Microsoft QL erver screen will appear. i. Enter the computer name for the QL/MDE erver containing the database you created in tep 1. ii. Enter the name of the database you created in tep 1. iii. Enter the username and password for the account you created in tep 2. If this is a Windows account, check the Use Windows NT 15

19 Authentication checkbox. Click Next to continue. e. The Database Wizard Completed screen will appear. Use the dropdown to specify the length of retention for collected events. By default, collected events are kept in the database forever. f. Click Finish to save the database connection settings.» To configure the ELM erver for a new Access database: 1. Create a blank Access database in Microsoft Access 2.0 or later format. If you do not have Access installed, or if you have not created a new Access database, you can use the ystem DN creation wizard to create a new, blank Access database. 2. Run the Database Configuration Wizard: a. In the Windows 2000 ervices MMC snap-in, double-click the ELM erver service and navigate to the Database tab. If your ELM erver is running on NT 4.0, double-click the ELM applet in Control Panel. b. Click the Launch Wizard button to launch the Database Connection Wizard. Click Next to continue past the Welcome screen. c. The Database Type screen will appear. Use the drop-down list on this screen to select Microsoft Access. Click Next to continue. d. The Microsoft Access Database screen will appear. Enter the path and filename you used for the database you created or specified in tep 1. You can click the Browse button to browse your file system for the path and filename. Click Next to continue. e. The Database Wizard Completed screen will appear. Use the dropdown to specify the length of retention for collected events. By default, collected events are kept in the database forever. f. Click Finish to save the database connection settings.» To configure the ELM erver for Oracle: 1. Create an empty database on your Oracle server. 2. Create a user account and grant that account database owner (dbo) privileges to the database you created in tep Create a ystem DN on the ELM erver computer and configure it to use the database you created in tep Run the Database Configuration Wizard: a. In the Windows 2000 ervices MMC snap-in, double-click the ELM erver service and navigate to the Database tab. If your ELM erver is running on NT 4.0, double-click the ELM applet in Control Panel. b. Click the Launch Wizard button to launch the Database Connection Wizard. Click Next to continue past the Welcome screen. c. The Database Type screen will appear. Use the drop-down list on this screen to select Oracle. Click Next to continue. d. The Oracle Database screen will appear. Enter the name of the DN you created in tep 3. Enter the username and password you created/used in tep 16

20 2. e. Click Next to continue. f. The Database Wizard Completed screen will appear. Use the dropdown to specify the length of retention for collected events. By default, collected events are kept in the database forever. g. Click Finish to save the database connection settings. 17

21 Chapter ELM Enterprise Manager Architecture ELM erver The ELM erver process is a 32-bit, multi-threaded, COM-based application that runs as a service on Windows NT, Windows 2000 and Windows XP computers. This process is implemented as a set of engines and other components that provide a variety of functions, as shown in the following illustration: ession Manager The ession Manager manages the state of the ELM erver. In addition, when an ELM Console is communicating with an ELM erver, it is communicating via the ession Manager. This is all COM-based communication. 18

22 Agent Engine The Agent Engine contains the non-performance related Items. In addition, the Agent Engine manages the COM objects that represent each Agent. Performance Engine (ELM Enterprise Manager and ELM Performance Manager only) The Performance Engine contains the performance-related Item. In addition, it includes the list of all performance objects and counters that are displayed in the Performance Data container within the ELM Console. tification Engine The tification Engine executes all notification methods. It manages both the COM objects that represent the tification Methods, as well as the tification Method job queue. Event Engine The Event Engine manages all of COM objects that represent Event Filters, all Views (Events, Alerts, and Personal), and Rules. In addition, it also executes and maintains both the NMP and yslog receiver threads. Report Engine The Report Engine manages all of the COM objects that represent all Reports. In addition, it manages a Report Job Queue (for scheduled reports). The Report Engine also creates, manages and maintains the database used by the ELM erver. It also manages report editing, and handles both running and previewing reports. License Manager The License Manager maintains current licensing state. The License Manager provides license information to the Agent Engine to ensure that the proper types of Agents are licensed, and that the proper Items are available to each Agent. It also provides information to the Event Engine to facilitate the licensing of IP Agents that transmit NMP Traps or yslog messages to the ELM erver. erver ocket Thread This thread is responsible for TCP two-way socket-based communication with all ervice Agents. In addition to establishing outbound communication with a ervice Agent, this thread also listens for inbound communication from an ELM Agent. This thread is also responsible for reporting the current values of all of the ELM erver's published performance counters. The component of the thread that is responsible for reporting this data does not do anything unless and until something requests the data via the ELM erver performance library file. MAPI upport This component provides support for the MAPI tification Method. In addition, in ELM Enterprise Manager, this component includes the Exchange item. NMP upport This component provides support for the NMP receiver, the NMP OID Item, and the NMP Trap and OID tification Methods. 19

23 Common Objects This component provides support for updating, managing and saving server configuration data, ELM erver logging, scheduled items, and actions that are triggered from Items. Localization Data This component provides support for non-u.. English (localized) versions of Windows. ELM erver Database Engine ELM includes a built-in database engine that provides database support for a variety of platforms: Microsoft Access (runtime included) Microsoft QL erver MDE Oracle In order for ELM to work with a database, you must install the Microsoft Data Access Components (MDAC) version 2.6 P1 or later and JET 4.0 ervice Pack 3. You can freely download both components from Microsoft's Data Access web site. ELM stores a variety of information in its database: Event Log Records NMP Traps yslog Messages Alerts Performance Data Knowledge Base Articles Events generated by ELM erver and Agents ELM includes a licensed runtime version of Microsoft Access that automatically creates an Access database for you. During etup, a Wizard will launch that will step you through the creation of your database. By default, ELM will create an Access database called ELM.MDB that resides in the ELM program directory. If you are using Microsoft QL erver, MDE, or an ODBC-compliant database, you must first create an empty database to house the collected data. Thereafter, the appropriate tables and columns will be automatically created. ELM creates the following tables in its database: TNTAlerts All generated Alerts are stored in this table. All Alerts in this table are displayed in the Alerts container in the MMC snap-in. When you delete an Alert from this container, you are also deleting it from this table. TNTErrorLog The ELM erver can be configured to log a variety of activity and error information. When you configure the erver to Log to a Database, the activity and error information will be stored in this table. 20

24 TNTEvents This table stores the collected event data. This data includes events from Windows NT, Windows 2000, and Windows XP event logs, NMP traps, yslog messages, and events generated your ELM erver and Agents. By default, collected event data is retained in the database forever. You can configure the event retention period by running the Database Connection Wizard. TNTKnowledgeBaseRecords All Knowledge Base Articles you create are stored in this table. For ELM Enterprise Manager and ELM Performance Manager only: In addition to the above tables, any performance data that is collected will be stored in tables whose names begin with the letters PD and correspond to the performance object being collected. For example, if you were collecting the Process performance object and counters, the data would be stored in a table called PDProcess; if you collect the Memory objects and counters, the data is held in a table called PDMemory. ELM can aggregate (average) collected performance data on a weekly, monthly or quarterly basis. By aggregating your collected data, you can reduce the growth rate of your database. ervice Agents ELM uses a ervice Agent to monitor Windows NT, Windows 2000, and Windows XP computers in realtime. A ervice Agent can run on the following computers: Windows NT Workstation 4.0 w/p5 or greater Windows NT erver 4.0 w/p5 or greater Windows NT erver Enterprise Edition w/p5 or greater Windows NT erver Terminal erver Edition w/p5 or greater Windows 2000 Professional Windows 2000 erver/advanced erver Windows XP Professional Agents and ervers can have one-to-one or one-to-many relationships. A erver can monitor multiple ervice Agents and a ervice Agent can be monitored by multiple ervers. Each ervice Agent maintains separate configuration, collection set and cache files for each erver that is monitoring it. The ervice Agent is comprised of a 32-bit, multithreaded executable called TNTAGENT.EXE, its companion DLLs and its configuration data. These files exist in the %systemroot%\tntagent and \Program Files\Common Files\TNT oftware\elm 3.0 folders on the monitored system. It runs as service under the Localystem account on each monitored system. ervice Agents typically consume about 7-15MB of memory, and less than.1% of the overall CPU time on the monitored system. The amount of resources actually consumed depend on the number of Items applied to the Agent, the frequency at which those Items are executed, and the amount of data generated by or being collected from the monitored system. ervice Agents create files in the TNTAgent folder that contain configuration data and cache information: File Name Description TNTAgent.dat Agent configuration data 21

25 If the communication or connectivity between the ervice Agent and the ELM erver are interrupted, or if the ELM erver is down for any reason, the Agent will go into Cache Mode. In Cache Mode, the Agent will cache up to 10MB of data. File Name ERVER-XXX.CACHE Description Event cache file (where ERVER is the name of the ELM erver(s) monitoring the Agent and XXX represents the three character product edition: ELM Enterprise Manager - EEM, ELM Log Manager - ELM, and ELM Performance Manager - EPM). This cache file will be located in one of two places: If the Agent has an ELM erver or an ELM Console installed, the cache file will reside in the \Program Files\Common Files\TNT oftware\elm 3.0 folder. If the Agent does not have an ELM erver or an ELM Console installed, the cache file will reside in the TNTAgent folder. te Agents monitored by multiple ELM ervers may not go into cache mode for all ervers at the same time. The cache mode behavior on an Agent monitored by multiple ervers will depend on the nature of the communications disruption. For example, if one of the ELM ervers is down for maintenance, the Agent will go into cache mode for that ELM erver only. The Agent will only go into cache mode for those ELM ervers with which it cannot communicate. Also note that disabling an Agent or its Items does not put it into cache mode. This means that data transmitted by the Agent after reenabling an Agent is not cached data and will therefore trigger applicable Rules and tification Methods. Windows-based Items that can be used for ervice Agents include: Event Collector/Alarm Event Collectors are used to monitor and collect events from the event logs on Windows NT, Windows 2000, and Windows XP. You can specify the events you want to collect based on a variety of event criteria, including event type, source, event ID, and event details. Event Alarms are used to trigger action and/or notification when an event does or does not occur. Event Alarms can be configured for Windows NT, Windows 2000 and Windows XP Agents. Cluster Event Log used a combination of a erver Agent and ELM Cluster (a cluster-aware resource DLL) to provide enhanced monitoring and performance data collection in Windows NT and Windows 2000 clusters. A Cluster replaces these two components with an integrated clusteraware ervice Agent. You can use a Cluster to watch cluster system and cluster registry events. The Cluster thread can monitor any or all of the seven Cluster APIs: cluster events, quorum events, network events, node events, group events, resource events and registry events. 22

26 File Event Log used a separate executable called FileMon.exe to monitor ACII flat files. FileMon has been integrated into this version of ELM to provide you easier monitoring of flat files. You can monitor individual files, an entire directory of files, or an entire directory tree of files. Performance Alarm Performance Alarms monitor performance objects, counters and instances and can generate a variety of tification Methods when a counter or instance of a counter is greater than, less than or equal to your specified threshold for your specified duration. You can use this monitor item on Windows NT, Windows 2000, and Windows XP. Performance Data Collection et This Item is used to collect and store performance data from Windows NT, Windows 2000, and Windows XP computers. A Collection et is a group of performance counters that are collected at the same time. You can use multiple Performance Data Collection ets that contain different groups of counters, or a single Performance Data Collection et that contains all of the counters you want to collect. Process If you need to monitor individual processes, you can do so with a Process. The Process is multi-functional; it can let you know when a process has exceeded the threshold of CPU usage you specify, and it can track when processes are instantiated or terminated. ervice ervice items are used to monitor individual services and devices on Windows NT, Windows 2000, or Windows XP. ervice s can generate notification when a service or device is stopped, started, paused or resumed. In addition, ervice s can alert you when it finds a service or device set to Automatic startup that is not running. QL Using QL s, you can periodically execute QL queries against a database and generate a variety of notification options if the results returned are different from what is expected. QL s support both Windows NT and QL erver authentication, making them easy to fit into your existing QL security environment. WMI If you are using Windows Management Instrumentation--the Microsoft implementation of Web-Based Enterprise Management (WBEM)--you can use WMI s to query a WMI namespace and database. If the results of the query change, a variety of notification options can be executed. In addition to the above Windows-based Items, ELM Enterprise Manager can also execute TCP/IPbased Items against a ervice Agent. TCP/IP-based application monitoring is performed through the use of the following Items and Receivers: 23

27 FTP This monitor is used to monitor a specific FTP URL. The ELM Enterprise Manager erver periodically establishes an FTP connection to the URL and port specified. If the response is negative or slower than expected a variety of notification options can be triggered. TCP Port If you need to monitor a TCP port on any TCP/IP-based system or device, you can use a TCP Port to do so. imply specify the port you wish to monitor and the expected response time in seconds. Ping The Ping is used to send period ICMP echo requests to the Agent(s) being monitored. You can specify the size of the echo request packets and the number of packets that are sent. POP3 POP3 s are used to periodically check a POP3 mailbox for availability. The ELM Enterprise Manager erver periodically establishes a POP3 connection to the server and port specified using the mailbox credentials you enter. If the response is negative or slower than expected a variety of notification options can be triggered. MTP MTP s are used to keep tabs on MTP hosts, gateways and services. The ELM Enterprise Manager erver periodically establishes an MTP connection to the server and port specified. If the response is negative or slower than expected a variety of notification options can be triggered. Web Page Web Page s are used to monitor HTTP and HTTP URLs. The ELM Enterprise Manager erver periodically establishes an HTTP connection to the server and port specified. If the response is negative, slower than expected, or if the content has been changed, a variety of notification options can be triggered. NMP OID ELM includes an NMP that enables you to query an NMP Object ID (OID) and trigger notification if the value is greater than, less than or equal to a specified value. The NMP includes an object browser that enables you to query the objects on an NMP-capable computer, and select specific objects for monitoring. NMP Traps NMP systems are monitored using IP Agents. The ELM erver listens for NMP Traps from registered IP Agents, and treats the incoming traps as events. yslog Unix, Linux and other yslog clients are monitored using IP Agents. The ELM erver listens for yslog messages from registered IP Agents, and treats the incoming messages as events. Windows-based yslog clients can be ervice Agents and Remote Agents, as well. 24

28 Remote Agents To monitor a TCP/IP system or device, or to monitor a Windows NT, Windows 2000, or Windows XP computer without installing any additional software, you can use a Remote Agent. Using a Remote is called Agentless monitoring because no Agent code is installed on the monitored system. Because Agent code is not used on the monitored system, this will add overhead to your network. However, this scenario is advantageous when you do not want to install any software on the monitored system in order to keep tabs on it. Remote Agents are not monitored in real-time. Instead, they are monitored one of three ways: The ELM erver can execute the Windows-based Items listed below on a Remote Agent. The ELM erver (ELM Enterprise Manager and ELM Log Manager only) can passively listen for NMP traps, yslog messages from a Remote Agent. The ELM erver (ELM Enterprise Manager only) can actively make Internet application protocol connections to the Remote Agent to check availability and quality of service. Windows-based Items that can be used for Remote Agents include: Event Collector/Alarm Cluster File Performance Alarm Performance Data Collection et Process ervice QL WMI FTP TCP Port Ping POP3 MTP Web Page NMP OID NMP Traps yslog 25

29 IP Agents ELM can monitor IP devices using an IP Agent (also known as a Remote IP Agent). The ELM erver listens for traffic (e.g., NMP traps, yslog messages) and can poll IP-based services (e.g., MTP, HTTP, etc.) for availability and quality of service. This scenario is advantageous when you do not want to install any software on the monitored system in order to keep tabs on it. The primary difference between a Remote Agent and an IP Agent is the available connectivity. Remote Agents are DCOM-based and therefore rely on NetBIO, RPC and DCOM ports to be open between the ELM erver and the monitored system (Agent). IP Agents do not require these ports, and only require TCP connectivity based on what is being monitored. This means, of course, that IP Agents have a subset of the monitoring capabilities of Remote Agents. The following Items can be assigned to IP Agents: FTP TCP Port Ping POP3 MTP NMP OID yslog NMP Traps 26

30 Chapter User Interface The user interface to the ELM erver is called the ELM Console nap-in, or simply the ELM Console. ELM uses the Microsoft Management Console (MMC) framework to host its primary user interface. The ELM Console is implemented as a standalone snap-in that requires MMC 1.2 or later to operate. You can add multiple snap-ins if you have more than one ELM erver in your organization. You can use the ELM Console snap-in as a standalone application, or you can add native operating system and third-party snapins. By combining all of your snap-ins into a single MMC console, you can manage your network and infrastructure using single-seat administration. The ELM Console provides the user interface to the ELM erver. The left pane of the Console contains the console tree, also known as the cope pane. This tree displays the ELM hierarchy. The ELM erver, which resides at the top of the snap-in hierarchy, is your workspace within the ELM Console. The right pane of the Console is the details pane, also known as the Results pane. When you select an item in the console tree, the contents of the details pane will change to reflect the item you selected. The ELM Console uses both standard views and Taskpad views for the Results pane in the ELM Console. tandard view are explorer-like views of objects and items. Taskpad views are also explorer-like, but also provide the ability to add shortcuts to functions (tasks) from inside and outside a given console. The Taskpad views include shortcuts for the most common functions in the ELM Console, such as starting Wizards, updating Agents, and so forth. You can modify the existing Taskpad views, or create additional custom Taskpad views that contain the desired tasks. For more information on creating or modifying Taskpad views, refer to the Microsoft Management Console Help file. Important You cannot select multiple items in a Taskpad view. Attempting to do so will cause an error message to appear. In order to select multiple items, you must switch to the standard view for the results pane in the ELM Console. The ELM Console provides a logical container-based representation of the ELM erver Objects you can configure: Agents. The ELM erver communicates with ervice Agents, Remote Agents and IP Agents. ELM Agents monitor Windows NT, Windows 2000 and Windows XP event logs, system services, performance data, and active processes and forward information to one or more central ELM ervers. Alerts are displayed in the Alerts container, and are visible from any ELM Console. Alerts can be generated by both Actions and tification Methods. Event Filters are used to isolate one or more specific events. Event Filters provide a mechanism for selecting a subset of all events. Using wild cards and Boolean logic, the filter will identify an 27

31 event or group of events. Any number of Event Filters can be combined to create a complex set of events. By using wildcards and Boolean operators, the Administrator does not have to be familiar with every event log message. Event Views provide a mechanism for grouping events into a view that match one or more filters. Each view is dynamically updated as new events occur. By using Event Views to organize volumes of event log information the administrator can quickly diagnose problems. Knowledge Base Articles can be used to annotate collected events with customizable notes and comments. Knowledge Base articles (KBs) are used to represent this information. ince this database is centralized, all of your technicians, Help Desk staff and other users can access and benefit from using KBs. When a problem first appears, its cause and solution can be documented in a KB. Next time the problem occurs, the amount of time used to troubleshoot and resolve it is reduced because the cause and resolution information is at hand. Items are individual items that you want to monitor. For example, to monitor the event logs on Windows NT, Windows 2000, or Windows XP, you would use an Event. If you want to monitor services, you would use a ervice. tification Methods are the ways you would want to be notified of events that occur. You can have separate methods for various event categories, or separate methods for various application events. For example, you could have one method that describes how to notify a database administrator about important database related events, and another method for notifying a security administrator about important security related events. Rules are used to take action when a specific event, alarm or condition occurs. A Rule combines any number of tification Methods with any number of Event Filters to create a procedure for notifying an administrator when important events occur, for taking corrective action, or both. Personal Views are essentially personal Event Views. Personal Views enable you to create and customize views for your own use that are separate from the server-based Event Views that you can create. Reports are used for reporting against the collected data in your database (Events, Performance Data, Alerts or Knowledge Base items). ELM includes a robust reporting engine and provides you with a Wizard-based interface for creating reports on the fly, and for scheduling reports to run at a specified time. ELM also uses Wizard-based technology to step you through the most commonly performed tasks. Wizards can be run from a variety of places, including context menus and within other Wizards. Web Viewer The Web Viewer provides a read-only view of your ELM erver data. In addition to viewing information, you can also enable and disable items, and view reports that have been saved and output in HTML format. During installation of the ELM erver, you are presented with an option to automatically create an ELM virtual directory on the ELM erver. If your II server is running multiple Web ites (also known as Virtual Web ervers), you can select which Web ite you want to contain the ELM virtual directory. The virtual directory should point to the Webite directory on your ELM erver (by default, C:\Program Files\TNT oftware\elm30\webite). The Web Viewer provides access to the following items: Agents Alerts Event Filters Event Views Knowledge Base Articles tification Methods Performance Data 28

32 Personal Views Reports Rules The Web Viewer is implemented as a set of COM objects within Active erver Pages (AP) documents. It uses the Extensible Markup Language (XML) as the transport mechanism for the data, making it lightweight and fast, and XL (XML tyles) to format the data's appearance. The Web Viewer can be installed on Internet Information erver/ervices 4.0, 5.0, and 5.1. Integration with II means that you can secure the Web Viewer from unauthorized use. In addition, you can control the name of the virtual directory, the port, and other properties. The Web Viewer server components must run on the ELM erver computer. Once installed on the server, you can access the Web Viewer by pointing your Web browser at the virtual directory (by default EEM30). For example, to access the Web Viewer on a server names EARTH, you would point your Web browser to te: While we recommend using Internet Explorer as your Web browser, the Web Viewer can be access using any Web browser that supports XML parsing and Javascript. 29

33 Chapter Installation Installing the ELM erver Installing the ELM erver is a relatively easy and straightforward process. Once you've determined that your system meets the minimum requirements as previously described, you can begin your installation by performing the actual installation of the application. ELM is distributed electronically from TNT oftware's Web site ( It is packaged into a self-extracting executable that will launch the setup process when executed. It is packaged into a self-extracting executable that will launch the setup process when executed: Windows 2000 and Windows XP, as well as Windows NT computers with the Windows Installer service installed can use the Microsoft Installer package (MI package). Windows NT computers without the Windows Installer service require the EXE package. You can download the Windows Installer for both NT 4.0 and Windows 2000 from Microsoft.» To Install the ELM erver: 1. Double-click the MI or EXE file you downloaded to execute it. The etup Wizard will launch. 2. Click Next to continue. The License Agreement screen will appear. 3. elect I accept the license agreement and click Next to continue. The ReadMe Information screen will appear. 4. Read the contents of the ReadMe file and click Next to continue. The elect Features screen will appear. 5. elect the feature(s) you want to install. When selecting the erver or Console components, you can use the Browse button to choose the destination folder. Use the Disk Cost button to check available disk space. Click Next to continue. The User Information screen will appear. 6. Enter the Company Name and erial Number as it appears on your LA. If this is an evaluation version, enter the Company Name and leave the erial Number field set to Evaluation. elect the option that says Anyone who uses this computer and click Next to continue. If this is an evaluation version, the expiration date will be displayed when you click Next. If this is a non-eval version, a confirmation dialog will appear when you click Next. 7. Click Next to continue, and click OK to clear the dialog message that appears. The ervice Account Logon screen will be displayed. 8. In the Username field, enter the account you want to use for the service account. This account must have administrative rights on the ELM erver, on all ervice Agents, and on all Windowsbased Remote Agents. Enter the password for this account in the Password and Verify Password fields. 30

34 9. Click Next to continue. If the account specified in the preceding step does not already have Log on as a ervice rights on the ELM erver, the etup process will grant this right to the account. 10. If II is installed, the Web ite Name screen will appear. If you wish to install the Web Viewer component, leave the Create the ELM Web ite virtual directory on this computer checkbox checked. Leave the default Alias set to EEM30. elect the Default Web ite and click Next to continue. te: if you do not create the Web Viewer virtual directory during the initial install of ELM, you will need to create the virtual directory manually. 11. The Ready to Install the Application screen will appear. 12. Click Next to continue. etup will copy the files to the target destination, register its components, install the ELM erver service and launch the Agent Installation Wizard. 13. Click Next to continue. te: If you are presented with the Upgrade Previous Version dialog box instead of the Agent Installation Wizard, clear all of the checkboxes on this dialog box and click Next to continue. Once the file copy process has completed, the Database Connection Wizard will launch. 14. Click Next to proceed past the Wizard's Welcome screen. The Database Type screen will appear. Using the Database Type dropdown, select the type of database you want to use. 15. Click Next to continue. The next screen depends on what database type you selected: If you select Microsoft Access, the Microsoft Access screen will appear. elect the path and filename for the Access database you want created. By default, a database called ELM.MDB will be created in the ELMerver directory. To accept this default, click Next. To change the database name or location, enter the path and filename you want to use, or use the Browse button to browse for the path. Click Next to continue. If you select Microsoft QL erver, the Microsoft QL erver screen will appear. Enter the Computer Name of the QL erver, the database name and the username and password for an account that has database owner (dbo) rights on the QL erver database you created. Click Next to continue. If you select Oracle, the Oracle Database screen will appear. Enter the name of the ystem DN you created. Enter the username and password for an account that has database owner (dbo) rights on the Oracle database you created. Click Next to continue. 16. Click Finish to complete the Database Connection Wizard. 17. Click Finish to complete etup. Installing the ELM Console Installing the ELM Console is a relatively easy and straightforward process. Once you've determined that your system meets the minimum requirements for installation, you can begin your installation by performing the actual installation of the application. ELM is distributed electronically from TNT oftware's Web site ( It is packaged into a self-extracting executable that will launch the setup process when executed. It is packaged into a self-extracting executable that will launch the setup process when executed: Windows 2000 and Windows XP, as well as Windows NT computers with the Windows Installer service installed can use the Microsoft Installer package (MI package). Windows NT computers without the Windows Installer service require the EXE package. You can download the Windows Installer for both NT 4.0 and Windows 2000 from Microsoft.» To Install the ELM Console: 1. Double-click the file you downloaded to execute it. The etup Wizard will launch. 2. Click Next to continue. The License Agreement screen will appear. 31

35 3. elect I accept the license agreement and click Next to continue. The ReadMe Information screen will appear. 4. Read the contents of the ReadMe file and click Next to continue. The elect Features screen will appear. 5. elect the erver component and choose Entire feature will be unavailable. Make sure just the Console component is selected. 6. Click Next to begin the install process. 7. Click Finish to complete the install process. Installing ervice Agents In order to monitor systems in the most efficient manner possible, ELM uses a ervice Agent. The ervice Agent is a 32-bit, multithreaded application. It consists of an executable called TNTAgent.exe, dynamic link library files (DLLs), and support files which reside on the monitored system. The default installation path is %systemroot%\tntagent. The TNT Agent service runs under the Localystem account on each monitored system. There is absolutely no reason to ever use a service account for the ervice Agent service. You can use the ELM Console to install ervice Agents remotely, or you can install them manually on the target machine. ervice Agents are only used for monitoring Windows NT, Windows 2000, and Windows XP systems; if you are monitoring a computer with an Alpha or RIC processor, a different O or device that uses TCP/IP, or if you do not wish to install software on the monitored system, you can use a Remote Agent or an IP Agent. te: In order to install a ervice Agent, you must have administrative rights on the monitored system. ELM will attempt to install the ervice Agent using your current credentials (e.g., the account you're logged on with); if this account does not have administrative rights on the ervice Agent, a Connect As dialog will appear that will allow you to specify an alternative account and password.» To install a ervice Agent: 1. Right-click on the Agent container in the ELM Console snap-in and select New Agent. The Agent Installation Wizard will launch. If necessary, click Next to continue. 2. From the dropdown, select ervice Agent and click Next to continue. 3. Enter the name or IP address of the system you want to monitor. Click the Browse button to browse your network if you are unsure of the computer's name. Click Next to continue. 4. Using the dropdown, select ervice Agent. Click Next to continue. 5. Modify the Categories field as desired, or leave the default entries. Click Next to continue. 6. In the Listen on TCP Port field, enter the TCP port on which you want the Agent to listen. ervice Agents communicate with the ELM erver over TCP/IP sockets. By default, ervice Agents listen on TCP port You can change 32

36 the port used by the Agent by selecting an alternative TCP port. Use the Test button to verify that the port is available. 7. Click Next to continue. If there are no monitor items configured, click Finish to complete the Wizard. If there are monitor items, the elect s dialog will appear. In this event, click on each Item you want applied to this ervice Agent. To create a new Item, right-click in the white space in this dialog and select New Item. Click Next to continue. Click Finish. 8. Click OK to acknowledge the Agent installation. When prompted to install another ervice Agent, click. The Agent executable, companion DLL files and configuration data will have been copied to the target computer. A service called the TNT Agent will be installed and started, and real-time monitoring of the ervice Agent will commence. Installing ervice Agents Remotely If the Agent you want to monitor it on the other side of a firewall, in a DMZ environment, or located in an environment that restricts the use of NetBIO and DCOM/RPC endpoint ports, you can use the etup package to install an Agent on the remote system and then use the Agent UI to register the Agent with the ELM erver and select monitor items for the Agent. ELM is distributed electronically from TNT oftware's Web site ( It is packaged into a self-extracting executable that will launch the setup process when executed. It is packaged into a self-extracting executable that will launch the setup process when executed: Windows 2000 and Windows XP, as well as Windows NT computers with the Windows Installer service installed can use the Microsoft Installer package (MI package). Windows NT computers without the Windows Installer service require the EXE package. You can download the Windows Installer for both NT 4.0 and Windows 2000 from Microsoft.» To install a ervice Agent remotely: 1. Copy the ELM etup package to the target computer, and execute the file to begin the install. 2. The Installation Welcome screen will appear. Click Next to continue. 3. The License Agreement screen will appear. Read the license agreement and indicate your acceptance of its terms by selecting I accept the license agreement. Click Next to continue. 4. The ReadMe Information screen will appear. Read the contents of the ReadMe file and click Next to continue. 5. The elect Features screen will appear: Click erver and choose Entire feature will be unavailable. Click Console and choose Entire feature will be unavailable. Click Agent and choose Will be installed on local hard drive. 6. Click Next to continue, and then Next one more time to initiate installation. 7. The Agent executable and support files will be installed. When the installation has completed, click Finish to exit the setup application. 8. Navigate to the install path for the Agent (by default it is %systemroot%\tntagent). Execute TNTAgent.exe. 9. The Agent user interface (UI) will appear. On the menu, choose ervice Manager Install as a ervice. You will see a status message that says Agent (TNTAgent) installed. 33

37 10. Choose ervice Manager tart to start the TNT Agent service. 11. Choose File Register erver. The Connect to erver dialog box will appear. In the Name field, enter the host name, IP address or fully-qualified domain name for the ELM erver you want to register. If desired, click the Browse button to browse the network for the ELM erver you want to register. In the Port field, enter the TCP port on which the ELM erver is listening. By default, ELM ervers listen on the following TCP ports: ELM Enterprise Manager - TCP Port 1251 ELM Log Manager - TCP Port 1351 ELM Performance Manager - TCP Port 1451 te: The name field may already be filled in with an Agent name that contains :EEM (or something similar) after it. The :EEM is a visual cue that indicates the product you are running. ELM Performance Manager users will see :EPM and ELM Log Manager users will see :ELM. When these descriptors are used, the Register erver Wizard will assume the default ELM erver port is being used, and attempt to communicate with the ELM erver on that port. If you are not using the default ELM erver port, do not use a product descriptor, and specify the port you are using. 12. Click Next to continue. The elect s dialog box will appear. Put a check in the box to the left of each Item you want to assign to this Agent. You can view the properties of any Item by right-clicking the item and selecting Properties. 13. Click Finish to save the Agent settings and ELM erver registration. You should see a status message that says Data sent to ERVER, message 0x4c8, where ERVER is the name of your ELM erver. Also, a file called TNTAgent.dat will be created in the TNTAgent folder. This file contains the Agent configuration settings. Installing Remote Agents ELM can monitor Windows NT, Windows 2000, and Windows XP computers without having to install a erver Agent. The ELM erver polls Remote Agents to collect data and monitor them. Because Agent code is not used on the monitored system, this will add overhead to your network. However, this scenario is advantageous when you do not want to install any software on the monitored system in order to keep tabs on it. Remote Agents require administrative privileges on the system being monitored. If the ELM erver ervice Account has the appropriate administrative rights on the monitored system, you can use that account. Otherwise, select a Custom Account that has administrative rights on the monitored system. You can use the Test button to validate the account's permissions on the Remote Agent. te: In order to use a Remote Agent for a Windowsbased system, you must provide an account with administrative rights on the monitored system. If the account you specify does not have administrative rights on the Remote Agent, you will not be able to monitor it. 34

38 » To install a Remote Agent: 1. Right-click on the Agent container in the ELM Console snap-in and select New Agent. The Agent Installation Wizard will launch. If necessary, click Next to continue. 2. From the dropdown, select Remote Agent and make sure the IP Agent checkbox is not checked. Click Next to continue. 3. Enter the name or IP address of the system you want to monitor. Click the Browse button to browse your network if you are unsure of the computer's name. Click Next to continue. 4. Modify the Categories field as desired, or leave the default entries. Click Next to continue. 5. Click Next to continue. If there are no monitor items configured, click Finish to complete the Wizard. If there are monitor items, the elect s dialog will appear. In this event, click on each Item you want applied to this ervice Agent. To create a new Item, right-click in the white space in this dialog and select New Item. Click Next to continue. Click Finish. 6. Click OK to acknowledge the Agent installation. When prompted to install another Remote Agent, click. The Remote Agent will be added to the list of monitored systems, and the selected Items for this Remote Agent will be executed according to their settings. Installing IP Agents ELM can monitor IP devices using an IP Agent (also known as a Remote IP Agent). The ELM erver listens for traffic (e.g., NMP traps, yslog messages) and can poll IP-based services (e.g., MTP, HTTP, etc.). This scenario is advantageous when you do not want to install any software on the monitored system in order to keep tabs on it. RTo install a Remote IP Agent: 1. Right-click on the Agent container in the ELM Console and select New Agent. The Agent Installation Wizard will launch. If necessary, click Next to continue. 2. From the dropdown, select Remote Agent and make sure the IP Agent checkbox is checked. Click Next to continue. 3. Enter the name or IP address of the system you want to monitor. Click the Browse button to browse your network if you are unsure of the computer's name. Click Next to continue. 4. Modify the Categories field as desired, or leave the default entries. Click Next to continue. 5. Click Next to continue. If there are no monitor items configured, click Finish to complete the Wizard. If there are monitor items, the elect s dialog will appear. In this event, click on each Item you want applied to this ervice Agent. To create a new Item, right-click in the white space in this dialog and select New Item. Click Next to continue. Click Finish. 35

39 6. Click OK to acknowledge the Agent installation. When prompted to install another Agent, click. The IP Agent will be added to the list of monitored systems, and the selected Items for this IP Agent will be executed according to their settings. 36

40 Chapter Pre-Configured Items ELM Enterprise Manager includes several pre-configured items, many of which are ready for immediate use. The table below lists the pre-configured items and their purposes. The pre-configured items are there to provide some functionality out of the box, and to provide examples of how to configure various things. You do not need to use pre-configured items. You are free to modify and/or delete them and create your own objects and items. Items are stored in the various containers that are shown in the left-hand (scope) pane of the ELM Console. ome items are set as a default, which means that they are automatically applied to any associated new items that get created. For example, the Ping is set as a default item. This means that every time you add a new Agent, the Ping will be automatically assigned to the new Agent. Finally, some items are enabled and some are disabled. The table below details the pre-configured items that ship with ELM Enterprise Manager, including container location, whether or not the item is set as a default, and (where applicable) whether or not the item is enabled. Container Item Type Name Description Default election Enabled Event Filters Event Filter All All events from all event logs on all monitored Windows Agents N/A Audit Failures Events with an event type of Audit Failure Audit uccess Events with an event type of Audit uccess Computer Down Error events generated by the Ping or Agent ELM Agent Events All events with a source of TNTAgent ELM Agent Messages All events generated by the Agent 37

41 Container Item Type Name Description Default election Enabled ELM Cluster Messages ELM Exchange Messages ELM File Messages ELM FTP Messages ELM HTTP Messages ELM Errors ELM Messages ELM Performance Alarm Messages ELM Ping Messages ELM POP3 Messages ELM Port Messages ELM Process Messages ELM erver Events ELM ervice Messages ELM MTP Messages ELM QL Messages All events generated by the Cluster All events generated by the Exchange All events generated by the File All events generated by the FTP All events generated by the HTTP All errors or failures generated by an ELM erver or ELM Agent component All events generated by any Item All events generated by the Performance Alarm All events generated by the Ping All events generated by the POP3 All events generated by the TCP Port All events generated by the Process All events generated by an ELM erver All events generated by the ervice All events generated by the MTP All events generated by the QL 38

42 Container Item Type Name Description Default election Enabled ELM WMI Messages All events generated by the WMI Errors All error events Informational All information events yslog Events All events from a yslog client (Agent) Warnings All warning events Event Views Event View Audit Failures Uses Audit Failures Event Filter to display only events with event type of Audit Failures N/A N/A Audit Messages Uses Audit uccess and Audit Failures Event Filters to display all security events ELM Agent Uses ELM Agent Events Event Filter to display all events from any ELM Agent ELM Messages Uses ELM Agent and ELM erver Event Filters to display all events from an ELM Agent or an ELM erver ELM erver Uses ELM erver Events Event Filter to display all events from any ELM erver Error Messages Uses Errors Event Filter to display all events with event type of Error Error and Warning Messages Uses Errors and Warnings Event Filters to display all events with event type of Error or Warning Events Uses All Event Filter to display all events from all event logs on all Agents yslog Events Uses yslog Events Event Filter to display all events with an event source of yslog 39

43 Container Item Type Name Description Default election Enabled Warning Messages Uses Warnings Event Filter to display all events with event type of Warning Items Agent Agent Performs 'heartbeat' check on ervice Agent every 10 minutes. Also checks for Qo response time of 10 seconds or less and restarts TNT Agent service if service is stopped Cluster Cluster s all Cluster APIs for new Cluster API messages every 30 seconds Event Collector Collect All Events Collects all events from all event logs on all monitored Windows Agents in real-time File ample File An example of how to monitor II log files for potential attacks every 15 minutes FTP ample FTP An example of how to monitor availability and Qo of an FTP erver every 20 minutes Percent Free Disk pace <= 5% s to the LogicalDisk/% Free Disk pace counter every 15 minutes and generates an Alert when there is 5% or less of the total disk space free Performance Alarm Available Memory <= 20MB s the Memory/Available MBytes counter every 15 minutes and generates an Alert when the amount of free memory in megabytes is 20 or less Disk Queue Length >= 3 s the LogicalDisk/Avg. Disk Queue Length counter for all logical disks every 15 minutes and generates an Alert of the value is 3 or greater 40

44 Container Item Type Name Description Default election Enabled Windows NT/2000/XP Disk Collects all LogicalDisk and PhysicalDisk performance objects/counters every 30 minutes Windows NT/2000/XP Memory Collects all Memory and Paging File performance objects/counters every 30 minutes Performance Data Collection et Windows NT/2000/XP Networking Collects all Network Interface, ICMP, NBT, Network egment, UDP, TCP and IP performance objects/counters every 30 minutes Windows NT/2000/XP Processes Collects all Process and Processor performance objects/counters every 30 minutes Windows NT/2000/XP ystem Collects all ystem performance objects/counters every 30 minutes Ping Ping ends three 32-byte ICMP Echo Messages every 5 minutes to Ping an Agent and check Ping Qo. POP3 ample POP3 An example of how to monitor availability and Qo of a POP3 erver every 20 minutes Process Process Inspect all processes except _Idle and _Total every 30 minutes for excessive CPU utilization. Generates warning Alert when CPU usage by any process exceeds 50% and error Alert when CPU usage exceeds 75% ervice ervice Inspect all services every 15 minutes and generate an Alert when a service's state changes to tarted, topped or Paused MTP ample MTP An example of how to monitor availability and Qo of an MTP erver every 20 minutes 41

45 Container Item Type Name Description Default election Enabled Web Page ample HTTP An example of how to monitor availability, content integrity and Qo of an HTTP or HTTP URL erver every 20 minutes tification Methods Alert Generate an Alert Generates an Alert event in the Alerts container within the ELM Console Beep Error Beep Warning Beep Play a beep noise on the ELM erver computer when an error event is received Play a beep noise on the ELM erver computer when a warning event is received Mail ample end MTP Mail An example of how to send an MTP mail message for notification purposes Network Pop-up Message ample Network Pop-up Message An example of how to send a network message to a Windows computer for notification purposes Play ound File ample Play Foghorn ound File An example of how to play a WAV sound file on the ELM erver for notification purposes Post Web Form ample Post Web Form to PageNet An example of how to use a web post form to send a message to a PageNet Nationwide Pager service subscriber NMP ample end NMP Trap An example of how to send an NMP Trap to any NMP-capable management system (including an ELM erver) for notification purposes yslog ample end yslog Message An example of how to send a yslog message to any yslog erver (including an ELM erver) for notification purposes Performance Performance ICMP ICMP Performance Object N/A N/A 42

46 Container Item Type Name Description Default election Enabled Data Object IP IP Performance Object LogicalDisk LogicalDisk Performance Object Memory Memory Performance Object NBT Connection NBT Connection Performance Object Network Interface Network Interface Performance Object Network egment Network egment Performance Object Paging File Paging File Performance Object PhysicalDisk PhysicalDisk Performance Object Process Process Performance Object Processor Processor Performance Object ystem ystem Performance Object TCP TCP Performance Object Thread Thread Performance Object UDP UDP Performance Object Reports N/A Daily ELM Events All events from an ELM erver or ELM Agent for the current day N/A Daily Error Events All error events for the current day Daily Events All events for the current day Daily Memory Utilization Memory usage for the current day for Agents that have been assigned the Windows NT/2000/XP Memory Performance Data Collection et 43

47 Container Item Type Name Description Default election Enabled Daily Process Utilization Daily Processor Utilization Daily ecurity Events Daily ecurity Failure Events Daily Warning Events Memory Utilization Network - ICMP tatistics Network - IP tatistics Network - TCP tatistics Network - UDP tatistics Process usage for the current day for Agents that have been assigned the Windows NT/2000/XP Processes Performance Data Collection et Processor usage for the current day for Agents that have been assigned the Windows NT/2000/XP Processes Performance Data Collection et All security events (Audit uccess and Audit Failures) for the current day All Audit Failure events for the current day All warning events for the current day Memory usage for Agents that have been assigned the Windows NT/2000/XP Memory Performance Data Collection et ICMP usage for Agents that have been assigned the Windows NT/2000/XP Networking Performance Data Collection et IP usage for Agents that have been assigned the Windows NT/2000/XP Networking Performance Data Collection et TCP usage for Agents that have been assigned the Windows NT/2000/XP Networking Performance Data Collection et UDP usage for Agents that have been assigned the Windows NT/2000/XP Networking Performance Data Collection et 44

48 Container Item Type Name Description Default election Enabled Weekly ELM Events All events from an ELM erver or ELM Agent for the past week Weekly Error Events All error events for the past week Weekly Events All events for the past week Weekly ecurity Events All security events (Audit uccess and Audit Failures) for the past week Weekly ecurity Failure Events All Audit Failure events for the past week Weekly Warning Events All warning events for the past week Rules N/A Audit Failures Uses Audit Failures Event Filter, but does not yet have tification Method assigned N/A Computer Down Uses Computer Down Event Filter, but does not yet have tification Method assigned Errors Uses Errors Filter and executes Error Beep tification Method FTP is down/up/slow Uses ELM FTP Messages Event Filter but does not yet have a tification Method assigned HTTP is down/up/slow Uses ELM HTTP Messages Event Filter but does not yet have a tification Method assigned Ping is down/up/slow Uses ELM Ping Messages Event Filter but does not yet have a tification Method assigned POP3 is down/up/slow Uses ELM POP3 Messages Event Filter but does not yet have a tification Method assigned 45

49 Container Item Type Name Description Default election Enabled ervice topped/tarted MTP is down/up/slow TCP Port is down/up/slow Warnings Uses ELM ervice Messages Event Filter but does not yet have a tification Method assigned Uses ELM MTP Messages Event Filter but does not yet have a tification Method assigned Uses ELM Port Messages Event Filter but does not yet have a tification Method assigned Uses Warnings Filter and executes Warning Beep tification Method 46