Nimsoft Monitor. ntevl Guide. v3.9 series

Transcription

1 Nimsoft Monitor ntevl Guide v3.9 series

2 CA Nimsoft Monitor Copyright Notice This online help system (the "System") is for your informational purposes only and is subject to change or withdrawal by CA at any time. This System may not be copied, transferred, reproduced, disclosed, modified or duplicated, in whole or in part, without the prior written consent of CA. This System is confidential and proprietary information of CA and protected by the copyright laws of the United States and international treaties. This System may not be disclosed by you or used for any purpose other than as may be permitted in a separate agreement between is notice. Notwithstanding the foregoing, if you are a licensed user of the CA Software you may make one copy of the System for internal use by you and your employees, provided that all CA copyright notices and legends are affixed to the reproduced copy. The right to make a copy of the System is limited to the period during which the license for the CA Software remains in full force and effect. Should the license terminate for any reason, it shall be your responsibility to certify in writing to CA that all copies and partial copies of the System have been destroyed. WITHOUT WARRANTY OF ANY KIND, INCLUDING WITHOUT LIMITATION, ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NONINFRINGEMENT. IN NO EVENT WILL CA BE LIABLE TO YOU OR ANY THIRD PARTY FOR ANY LOSS OR DAMAGE, DIRECT OR INDIRECT, FROM THE USE OF THIS SYSTEM, INCLUDING WITHOUT LIMITATION, LOST PROFITS, LOST INVESTMENT, BUSINESS INTERRUPTION, GOODWILL, OR LOST DATA, EVEN IF CA IS EXPRESSLY ADVISED IN ADVANCE OF THE POSSIBILITY OF SUCH LOSS OR DAMAGE. The manufacturer of this System is CA. Government is subject to the restrictions set forth in FAR Sections , , and (c)(1) - (2) and DFARS Section (b)(3), as applicable, or their successors. Copyright 2013 CA. All rights reserved. All trademarks, trade names, service marks, and logos referenced herein belong to their respective companies. Legal information on third-party and public domain software used in the Nimsoft Monitor solution is documented in Nimsoft Monitor Third-Party Licenses and Terms of Use (

3 Contact CA Contact CA Support For your convenience, CA Technologies provides one site where you can access the information that you need for your Home Office, Small Business, and Enterprise CA Technologies products. At you can access the following resources: Online and telephone contact information for technical assistance and customer services Information about user communities and forums Product and documentation downloads CA Support policies and guidelines Other helpful resources appropriate for your product Providing Feedback About Product Documentation Send comments or questions about CA Technologies Nimsoft product documentation to To provide feedback about general CA Technologies product documentation, complete our short customer survey which is available on the CA Support website at

4

5 Contents Chapter 1: ntevl ntevl Overview... 7 Chapter 2: ntevl Probe Deployment 9 Supported Platforms... 9 System Requirements... 9 Software Requirements... 9 Probe Deployment Information Installation Notes Chapter 3: ntevl Configuration 11 Probe Configuration Interface Installation Probe Defaults Probe Configuration The Setup Tab The Status Tab Parameters in a Posted Message Chapter 4: Edit Probe Configuration 33 View Event Details Chapter 5: Operation and Use 39 Chapter 6: ntevl QoS Metrics 42 Contents 5

6

7 Chapter 1: ntevl 3.9 This description applies to ntevl probe version 3.9. This section contains the following topics: ntevl Overview (see page 7) Documentation Changes (see page 8) ntevl Overview The ntevl probe monitors the Windows NT Event Logs for generating the alarm messages that are based on the configuration of the monitoring profile. In other words, the probe keeps an eye on the Windows NT Event Logs and alerts the user when something unexpected happens. Chapter 1: ntevl 3.9 7

8 ntevl Overview Documentation Changes This table describes the version history for this document. Version Date What's New? 3.9 June 2014 Updated the Software Requirements topic. 3.9 December 2013 Updated the Event Selection Tab section. Updated the Alarm/Post Tab section. Added the View Event Details section. Added the Configuring Locale Specific Severity String section. Updated the Operator filed description of the Variables Tab section. 3.8 December 2012 Added functionality to monitor Operational and Admin event logs (introduced from Vista/Windows 2008 onwards). Added support to monitor other windows event apart from Application, Security, and System only. Added Probe Defaults. The Source field is renamed to Source/Publisher Name. 3.7 October 2012 Added support for converting event description to a localized form. Related Documentation Documentation for other versions of the ntevl probe The Release Notes for the ntevl probe Added a check box - Run command on match, containing two fields, Command executable and Command arguments. If you add variables in a profile, then the values for those variables are displayed in post message in evl_var (variable name) field. Monitor Metrics Reference Information for CA Nimsoft Probes ( 8 ntevl Guide

9 Chapter 2: ntevl Probe Deployment This section contains prerequisites, system requirements, and deployment information for the ntevl probe. This section contains the following topics: Supported Platforms (see page 9) System Requirements (see page 9) Software Requirements (see page 9) Probe Deployment Information (see page 10) Installation Notes (see page 10) Supported Platforms The ntevl probe is supported on the same set of operating systems and databases as the Nimsoft Monitor Server solution. Please refer to the: Nimsoft Compatibility Support Matrix for the latest information on supported platforms. Support Matrix for Nimsoft Probes for additional information on the ntevl probe. System Requirements The ntevl probe must be installed on systems with the following minimum resources: Memory: 2-4 GB of RAM. The OOB configuration of the probe requires 256 MB of RAM CPU: 3-GHz dual-core processor 32, or 64 bit Software Requirements The ntevl probe requires the following software environment: Nimsoft Monitor Server or later Nimsoft Robot 5.23 or later Java Virtual Machine 1.6 or later (typically installed with NMS 5.0 and above) WMI service needs to be enabled for the probe to work. Chapter 2: ntevl Probe Deployment 9

10 Probe Deployment Information Probe Deployment Information There are three ways to distribute archive packages. You can distribute the package within the web-based Admin Console (for supported probes), from within Infrastructure Manager, or use the standalone Nimsoft Distribution application. See Probe Deployment for more information on deploying probes. Installation Notes The New Probe probe monitors the event logs for new messages and generates Nimsoft alarm messages according to your setup. You can configure the probe for triggering each time a new message is added to the event log or you can check the eventlog for new messages at a fixed interval, which will reduce the system load generated by the probe. Consider the following points while installing the New Probe: Restart the probe when the time zone is changed or when "Automatically adjust clock for daylight saving changes" is selected or cleared. The Windows event log watcher probe version 3.0x uses WMI to retrieve the event logs. Accessing windows event logs using WMI may severely affect the performance of the Windows 2000 system. If the probe is deployed on Windows 2000 system, the probe will raise an alarm and will stop execution. Probe version 2.33 does not use WMI for retrieving the event log and can be used for monitoring event logs on Windows 2000 system. 10 ntevl Guide

11 Chapter 3: ntevl Configuration The ntevl probe is configured by defining one or more profiles, identifying a set of criteria for event log message selection and how these messages should be treated. This allows you to define different actions for different event log messages. This probe is configured to generate alerts based on messages from the Windows event logs. This section contains the following topics: Probe Configuration Interface Installation (see page 11) Probe Defaults (see page 11) Probe Configuration (see page 11) Probe Configuration Interface Installation The probe configuration interface is automatically downloaded and installed by the Nimsoft Infrastructure Manager when the probe is deployed on a robot. Probe Defaults At the time of deploying a probe for the first time on robot, some default configuration will get deployed automatically. These probe defaults could be Alarms, QoS, Profiles and so on which save time to configure the default settings. These probe defaults will be seen on a fresh install, that is no instance of that probe is already available on that robot in activated or deactivated state. Probe Configuration This section contains specific configuration for the probe. Chapter 3: ntevl Configuration 11

12 The Setup Tab When you double-click the probe name in Infrastructure Manager, the GUI for ntevl probe is displayed with Setup tab (Profiles sub tab) opened, by default. This tab contains the below listed sub tabs: Properties (see page 13) Profiles (see page 15) Exclude (see page 25) All these tabs are explained in detail in the subsequent sections. 12 ntevl Guide

13 The Properties Tab The fields in the above dialog are explained below: Probe active If selected, activates the probe. To deactivate it, clear the check box. Description Delimiter Adds any character including special characters to replace the existing character as delimiter. Remove Recurring Delimiter If selected, removes repetition of delimiter. Run type Allows you to select Event to trigger the probe every time Windows NT puts a new message into the event log. Select Poll and specify a Poll Interval and Alarm Timeout to check at regular intervals. Note: Nimsoft recommends using the Event mode, as events are processed in real time. In Poll mode, there is additional overhead in creating query each time. You might experience momentary increase in CPU usage if number of events accumulated in that interval is large. Chapter 3: ntevl Configuration 13

14 Logging Allows you to specify the file (Log file) to which the probe logs information about its internal activity and the level of details written to the log file (Log level). Log as little as possible during normal operation (to minimize disk consumption), and increase the amount of detail when debugging. Post event log message setup When event log messages are posted, the default message subject is specified here (Default post subject). Do not use the following subjects: alarm alarm_new alarm_update alarm_close alarm_assign alarm_stats QOS_MESSAGE QOS_DEFINITION These are used internally in Nimsoft for alarm messages. The subject can be overridden in a profile. The Column prefix is pre-pended to each field name when an event is posted. When the event log messages are received, the fields are identified by this prefix and the field name. Fetch event setup Max. events to fetch Specifies the maximum number of events that are fetched from the event log in the Status tab. The default if this field does not have a value is The reason to set a limit is to avoid timeout situations while fetching events from the probe. Fetch alarms on configurator start-up Fetches all alarms at configuration start-up (select the Status tab to see the alarm list). By default, this option is enabled. If the option is not checked, this list will be empty at configurator start-up, and you have to click the Refresh button the Status tab to fetch the alarms. Available Log Files Provides a list of available Log files, which you can select to be monitored. Select any of the log files and click the >> button, to start monitoring. This option is available for Vista and later version of Windows OS only. 14 ntevl Guide

15 Log Files to be monitored Displays a list of log files being monitored by the probe. The log files Application, Security and System are added by default and cannot be removed. However, you can add/remove other log files from the Available Log Files list view. This option is available for Vista and later version of Windows OS only. Note: The ntevl probe does not monitor the Debug and Analytic logs. The Profiles Tab When you select the Profiles tab, the GUI is displayed which contains the list of profiles in the left pane and some sub tabs in the right pane. These sub tabs are used to configure the selected profile. The fields in the above dialog are explained below: <List> Displays all the defined setup profiles. The check box to the left of the profile name must be checked to enable the profile. Select a profile to display/modify its parameters. The first profile in the list is processed first and then the next one. Right-clicking in the list allows you to move a profile up or down. Chapter 3: ntevl Configuration 15

16 Description A text string identifying the watcher. The four sub tabs in the Profile tab are listed below: Event selection (see page 16) Alarm / Post (see page 18) QoS (see page 21) Variables (see page 22) The Event Selection Tab The Event Selection tab lets you configure the event properties for filtering the Windows events, which the profile monitors. 16 ntevl Guide

17 The Event Selection tab contains the following fields: Event selection criteria Lets you configure the selection criteria of an event for monitoring. An asterisk (*) in one of these fields means that the profile processes all log messages regardless of the contents in the field. No Propagation of Events Log Excludes an event matching the selection criteria of one of the monitoring profiles, which is made unavailable for the other profiles. Note: You can change the order of the profiles and the corresponding processing order. Specifies the log file from where the probe monitors the event. The event log files, which are selected in the Properties tab (see page 13) are displayed here. Computer Defines the computer name on which the event has occurred. Note: You can use localhost in the Computer field to get only local messages. You can also use both ranges and commas in the same entry, such as 1-5 and Source/Publisher Severity User Defines the source or the publisher from where the event has logged. Specifies the event severity. Note: The audit success and audit failure severity options are applicable only for Windows earlier than Vista and Microsoft has moved these options to the keyword field from Windows Vista and 2007 onwards. The severity level of these events is shown as Informational in the event viewer. The current implementation of the ntevl probe does not support monitoring on basis of the keyword field. Defines the Windows user account for which the event is generated. Category Event ID Defines the event category, for example, Service State Event. Defines the event ID you are monitoring. Use * for monitoring all event of the select log file. Note: The Event ID field does not support regular expressions. Chapter 3: ntevl Configuration 17

18 Message String Defines the alarm message text when the event selection criteria matches an event. Run Command on match Allows you to run the command when an event matches the selected criteria. Specify the command to be run and optional parameters in the Command executable and Command arguments fields. The Alarm / Post Tab 18 ntevl Guide

19 The Alarm/Post tab contains the following tabs: Send alarm If selected, sends a Nimsoft alarm message on recognition of an event log message. Alarm Message Level Creates/edits an alarm message for the selected profile, and you are allowed to use variables in the messages: $profile: Name of the Profile for which alarm/qos is generated. $description: User-defined description. $variable: User-defined variable. $source: The source from where the event is logged, for example, [Service Control Manager]. $event_id: The ID of the particular event. $category: Category name of the particular event, for example, [Management] and [Disk]. $log: The event log name, for example, [System] and [Application]. $severity: The event Severity level of the event. $severity_str: The severity code name, for example, [error] and [information]. $user: Username of the event. $computer: Host name of the system on which the event is generated. $time_stamp: Date Timestamp when the event is generated. $message: Message description available in the event logger. $record_id: The record number which is assigned to the event when the event is logged. $evldata: The variable $evldata can be used to get the data associated with the event. If no data is present, None is added to the message. Lets you select the severity level of the generated alarms. You can select from eventlog for using the same severity level as the eventlog message. Note: The critical level is supported at Windows Server 2008 only. Subsystem A descriptive text name for the subsystem (variables can be used). Set Suppression Key, optional key Activates the message suppression feature, which avoids the multiple instances of the same alarm-event (variables can be used). You can also define the custom suppression key for the alarms. Chapter 3: ntevl Configuration 19

20 Time frame Time interval during which the events are monitored, and if necessary, the alarms are generated. By default, this field is empty. Event count operator Sets the operator for the event count. Note: Use the alarm count operators with care and avoid generating few or too many alarms. Event count Post message The number of events that are counted to generate an alarm, during the specified time interval. Select this option if you want the event log message data to be posted as a Nimsoft message with the given subject. Note: The field names of the message are used with the Column prefix as specified in the Properties (see page 13) tab. Post subject Defines the custom Message Subject for the selected profile. This subject overrides the default subject, which is ntevl. You can use variables in the messages. $variable: User-defined variable 20 ntevl Guide

21 The QoS Tab The fields in the above dialog are explained below: Number of events found in time interval Sends QoS messages on number of events detected within the specified time interval. Time interval The time interval (in seconds) for event detection used by the QoS option described above. The default time frame value is 300 seconds. Chapter 3: ntevl Configuration 21

22 The Variables Tab The Variables tab enables you to define one or more variables for each profile. There is no limit on the number of variables that can be defined for each profile. Also, note that duplicate variable names are not allowed. 22 ntevl Guide

23 Follow these steps to create a variable: 1. Select the profile check box on the left hand pane to activate it. 2. In the Variables tab, right-click in the grid and select New from the context menu. The Variable settings dialog opens. The fields in the above dialog are explained below: Name Defines the name for the variable. Duplicate variable names are not allowed. By default, var is displayed. Source Line The source line of the variable where the threshold alarm needs to be defined. Select the FROM and TO positions. Source FROM position Extracting from a source file: Define from which position in the source line defined to extract the variable, either a column or a character. Extracting from a match expression: If extracting from the match expression, click the Match expression option button and specify the number referring to the correct position in the match expression. You can extract variables from the contents inside parentheses in the match expression. Using number 1, refers to the first parenthesis in the expression, using number 2, refers to the second parenthesis in the expression, and so on. Chapter 3: ntevl Configuration 23

24 Source TO position Extracting from a source file: Define to which position in the source line defined to extract the variable, either a column or a character. Extracting from a match expression: Ignore 'to' is automatically selected (as the only valid option). Threshold alarm definition Operator Select a comparison operator from the drop-down list. You can also select the re option for using the regular expressions. Note: The >, <, >=, and <= operators support only integer and float type values. These operators do not work with string values. Threshold Set the threshold value for the variable. Example: If the threshold does not match with the message description of an event, then the probe generates an alarm. 3. Enter and select the required fields and click OK. Notes: The newly created variable is displayed in the Variables grid. To edit a variable, right-click on it and select Edit option from the context menu. To delete a variable, right-click on it and select Delete option from the context menu. 24 ntevl Guide

25 The Exclude Tab The Exclude tab enables you to specify the profiles that should be excluded by the ntevl probe. Follow these steps to create an entry: 1. Right-click in the left-hand section and select New from the context menu. The Exclude entry name dialog opens. Chapter 3: ntevl Configuration 25

26 2. Enter a name for the entry and click OK. The entry gets added at the left-hand pane. Also, the fields in the right-hand pane get enabled. The fields in the above dialog are explained below: <List> Shows all the defined exclude profiles. Select a profile to display/modify its parameters. Event selection criteria Specify regular expressions identifying the eventlog messages you are looking for. An asterisk (*) in one of these fields means all log messages regardless of the contents in the field. Note: You can also use, both, ranges and commas in the same entry, such as 1-5, Events matching all the criteria in an exclude profile will be excluded from monitoring by the defined profiles. The Event ID field does not support regular expressions. 26 ntevl Guide

27 Use format as shown in the examples below: * 114 1, 5,10 1, The Status Tab The ntevl probe extracts the current values of the system, application and security event-logs by default. You can add custom event logs here. Note: Only the latest messages appear (determined by the number specified in the Max events to fetch field under Setup/Properties) of so that more event log messages may be present in the actual event log. Also, note the Fetch alarms on configurator start-up option on the Setup tab. By default, this option is enabled, which fetches all alarms at configuration start-up. If the option is not checked, the alarm list will be empty at configurator start-up and you have to click the Refresh button on the Setup tab to fetch the alarms. Chapter 3: ntevl Configuration 27

28 The following right-click menu selections are available: Refresh: Fetch the event log messages again. New profile: Create a monitoring profile using values from the current event. Exclude from monitoring: Create an exclude profile using values from the current event. Clear log: Remove all event messages from the current event log. The Custom Events can be added from Raw Configure. Follow these steps to add a custom event: 1. Right-click the probe in Infrastructure Manager and click Deactivate. 2. In the inactive probe, press SHIFT+Right-click and select Raw Configure from the context menu. 3. Select Edit Configuration File... in the Raw Configure dialog. 28 ntevl Guide

29 4. In the Raw Configure dialog, select logs in the left pane and click New Key... The New Key dialog opens. 5. Enter the key name and value and click OK. The new key gets added in the Key list. 6. In the left pane, select subsystems and click New Key... The New Key dialog opens. Chapter 3: ntevl Configuration 29

30 7. Enter the key name and value. Ensure to keep the same key name as the one defined earlier and click OK. The new key gets added in the list. 8. Apply the above settings, activate the probe and open the GUI. The custom log reflects in Status > Event log list. 30 ntevl Guide

31 Configure Locale Specific Severity String The New Probe probe displays the event severity as Information, when deployed in the non-english environment. This thing happens when the probe is installed on Windows Vista or Windows Server 2008 R2 or a later version. The Windows returns event severity string in their specific locales and the probe is not able to compare these values with equivalent English string. You can use the Raw Configure option for configuring the locale-specific severity. Follow these steps: 1. Open the Raw Configure GUI of the New Probe probe. 2. Go to the language_string section. Seven keys are available in this section for configuring the severity value: critical information warning verbose error audit_failure audit_success 3. Define the severity value corresponding to the severity name according to their system locales. For example, if we are using the French locale, then define Erreur for the error key. Important! These seven keys are case-sensitive; therefore the severity string must be exactly same as it is displaying in the event viewer. 4. Click OK and close the Raw Configure GUI. 5. Restart the probe for applying the changes. The probe now displays the appropriate severity of each event. Parameters in a Posted Message The messages are posted to a table called EventLogMessages containing the following fields: Parameter Type Value column prefixwatcher Text The name of the profile finding the event log message column prefixlog Text The event log containing the event Chapter 3: ntevl Configuration 31

32 Parameter Type Value column prefixseverity Text The event type column prefixseverity_str Text Event severity column prefixsource Text Identification of the application generating the event column prefixcategory Text The event category column prefixevent_id Number A numeric event identifier column prefixuser Text The user running the application that generated the event column prefixcomputer Text The computer name on which the event was generated column prefixdescription Text Expanded event description column prefixdata Text None column prefixtime_stamp_epoc Number The time the event was generated column prefixtime_stamp Date/Time The time the event was generated column prefixvariable Text Value of the variable created in the profile Note: Depending on the number of variables created in the profile the parameters gets displayed. The adogtw probe can be used to receive the posted messages and redirect these to your database. 32 ntevl Guide

33 Chapter 4: Edit Probe Configuration To edit the probe configuration, right-click the probe in Infrastructure Manager and select Edit. Chapter 4: Edit Probe Configuration 33

34 The following dialog appears: The fields in the above dialog are explained below: Probe Type The probe name. This field is non-editable. The type of execution. By default, timed option is selected. You can deactivate the setting by de-selecting the Active check box. Command The process that will execute the reboot. By default, it is ntevl.exe. Arguments Optional arguments that can be passed to the probe. For the list of available arguments, see Arguments (see page 35) section. Working Directory Configuration File \probes\system\reboot. The name of the probe configuration file. By default, the file is named ntevl.cfg. 34 ntevl Guide

35 Arguments Parameter Data File Specify the name if the probe data file, if required. Time Specification Specify the time range within which the probe activity should be carried out. Execution Group Specify the time interval at which the reboot should be executed. You can specify the start time or frequency (in minutes). Choose Ignore option to nullify this field. Specifies the probe grouping. By default, it is Systemgroup. Description Log File A brief description of the probe activity. By default, the description text is Windows NT Event Log watcher. Name of the log file for the probe. By default, it is ntevl.log. This section contains the following topics: Arguments (see page 35) Description -p < port> Communications port to use -d<log level> Set log level -l <log file> Specify log file -e <evl log file> File for logging internal messages -c <config file> File used for general and watcher setup -f <position file> File used for storing event log positions -V Print version information -z Set current event log positions -Z Set current event log positions and run the probe normally -h Help information Chapter 4: Edit Probe Configuration 35

36 View Event Details The probe configuration lets you view the event details that you are monitoring. These event details are used for deciding the monitoring parameters of the event. Follow these steps: 1. Click the Status tab. 2. Select the event log file from the Event log drop-down list. Note: The Event log drop-down list displays only those log files, which are selected in the Log Files to be monitored list. The probe displays the list of events, which are available in the selected log file. 3. Double-click the appropriate event in the list. The Event Properties dialog is displayed. 36 ntevl Guide

37 The General tab of the Event Properties dialog displays the event description. 4. Click the Details tab for displaying the XML view of the event. Note: The XML view is available with Windows Vista and Windows 2008 onwards only. 5. Click Close. You can use the $evldata variable for getting this event XML in the alarm message text. Chapter 4: Edit Probe Configuration 37

38

39 Chapter 5: Operation and Use This section describes how to monitor up and down status for multiple computers, using two profiles. Create the two profiles UP status and DOWN status by selecting the Profiles tab, right-clicking in the Profile list and then selecting the New option. Select the Activate box for both profiles. Follow these steps to configure the UP status profile: 1. Select the Event selection tab and specify the Event ID for the UP status (50002). Chapter 5: Operation and Use 39

40 2. Select the Alarm/Post tab. Create an alarm message (e.g. $computer up) and select severity level as Clear. 3. Set a suppression key (e.g. $computer) to avoid multiple instances of the same alarm message. 40 ntevl Guide

41 4. Now, configure the DOWN status profile. For this, select the Event selection tab and specify the Event ID for the DOWN status (50001). Chapter 5: Operation and Use 41

42 5. Select the Alarm/Post tab create an alarm message (e.g. $computer down) and select severity level warning. 6. Set a suppression key (e.g. $computer) to avoid multiple instances of the same alarm message. 7. Click the Apply button to activate the new profiles and then the OK button to exit the ntevl configuration tool. Chapter 6: ntevl QoS Metrics The following table describes the checkpoint metrics that can be configured using the ntevl probe: Monitor Name Units Description QOS_EVL_COUNT Count Windows Events 42 ntevl Guide