SYSLOG and SUPERVISOR S WORKSHOP Knowledge Module for PATROL - Data Sheet Version Made by AXIVIA Conseil

Transcription

1 SYSLOG and SUPERVISOR S WORKSHOP Knowledge Module for PATROL - Data Sheet Version Made by SUMMARY SYSLOG and SUPERVISOR S WORKSHOP Knowledge Module for PATROL integrates a PATROL architecture as distributed by BMC Software, Inc. Main monitoring functions embedded in this product are relative to the following objects : Log files : either system files on UNIX or LINUX servers, or user defined files. Directories or file sets. Processes. File systems on UNIX and LINUX servers. Network : ports, sockets, ICMP ping and PATROL ping. Database connections : ORACLE, SQL Server, MySQL or PostgreSQL. SQL queries content analysis : ORACLE, SQL Server, MySQL or PostgreSQL. System or user defined executable programs, either binaries or scripts. URLs ( Uniform Resource Locator ) by using most of the INTERNET protocols. Blackouts. In addition, some features may be used to help configuration and development : Several diaries may be defined to start and stop the monitoring of the objects. Backup of configuration files and file transfer tools to distribute on remote agents. Integrated plugin-api to quickly develop special KM that meet application monitoring needs. Application icons may be created at the very top hierarchical view. Many commands to help configuring the monitoring details. A GUI help you in customizing events to fit your needs when using event manager such as PEM or BEM. OUR SOLUTION The SYSLOG and SUPERVISOR S WORKSHOP Knowledge Module for PATROL is designed to integrate BMC Performance Monitoring ( formely PATROL ) from BMC Software Inc. When loaded, it is executed by the agent, and acts as a powerful monitoring tool for various objects frequently used in systems. Alerts and events may be generated to notify user when something goes wrong.

2 REQUIRED OPERATING SYSTEMS This product may be used on any UNIX, LINUX or WINDOWS system that is compliant with a PATROL agent since version FILE MONITORING FUNCTIONS One of the main ways to detect abnormal situations is to recognize some particular messages in log files. The content analysis tools embedded in this product execute an efficient and powerful text parser. With this product, you can monitor the content of files and their attributes : size, growth rate, presence, last modification time, total number of read lines, number of read lines by minute. On UNIX and LINUX servers, system files made by the syslogd are automatic discovered and monitored. In addition, application log files can be added by the user. The ability to help users in defining simple or complex rules, to automatically parse the logs written by the syslogd daemon or by any application 3Sages applicausagesitical messages and and events in PATROL consoles is a great improvement in the functional need of log monitoring. Key Features and benefits for log files Automatic discovery of the system files based on the syslog configuration file ( /etc/syslog.conf). Continuously parses the log files and alerts PATROL operators of the incoming of critical messages. Include an efficient engine that executes powerful rules. Can use named rules, thus enabling the user alerts. Use the powerful mechanism of regular expressions embedded in PATROL agents. Statistical computations kly identify the most frequently -23eived messages. Graphical interface onfigure powerful rules and filters on particular messages selected in the log file. Specialised rules editors quickly and easily define rules for CISCO PIX, CISCO routers, APACHE error log, UNIX system messages and application logs. Capability ne rules by di-23tly entering regular expressions. Commands application logs. Files may be regular or Rotating files are those that are created by some applications, for instance on a periodic basis (like logrotate can do). Regular files are identified by their full names; rotating files are identified by a regular expression. When monitoring rotating files, this product automatically switches from the currently monitored file to a newly created one without any action requested from the user and any loss of message.

3 A file set is made by all files the name of which conform to a regular expression. When defining a file set, you can use wildcards. For example, a file set may be c:\tmp\appl*.log. Thanks to a graphical interface, alert conditions may be very easily defined. Thus, you can monitor directories or file sets and generate alerts on : The number of files. The total size. The growth rate of the total size. The presence of the directory. The time from the last access, either read or write operation. The time from the last modification time by a write operation. On very secured servers, you can use a special account to monitor these directories or file sets. On UNIX or LINUX systems, you can also tell this product to use «sudo». PROCESS MONITORING Thanks to the embedded functions, you can easily monitor : The total number of processes. The presence of one particular process. The number of occurrences of a process by defining the minimum and the maximum numbers. You can also alert when an unexpected process is launched. FILE SYSTEMS With this product, you can define file systems and monitor : the total free space. the total free space percent. the mount status. NETWORK CONNECTIONS MONITORING Thanks to the functions embedded in this product, it s very easy to check for the status of connections. User can define a port number, an IP address, the expected state of the connection and the number of end-points that must match these criterias. ICMP pings can be made and alert when they fail. For PATROL agent, PATROL ping may be executed to alert when an agent is down. DATABASE CONNECTIONS AVAILABILITY AND CONTENT With this product, you can monitor connections to database instances of ORACLE, SQL Server, MySQL or PostgreSQL and execute SQL queries. For each database connection, you can monitor : Database availability. Returned data size. Returned data content by using the powerful engine for regular expressions embedded in this product. Request execution time.

4 SYSTEM OR USER DEFINED EXECUTABLE SCHEDULER A scheduler is integrated in this product in order to launch system or user defined programs, either binaries or scripts. Multiple diaries may be configured to define hours to run these programs. Depending on the kind of outputs generated by these programs, you can make graphs of numerical values, or analyse the content of the textual output for the occurrence of predefined patterns. In both cases, alert conditions may be defined. URL Either remote or local URLs (Uniform Resource Locator ) may be monitored by using one of the frequently used secured or unsecured INTERNET protocol : HTTP, HTTPS, FTP, FTPS, SFTP, SCP, DICT, LDAP, LDAPS or FILE. Once URL has been defined, you can monitor : URL availability. Returned data size. Response code of HTTP or HTTPS request. Response code of FTP or FTPS request. Returned data content by using the powerful engine for regular expressions embedded in this product. Request execution time. The URL monitoring functions rely on the well-known «curl» freeware now integrated in the main UNIX and LINUX systems. For WINDOWS systems, we provide and add-on that can be downloaded from our site and installed with the PATROL standard installer. For UNIX or LINUX system, «curl» must be already installed. If it is not installed, you can find ready-to-use binary packages for most of the systems on the site « In case of special needs, contact us. BLACKOUTS Blackouts are periods when alerts are prohibited. This is very useful for example to avoid false alarms when a database is shut down. Depending on your operational environment, you can select one or more conditions to start the blackout period. These conditions may be : One or several diaries, presence or absence of a file, presence or absence of up to two processes, presence or absence of a configuration variable. Blackouts applies on entire application classes, application instances or parameter. For distributed monitoring architecture, the start and stop signals of one blackout period may be propagated to remote agents. Thus, the configuration is dramatically easy. APPLICATION ICON By creating an icon for one application, you can concentrate the various items you want to monitor for this application. You can create any number of icons as you need and you can create sub-containers for particular part of your application. BACKUP OF CONFIGURATION AND FILE TRANSFERT Thanks to the tools integrated in this product you can very easily save your configuration in a file that conforms to the format of configuration files used by the agent. You can also transfert these files to remote agents and very quickly import the transferred configuration in the target agents.

5 WRITING PLUGINS WITH THE PLUGIN-API Many times, special needs are not covered by on-the-shelf knowledge modules working with log files. This is the case for instance when statistics must be computed, when correlations must be done between multiple messages found in log files or in the output of some database queries. Thanks to the plugin-api integrated in this product, users can quickly develop their own correlation or statistical codes. With the plugin-api, the user does not need to read the file, to execute a query to a database, to monitor errors etc, the KM do that for he (her). The developer can focus on the heart of its needs : the information. The plugin-api is a collection of functions fully accessible in a standard PSL library. See the user s guide for more information. CERTIFICATION This product is a CONTACT For any information about this product, contact support@axivia.com.