Nimsoft Unified Management Portal. SOC Probes Configuration Reference

Transcription

1 Nimsoft Unified Management Portal SOC Probes Configuration Reference

2 Contact Nimsoft For your convenience, Nimsoft provides a single site where you can access information about Nimsoft products. At you can access the following: Online and telephone contact information for technical assistance and customer services Information about user communities and forums Product and documentation downloads Nimsoft Support policies and guidelines Other helpful resources appropriate for your product Provide Feedback If you have comments or questions about Nimsoft product documentation, you can send a message to support@nimsoft.com.

3 Legal Notices Copyright 2012, CA. All rights reserved. Warranty The material contained in this document is provided "as is," and is subject to being changed, without notice, in future editions. Further, to the maximum extent permitted by applicable law, Nimsoft LLC disclaims all warranties, either express or implied, with regard to this manual and any information contained herein, including but not limited to the implied warranties of merchantability and fitness for a particular purpose. Nimsoft LLC shall not be liable for errors or for incidental or consequential damages in connection with the furnishing, use, or performance of this document or of any information contained herein. Should Nimsoft LLC and the user have a separate written agreement with warranty terms covering the material in this document that conflict with these terms, the warranty terms in the separate agreement shall control. Technology Licenses The hardware and/or software described in this document are furnished under a license and may be used or copied only in accordance with the terms of such license. No part of this manual may be reproduced in any form or by any means (including electronic storage and retrieval or translation into a foreign language) without prior agreement and written consent from Nimsoft LLC as governed by United States and international copyright laws. Restricted Rights Legend If software is for use in the performance of a U.S. Government prime contract or subcontract, Software is delivered and licensed as "Commercial computer software" as defined in DFAR (June 1995), or as a "commercial item" as defined in FAR 2.101(a) or as "Restricted computer software" as defined in FAR (June 1987) or any equivalent agency regulation or contract clause. Use, duplication or disclosure of Software is subject to Nimsoft LLC s standard commercial license terms, and non-dod Departments and Agencies of the U.S. Government will receive no greater than Restricted Rights as defined in FAR (c)(1-2) (June 1987). U.S. Government users will receive no greater than Limited Rights as defined in FAR (June 1987) or DFAR (b)(2) (November 1995), as applicable in any technical data. Trademarks Nimsoft is a trademark of CA. Adobe, Acrobat, Acrobat Reader, and Acrobat Exchange are registered trademarks of Adobe Systems Incorporated. Intel and Pentium are U.S. registered trademarks of Intel Corporation. Java(TM) is a U.S. trademark of Sun Microsystems, Inc. Microsoft and Windows are U.S. registered trademarks of Microsoft Corporation. Netscape(TM) is a U.S. trademark of Netscape Communications Corporation. Oracle is a U.S. registered trademark of Oracle Corporation, Redwood City, California. UNIX is a registered trademark of the Open Group. ITIL is a Registered Trade Mark of the Office of Government Commerce in the United Kingdom and other countries. All other trademarks, trade names, service marks and logos referenced herein belong to their respective companies. For information on licensed and public domain software, see the Nimsoft Monitor Third-Party Licenses and Terms of Use document at:

4

5 Contents Chapter 1: SOC-Supported Probes 11 Chapter 2: ad_response 13 Replication Monitor (Remote) Configuration Response Monitor (Remote) Configuration Search Monitor (Remote) Configuration Chapter 3: ad_server 19 Active Directory Server (WMI) Monitor (Local) Configuration Active Directory Server Services Monitor (Local) Configuration Active Directory Server (Performance) Counter Monitor (Local) Configuration Active Directory Server (Processes) Monitor (Local) Configuration Active Directory Server (File System) (Local) Configuration Active Directory Server (Files) (Local) Configuration Active Directory Server (Event Log) (Local) Configuration Chapter 4: adevl 29 Active Directory Event Monitor (Local) Configuration Active Directory Exclude Monitor (Local) Configuration Chapter 5: apache 35 Chapter 6: cdm 41 CPU Usage (Local) configuration Computer Up Time Monitor (Local) configuration Memory Paging (Local) configuration Computer Reboot Monitor (Local) configuration Disk Usage (Local) Configuration Contents 5

6 Chapter 7: cisco_monitor 53 Chapter 8: cisco_qos 57 Chapter 9: cisco_unity 59 Chapter 10: db2 63 Chapter 11: dhcp 71 Chapter 12: dirscan 73 Directory Scanner Setup Properties (local) Directory Scanner (local) Directory Integrity Scanner (local) SOC Probes Configuration Reference

7 Chapter 13: dns_response 79 Chapter 14: _response 81 Chapter 15: exchange_monitor 85 Chapter 16: exchange_response 91 Chapter 17: fetchmsg 93 Chapter 18: iis 95 Chapter 19: informix 99 Chapter 20: interface_traffic 103 Chapter 21: jdbc_response 111 Chapter 22: jobqs 115 Chapter 23: jobs 117 Chapter 24: jobsched 119 Chapter 25: jvm_monitor 121 Resource Monitor configuration Properties configuration Contents 7

8 Chapter 26: ldap_response 125 Chapter 27: logmon 129 Chapter 28: mysql 137 Chapter 29: net_connect 143 Remote Monitor configuration Service Remote Monitor configuration Chapter 30: ntevl 147 Windows Event Monitor (local) Configuration Windows Event Monitor Exclude (local) Configuration Chapter 31: ntp_response 153 Chapter 32: ntperf 155 Chapter 33: ntservices 157 windowsservicessetup.ntservicesmonitor configuration windowsservices.ntservicesmonitor configuration Chapter 34: ocs_monitor 161 ocs_monitor WMI Monitor (Local) Configuration ocs_monitor Services Monitor (Local) Configuration ocs_monitor Performance Counter Monitor (Local) Configuration ocs_monitor Processes Monitor (Local) Configuration ocs_monitor File System (Local) Configuration ocs_monitor Files (Local) Configuration ocs_monitor Event Log (Local) Configuration SOC Probes Configuration Reference

9 Chapter 35: oracle 171 Chapter 36: outqs 177 Chapter 37: printers 179 Watcher Properties configuration printers configuration Chapter 38: processes 181 Chapter 39: reboot 185 Chapter 40: rsp 187 Windows Services (remote) configuration CPU Usage (remote) configuration Disk Usage (remote) configuration Memory (remote) configuration Paging (remote) configuration Load (remote) configuration Windows Event Monitor (remote) configuration Processes (remote) configuration Chapter 41: saa_monitor 203 Chapter 42: sharepoint 211 Sharepoint WMI Monitor (Local) Configuration Sharepoint Services Monitor (Local) Configuration Sharepoint Performance Counters Monitor (Local) Configuration Sharepoint Processes Monitor (Local) Configuration Sharepoint Filesystem Monitor (Local) Configuration Sharepoint Files Monitor (Local) Configuration Sharepoint Eventlogs Monitor (Local) Configuration Chapter 43: snmpget 223 setup configuration snmpoid configuration Contents 9

10 Chapter 44: sql_response 229 Chapter 45: sql_server 235 Chapter 46: sybase 241 Chapter 47: sysstat 247 Chapter 48: temperature 251 Temperature Sensors Monitor (Local) Configuration Temperature Monitor (Local) Configuration Chapter 49: url_response 253 Chapter 50: vmware 259 Getting Started with Service-Oriented Configuration Detach a VMware Probe from Service-oriented Configuration Creating VMware Monitoring Templates VMware ESX Host CDMN Monitor dialog VMware VM CDMN Monitor dialog Creating VMware Groups SOC Probes Configuration Reference

11 Chapter 1: SOC-Supported Probes Local Probes The following table lists the probes, either local or remote, that can be used with Service Oriented Configuration. Local probes run on the target system. Remote probes run on a Nimsoft Monitor Station (a system where a discovery agent and a Nimsoft robot are installed). Probes are automatically deployed and configured when a monitor is applied to a system. Remote Probes adevl 1.56 ad_server 1.43 cdm 4.44 dhcp 3.22 dirscan 3.05 exchange_monitor 4.01 fetchmsg 1.43 jobqs 1.12 jobs 1.35 jobsched 1.21 logmon 3.22 ntevl 3.81 ntperf 1.83 ntservices 3.10 outqs 1.11 printers 2.53 processes 3.70 reboot 1.40 sharepoint 1.51 sysstat 1.13 ad_response 1.52 apache 1.51 cisco_monitor 3.31 cisco_qos 1.22 dns_response _response 1.41 exchange_response 2.51 iis 1.52 interface_traffic 5.23 jdbc_response 1.12 jvm_monitor 1.20 ldap_response 1.33 mysql 1.43 net_connect 2.90 ntp_response 1.30 rsp 2.92 saa_monitor 1.62 snmpget 1.81 sql_response 1.60 sql_server 4.71 sybase 4.11 url_response 4.12 vmware 4.0 (no discovery_agent dependency) Chapter 1: SOC-Supported Probes 11

12

13 Chapter 2: ad_response The ad_response probe monitors the availability of Active Directory on Windows servers. This probe monitors profiles, defines a domain/server connection, and specifies monitored objects/attributes. The profiles are placed into the following groups: Replication Response Search The ad_response probe monitors and reports the following parameters: Connect response time. Search response time and number of objects found. Replication of modified objects between servers, sites and domains. A new tab, Connection, has been added in each of the monitors (Replication, Response, and Search) to define the connection properties for the profile. As against the previous approach, where manual entries had to be done into the database tables (CM_AUTHENTICATION and CM_AUTHENTICATION_PARAMETER) for this probe to work, with this new tab, inputs will be taken directly into the GUI. This section contains the following topics: Replication Monitor (Remote) Configuration (see page 13) Response Monitor (Remote) Configuration (see page 15) Search Monitor (Remote) Configuration (see page 16) Replication Monitor (Remote) Configuration General Tab Profile Name Sample data every Enabled (runs at specified interval) Enter a name for this profile. Enter a description for this profile. Enter the time interval when this profile must collect sample values for checkpoints and click the unit value for this time interval. Select this check box to enable the profile to sample data. Chapter 2: ad_response 13

14 Replication Monitor (Remote) Configuration Connection Tab Options Authentication Type: Select type of connection to be used by the profile: LDAP or Global Catalog. Use secure connection: Select this option if you want to use a secure connection, ensuring that all communication will be encrypted. Bind to specific server: Select this option if you want to bind this connection to a specific server. If the server defined is unavailable, the connection will fail Specify valid login credentials (UserName along with domain name and Password) to be used by the profile when logging on the server is to be monitored. If the domain name does not exist, then user name must be specified preceded with a "\". Object Tab Container Object Attribute Write mode Enter the container name. The probe searches for object in this location. Enter the object that needs to be searched for by this profile. Enter the attribute that needs to be monitored by the probe. Select the check box to enable changing object timestamps by the probe. Counters Tab Object Age Tab Object age threshold Add Value Severity Allows you to define a threshold value and severity level for the counter. Note: You can define multiple threshold settings. Select this check box to activate a checkpoint. Monitoring starts only after you activate a checkpoint. Click the operator in the list and enter the threshold value for the object age in the box. Click the severity of the alarm message that the probe must send to Nimsoft Information System (NIS). 14 SOC Probes Configuration Reference

15 Response Monitor (Remote) Configuration Send QoS Select this check box to send QoS values to the QoS database. Status Tab Status Threshold Add Value Severity Allows you to define a threshold value and severity level for the counter. Note: You can define multiple threshold settings. Select this check box to activate a checkpoint. Monitoring starts only after you activate a checkpoint. Click the operator in the list and enter the threshold value for the object age in the box. Click the severity of the alarm message that the probe must send to Nimsoft Information System (NIS). Response Monitor (Remote) Configuration General Tab Profile Name Sample data every Enabled (runs at specified Interval) Enter a name for this profile. Enter a description for this profile. Enter the time interval when this profile must collect sample values for checkpoints and click the unit value for this time interval. Select this check box to enable the profile to sample data. Connection Tab Options Type: Select type of connection to be used by the profile: LDAP or Global Catalog. Use secure connection: Select this option if you want to use a secure connection, ensuring that all communication will be encrypted. Bind to specific server: Select this option if you want to bind this connection to a specific server. If the server defined is unavailable, the connection will fail Chapter 2: ad_response 15

16 Search Monitor (Remote) Configuration Authentication Specify valid login credentials (UserName along with domain name and Password) to be used by the profile when logging on the server is to be monitored. If the domain name does not exist, then user name must be specified preceded with a "\". Counters Tab Response Time Tab Response time threshold Add Value Severity Send QoS Allows you to define a threshold value and severity level for the counter. Note: You can define multiple threshold settings. Select this check box to activate a checkpoint. Monitoring starts only after you activate a checkpoint. Click the operator in the list and enter the threshold value for the object age in the box. Click the severity of the alarm message that the probe must send to Nimsoft Information System (NIS). Select this check box to send QoS values to the QoS database. Status Tab Status Threshold Add Value Severity Allows you to define a threshold value and severity level for the counter. Note: You can define multiple threshold settings. Select this check box to activate a checkpoint. Monitoring starts only after you activate a checkpoint. Click the operator in the list and enter the threshold value for the object age in the box. Click the severity of the alarm message that the probe must send to Nimsoft Information System (NIS). Search Monitor (Remote) Configuration General Tab Profile Name Enter a name for this profile. Enter a description for this profile. 16 SOC Probes Configuration Reference

17 Search Monitor (Remote) Configuration Sample data every Enabled (runs at specified interval) Enter the time interval when this profile must collect sample values for checkpoints and click the unit value for this time interval. Select this check box to enable the profile to sample data. Connection Tab Options Authentication Type: Select type of connection to be used by the profile: LDAP or Global Catalog. Use secure connection: Select this option if you want to use a secure connection, ensuring that all communication will be encrypted. Bind to specific server: Select this option if you want to bind this connection to a specific server. If the server defined is unavailable, the connection will fail Specify valid login credentials (UserName along with domain name and Password) to be used by the profile when logging on the server is to be monitored. If the domain name does not exist, then user name must be specified preceded with a "\". Query Tab Search root container Enter the root container name. The probe searches for object in this location. Enter an LDAP filter for the search. The LDAP filter defines the objects to search for by the probe. LDAP filter formats are defined in RFC2254 ( Filter Include subcontainers Examples for setting up a filter in Active Directory: User ID starting with "e": (samaccountname=e*) User ID NOT starting with "e": (!samaccountname=e*) Surname starting with "a" and first name starting with "b": (&(sn=a*)(givenname=b*)) Surname starting with "a" or "b": ( (sn=a*)(sn=b*)) Select this check box to include subcontainers, within the root container, when performing this query. Chapter 2: ad_response 17

18 Search Monitor (Remote) Configuration Counters Tab Object Found Tab Object found threshold Add Value Severity Send QoS Allows you to define a threshold value and severity level for the counter. Note: You can define multiple threshold settings. Select this check box to activate a checkpoint. Monitoring starts only after you activate a checkpoint. Click the operator in the list and enter the threshold value for the object age in the box. Click the severity of the alarm message that the probe must send to Nimsoft Information System (NIS). Select this check box to send QoS values to the QoS database. Response Time Tab Response time threshold Add Value Severity Send QoS Allows you to define a threshold value and severity level for the counter. Note: You can define multiple threshold settings. Select this check box to activate a checkpoint. Monitoring starts only after you activate a checkpoint. Click the operator in the list and enter the threshold value for the object age in the box. Click the severity of the alarm message that the probe must send to Nimsoft Information System (NIS). Select this check box to send QoS values to the QoS database. Status Tab Status Threshold Add Value Severity Allows you to define a threshold value and severity level for the counter. Note: You can define multiple threshold settings. Select this check box to activate a checkpoint. Monitoring starts only after you activate a checkpoint. Click the operator in the list and enter the threshold value for the object age in the box. Click the severity of the alarm message that the probe must send to Nimsoft Information System (NIS). 18 SOC Probes Configuration Reference

19 Chapter 3: ad_server The probe monitors selected checkpoints on Active Directory. Active Directory is the directory service included with Windows servers and provides the means to manage the identities and relationships that make up network environments. The probe uses monitoring profiles, and the profiles are grouped in the following seven predefined groups or categories: Eventlogs Event logs for specific event ID s contents (e.g. messages) etc. Filesystems Monitoring file systems for specific patterns. Files Monitoring for specific files. Performance counters Performance counters for a wide range of system objects, such as disk, CPU performance, memory print queues etc. Processes A wide range of counters for the different processes running on the system. Services Services outside Active Directory that are essential to the proper operation of Active Directory. WMI Checking authentication failures and the inability to access resources. Note that WMI of Datatype Reference is not supported. Chapter 3: ad_server 19

20 Active Directory Server (WMI) Monitor (Local) Configuration Each of these categories can contain several profiles. The ad_server probe is delivered with a default configuration with a selected set of profiles to be monitored, but you can also define your own profiles. Each of the profiles can contain several counters. This section contains the following topics: Active Directory Server (WMI) Monitor (Local) Configuration (see page 20) Active Directory Server Services Monitor (Local) Configuration (see page 21) Active Directory Server (Performance) Counter Monitor (Local) Configuration (see page 22) Active Directory Server (Processes) Monitor (Local) Configuration (see page 23) Active Directory Server (File System) (Local) Configuration (see page 25) Active Directory Server (Files) (Local) Configuration (see page 26) Active Directory Server (Event Log) (Local) Configuration (see page 27) Active Directory Server (WMI) Monitor (Local) Configuration General Tab Name Sample data every Startup delay Enabled (runs at specified interval) WMI Tab Namespace Class Instance Enter a name for this profile. Enter a description for this profile. Enter the time interval when this profile must collect sample values for checkpoints and click the unit value for this time interval. Enter the time interval for which the profile must wait, after its activation, for collecting values for the checkpoints and click the unit for this time. Select this check box to enable the profile to sample data. Enter the namespace of the WMI that the probe must monitor. Enter the class under the specified Namespace that the probe must monitor. If the class returns more than one instance, enter the instance that the probe must monitor. 20 SOC Probes Configuration Reference

21 Active Directory Server Services Monitor (Local) Configuration Counters Tab Counter Name Send QoS Enter a name for the counter(s) you are specifying. Select this check box to send QoS values to the QoS database. Threshold Setting Add Value is Severity Message Select this check box to activate a checkpoint. Monitoring starts only after you activate a checkpoint. Click the operator in the list and enter the threshold value in the box. When the monitored value meets the threshold criteria, the probe generates an alarm. For example: If you set the threshold value to >3 for the Process Queue Length checkpoint and the monitored value is 5, the probe generates an alarm. Click the severity of the alarm message that the probe must send to Nimsoft Information System (NIS). Click the message that the probe must send to the Nimsoft Information System (NIS) when the monitored value exceeds the threshold value. Active Directory Server Services Monitor (Local) Configuration General Tab Name Sample data every Startup delay Enabled (runs at specified interval) Enter a name for this profile. Enter a description for this profile. Enter the time interval when this profile must collect sample values for checkpoints and click the unit value for this time interval. Enter the time interval for which the profile must wait, after its activation, for collecting values for the checkpoints and click the unit for this time. Select this check box to enable the profile to sample data. Chapter 3: ad_server 21

22 Active Directory Server (Performance) Counter Monitor (Local) Configuration Service Tab Service Enter the windows service currently installed on your computer that the probe must monitor. Counters Tab State Tab Active Value is Severity Message Select this check box to activate a checkpoint. Monitoring starts only after you activate a checkpoint. Click the operator in the list and enter the threshold value in the box. When the monitored value meets the threshold criteria, the probe generates an alarm. For example: If you set the threshold value to >3 for the checkpoint and the monitored value is 5, the probe generates an alarm. Click the severity of the alarm message that the probe must send to Nimsoft Information System (NIS). Click the message that the probe must send to the Nimsoft Information System (NIS) when the monitored value exceeds the threshold value. Active Directory Server (Performance) Counter Monitor (Local) Configuration General Tab Name Sample data every Startup delay Enabled (runs at specified interval) Enter a name for this profile. Enter a description for this profile. Enter the time interval when this profile must collect sample values for checkpoints. Also, specify unit value for this time interval. Enter the time interval for which the profile must wait, after its activation, for collecting values for the checkpoints. Also, specify unit for this time. Select this check box to enable the profile to sample data. 22 SOC Probes Configuration Reference

23 Active Directory Server (Processes) Monitor (Local) Configuration Performance Counter Tab Object Instance Enter the performance object that the probe must monitor. Some of the objects may have more than one instance on the system. If so, the Instance field will be enabled, letting you select an instance. Otherwise, the field is dimmed. Counters Tab Counter Name Send QoS Enter the name for this counter. Select this check box to send QoS values to the QoS database. Threshold Setting Add Value is Severity Message Select this check box to activate a checkpoint. Monitoring starts only after you activate a checkpoint. Click the operator in the list and enter the threshold value in the box. When the monitored value meets the threshold criteria, the probe generates an alarm. For example: If you set the threshold value to >3 for the checkpoint and the monitored value is 5, the probe generates an alarm. Click the severity of the alarm message that the probe must send to Nimsoft Information System (NIS). Click the message that the probe must send to the Nimsoft Information System (NIS) when the monitored value exceeds the threshold value. Active Directory Server (Processes) Monitor (Local) Configuration General Tab Name Sample data every Enter a name for this profile. Enter a description for this profile. Enter the time interval when this profile must collect sample values for checkpoints and click the unit value for this time interval. Chapter 3: ad_server 23

24 Active Directory Server (Processes) Monitor (Local) Configuration Startup delay Enabled (runs at specified interval) Enter the time interval for which the profile must wait, after its activation, for collecting values for the checkpoints and click the unit for this time. Select this check box to enable the profile to sample data. Process Tab Process Name Enter the process currently running on your computer that the probe must monitor. Counters Tab Value Severity Message QoS Active Click the operator in the list and enter the threshold value in the box. When the monitored value meets the threshold criteria, the probe generates an alarm. For Example: If you set the threshold value to >3 for the checkpoint and the monitored value is 5, the probe generates an alarm. Click the severity of the alarm message that the probe must send to Nimsoft Information System (NIS). Click the message that the probe must send to the Nimsoft Information System (NIS) when the monitored value exceeds the threshold value. Select this check box to send QoS values to the QoS database. Select the check box to activate a checkpoint. Monitoring starts only after you activate a checkpoint. Note: There are three different Counters tabs (Counters (1), Counters (2) and Counters (3)) to specify different type of variables, hence making the monitoring process more controlled and effective. Moreover, each Counter Tab contains sections (Caption, Command Line, Creation Class Name, CS Name,, Executable Path, Executable State, Handle, Handle Count, Name, OS Name, Other Operation Count, Other Transfer Count, Page Faults, Page File Usage, Parent Process Id, Peak Page File Usage, Peak Virtual Size, Peak Working Set Size, Priority, Process Id, Quota Non Paged Pool Usage, Quota Peak Paged Pool Usage, Read Operation Count, Read Transfer Count, Session Id, Status, Thread Count, User Mode Time, Virtual Size, Windows Version, Working Set Size, Working Operation Count and Working Transfer Count) to define counters for each section separate. 24 SOC Probes Configuration Reference

25 Active Directory Server (File System) (Local) Configuration Active Directory Server (File System) (Local) Configuration General Tab Name Sample data every Startup delay Enabled (runs at specified interval) Enter a name for this profile. Enter a description for this profile. Enter the time interval when this profile must collect sample values for checkpoints and click the unit value for this time interval. Enter the time interval for which the profile must wait, after its activation, for collecting values for the checkpoints and click the unit for this time. Select this check box to enable the profile to sample data. Filesystem Tab Directory Pattern Include subdirectories Enter the directory that the probe must monitor for a specific pattern. The probe will check whether the directory exists, the size of the directory and age of the oldest and newest file in that directory. Enter the pattern the probe must search for in the specified directory. For example: *.* is a pattern that can be used to search a file in the directory. Select this check box if you want that the probe must recursively monitor subdirectory. Counters Tab (Directories, File Age Newest, File Age Oldest, Files, Total Size, Not Found) Send QoS data Active Select this check box to send QoS values to the QoS database. Select this check box to activate a checkpoint. Monitoring starts only after you activate a checkpoint. Chapter 3: ad_server 25

26 Active Directory Server (Files) (Local) Configuration Value is Severity Message Click the operator in the list and enter the threshold value in the box. When the monitored value meets the threshold criteria, the probe generates an alarm. For example: If you set the threshold value to >3 for the checkpoint and the monitored value is 5, the probe generates an alarm. Click the severity of the alarm message that the probe must send to Nimsoft Information System (NIS). Click the message that the probe must send to the Nimsoft Information System (NIS) when the monitored value exceeds the threshold value. Active Directory Server (Files) (Local) Configuration General Tab Name Sample data every Startup delay Enabled (runs at specified interval) Enter a name for this profile. Enter a description for this profile. Enter the time interval when this profile must collect sample values for checkpoints and click the unit value for this time interval. Enter the time interval for which the profile must wait, after its activation, for collecting values for the checkpoints and click the unit for this time. Select this check box to enable the profile to sample data. File Tab File Enter the path of the file that the probe must monitor. The probe checks whether file is created or updated. Counters Tab (Changed, Created, Not Found) Send QoS data Active Select this check box to send QoS values to the QoS database. Select this check box to activate a checkpoint. Monitoring starts only after you activate a checkpoint. 26 SOC Probes Configuration Reference

27 Active Directory Server (Event Log) (Local) Configuration Value is Severity Message Click the operator in the list and enter the threshold value in the box. When the monitored value meets the threshold criteria, the probe generates an alarm. For Example: If you set the threshold value to >3 for the checkpoint and the monitored value is 5, the probe generates an alarm. Click the severity of the alarm message that the probe must send to Nimsoft Information System (NIS). Click the message that the probe must send to the Nimsoft Information System (NIS) when the monitored value exceeds the threshold value. Active Directory Server (Event Log) (Local) Configuration General Tab Name Sample data every Startup delay Enabled (runs at specified interval) Enter a name for this profile. Enter a description for this profile. Enter the time interval when this profile must collect sample values for checkpoints and click the unit value for this time interval. Enter the time interval for which the profile must wait, after its activation, for collecting values for the checkpoints and click the unit for this time. Select this check box to enable the profile to sample data. Event Log Tab Log Computer Source Enter the log file that the probe must monitor. Probe generates the alarm for the events corresponding to this log file. Enter the name of the computer that the probe must search in the log file. Probe generates the alarm for the events corresponding to this computer. Enter the Source ID that the probe must search in the log file. Probe generates the alarm for the events corresponding to this Source ID. Chapter 3: ad_server 27

28 Active Directory Server (Event Log) (Local) Configuration Severity User Category Event Id Message Click the severity that the probe must search in the log file. Probe generates the alarm for the events corresponding to this severity. Enter the name of a user that the probe must search in the log file. Probe generates the alarm for the events corresponding to this User. Enter the category that the probe must search in the log file. Probe generates the alarm for the events corresponding to this Category Enter the Event Id that the probe must search in the log file. Probe generates the alarm for the events corresponding to this Event Id. Enter the Message that the probe must search in the log file. Probe generates the alarm for the events corresponding to this Message. Counters Tab (Event Found and Number of Event Found) Send QoS data Active Value is Severity Message Select this check box to send QoS values to the QoS database. Select this check box to activate a checkpoint. Monitoring starts only after you activate a checkpoint. Click the operator in the list and enter the threshold value in the box. When the monitored value meets the threshold criteria, the probe generates an alarm. For example: If you set the threshold value to >3 for the checkpoint and the monitored value is 5, the probe generates an alarm. Click the severity of the alarm message that the probe must send to Nimsoft Information System (NIS). Click the message that the probe must send to the Nimsoft Information System (NIS) when the monitored value exceeds the threshold value. 28 SOC Probes Configuration Reference

29 Chapter 4: adevl The Active Directory Events probe (adevl) generates alerts based on messages from the NT event logs associated with Active Directory. The probe monitors the event logs Directory Service, DNS Server and File Replication Service for new messages and generates alarm messages according to your setup. You can set up the probe to trigger each time a log event occurs in windows, which will activate it immediately every time a new message is put into the event log. Otherwise, you can also choose to check the event log for new messages at fixed time intervals, which will reduce the system load generated by the probe. This section contains the following topics: Active Directory Event Monitor (Local) Configuration (see page 29) Active Directory Exclude Monitor (Local) Configuration (see page 33) Active Directory Event Monitor (Local) Configuration Profiles Tab Profile Name Enter the name of the profile you are creating. Enter any additional information about the profile you are creating. Event Selection Criteria No propagation of events Log Computer Severity If checked, an event matching the selection criteria for a profile will be made available for other profiles. Note: You can change the order of the profiles and thus the processing order. Enter the log file that probe must monitor. Probe generates the alarm for the events corresponding to this log file. Enter the name of the computer that the probe must search in the log file. Probe generates the alarm for the events corresponding to this computer. Click the severity that the probe must search in the log file. Probe generates the alarm for the events corresponding to this severity. Chapter 4: adevl 29

30 Active Directory Event Monitor (Local) Configuration User Event Id Message String Source Category Enter the name of a user that the probe must search in the log file. Probe generates the alarm for the events corresponding to this User. Enter the Event ID that the probe must search in the log file. Probe generates the alarm for the events corresponding to this Event ID. Enter the Message that the probe must search in the log file. Probe generates the alarm for the events corresponding to this Message. Enter the Source ID that the probe must search in the log file. Probe generates the alarm for the events corresponding to this Source ID. Enter the category that the probe must search in the log file. Probe generates the alarm for the events corresponding to this Category. Alarm Post Selection Send Alarm Alarm Message Level Subsystem Set Suppression Key, Optional Key Select this option to send an alarm message on recognition of an event log message. Enter the alarm message for the selected profile. You can also use variables in the messages: $profile $description Event selection criteria: $source $event_id $category $profile $log $severity $user $computer $time_stamp Select the severity level for the generated alarm. Select from eventlog to use the same severity level as the eventlog message. Enter a descriptive text name for the subsystem. Select this check box to activate message suppression feature. This avoids generation of multiple instances of the same alarm-event. You can use variables in this field. 30 SOC Probes Configuration Reference

31 Active Directory Event Monitor (Local) Configuration Time Frame Event Count Post Message Select the time interval during which the events will be monitored, and if necessary, the alarms will be generated. By default, this field is empty. Enter the number of events that will be counted to generate an alarm during the specified time frame. Select this check box to post the eventlog message with the given subject in Dr Nimbus. Post Subject QoS Allows you to create/edit a custom Message Subject for the selected profile. You are allowed to use variables in the messages. $variable: User-defined variable Number of Events Found in Time Interval Time Interval Select this option to send the QoS messages for number of events detected within the specified time interval. Enter the time interval for event detection. Variable Settings (1), (2), (3) Tab Variable Settings Name Source Line Enter the name of the variable. Duplicate variable names are not allowed. Once the variable name is saved, it cannot be edited. By default, var is displayed as variable name. Select this check box to define the Source Line to be searched in the event description. Enter the Source Line in the text box from where the probe should start searching the specified threshold in the event description. Note: The Source Line starts from 0. Chapter 4: adevl 31

32 Active Directory Event Monitor (Local) Configuration Source FROM/TO position Threshold Alarm Definition Operator Threshold If you want the probe to search the threshold in the specified Source Line, you must set the Source From and Source To position to define the range. Source From: The probe must start searching the threshold from this position in the event description. It supports the following values: Column: Select this option to define the column number from where the probe must start searching for the specified threshold in the event description. Enter the column number in the text box. Note: The column number starts from 0. Character Position: Select this option to define the character position from where the probe must start searching for the specified threshold in the event description. Enter the character position in the text box. Note: The character position starts from 0. Match Expression: Select this option to define the regular expression that the probe must search in the event description. Note: The regular expression should match the event description. Source To: The probe must stop searching the event description at this position. It supports the following values: Ignore To: Select this option to allow the probe to search the event description till the end. To Column: Select this option to define the column number till where the probe must search the specified threshold in the event description. Enter the column number in the text box. To End Of Line: Select this option to allow the probe to search the event description till the end of defined Source Line. Click the operator in the list. Select re if you are using regular expressions. Enter the threshold value for the variable that the probe must search in the event description. 32 SOC Probes Configuration Reference

33 Active Directory Exclude Monitor (Local) Configuration Active Directory Exclude Monitor (Local) Configuration Exclude Tab Exclude entry name Log Computer Severity User Event Id Message String Source Category Enter the name of the profile to be excluded from monitoring. Enter the log file that the probe must monitor. Probe excludes the events corresponding to this log file from monitoring. Enter the name of a computer that the probe must search in the log file. Probe excludes the events corresponding to this computer from monitoring. Click the severity that the probe must search in the log file. Probe excludes the events corresponding to this severity from monitoring. Enter the name of a user that the probe must search in the log file. Probe excludes the events corresponding to this User from monitoring. Enter the Event Id that the probe must search in the log file. Probe excludes the events corresponding to this Event Id from monitoring. Enter the Message that the probe must search in the log file. Probe excludes the events corresponding to this Message from monitoring. Enter the Source Id that the probe must search in the log file. Probe excludes the events corresponding to this Source Id from monitoring. Enter the category that the probe must search in the log file. Probe excludes the events corresponding to this Category from monitoring. Chapter 4: adevl 33

34

35 Chapter 5: apache The Apache HTTP server is the most popular HTTP server on the market. The combination of open software, a stable and feature-rich system and support for a number of hardware platforms and operating systems have contributed to the popularity of this HTTP server. This implies that a large number of business critical web sites are hosted by the Apache HTTP server, web sites that must maintain a very high level of availability and performance to the user community. The Nimsoft apache monitor allows organizations to centrally monitor all their Apache based HTTP servers, thus ensuring that any irregularities in performance and availability are detected at the earliest possible stage. The Quality of Service data provided by the Apache monitor makes it possible to detect performance trends enabling the organization to take precautionary actions before users notice any degradations of the service. Profile Tab Hostname or IP address Group Alarm Message Override default Suppression ID Suppression ID Server address for http response and server-status Data collection interval Extended Status Specify the name or IP address of the host to be monitored. Select the group folder from the drop-down list in which you want to put the host. Use the group folders to place the hosts in logical groups. Select the alarm message to be issued if the host does not respond. Select this check box if you wish to override the default suppression ID. Enter a suppression ID. Specify the server address in the format <server address>/server-status?auto For example: A short optional description of the monitored host. Select the data collection interval (how often to collect data from the host) from the drop-down menu. The minimum recommended Data Collection interval is 1 minute. Select the check box if you want the template to collect extended status (including detailed connection and request information) from the server. SSL Setting Chapter 5: apache 35

36 Active Directory Exclude Monitor (Local) Configuration Use SSL Peer Verification Certification Authority Bundle Path Host Verification Host Verification Level ServerLevelCheckpoints Tab Name Publish QoS Enable Monitor Value Instructs the monitor to enable/disable SSL certificate verification. Instructs the monitor to enable/disable peer verification. Peer is the certification authority who issues SSL certificates. Instructs the monitor to use the certification bundle path for SSL verification. The bundle contains certificates of all the issuing authorities. The certification authority bundle can be obtained from For the verification of SSL certificates, the certification bundle path is needed. Instructs the monitor to enable/disable host verification. The two levels by which a host can be verified are Loose and Strict. At Loose level, the host name which is entered in the Server address field is not verified against the CN (Common Name) attribute appearing in the SSL certificate. The verification checks if the IP address/host name points to the same server. At Strict level, the host name which is entered in the Server address field is verified against the CN (Common Name) attribute appearing in the SSL certificate. If the host name does not matches the CN field, the session request gets rejected. Enter a name for the monitor profile. Enter a brief description for the monitor profile. Select this checkbox if you wish to generate QoS messages. Select this check box to enable the checkpoint monitor. Select one of the radio-buttons: Last/Current Sample: Select if you wish set the checkpoint on the last or the current sample. Compute average: Select if you wish to set the checkpoint based on the average of samples as chosen from the drop-down. 36 SOC Probes Configuration Reference

37 Active Directory Exclude Monitor (Local) Configuration Operator Select one of the relational operators (=,<,>,<>). Threshold Message Token Override default suppression ID Enter the threshold value for the checkpoint. Select the message ID that should accompany the alarm. Select this check box if you wish to override the default suppression ID. Note: The fields described in the above table will be used to configure the following sections: Http Response Time Http Response Value CPU Load Request/Sec AggregatedWorkerLevelCheckpoints Tab Name Publish QoS Enable Monitor Value Enter a name for the monitor profile. Enter a brief description for the monitor profile. Select this check box if you wish to generate QoS messages. Select this check box to enable the checkpoint monitor. Select one of the radio-buttons: Last/Current Sample: select if you wish set the checkpoint on the last or the current sample. Compute average: Select if you wish to set the checkpoint based on the average of samples as chosen from the drop-down. Operator Select one of the relational operators (=,<,>,<>). Threshold Message Token Override default suppression ID Enter the threshold value for the checkpoint. Select the message ID that should accompany the alarm. Select this check box if you wish to override the default suppression ID. Chapter 5: apache 37

38 Active Directory Exclude Monitor (Local) Configuration Note: The fields described in the above table will be used to configure the following sections: Waiting For Connection Count Open Slot No Current Process Count Keepalive Count Gracefully Finishing Count DNS Lookup Count Closing Connection Count ConnectionLevelCheckpoints Tab Name Publish QoS Enable Monitor Value Enter a name for the monitor profile. Enter a brief description for the monitor profile. Select this check box if you wish to generate QoS messages. Select this check box to enable the checkpoint monitor. Select one of the radio-buttons: Last/Current Sample: select if you wish set the checkpoint on the last or the current sample. Compute average: Select if you wish to set the checkpoint based on the average of samples as chosen from the drop-down. Operator Select one of the relational operators (=,<,>,<>). Threshold Message Token Override default suppression ID Enter the threshold value for the checkpoint. Select the message ID that should accompany the alarm. Select this check box if you wish to override the default suppression ID. Note: The fields described in the above table will be used to configure the following sections: Request Max Time SS (Second since beginning of most recent request) Avg Time Conn Max Kbytes Slot Max Mbytes 38 SOC Probes Configuration Reference

39 Active Directory Exclude Monitor (Local) Configuration ConnectionModeCheckpoints Name Publish QoS Enable Monitor Value Enter a name for the monitor profile. Enter a brief description for the monitor profile. Select this check box if you wish to generate QoS messages. Select this check box to enable the checkpoint monitor. Select one of the radio-buttons: Last/Current Sample: select if you wish set the checkpoint on the last or the current sample. Compute average: Select if you wish to set the checkpoint based on the average of samples as chosen from the drop-down. Operator Select one of the relational operators (=,<,>,<>). Threshold Message Token Override default suppression ID Enter the threshold value for the checkpoint. Select the message ID that should accompany the alarm. Select this check box if you wish to override the default suppression ID. Note: The fields described in the above table will be used to configure the following sections: Mode-W SS Max Time Mode-R SS Max Time Mode-K SS Max Time Mode-C SS Max Time Mode-D SS Max Time Mode-L SS Max Time Chapter 5: apache 39

40

41 Chapter 6: cdm The Nimsoft CPU, Disk and Memory (cdm) monitor monitors various system performance variables. The cdm monitor monitors performance and load on critical system resources such as: CPU (multi-cpu support from version 3.0) Disk Memory The template operates in two modes: Generate alarms based on configured threshold values Generate trending statistics The trending data is sent as Quality of Service data to the data_engine template. This facilitates capacity planning for the monitored system: See how disks are filling up over time. Plan batch jobs based on CPU utilization, etc. This section contains the following topics: CPU Usage (Local) configuration (see page 41) Computer Up Time Monitor (Local) configuration (see page 44) Memory Paging (Local) configuration (see page 45) Computer Reboot Monitor (Local) configuration (see page 48) Disk Usage (Local) Configuration (see page 48) CPU Usage (Local) configuration General Tab Interval Samples CPU Usage Tab Alarm Setting How often the template should collect the data from the system. Number of samples the template keeps in memory for average/threshold comparison. Chapter 6: cdm 41

42 CPU Usage (Local) configuration Threshold High (%) Threshold Low (%) Quality of Service Messages Total CPU Usage CPU user CPU system CPU wait CPU idle Multi CPU Usage Tab Alarm Setting Multi Cpu Maximum Multi Cpu Difference Quality of Service Messages Multi CPU Usage Multi CPU user Multi CPU system Multi CPU wait Multi CPU idle Select the check box and enter a value to set the alarm for the specified threshold value. Select the check box and enter a value to set the alarm for the specified threshold value. Select the check box if the QOS message has to be sent for total CPU usage. Select the check box if the QOS message has to be sent for CPU usage by user applications. Select the check box if the QOS message has to be sent for CPU usage by the system. Select the check box if the QOS message has to be sent for CPU wait time. Select the check box if the QOS message has to be sent for the CPU idle time. Alarms are sent when CPU s in multi CPU system breaches the threshold Alarms are sent when in CPU usage between the different CPUs in the multi system breach the threshold. Select the check box if the QOS message has to be sent for total CPU usage for all CPUs. Select the check box if the QOS message has to be sent for CPU usage by users/applications for all CPUs. Select the check box if the QOS message has to be sent for CPU usage by the system for all CPUs. Select the check box if the QOS message has to be sent for CPU wait time for all CPUs. Select the check box if the QOS message has to be sent for the CPU idle time for all CPUs. 42 SOC Probes Configuration Reference

43 CPU Usage (Local) configuration Processor Queue Length Tab Processor Queue Length Active Max Queue Length Threshold Quality of Service Messages Processor Queue Length Custom Tab Active Name Alarm On CPU Usage Tab Threshold (High) Threshold (Low) CPU user Tab Threshold (High) Threshold (Low) CPU system Tab Threshold (High) Threshold (Low) Select this check box to activate the monitor profile Raise alarm if the queue length exceeds the specified value Select the check box to generate the QoS based on the processor queue length Select the check box to activate the Custom monitor Enter a name for the monitor profile Enter a brief description for the monitor profile Select the criteria based on which the checkpoint monitor is to be created Select the check box and enter a value to set the alarm for the specified threshold value. Select the check box and enter a value to set the alarm for the specified threshold value. Select the check box and enter a value to set the alarm for the specified threshold value. Select the check box and enter a value to set the alarm for the specified threshold value. Select the check box and enter a value to set the alarm for the specified threshold value. Select the check box and enter a value to set the alarm for the specified threshold value. Chapter 6: cdm 43

44 Computer Up Time Monitor (Local) configuration CPU iowait Tab Threshold (High) Threshold (Low) CPU idle Tab Threshold (High) Threshold (Low) Processor Queue Length Tab Active Max Queue Length Threshold Select the check box and enter a value to set the alarm for the specified threshold value. Select the check box and enter a value to set the alarm for the specified threshold value. Select the check box and enter a value to set the alarm for the specified threshold value. Select the check box and enter a value to set the alarm for the specified threshold value. Select the check box to activate the checkpoint Specify the maximum value for the queue length Computer Up Time Monitor (Local) configuration Up Time 44 SOC Probes Configuration Reference