Optimizing and Maintaining your N-central Environment

Transcription

1 Optimizing and Maintaining your N-central Environment v.2.3 Jan 21, 2015 N-central 9.5 Editor: Scott Parker

2 Contents Important Information regarding this document... 4 Implementation Strategy... 4 Resources and Time Budgeting... 4 Training and Supplementary Materials... 4 Introduction Your goals within N-central... 5 Where will N-central fit into my organization... 5 The N-central clean-up process... 6 Identifying an N-central server that requires a clean-up... 6 Test #1: Is there an overabundance of non-critical Active Issues?... 6 Test #2: Does the N-central server have Misconfigured or Stale services?... 7 Test #3: Is my support team getting too many Notifications?... 7 Test #4: Am I seeing many failed probes across my customers?... 7 System Clean-Up Phase 1 Building a solid foundation... 7 Step 1 Take note of your current state... 7 Step 2 Review and Resolve N-central Probe issues... 8 Step 3 Employing Deployment Best Practices for all environments Step 4 Upgrade your On-premises N-central Server to the latest version System Clean-Up Phase 2 Aligning your core monitoring Step 1 Ensure all Customers appear in default Service Organization Level Rules Step 2 On-premises adjustment of Virtual Memory Step 3 Resolving Exchange/SQL server memory and disk monitoring Step 4 Remove Connectivity from Workstations and Laptops Step 5 Review and Re-apply Workstation and Laptop Service Templates Step 6 Removing Warranty alerting from Workstations and Laptops System Clean-Up Phase 3 Customer level maintenance Step 1 Configuring asset discovery Step 2 Populating credentials for all Customers System Clean-Up Phase 4 Leveraging the All Devices view for Maintenance Step 1 Devices who s Agents have not checked in for over 30 days Step 2 Devices classified as Other Step 3 Devices with Failed Connectivity

3 System Clean-Up Phase 5 Resolving remaining Active Issues Generic SQL Server 1433 (Failed) and SQL Server _ Total (Misconfigured) Guest Status VMware SERVERNAME (Failed) Disk I/O (Failed or Warning) HTTP/HTTPS (Failed) Windows Services (Failed) Exchange 2003 (Misconfigured) Basic workflow for troubleshooting unnecessary Active Issues (All other types) System Clean-Up Phase 6 Configuring Notifications State 1 - Legacy format using 0 Minute Delay type titles State 2 N-central 9.1+ format with a Notification per function State 3 - Mixed or user configured System Clean-Up Phase 7 Completion and Keeping Things Clean Feedback Appendix A Reviewing leveraging Filters to focus attention on critical issues Viewing only Failed and Warning states Hiding non-critical failures Filtering for items that generate a notification only Resetting your filter in Active Issues Appendix B Recommended maintenance schedule for MSPs Things to do Weekly (Maintenance): Things to do Daily (Reacting to and resolving issues): Appendix C Best Practice for new client onboarding Appendix D Notification Structure

4 Important Information regarding this document Section specific Warnings, Notes and Best Practices Tips should be understood before continuing with your changes. Please be sure to read them carefully. This content is identified by the images below: Implementation Strategy Resources and Time Budgeting The process contained in this guide may take several days of work with a dedicated group of resources depending on the current state of your N- central server. It is highly recommended that you budget appropriate time to resolve the issues and work as a team to implement the processes in these pages to get the most out of your N-central system. A successful N- central implementation coupled with improved change management will result in a more efficient, proactive service offering and increased satisfaction from both your technical team and your end users. Training and Supplementary Materials Ideally your resources should review this document and then attend the training course offered by N-able titled Optimizing your N-central Deployment. In this course you will be given a high level overview of the entire process and have the opportunity to discuss questions with an expert. This is a highly valuable starting point and is the recommended approach for anyone undertaking a server clean-up or simply looking to become more familiar with the inner workings of the system. To attend a session please follow this link: SUBSCRIPTION TRAINING CALENDAR 4

5 Introduction Your goals within N-central N-central is a comprehensive monitoring tool that will give you high visibility into the health of your managed environments. It has been configured out of the box to offer a wide spectrum of monitoring and alerting across a multitude of device classes. Your goal as an administrator of N-central should be to ensure the systems monitoring and notifications match with your needs as a managed service provider (MSP) and that the Active Issues view remains free of clutter, allowing your technical team to focus on incidents that are of importance to you and your customer. Without proper configuration clutter may build up, rendering the Active Issues view unable to perform its function as a dashboard of issues that require attention. If you are finding that there are warnings in this view that are considered unimportant by your team, you should take steps to remove them. You may also find that you are receiving an over-abundance of Notifications as a result of a cluttered Active Issues view and may wish to re-focus your alerts to critical issues only. Where will N-central fit into my organization Properly implemented and managed, N-central will be a key tool in your day to day service operations. The primary resource for the identification of reactive and proactive issues Using a properly filtered Active Issues view, Notifications, Ticketing, Dashboards and Reporting we will focus attention on critical issues and organize our service efforts. Provide visibility and accessibility for your support team By effectively working with Active Issues and Dashboard views, connecting your team through mobile devices and effectively assessing customer environments through targeted reporting we can provide a high level of visibility for your support team. Remote control to all managed devices should be functional and configured to your needs for all devices. Act as a resource for sales opportunities Leveraging N-central reports such as the Executive Summary, Patch Status, Endpoint Status and System Warranty we can bring potential opportunities to light for your sales team. Report Manager for Onpremises servers makes available advanced reports including an expanded Executive Summary that can dramatically deepen the value of the content you bring to regular customer reviews. A platform for the automation of tasks Using N-central s robust automation options, we are able to schedule regular maintenance, execute ondemand remote commands and perform file transfers and application installs. 5

6 The N-central clean-up process Identifying an N-central server that requires a clean-up If you answer yes to any of the following questions, you should plan to perform a server clean-up within your environment: Test #1: Is there an overabundance of non-critical Active Issues? 1. Expand the filter in your N-central Active Issues view by using the tab at the right hand side of your screen (requires N-central 9.1 or higher). 2. Click Reset Filter (highlighted in green below). 3. Select the options to filter Active issues by Failed and Warning only (highlighted in red). 4. Selectively remove the Patch Status, Printer Status and Printer Toner services (highlighted red). 5. Review the remaining Active Issues: a. Are there large groups of the same issue (Memory, SQL, etc.)? b. Are there services failing that you can identify as not true problems? c. Do you see issues that you will never realistically respond to because either you are not contractually obligated or they are better explored during regular business reviews or using reporting? 6

7 Test #2: Does the N-central server have Misconfigured or Stale services? 1. Click Reset Filter in the Active Issues Filter. 2. Filter Active Issues for Misconfigured and Stale. 3. Selectively remove the Patch Status, Printer Status and Printer Toner services. 4. Review the Active Issues view. Any number of misconfigured and stale issues indicates a need to clean the system. Test #3: Is my support team getting too many Notifications? 1. A common result of a cluttered Active Issues is an overabundance of Notifications flowing from N-central and overburdening your technical team. If you feel your team is suffering from this issue, your N-central server requires a clean-up. Test #4: Am I seeing many failed probes across my customers? 1. From the Service Organization (SO) level in N-central, scroll down the left hand side menu system to the Administration category. 2. Click on Probes. 3. This list should not have anything but Normal green checkmarks. Any probe that is either Stale, Misconfigured, or Failed will need to be resolved. 4. Every Customer environment should have a probe if at all possible. Are any missing one? System Clean-Up Phase 1 Building a solid foundation All thresholds and modifications in this document are suggestions based in best practices. You should evaluate and adjust these recommendations to best suit your own company s requirements and obligations to your customers. Step 1 Take note of your current state In order to see progress it is important to know where your server started. During this process the Active Issues view will fluctuate with various numbers of alerts. Pause now to document how many Active issues you see when filtering on Failed & Warning only, with the 3 services disabled (Patch Status, Printer Toner and Printer Status). We will also document how many notifications you get daily (approximate). We will be focusing on streamlining these as well. This information is visible at the bottom right of your filtered Active Issues screen. 7

8 Step 2 Review and Resolve N-central Probe issues 1. From the Service Organization (SO) level in N-central, scroll down the left hand side menu system to the Administration category. 2. Click on Probes. 3. Sort this list by Customer/Site by clicking the heading. 4. Review the displayed list: Probes in a status other than Normal will result in further misconfigured or stale services, failed patch management and agent deployment as well as many other issues. We will want to resolve these first. o As per Deployment Best Practices it is recommended you create a Domain Administrator account for the probe to use, with a complex password that will not expire. If however the password does expire, the probe will fail. You will need to log into the server that hosts the probe and re-install it should this occur. o Ensure the Windows Software Probe service is installed and running. It may simply need to be restarted. o N-central Probes require.net4. If for some reason.net fails, the probe service may fail as well. o A common problem with Probes is that the Administrator password you gave them during install has since expired or an upgrade occurred and the probe failed to inherit the credentials from the previous install resulting in permission denied errors. You can reset the password and account the probe is using by following these steps: Log on to the server or device that hosts your probe. Run the windows application services.msc on the probe device. Stop the probe services: - Windows Software Probe Maintenance service. - Windows Software Probe service. - Windows Software Probe Syslog service. Open the Properties of the Windows Software Probe service by right clicking the service. Select the Log On tab. Enter the new Domain Administrator credentials. Click Apply. Select the General tab. Enter the following in the Start Parameters field: username=yourdomain\user Password=Yourpa$$word 8

9 o o Select the Start button. Re-start the other Windows Software Probe services. If you decide to re-install the probe, you may simply manually install the appropriate customer specific Probe directly over top of the existing one on the customer s server. The first time you launch the installer it will remove the existing probe. You will commonly need to run it a second time to install a new probe service. If you choose to install the probe on a different system, DO NOT DELETE THE EXISTING PROBE IN N-CENTRAL until you have performed a Task Transfer in the Administration > Probes section of the N-central UI to move the requirements of the one probe to the new device. Best Practices Tip: Every environment (including workgroups) should have an N-central Probe. They facilitate agent deployment, patch management, device discovery and act as a source for the monitoring of network devices. If you have an environment without a server, consider building a small box running Windows 7 to place into the environment to run your probe. Alternatively, designate a PC in the environment to stay on permanently and run the probe. 9

10 Step 3 Employing Deployment Best Practices for all environments Phase 2 of the Deployment Best Practices guide (found in the N-able Resource Center, NRC, under Product Documentation) and the Runbook suggest several pre-deployment steps that are designed to make domain based devices easier to identify and on-board. If you have not previously completed the following steps, it is encouraged that you not only revisit your clients and configure them, but also incorporate these steps into all future deployments: 1. Configure a Group Policy to open three items in the workstation and server firewalls to allow easy detection and agent deployment: a. File & Print Sharing b. ICMP Inbound Echo Requests c. Inbound Remote Administration 2. On your DNS server, configure scavenging to ensure we do not have devices with multiple IP addresses. 3. On network devices such as routers, firewalls and switches, enable read only SNMP. 4. On physical name-brand servers enable SNMP and install Dell, HP or Intel management software such as Dell Openmanage. Best Practices Tip: All of the above suggestions are covered in detail in the Deployment Best Practices guide. It is HIGHLY recommended that your technical team download and follow this document for trouble free deployments in future. Step 4 Upgrade your On-premises N-central Server to the latest version Every release of N-central brings improvements and new features that we can use to better manage and maintain the system. You should update your server to get access to these features and improved monitoring templates. Hosted customers will not need to do this step as N-able automatically updates your system for you. To update your server, open the online help in the N-central UI and search for Upgrade N-central. Follow the instructions and contact the N-able support team if there are questions or problems. The Release Notes of the updates will detail the pre-requisites for updates and system requirements. In N-central version 9.2 you will see WSUS management of patching disappear, proper steps should be taken to migrate your patch management. These steps are not covered in this guide but are outlined in the release notes for that version. In 9.3 we have released a new AV Solution, and migration steps in the online help (hover over the System Time in the top right of the N-central UI and it will reveal a (?) Help Icon) should be followed as well. Best Practices Tip: Be sure to have a backup of your N-central data before performing an update. Backups are configured at the System level (typically red) of your on-premises server under the Administration > Backup & Restore section. DO NOT KEEP A VIRTUAL SNAPSHOT AS THEY WILL CREATE HIGH SYSTEM LATENCY AND WILL GROW EXPONENTIALLY DUE TO THESE CHANGES. 10

11 System Clean-Up Phase 2 Aligning your core monitoring Step 1 Ensure all Customers appear in default Service Organization Level Rules If you have a Hosted server, or you have upgraded your own on-premises server from version 7.x or earlier you may find that several of the core Rules did not apply to your older customers. This may indicate that devices have not had their appropriate Service Templates applied and you are missing core monitoring. It will also hinder your ability to manage your clients top down, requiring unnecessary granular changes at the customer level. We will add all customers back to the SO level Rules and clean up any residual Customer level clutter to avoid conflicts. 1. From the Service Organization level (typically orange in colour) and in the left-hand side menu of the UI click on Configuration, Monitoring and then Rules. 2. Open each Rule in turn and review the last tab named Grant Customer/Sites Access. If the Propagate to all new customers/sites tab is selected (see warnings highlighted in red below), typically all customers should be in the right hand side box labeled Selected Customers/Sites. Best Practices Tip: Create a list of the Customers that had remained on the left hand side (not applied to the Rule), you will have some clean-up work to do at their Customer level (green by default) in the next step. Not ALL Rules need all customers in the Grant Customer/Site Access box. For example rules for Patch or AV management rules typically will only include customers that get AV or Patch management. If the Propagate to all new customers/sites is checked, then typically all Customers should be added to this Rule. Applying Customers to Rules will re-deploy your monitoring templates for those affected. Expect a considerable amount of new Active Issues/Notifications during this process and inform your helpdesk accordingly. Also expect that any granular/custom threshold changes done at a device level will be overwritten with defaults. Applying a Rule (and its associated templates/notifications) to a large number of clients/devices at once may cause a database deadlock in N-central. It is advisable that you add only 10 or fewer Customers at a time to SINGLE Rule to avoid this problem. Save the Rule with the added clients, allow it to complete its change (a warning icon will appear while the change is in progress) before continuing making additional changes or adding additional Customers. 11

12 3. Once all clients are added to the core system Rules, you will want to go to each of the Customer level s (green by default) you identified as having been left out of Rules and clean up any remaining unnecessary customer Rules. a. Under the Customer Level > Configuration > Monitoring > Rules look for Customer Rules identified by the icon without a small yellow lock, as seen circled in red below: b. You can safely select and delete these Customer level Rules as long as you are confident you have not created them to enforce granular changes at that Customer level at some point. In most cases, they were created unnecessarily during an update from N-central 7 to 8. Do not delete the Service Organization level rules! Pay close attention to the icon indicator at the Customer level: This indicates the Rule was created by a level above (ie: the Service Organization level). Step 2 On-premises adjustment of Virtual Memory If you are using an On-premises version of N-central we can make a quick change that will produce a significant reduction in unnecessary Active Issues. Hosted users can skip this step we will address these items through Service Templates. The problem we will address here is that Virtual memory thresholds on many servers was set initially far too aggressively. It will begin to warn and fail at only 40% utilization. Many new devices on their first day on will exceed 40%. We need to quiet this particular threshold down and the easiest way to accomplish this task is through the back end of your N-central server. 1. Log into the back end of your On-premises server ( 12

13 2. Look for a menu item called Default Service Thresholds under the Services heading: 3. Find Memory (%) for Virtual Memory Usage and adjust it to have a Normal range of 0-85, a Warning range of 80-95% and a Failed range from 90% to 100%. *Note that if you prefer a more aggressive threshold you are free to set it. 4. Check the box at the right of the screen and scroll down to the bottom of the page and click SAVE. This will commit your changes. 5. Back in N-central, you will see changes to the number of memory errors and warnings visible in the Active Issues console within 5 or so minutes. You may also want to adjust the thresholds for Inbound and Outbound Discards for the Interface service if you find you have too many alerts on those type of Active Issues. Generally however, you will not want to adjust thresholds in the NAC unless you are SURE you want to adjust the default system wide. Step 3 Resolving Exchange/SQL server memory and disk monitoring As it is common for these systems to use as much physical memory as they can find, we need to make some adjustments to our monitoring to accommodate this. We do not need to see that an Exchange or SQL server has used 98% of its physical memory. We also need to take into account that if an exchange server today falls below 4GB of space we will begin to experience backpressure, which will slow or stop mail traffic altogether. We will need to adjust the Disk monitoring on these devices. Templates have already been added to your system to enable these changes however if you have upgraded, they are likely waiting for you to apply them. If you have installed a fresh new N-central server that is version 9.2 or later, they are likely already in effect. To make the necessary adjustments on older servers that have recently upgraded, follow these steps: 13

14 1. Switch to the Service Organization level (orange by default) of N-central and navigate to Configuration > Monitoring > Rules. 2. Find the Exchange 2007 Rule and open it. a. Tip: Be sure not to accidentally choose the CAS or Transport Rules. 3. Navigate to the Monitoring Options tab in this Rule. 4. Under Service Templates we will find Exchange 2007 Memory/Disk Modification and move it over with a click of the single-arrow button so that it appears under Selected Service Templates as seen below: 5. SAVE the changes to implement this template system wide. 6. Repeat these steps for the Exchange 2010 Rule. We will be adding the Exchange 2010 Memory/Disk Modification template in this case: 14

15 7. Save and Re-Apply your SQL 2000, SQL 2005 and SQL 2008 Service Templates as these contain the Memory adjustments. If you have previously deleted the SQL_Total or and SQL Related services they will re-appear on their respective devices. We will resolve them at a later stage. Step 4 Remove Connectivity from Workstations and Laptops The Connectivity service is a ping test from the local probe or central server to the device to identify if the device is still attached to the network and responding. Because laptops and workstations tend to turn on and off during the day, this service will constantly be in a failed state if applied to these devices. It follows then that Connectivity should never be applied to a workstation or laptop. In some cases however, Connectivity will have been accidentally applied to your systems. We need two service templates targeting both laptops and workstations that remove connectivity and a Rule that applies this change out to all laptops and workstations. 1. At the Service Organization level, drop down to Configuration > Monitoring > Service Templates. 2. ADD a new template and call it Removal Connectivity on Laptops. 3. Choose the appropriate device class of Laptops Windows. 4. Search for the Service Connectivity and ADD it to the list. 5. Skip through the threshold configuration, we are removing the service so this is irrelevant. 6. Once added into the list, change the ACTION to Remove. 7. SAVE your template. 15

16 Repeat steps 1-7 to create another template for the Workstations Windows class. We now have 2 Service Templates that will remove connectivity on their respective devices. We will now create a RULE to propagate these 2 Service Templates out to your system devices: 1. Under the SO level, Configuration > Monitoring > Rules we will ADD a new Rule. 2. Name the rule Removal Connectivity on Laptops and Workstations. 3. Add in the 2 filters for Laptops Windows and Workstations Windows. 4. Under the MONITORING tab, scroll down to the Service Templates section and add in our 2 newly created Removal templates. 5. On the Grant Customer/Site Access tab, add in all clients and check off Propagate to new customers. 6. Check the PREVIEW tab on the right side of your screen. Verify all appropriate devices are targeted. 7. SAVE to make the change system wide. To resolve this issue permanently we need to adjust how N-central applies the Connectivity service. N- able has already added Connectivity to the appropriate device templates, we now need to remove it from the list of services that auto-apply on discovery; this is the root of the problem: 1. Under the Service Organization level navigate to Administration > Defaults > Discovery Defaults. 2. Remove Connectivity from the list if it exists there by selecting it under Assigned Services and clicking the single left facing arrow to move it under the Available Services column. 3. SAVE to complete the change. Note that you should not check Propagate. Step 5 Review and Re-apply Workstation and Laptop Service Templates Typically you will not need as in-depth alerting on workstations as you might a server. When a workstation launches an application it tends to trigger CPU and Memory warning/failures which are all 16

17 but ignored by technicians. Workstation class devices also commonly have a nearly full restore partition which triggers unnecessary capacity warnings on a drive you expect to be nearly full. We will adjust or turn off thresholds to more effectively monitor these devices for critical failures that your team. Turning OFF thresholds does not stop data gathering, it simply stops alerts from occurring on that particular service. When you come to your regular reporting these devices and their services will still be included with full details. If you are on N-central 9.1 or later your Workstation Windows and Laptop Windows templates should already have been modified. You will want to confirm this by following these steps: 1. From the Service Organization level, navigate to Configuration > Monitoring > Service Templates. 2. Find the Workstation Windows template and click to open it. It should appear as the example below: 3. Each service has been modified to conform to a standardized best practice. Explore each one in turn and verify they are configured appropriately: a. CPU (WMI) thresholds should typically be set to OFF. We do not want to see when a workstation has a high CPU usage moment by moment, we want to see how busy it was over a period of time, in a quarterly report for example. This can help us promote a PC refresh plan for our customers but not overrun the support team with alerts: 17

18 b. Disk (WMI) should have the option to Use Asset Info unchecked, and the drive C: entered as the Volume Name, as seen here: This will ensure that for devices on-boarded in future we will only monitor drive C: (arguably the only important drive from a service provider s perspective; we typically don t want alerts on recovery partitions, USB thumb drives, etc.). You may also elect to adjust the Thresholds as the current 2GB free space failure point may not be adequate for your needs. Recommended settings are provided below. In this example we will set the drive to Fail when it reaches 2GB free space, and Warn at 5 GB free (represented in kilobytes). We will also turn OFF the Disk Usage percentage as it is too arbitrary to be effective. See below for an image of these changes: c. Next we want Memory (WMI) adjusted to turn Physical Memory thresholds to OFF and raise (or turn OFF) the Virtual Memory threshold as suggested below. Whether you choose to simply turn off the Virtual memory monitoring or not is up to your organization however it is very rare that a service team will proactively respond to high 18

19 memory use on a workstation and information on this item are typically not required beyond reporting: 4. We do not typically need to make changes to Patch Status or System Warranty (if it is visible here) however you may want to explore these thresholds as a team and make any changes you see fit. 5. To make changes to ALL workstations system wide we will click on the Associated Devices tab, check off all devices, and click Save & Re-apply Service Template at the bottom of your screen. Give the system time to complete these changes before moving on. Additionally, all future devices that you on-board into N-central will adopt these thresholds: Adjusting templates does not make changes for existing devices. You will need to Save & Re-apply Service Template. 6. We will want to repeat this process with the Laptop Windows Service Template. As this class of devices is typically treated the same as a Workstation simply repeat the above 5 steps as indicated and Save and Re-Apply the Service Template: 19

20 You should not need to make any changes to the LocalIP service, if it appears on this template. Step 6 Removing Warranty alerting from Workstations and Laptops The N-central system by default will retrieve Warranty information and populate a device s Asset tab and apply a System Warranty service to the Status tab. The service does not need to be present to use the warranty data in reporting, and typically this is where you will want Workstation and Laptop warranty represented. It makes sense then to turn the alerting thresholds OFF on these devices to avoid cluttering our Active Issues view and keep that data for quarterly business reviews. Server warranty status will remain untouched as this is arguably more important and you may want to see it in Active Issues or Dashboards. To turn thresholds off for System Warranty on workstations and laptops, complete the following: 1. ADD a Service Template under the Service Organization level (orange by default) > Configuration > Monitoring > Service Templates. 2. Name it Adjust Warranty on Workstations 3. Choose the class of Workstation Windows for this template. 4. Add the System Warranty service, and under the Thresholds set them to OFF. 20

21 5. Change the System Warranty service Action to Modify as we typically do not want to add it where it was previously deleted. 6. Verify it looks as this example does and Save: 7. Repeat steps 1-6 and create a second template targeted at the device class of Laptop Windows, named Adjust Warranty on Laptops. 21

22 8. Now we will create a Rule to put these templates into effect within all of N-central. Under the Service Organization level (orange by default) navigate to Configuration > Monitoring > Rules. 9. ADD a new Rule with the name of Adjust System Warranty on Laptops and Workstations 10. Filter by using the Workstations and Laptops Windows 11. Skip down to the Monitoring tab, and add in your 2 newly created service templates to Adjust System Warranty. 12. Under Grant Customer/Sites Access tab we will add in all customers and check off the option to propagate to future customers. 13. Save your Rule to commit its changes to the system. These changes will not take effect until the System Warranty services check in, which typically takes about 24 hours. Your Active Issues view will not clear until this time has passed. 22

23 System Clean-Up Phase 3 Customer level maintenance Step 1 Configuring asset discovery Deployment Best Practices recommends that you create one recurring Discovery job per Customer subnet that does not auto-import devices, but instead allows you to see what new items have appeared over a weeks or months time. This avoids accidentally on-boarding devices such as contractor owned workstations and cell phones etc. that are simply passing through the environment. If you have not already done so, we need to configure this in your system: 1. From the Customer level (green by default) we will navigate to Configuration > Discovery jobs. 2. Delete any existing discoveries you find there. 3. Create a new Discovery job named as seen here: CompanyName Recurring Discovery a. Do not include any options to Auto Import devices, see below: b. Do include the SNMP community string on the Advanced Settings tab: c. Do set it to be a Recurring Discovery. Pick a time during the workday, once a week. Be sure to stagger these Discoveries across various days between Monday and Thursday, 9 5pm for your various clients. The schedule should be built similarly to the one demonstrated here: 23

24 Setting Recurring Discoveries during a new customer on-boarding: 1. When completing an on-boarding of a new client, review your list of devices in the All Devices view and ensure you have all the systems you intend to monitor imported and configured. 2. From the Service Organization level (orange by default) review the Actions > Add/Import Devices list of devices to be imported and choose to IGNORE anything remaining. 3. Create a Recurring Discovery as indicated at the beginning of this phase. Devices that are Ignored will re-appear if their details change. For example a VOIP phone ignored today in a DHCP range may re-appear in a subsequent discovery if it s IP, Mac address or asset details change. Using Recurring Discoveries during a regular weekly maintenance: 1. Once a week (typically Friday or the weekend) review the Add/Import list for new additions. a. Import the devices you want (be sure to choose to deploy an Agent to the Windows based devices. You may also want to set their license type before importing. b. Ignore the devices you have no intention of monitoring. c. Delete those you are unsure about, leaving a clean list. 2. Review this list on a weekly basis. Focus on keeping this list as clear as possible. Devices that are Ignored will re-appear if their details change. For example a VOIP phone ignored today in a DHCP range may re-appear in a subsequent discovery if it s IP, Mac address or asset details change. Step 2 Populating credentials for all Customers The credentials on the Properties tab of every workstation, laptop and server device is key to ensuring scripting, file transfers and third party software pushes functions correctly from N-central. Typically, we will add these credentials during a Best Practice deployment as directed by that guide; however if this 24

25 step was missed you will see many devices without any kind of information for User Name or Password as seen below: To resolve this across your customers, follow these steps: 1. At the Customer level (green by default) navigate to Administration > Defaults > Appliance Settings. 2. Navigate to the Credentials tab and populate a username and password. 3. Check off the option to Propagate. 4. Save to complete the operation and put those credentials on every device. Best Practices Tip: It is recommended that the credentials you use for every customer be a custom made domain administrator account with a password that does not expire. If the password should ever be reset you will need to log into the customer s server and reset it in the Windows Software Probe service itself. 25

26 System Clean-Up Phase 4 Leveraging the All Devices view for Maintenance The N-central All Devices view, through the use of Filters, can be leveraged to identify common issues or find devices that may have slipped through the change management process. It is recommended you perform these tasks as part of a weekly maintenance schedule for N-central. Step 1 Devices who s Agents have not checked in for over 30 days It is not uncommon to find an N-central server cluttered with old devices that have long since been decommissioned, disappeared into loner-pools, or simply lost. A Filter has been created for you in a recent release of N-central to help identify these devices so that you can clean them up: 1. At the Service Organization level switch to the All Devices view. 2. Click the FILTER button and select Agent Check in over 30 Days : 3. A list of devices will appear, and every one either has an Agent that has not checked in with N-central in over a month, OR a Windows device that has no agent at all (indicated by a -- in the Agent Version column as seen below): 4. Address the Workstations and Laptops however you see fit: a. Try to re-deploy the Agent to them by opening the device (click the device Name) and selecting the Properties tab. Uncheck Local Agent. Save. Re-check Local Agent and select the local probe (do not use Best Available unless necessary). Save. You should now see a line of text indicating an agent is being installed: 26

27 b. If the agents still refuse to deploy to a device, you might consider simply deleting them from N-central. They have not reported back to N-central in over a month, chances are they are not coming online because they have been decommissioned. It may be wise to save some time and delete the devices and let your previously configured recurring discoveries find them again if they still exist in the customer environment. 5. Address the Servers as you see fit: a. These devices are typically a bit more critical. We will want to confirm that the server has been taken intentionally offline or that the monitoring Agent has been removed on purpose. b. In the case of a server, it is unlikely we will be satisfied with simply deleting it and waiting to see if it comes back. Address the issue directly with the client or your technical team. If it has indeed been decommissioned, you may want to consider deleting it. The first time you use this filter you will *likely* have many devices to deal with. Subsequent uses however should be considerably less cluttered assuming you are able to keep up the suggested weekly routine. Typically the best defense against a large list of defunct devices is to have a strong change management plan in your environment. Think as a team on how changes in the field to hardware can be reliably reflected back in N-central. Step 2 Devices classified as Other During the discovery process our local Probe will identify anything with an IP address and classify them based on the SNMP or WMI data it is able to retrieve. Discovery Best Practices will suggest that you do not auto-import devices classified as Other and the reason for this is that we typically do not know what they are. We do not want a monitoring system filled with unclassified devices whose only identifier is an IP address; especially because the only service added to these devices, connectivity, will fail every time the device goes offline or leaves the environment and your team will not know how to respond, or if they should be responding. This is particularly difficult if you offer 24x7 support. 1. From the Service Organization level (orange by default) we will navigate to the All Devices view. 2. Filter by Other using the Filter dropdown at the top of the page. 3. Review and address this list: a. Re-classify and resolve any items in this list that should not be Other. This may include switches, routers and Firewalls etc. b. Delete any Other devices that may have been accidentally imported through the discovery process or otherwise. If you don t know what they are and are not obligated to monitor them, remove the clutter. During the ADD/Import phase you have the ability to view details such as MAC Address, Serial Number and ports that may assist you in discovering what the device is. Simply click the + icon at the right of the screen to allow these details. 27

28 Best Practices Tip: If you do need to have an Other classified device, be sure to identify it appropriately on its Properties tab in the Name: field. Do not leave it simply as an IP address because although the address may mean something to you, it may not to your support team or future hires. Step 3 Devices with Failed Connectivity During an initial cleanup you will find typically find many devices with Connectivity (a ping test from probe to device) failed even though we have resolved the Connectivity issues on Workstations and Laptops in Phase 2, Step 4 and we have resolved the Probe issues in Phase 1, Step 2. These devices are commonly Network related such as routers and switches, ESX Hosts or Servers. Typically the reason for these remaining Connectivity failures is that the device has been decommissioned or otherwise removed from the environment. We will run a filter to identify these devices and address the various issues that might cause a Connectivity failure. 1. Create a new Filter to identify devices with a failed Connectivity service: a. From the Service Organization level (orange by default) we will navigate to Configuration > Filters. b. Click the ADD button at the top of the screen and begin the process of creating a new filter. c. Name the filter Devices with Failed Connectivity d. Add a description that explains the filter will find devices where the Connectivity service has failed. e. Create a filter as seen below using Monitoring N-central service in status of Failed : f. SAVE your Filter. Remember that in order for others to see and use your Filter you will need to use the Show In Other Users Drop-Down button at the top of the Filters section. Select your new filter by moving it to the right-hand side box and save. 28

29 2. Use our Filter to find devices in the system where Connectivity has failed: a. From the Service Organization level (orange by default) we will navigate to the All Devices view. b. Under the Filter dropdown, find and select the newly created Devices with Failed Connectivity. 3. Resolve the issue of failed Connectivity. This issue can be caused by several things and should never be left unresolved: a. Problem 1 A probe was deleted unexpectedly and the Connectivity service defaulted to the closest available monitoring device, the N-central server, which of course cannot reach the device sitting inside of a client s network: To resolve this, we will need to ensure there is an active probe in this environment (see the section earlier on probes) and then edit the Connectivity service s Details to modify it from using the Central Server to the local N-central probe instead: To avoid this issue in future, remember to Transfer Tasks of one probe to a new one before deleting them from N-central. This can be done at the Customer level under Administration > Probes. b. Problem 2 The device has gone offline or become otherwise unreachable. Check on the Properties tab of the device to ensure under the Network Address section we are communicating with the appropriate IP or FQDN. 29

30 You may also want to check the network routing in your environment. Is ping somehow restricted? Are you pinging from the correct probe? Check the Probe/Agent column on the Status tab to ensure this is the case and edit the Connectivity service s Details if needed. Try to ping the device from the server the probe resides on to test your routing. Ensure DNS scavenging is engaged in the environment as directed in the Deployment Best Practices guide. c. Problem 3 - Is Time to Live turned on in an IPv6 environment? N-central s service is not IPv6 compliant and Time to Live will fail. It has been turned off in your system by default but this change may not have taken hold on existing devices. Under the thresholds tab we will want to disable Time to Live: 30

31 System Clean-Up Phase 5 Resolving remaining Active Issues In some cases monitoring services may be applied to devices on which you do not intend to use them, for example Exchange monitoring on an SBS server that is not being used as an Exchange mail server. This can cause unwanted failure or warning Alerts and notifications and it is important to clean up these services to avoid cluttering your Active Issues view. Return to the Service Organizational (orange by default) level in N-central and navigate to the Active Issues view. Click on the Show Filter tab at the right hand side of your screen and ensure we have selected only Failed and Warning and Misconfigured as Status options, and deselected Patch Status, Printer Toner and Printer Status. Close the filter by clicking the Hide Filter tab. Review the Active issues that are left by clicking the column heading for Service to arrange things alphabetically. We will want to evaluate this list and resolve any issues that are not real critical problems either by adjusting thresholds to better align monitoring with our needs or by disabling the services. We will also want to resolve any Misconfigured services. Generic SQL Server 1433 (Failed) and SQL Server _ Total (Misconfigured) This service, along with SQL Server -_Total, tends to be applied to devices that appear to have a full SQL package on them, but in fact only have an Express version installed. This is common on a system running Backup Exec or Quickbooks. The 1433 service is monitoring the availability of the port that SQL commonly uses to communicate on, and the _Total service is verifying the health your database (this is only available on full blown SQL databases). In most cases, the solution here is to simply disable both of these services as they are not relevant. Best Practices Tip: Remember to always Disable, not Delete, a service. If you delete a service, there is a chance it could return if you, or the N-central system, were to re-apply the associated Service Template. Multiple this chance over hundreds of deleted services and there is always a risk you could have a significant amount of work to do someday if an upgrade should trigger a re-evaluation of templates. Guest Status VMware SERVERNAME (Failed) There is currently an issue with some older versions of ESX Guests reporting a high volume of Guest Dropped Packets Received and Transmitted (under Network Consumption): 31

32 If you find your Active Issues cluttered by this, you may choose to turn off the thresholds that are the cause temporarily. 1. Under the Service Organization level (orange by default) we will navigate to Configuration > Monitoring > Service Templates. 2. Find the Servers ESXi template and click into it. 3. Click the Guest Status (VMware) service and then select the Thresholds tab. 4. Find the two options for Dropped Packets and set these thresholds to OFF. 5. Save. 6. Under the Associated Devices tab, select all of the devices and Save and Re-apply the Service Template to commit your changes to all ESX hosts. Disk I/O (Failed or Warning) The Disk I/O service was created to monitor read/write activity on your physical disks. There are many data points gathered by this service, but ideally you will want to confine your alerting to Idle Time and explore the service should it fail to see what specifically is causing a low idle. Idle Time reflects the amount of time your drive is available to write or read new data. If this threshold drops to 0 then the drive is fully utilized and if it remains at 0 for a prolonged period of time likely indicates something on the system is stalled during a read/write process. In some cases (upgrades) the Disk I/O service was added with all thresholds set to Default (on), in other cases, Current Queue Length may have been left on which is commonly what causes the service to fail. You will want to decide if there is value in seeing a high current queue length for your business. To adjust the DISK I/O service we will take a two-part approach: 32

33 Part 1: Adjust the thresholds in the Server Windows template where it is commonly applied from. This will resolve the problem for all future devices that come onboard: 1. From the Service Organization level (orange by default) navigate to Configuration > Service Templates and find the Server Windows template. 2. Edit the Disk I/O service. It is recommended you set all thresholds to OFF with the exception of Idle Time which we will set to Default. Part 2: Adjust Disk I/O across all servers using a new Service Template and a Rule to ensure everything is in sync with your monitoring intentions. 3. From the Service Organization level (orange by default) navigate to Configuration > Service Templates. a. Click ADD to create a new template. b. Create a template named Adjust Disk IO, targeted at the device class of Servers Windows and add the DISK I/O service. c. Set the service s action to Modify as seen below: Be sure not to choose anything other than Modify. This setting will adjust any Disk I/O services it finds, but it will not add a new one. This is the behavior you will want. d. SAVE the template. 4. Navigate to the Service Organization level and under Configuration > Monitoring > Rules. a. Click ADD to create a new Rule. b. Give the Rule a name such as Adjust Disk IO for Servers c. For a Filter, we will select both the Server Windows and SBS Servers filters to cover the entire range of Windows based servers in the system. 33

34 d. Under the Monitoring Options tab we will add our recently created service template Adjust DISK IO. e. Under the Grant Customer/Sites Access tab we will add all customers and check off the option to Propagate. f. Save your Rule to associate the template to all devices and it will update Disk I/O system wide. g. Once complete (5-10 minutes), you can in fact delete this Rule. It will no longer be necessary. HTTP/HTTPS (Failed) These services are added by several templates to check for the following: - Port accessibility (80 or 443) - Query response (Did N-central receive, for example, a 402 response indicating things are good?) - Login (you can provide a username and password in Service Details) - Certificate validity for HTTPS It may be that one of these things is out of alignment, or it may be that the port is simply closed. If you do not need to monitor this on the device, simply Disable the service. Windows Services (Failed) In some cases services are expected for certain applications such as POP for Exchange servers. N-central has attempted to monitor these for you, but finds them shut off (not many Customers use POP anymore, however it is an expected service in Exchange, for example.) If you do not need to monitor a given Windows service, simply Disable it on the Status tab of the device. Exchange 2003 (Misconfigured) The Exchange 2003 service, unlike other Exchange services, is unable to determine where your information stores are located. You will need to tell this service where to look if the exchange stores are not in the default location c:\program Files\Exchsrvr\MDBDATA\pub1.edf. To adjust, do the following: 1. Click the Exchange 2003 service and navigate to the Service Details tab. 2. Edit the location of your exchange public and private stores. 34

35 3. SAVE to commit your changes. 4. On the Status tab of the Exchange device, select the Exchange 2003 service with a checkmark and under More Options you will Disable and then repeat the process and Enable the service. 5. Within a few minutes the service should come up with appropriate monitoring. Basic workflow for troubleshooting unnecessary Active Issues (All other types) If you have identified a service in the Active issues view that is not properly reflecting the state of an Application or Hardware and needs adjustment or removal we will follow a standard troubleshooting workflow: 1. Click into the device itself (not the service) from the Active Issues view 2. Now click into the service that is having an issue. a. If the service is Misconfigured, we will typically see a reason listed. 1. SNMP issues are typically caused when it is not properly enabled, either on the hardware itself or in the N-central UI, during our initial discovery. Confirm that SNMP is checked off on the Properties tab of the professionally licensed device. You will also want to confirm that the proper community string is populated there. On the hardware itself, ensure SNMP is enabled in all the various locations necessary (Sonicwall for example must have it enabled in both Administration and the LAN interface under Networking). To complete this solution, you will need to re-discover this particular device with a valid community string and re-apply the Service Templates in the N- central UI. 2. Service Details may not be correct as we see in the case of the Exchange 2003 service. Have a look on the service details tab and inspect any dropdown or box containing service specific details. Of the various possibilities, some potential questions will be: Is the right service listed to be monitored? Is the drive location that is populated correct?; Are we looking for the proper RAID card (or other device such as a fan) if more than one was detected; does a backup job name need to be populated, etc. 3. Is an aspect of the monitored service missing? In the case of Dell RAID cards for example we will run into onboard RAID with no battery. The misconfigured message will complain that there is no state for the battery and as this is required for the service, it may fail. For On-premises customers there is a Custom Service that will allow you to monitor Raid cards from Dell without batteries. 4. Is this service simply not valid on this hardware? As we have seen in the case of SQL Server _ Total, in some cases services get added by default but there is nothing on the device of that nature to monitor. We should simply disable these services to clean up the clutter. 35

36 b. If the service is Failed, we can explore: 1. Is the service relying on something that isn t reachable? For example most services are monitored from the Local Agent or Probe. Central Server should only be monitoring services that talk directly to N-central, such as Agent Status. The Connectivity service will fail (for example) if you are trying to perform a ping from your N-central server, or if DNS does not allow the local probe to route to itself and perform the test on its own IP. Does something in this regard need adjusting under Service Details, or do DNS changes need to happen in that environment to allow the routing? 2. Is the service relying on something that isn t working? Ensure that if a service is using the local Probe that the probe is up and functional. This can be confirmed under Administration > Probes. If it is relying on an Agent, is the agent installed and functional? If it is relying on a path or file being present, does this item exist? 3. Is the threshold too aggressive? Perhaps the service is failed because we have asked it to switch to failure too aggressively. Explore the possibility of adjusting the template that governs this service to change the thresholds and ensure you are alerted only when a valid failure to your standards occurs. 36

37 System Clean-Up Phase 6 Configuring Notifications Your current notifications (visible under the Service Organization level > Configuration > Monitoring > Notifications) may either not be configured appropriately or may simply be too noisy in their current configuration. It is important to assess what you are receiving when things Fail or Warn and generate a Notification. Based on this assessment, you may want to adjust the current Notifications or simply remove them and start fresh. Your Notifications will generally be in one of three states: State 1 - Legacy format using 0 Minute Delay type titles You may have this form of Notification if you are on an older version of N-central (9.1 or earlier) or if a recent N-central upgrade decided to leave your existing Notifications in place because they had been in some way modified in the past. Issues you will see with this setup are: Chances are you are receiving a multitude of alerts for Windows Event Logs from the 0 Minute Delay > Server Applications > Windows Event Logs trigger. Alerting for both applications and hardware are hidden under very few notifications making it hard to identify exactly what needs to be adjusted. A single Notification could contain Exchange, SQL, physical drive status and Raid status all under one heading. You are not on the most current Notification scheme making it harder for support and your Sales Engineer to assist you. The new scheme is also quite a bit more intuitive to use. Solution A: You may want to reconfigure your Notifications to get them in line with the most current solution. Appendix D (9.1+ Notification Structure) will guide you through creating your new Notifications, or alternatively you can create an N-central Hosted Trial from and copy what you see under the Service Organization level > Configuration > Monitoring > Notifications section after deleting your existing Notifications. Solution B: You may want to build new Notifications from the ground up to suit your needs. This will require an in depth knowledge of how these are created and used. There is training available on the N- able Resource Center ( under the Training > Onboarding section however you will ultimately want to have some time set aside to experiment. State 2 N-central 9.1+ format with a Notification per function This is the ideal configuration to be in for the purposes of this document. You have the current Notification scheme in the format shown below and it remains untouched. You will simply need to add a contact to these Notifications to put them into effect. Ultimately, as you become more familiar with Notifications you may choose to adjust these to meet your service requirements, but this configuration will start your organization on the right foot. 37

38 Windows Event Logs are not dealt with in the current Notification scheme. To enable them, and set them up appropriately, it is recommended you review this linked video: State 3 - Mixed or user configured In some cases you may see elements of the 9.1+ Notifications along with the older legacy format. Alternatively, you may have worked on configuring custom Notifications in the past and have remnants of those lingering in the system. If you are comfortable with your user configured Notifications and choose to keep them be sure to assess carefully what s they are generating. Make certain they meet your needs in their current form. It could be that your Notifications are properly configured and simply suffering from overwhelming alerts which we will have begun to resolve in the previous steps. Windows Event Logs may be something that need to be addressed, even in your properly configured setup. It is recommended you review this linked video for guidance: 38

39 System Clean-Up Phase 7 Completion and Keeping Things Clean By this time, your Active issues view should contain ONLY items that you deem of importance and that you plan to react to in some way. The Notifications from your system should similarly contain only important content and not flood your inbox with the exception of perhaps a full environment going offline (there is no way to avoid this should it happen). To maintain this, we encourage you and your team to review the following appendices with regards to implementing a regular routine of weekly maintenance, as well as developing your own process around onboarding new clients, naming conventions and basic day to day use of N-central. Be aware that with new features and upgrades comes the possibility of new items to address. Ensure that your team reviews these new services and functions and aligns them and their thresholds to your goals and responsibilities as a Managed Services Provider. Ensure you are adding these new services along with any custom services you import to Notifications so they remain visible. If you encounter services you are unable to resolve please create a ticket on the N-able Resource Center and the N-able team will assist you, or join our Daily Q&A session help at 4PM EST. Details are on the NRC under Training > Live Q&A. Feedback We would greatly appreciate any feedback you have on this document. If you feel it was of value to your organization and made an impact on your day to day experience with N-central, or if you feel a certain section could use some additional elaboration please write to sparker@n-able.com and share your thoughts. 39

40 Appendix A Reviewing leveraging Filters to focus attention on critical issues Filters image The following image will be referenced throughout this section: Viewing only Failed and Warning states It is generally standard practice during day to day operations to filter your Active Issues view by Failed and Warning status. Selecting these two states will allow you to view only the items that are currently requiring technical attention in your client environments. N-central 9.0 introduced a new location for these filters. They can be found by clicking the Show Filter tab at the right hand side of your screen (Filters image, item 1). A slide-out field will appear and here you are able to select that only Failed and Warning states be visible by checking the respective boxes under Status (Filters image, item 2). Close the 40