3.1. Administrator s Guide TNT SOFTWARE. ELM Enterprise Manager. Version

Transcription

1 Version 3.1 TNT SOFTWARE ELM Enterprise Manager Administrator s Guide

2 TNT SOFTWARE ELM Enterprise Manager 3.1 Administrator s Guide Copyright TNT Software All Rights Reserved 2001 Main Street Vancouver, WA USA Phone Fax support@tntsoftware.com

3 Table of Contents ELM Enterprise Manager 3.1 Terminology... 1 Installation of ELM Server and ELM Console... 5 Installing the ELM Console... 7 Agents... 8 Installing Service Agents... 8 Installing Service Agents Using Setup Package...10 Installing Remote Agents...11 Installing IP Agents...13 Troubleshooting Service Agent Installation...14 Troubleshooting Service Agent Communications...15 Monitor Items...16 Monitor Item Properties...18 Monitor Item Best Practices...18 Creating Monitor Items...19 Event Alarms...19 How To Create an Event Alarm...19 Event Collector...20 How To Create an Event Collector...20 Cluster Monitor...21 How To Create a Cluster Monitor...21 ELM Server Monitor...22 How To Create an ELM Server Monitor...23 Exchange Monitor...24 How To Create an Exchange Monitor...24 File Monitor...26 How To Create a File Monitor...26 FTP Monitor...27 How To Create an FTP Monitor...28 IIS Monitor...29 How To Create an IIS Monitor...29 i

4 Link Monitor...30 How To Create a Link Monitor...31 Performance Alarms...32 How To Create a Performance Alarm...32 Performance Collector...33 How To Use Performance Collectors...33 Ping Monitor...34 How To Create a Ping Monitor...35 POP3 Monitor...36 How To Create a POP3 Monitor...36 Process Monitor...37 How To Create a Process Monitor...38 Service Monitor...39 How To Create a Service Monitor...39 SMTP Monitor...40 How To Create an SMTP Monitor...40 SNMP Monitor...41 How To Create an SNMP Monitor...42 SQL Server Monitor...43 How To Create an SQL Monitor...43 TCP Port Monitor...43 How To Create a TCP Port Monitor...44 Web Page Monitor...44 How To Create a Web Page Monitor...45 WMI Monitor...46 How To Create a WMI Monitor...47 Monitor Item Actions...47 Event Filters, Rules and tification Methods...49 Event Filters...49 tification Methods...50 Alerts...52 How To Create an Alert...52 Beeps...53 How To Create a Beep tification Method...53 Command Script...54 How To Create a Command Script tification Method...54 How To Programmatically Enable or Disable Items...55 Forward Event

5 How To Forward an Event...58 Instant Message...59 How To Use an Instant Message tification Method...59 Mail tification...61 How To Use MAPI tification...61 How To Create an SMTP tification Method...62 Marquee Device...64 How To Create a Marquee tification Method...64 Network Message Settings...67 How To Create a Network Popup tification Method...67 Pagers...68 How To Create a Pager tification Method...68 SNMP tification...70 How To Create an SNMP tification Method...71 How To Create an SNMP Trap tification Method...73 Sound File...74 How To Create a Sound File tification Method...74 Syslog tification...75 How To Create a Syslog tification Method...75 Text-To-Speech tification...76 How To Create a Text-to-Speech tification Method...76 Web Post tification...77 How To Create a Web Post tification Method...77 Rules...78 How To Create a Rule...78 Information Management...81 Event Log Records...81 Alerts...82 How To Create an Alert tification Method...82 Receivers...83 SNMP Receiver...83 How To Receive SNMP Traps...84 Syslog Receiver...85 How To Receive Syslog Messages...85 Knowledge Base Articles...85 Event Views and Personal Views...88 Event Views...88 Event View Settings

6 How To Create an Event View...89 Personal Views...90 How To Create a Personal View...90 Reports...91 How To Create Reports...92 How To Schedule Reports...94 How To Add a Chart to a Report...97 Web Viewer...99 Web Viewer Security Web Viewer User Interface Pre-Configured Items

7 Chapter 1 ELM Enterprise Manager 3.1 Terminology The following terms are used in this document, in the ELM Enterprise Manager product documentation (EEMMMC.CHM) and in ELM Enterprise Manager. Term Description ELM Server The ELM server process (eemsvr.exe) and supporting modules (DLLs). This component is comprised of several engines that handle such tasks as creating and maintaining a database for data storage, archiving and reporting, managing Agents and Agent licensing, processing Event Filters and Rules, and executing tification Methods. ELM Server Database The ELM server includes Receivers (SNMP and Syslog), it monitors Remote Agents and Remote IP Agents, and manages sessions with ELM Consoles. The ELM Server database contains data collected from Agents (events and performance data), Alerts generated by Actions and the Alert tification Method, data received via a Receiver, and Knowledge Base Articles created by administrators and end-users. The ELM Server can use Microsoft Access (runtime included), Microsoft SQL Server 6.5 or later, Microsoft SQL Desktop Engine (MSDE), or Oracle 8i or later as its database platform. The ELM Server database requires the MDAC 2.6 SP1 or later and JET 4.0 SP3 or later. ELM Console The ELM Console refers to the snap-in that resides in a Microsoft Management Console. The ELM Console is the primary user interface for the product. The ELM Console is freely distributable throughout your organization. Installing the ELM Console requires MMC 1.2 or later; you can save the ELM Console in MMC 2.0 format when running on Windows XP or Windows Each snap-in can connect to multiple ELM Servers, and the ELM Console snap-in can be co-mingled with other MMC snap-ins to provide single-seat administration. Web Viewer The Web Viewer is an HTTP/XML-based interface to ELM Server Objects. It is a set of COM objects within a set of Active Server Pages that runs under Internet Information Services 5.0 and later. The server side of the Web Viewer is installed using the setup package for ELM. The client side of the Web Viewer is any Javascript/XML-capable Web browser. The latest versions of Netscape and Internet Explorer support both Javascript 1

8 ELM Server Objects and XML and will provide the richest Web Viewer experience. Because the client side is simply a Web browser, most organizations will not have to deploy any software to client machines in order to utilize the Web Viewer. Term Description Agent A system monitored by an ELM Server, or a system that transmits messages to an ELM Server. There are three types of Agents: Service Agents, Remote Agents and Remote IP Agents. Service Agent The Service Agent process (tntagent.exe) and supporting modules. This component executes Monitor Items, collects data, transmits collected data to the ELM Server, and executes the configured Actions for assigned Monitor Items. Remote Agent Service Agents run as a service on the monitored Agent. Service Agents are required in order to monitor event logs, health and performance and other subsystems in real-time. Service Agents can only be run on Windows NT, Windows 2000, Windows XP and Windows 2003 computers. Remote Agents are also called Agentless because, unlike a Service Agent, nothing is installed on the system being monitored. Remote Agents fall into two categories: Windows workstations and servers, and TCP/IP-based computers and network devices (IP Agent). The actual monitoring functions for a Remote Agent execute within the ELM Server Process. As a result, Remote Agents cannot be monitored in real-time. In addition, Remote Agents add overhead to the ELM Server process (~10MB per Remote Agent, depending on what Monitor Items are used). IP Agent IP Agents are non-windows workstations and servers (e.g., Unix, Linux, NetWare, etc.) and TCP/IP-based devices (routers, switches, hubs) that send messages to the ELM Server, and/or can be pinged by the ELM Server. IP Agents can be used for receiving SNMP traps, TCP and UDP Syslog Messages, as well as for monitoring TCP/IP-based application availability and quality of service (HTTP/HTTPS, SMTP, POP3, FTP, PING and any TCP Port). Alert A special type of event that can be generated from a Monitor Item or by the Alert tification Method. Alerts are stored in the TNTAlerts database and displayed in the Alerts container within the ELM Console. By design, all entries in the TNTAlerts database are displayed in the Alerts container. Alerts have two Status settings: Open and Closed. You can configure the ELM Console to display Alerts based on its status (Open, Closed, or Both). You can also re-open Alerts that have been closed. Event Filters Event Filters are displayed within the Event Filter container within the ELM Console. Event Filters are used to process incoming events to determine whether or not the event should be displayed in an Event View or a Personal View, and whether or not the event should cause a Rule to execute a tification Method. Event Filters can be used to isolate a single event or specific set of events, or to isolate all events except for a single event or specific set of events. You can create an unlimited number of Event Filters. Event An event can be a single record from a Windows event log, an SNMP trap, a Syslog message or an Alert from an ELM Agent. Event Views Event Views use one or more Event Filters to display some or all events. Events are stored in the TNTEvents table in the ELM Server database and displayed in 2

9 one or more Event Views. Event Views are created as child objects within the Event Views container in the ELM Console. Knowledge Base Articles You can associate one or more Event Filters to filter what events are displayed, as well as limit the number of events displayed. Knowledge Base Articles are used to add notes and comments to Events. The notes, comments and event details that comprise the Knowledge Base Article are stored in the TNTKnowledgeBaseRecords table in the ELM Server database. Knowledge Base Articles are displayed in the Knowledge Base Article container in the ELM Console. Because Knowledge Base Articles are written by administrators/end-users, they represent information that is unique and valuable to your organization. Monitor Item A Monitor Item is the individual thing being monitored. Monitor Items are displayed within the Monitor Item container in the ELM Console. Monitor Items watch for conditions and thresholds, collect data, check Agent, system and application availability and verify quality of service. tification Methods tification Methods are used to notify administrators/end-users or take corrective action. tification Methods are displayed within the tification Method container of the ELM Console. Performance Data The ELM Server has a rich notification engine that can execute a variety of tification Methods. You can use beeps and sounds, electronic mail, numeric and alphanumeric pagers, SNMP traps, Syslog messages and scripts as tification Methods. Performance Data refers to the Performance Objects and Performance Object Counters that are displayed in the Performance Data container within the ELM Console. Performance Objects are published by the operating system, software applications and hardware devices. Personal Views Performance Counters can be monitored for thresholds and collected for capacity planning purposes. You can also import performance counters for monitoring and collection from any Windows NT, Windows 2000, Windows 2003, or Windows XP computer. Personal Views are identical to Event Filters, except that they are tied to the specific administrator/end-user that created them. Unlike Event Views which are shared views, Personal Views are only visible in the ELM Console for the user who created them. Personal Views are created as child objects within the Personal Views container in the ELM Console. You can associate one or more Event Filters to filter what events are displayed, as well as limit the number of events displayed. Reports Reports refer to report objects that perform database queries and return the results in a pre-designed format. The ELM Server includes a report engine that enables administrators/end-users to create reports without requiring any additional software. Reports are displayed in the Reports container within the ELM Console. Reports can be generated both on an ad hoc basis and at periodic intervals, and output to a variety of formats. Rules Rules link Event Filters with tification Methods. When one or more Event Filters assigned to a Rule are matched, the tification Method(s) assigned to the Rule is/are executed. Rules are displayed in the Rules container within the ELM Console. Each Rule can have multiple Event Filters assigned to it, and each Rule can trigger multiple tification Methods. 3

10 Receivers The ELM Server includes two receivers: an SNMP trap receiver and a Syslog message receiver. The SNMP receiver can collect, filter and archive SNMP traps with and without SNMP Object IDs. The Syslog receiver can receive both TCP and UDP Syslog messages. Other Terms Term Description Actions Actions are a form of notification that is executed by a Monitor Item. As a result, Actions occur outside of the ELM Server's notification engine. Quality of Service (QoS) There are four Actions that can be executed: generate Alert, generate application event log entry, send a Network Pop-up Message or execute a script. Quality of Service deals with response times. It is a level of monitoring above general availability. Determining that a critical service or application is available is only one part of proactive monitoring. Ideally, you should also monitor the responsiveness or quality of service of your critical business applications. Many Monitor Items include quality of service monitoring that enables you to generate warning events or take corrective action when an Agent, TCP port or TCP/IP-based application does not respond within the quality of service threshold. Wizards Creating new objects in ELM is accomplished through the use of Wizards. Each Wizard takes the administrator/end-user step-by-step through the creation of an object. Wizards are used to reduce the learning curve for ELM and increase usability. Wizards are launched whenever new object creation is invoked from within the ELM Console. At the end of each Wizard is an option to re-run the Wizard to create additional objects, making multiple object creation quick and easy. 4

11 Chapter 2 Installation of ELM Server and ELM Console Installing the ELM Server is a relatively easy and straightforward process. Once you've determined that your system meets the minimum system requirements, you can begin your installation by performing the actual installation of the application. ELM is distributed electronically from TNT Software's Web site ( It is packaged into a self-extracting executable that will launch the setup process when executed: Windows 2003, Windows 2000 and Windows XP, as well as Windows NT computers with the Windows Installer service installed can use the Microsoft Installer package (MSI package). Windows NT computers without the Windows Installer service require the EXE package. You can download the Windows Installer for both NT 4.0 and Windows 2000 from Microsoft. During Setup, the following services (and any services dependent on the following services) will be stopped and restarted: IIS Admin Service SNMP Service SNMP Trap Service ELM Server service (if upgrading only) TNT Agent service (if upgrading only)» To Install the ELM Server: 1. Double-click the MSI or EXE file you downloaded to execute it. The Setup Wizard will launch. 2. Click Next to continue. The License Agreement screen will appear. 3. Select I accept the license agreement and click Next to continue. The ReadMe Information screen will appear. 4. Read the contents of the ReadMe file and click Next to continue. The Select Features screen will appear. 5. Select the feature(s) you want to install. When selecting the Server or Console components, you can use the Browse button to choose the destination folder. Use the Disk Cost button to check available disk space. Click Next to continue. The User Information screen will appear. 6. Enter the Company Name and Serial Number as it appears on your SLA. If this is an evaluation version, enter the Company Name and leave the Serial Number field set to Evaluation. Select the option that says Anyone who uses this computer and click Next to continue. If this is an evaluation version, the expiration date will be displayed when you click Next. If this is a non-eval version, a confirmation dialog will appear when you click Next. 5

12 7. Click Next to continue, and click OK to clear the dialog message that appears. The Service Account Logon screen will be displayed. 8. In the Username field, enter the account you want to use for the service account. This account must have administrative rights on the ELM Server and on all Windows-based Remote Agents. Enter the password for this account in the Password field. 9. Click Next to continue. If the account specified in the preceding step does not already have Log on as a Service rights on the ELM Server, the Setup process will grant this right to the account. 10. If IIS is installed, the Web Site Name screen will appear. If you wish to install the Web Viewer component, leave the Create the ELM Web Site virtual directory on this computer checkbox checked. Leave the default Alias set to EEM31. Select the Default Web Site and click Next to continue. te: if you do not create the Web Viewer virtual directory during the initial install of ELM, you will need to create the virtual directory manually. 11. The Ready to Install the Application screen will appear. 12. Click Next to continue. Setup will copy the files to the target destination, register its components, install the ELM Server service and launch the Agent Installation Wizard. 13. Click Next to continue. te: If you are presented with the Upgrade Previous Version dialog box instead of the Agent Installation Wizard, clear all of the checkboxes on this dialog box and click Next to continue. Once the file copy process has completed, the Database Connection Wizard will launch. 14. Click Next to proceed past the Wizard's Welcome screen. The Database Type screen will appear. Using the Database Type dropdown, select the type of database you want to use. 15. Click Next to continue. The next screen depends on what database type you selected: If you select Microsoft Access, the Microsoft Access screen will appear. Select the path and filename for the Access database you want created. By default, a database called ELM.MDB will be created in the ELM Server directory. To accept this default, click Next. To change the database name or location, enter the path and filename you want to use, or use the Browse button to browse for the path. Click Next to continue. If you select Microsoft SQL Server, the Microsoft SQL Server screen will appear. Enter the Computer Name of the SQL Server, the database name and the username and password for an account that has database owner (dbo) rights on the SQL Server database you created. You should also use this option when using Microsoft SQL Server Desktop Engine (MSDE) as your database platform. Click Next to continue. If you select Oracle, the Oracle Database screen will appear. Enter the name of the System DSN you created. Enter the username and password for an account that has database owner (dbo) rights on the Oracle database you created. Click Next to continue. 16. Click Finish to complete the Database Connection Wizard. 17. Click Finish to complete Setup. 6

13 Installing the ELM Console Installing the ELM Console is a relatively easy and straightforward process. Once you've determined that your system meets the minimum requirements for installation, you can begin your installation by performing the actual installation of the application.» To Install the ELM Console: 1. Double-click the file you downloaded to execute it. The Setup Wizard will launch. 2. Click Next to continue. The License Agreement screen will appear. 3. Select I accept the license agreement and click Next to continue. The ReadMe Information screen will appear. 4. Read the contents of the ReadMe file and click Next to continue. The Select Features screen will appear. 5. Select the Server component and choose Entire feature will be unavailable. Make sure just the Console component is selected. 6. Click Next to begin the install process. 7. Click Finish to complete the install process. 7

14 Chapter 3 Agents Creating and managing Agent Objects Agent is the general term used to describe a managed system. There are four classes of Agents: Cluster Agent for Windows NT, Windows 2000 and Windows 2003 clusters Server Agent for Windows NT, Windows 2000 and Windows 2003 Servers Workstation Agent for Windows NT Workstation, Windows 2000 Professional and Windows XP Professional IP Agent for any TCP/IP addressable device/system. With respect to Cluster, Server and Workstation Agents, there are two types: Service Agents code that runs as a service on the monitored system Remote Agents Agentless monitoring, where the ELM Server performs monitoring/collection. IP Agents are always Remote (agentless) Agents. You can monitor, collect data from or receive data from Unix, Linux, NetWare, Cisco and Apple systems, hubs, switches, routers, gateways, etc. using IP Agents. Windows systems can also be IP Agents; however, you will not be able to use Event Collectors, Event Alarms or File Monitors against these systems. Installing Service Agents Service Agents and ELM Servers can have one-to-one or one-to-many relationships. An ELM Server can monitor multiple Service Agents and a Service Agent can be monitored by multiple ELM Servers. Each Service Agent maintains separate configuration, collection set and cache files for each Server that is monitoring it. The Service Agent is comprised of a 32-bit, multithreaded executable called TNTAGENT.EXE, its companion DLLs and its configuration data (TNTAgent.dat). These files exist in the %systemroot%\tntagent on the monitored system. The Service Agent can run in the security context of the LocalSystem, or in a user security context (e.g., using a service account). Service Agents typically consume about 7-15MB of physical memory, and less than.1% of the overall CPU time on the monitored system. The amount of resources actually consumed depend on the number of Monitor Items applied to the Agent, the frequency at which those Monitor Items are executed, and the amount of data generated by or being collected from the monitored system. 8

15 You can use the ELM Console to install Service Agents remotely, or you can install them manually on the target machine. Service Agents are only used for monitoring Windows NT, Windows 2000, Windows 2003, and Windows XP systems; if you are monitoring a computer with an Alpha or RISC processor, a different OS or device that uses TCP/IP, or if you do not wish to install software on the monitored system, you can use a Remote Agent or an IP Agent.» To install a Service Agent: 1. Right-click on the Agents container in the ELM Console and select All Tasks New Agent. The Agent Installation Wizard will launch. If the Welcome dialog is displayed, click Next to continue. 2. From the dropdown, select Service Agent and click Next to continue. 3. Enter the host name, fully-qualified domain name, or IP address of the system you want to monitor. Click the Browse button to browse your network if you are unsure of the computer's name. Click Next to continue. 4. The Logon Account dialog will appear. You can run a Service Agent under a user account, or under the LocalSystem account. Enter the account information and click Next to continue. 5. In the Listen on TCP Port field, enter the TCP port on which you want the Agent to listen. Service Agents communicate with the ELM Server over TCP/IP sockets. By default, Service Agents listen on TCP port You can change the port used by the Agent by selecting an alternative TCP port. Use the Test button to verify that the port is available. te Once an Agent has been configured to listen on a specific port, you cannot change the port. If you want the Agent to listen on a different port, you will need to remove and re-add the Agent using the new port. 6. Click Next to continue. The copy file process will begin. The Agent executable, companion DLL files and configuration data will be copied to the target computer. Important In order to install a Service Agent, you must have administrative rights on the monitored system. ELM will attempt to install the Service Agent using your current credentials (e.g., the account you're logged on with); if this account does not have administrative rights on the Service Agent, you will be prompted to specify alternate credentials to perform the installation. Another alternative is to use the setup package you downloaded to install the Service Agent. 7. The Description dialog will appear. Enter an optional description for this Service Agent, and click Next to continue. 8. The Agent Categories dialog will appear. Modify the Categories field as desired, or leave the default entries. Click Next to continue. 9

16 9. The Select Monitors dialog will appear. Select the Monitor Items you want applied to this Service Agent. Click Next to continue. Click Finish. 10. Click OK to acknowledge the Agent installation. When prompted to install another Service Agent, click Yes or, depending on your needs. Installing Service Agents Using Setup Package If the Agent you want to monitor is on the other side of a firewall, in a DMZ environment, or located in an environment that restricts the use of NetBIOS and RPC endpoint ports, you can use the Setup package to install an Agent on the remote system and then use the Agent UI to register the Agent with the ELM Server and select monitor items for the Agent.» To install a Service Agent using Setup: 1. Copy the ELM Setup package to the target computer, and execute the file to begin the install. 2. The Installation Welcome screen will appear. Click Next to continue. 3. The License Agreement screen will appear. Read the license agreement and indicate your acceptance of its terms by selecting I accept the license agreement. Click Next to continue. 4. The ReadMe Information screen will appear. Read the contents of the ReadMe file and click Next to continue. 5. The Select Features screen will appear: Click Server and choose Entire feature will be unavailable. Click Console and choose Entire feature will be unavailable. Click Agent and choose Will be installed on local hard drive. 6. Click Next to continue, and then Next one more time to initiate installation. 7. The Agent executable and support files will be installed. When the installation has completed, the Register Server Wizard will launch. 8. In the Name field, enter the host name, IP address or fully-qualified domain name for the ELM Server you want to register. If desired, click the Browse button to browse the network for the ELM Server you want to register. 9. In the Port field, enter the TCP port on which the ELM Server is listening. By default, ELM Servers listen on the following TCP ports: ELM Enterprise Manager - TCP Port 1251 ELM Log Manager - TCP Port 1351 ELM Performance Manager - TCP Port 1451 te The name field may already be filled in with an Agent name that contains :EEM. The EEM is a visual cue that indicates the product you are running. ELM Performance Manager users will also see the EEM designation and will need to change to the appropriate descriptor (e.g., ELM or EPM). 10. Click Next to continue. The Select Monitors dialog box will appear. Put a check in the box to the left of each Monitor Item you want to assign to this Agent. You can view the 10

17 properties of any Monitor Item by right-clicking the item and selecting Properties. 11. Click Finish to save the Agent settings and ELM Server registration.» To Uninstall a Service Agent That Was Installed Using Setup: 1. Open the Control Panel and double-click Add/Remove Programs. 2. Select the product you have installed, either: ELM Enterprise Manager ELM Log Manager ELM Performance Manager 3. Click the Change button. 4. If the Service Agent is the only ELM component installed on this system, or if there are other ELM components (e.g., ELM Server or ELM Console) and you want to uninstall everything, select Remove and proceed through the Wizard. If there are other ELM components installed on this system and you do not want to remove them, select Modify and continue through the Wizard. When the component dialog is shown, change the Service Agent from Will be installed on local hard drive to Entire feature will be unavailable. Then, complete the Wizard to remove it. Installing Remote Agents You can monitor Windows NT, Windows 2000, Windows XP and Windows 2003 computers without having to install a Service Agent. You can use a Remote Agent. Instead of running a service on the monitored system, the ELM Server collects and monitors the Agent remotely. Because Agent code is not used on the monitored system, this will add overhead to your network and to the ELM Server. However, this scenario is advantageous when you do not want to install any software on the monitored system in order to keep tabs on it. Remote Agents require that the ELM Server service account has administrative privileges on the system being monitored. In addition, Remote Agents require RPC and NetBIOS connectivity between the ELM Server and the monitored system. Because Remote Agents are remotely monitored by the ELM Server, they cannot be monitored in real-time.» To install a Remote Agent: 1. Right-click on the Agent container in the ELM Console snap-in and select All Tasks New Agent. The Agent Installation Wizard will launch. If necessary, click Next to continue. 2. From the dropdown, select Remote Agent and make sure the IP Agent checkbox is not checked. Click Next to continue. 3. Enter the name or IP address of the system you want to monitor. Click the Browse button to browse your network if you are unsure of the computer's name. Click Next to continue. 4. Modify the Categories field as desired, or leave the default entries. Click Next to continue. 5. Click Next to continue. If there are no monitor items configured, click Finish to complete the Wizard. If there are monitor items, the Select Monitors dialog will appear. In this event, click on each Monitor Item you want applied to this Service Agent. To create a new Monitor Item, right-click in the white space in this dialog and select New Monitor Item. Click Next to continue. Click Finish. 6. Click OK to acknowledge the Agent installation. When prompted to install another Remote Agent, click. 11

18 The Remote Agent will be added to the list of monitored systems, and the selected Monitor Items for this Remote Agent will be executed according to their settings. 12

19 Installing IP Agents ELM can monitor IP devices using an IP Agent (also known as a Remote IP Agent). The ELM Server can receive SNMP Traps and both TCP-based and UDP-based Syslog messages from IP Agents, as well. To install a Remote IP Agent: 1. Right-click on the Agent container in the ELM Console and select All Tasks New Agent. The Agent Installation Wizard will launch. If necessary, click Next to continue. 2. From the dropdown, select Remote Agent and make sure the IP Agent checkbox is checked. Click Next to continue. 3. Enter the name or IP address of the system you want to monitor. Click the Browse button to browse your network if you are unsure of the computer's name. Click Next to continue. 4. Modify the Categories field as desired, or leave the default entries. Click Next to continue. 5. Click Next to continue. If there are no monitor items configured, click Finish to complete the Wizard. If there are monitor items, the Select Monitors dialog will appear. In this event, click on each Monitor Item you want applied to this Service Agent. To create a new Monitor Item, right-click in the white space in this dialog and select New Monitor Item. Click Next to continue. Click Finish. 6. Click OK to acknowledge the Agent installation. When prompted to install another Agent, click. The IP Agent will be added to the list of monitored systems. 13

20 Troubleshooting Service Agent Installation Installing a Service Agent is a relatively easy procedure that is usually trouble-free. If you are having problems installing an Agent, some things that you can check are listed below. Does the ADMIN$ share exist on the Agent machine? When installing an Agent from the ELM Server, the ELM Server will attempt to connect to the ADMIN$ share on the Agent machine, so that the Agent executable can be copied to the SYSTEM32 folder on the Agent. If the ADMIN$ does not exist, re-create it. If this is not an option, follow the procedure for manually installing an Agent, which is detailed below. Do you have good name resolution between the ELM Server and Agent? Can you ping the Agent by name from the ELM Server? Can you ping the ELM Server by name from the Agent? Are you able to do a NET VIEW on each system from the other system? ELM can use NetBIOS or host name resolution. Are there any firewalls between the ELM Server and this Agent? Are you able to Telnet from the Agent computer to the appropriate port on the ELM Server? By default, the ELM Enterprise Manager Server listens on TCP Port Does a Netstat -a -p tcp on the ELM Server show it listening on the appropriate port? If you run this command on the Agent, does it show something else listening on port 1253 on the Agent? If the Agent is in a DMZ or a firewall environment, you can use the ELM setup package to install the Agent remotely. Do you have administrative rights on the Agent machine? Only Administrators can connect to the ADMIN$ share and install a new service. When you attempt to install an Agent, ELM will first try to use your existing credentials to authenticate you to the Agent machine. If authentication fails, you will be presented with a Connect As dialog box, which can be used to specify alternate credentials (e.g., local administrator username and password.) te: the Connect As dialog box does not support blank passwords. If you do not enter a password, the connection will fail. To get around this limitation, go to a command prompt on the ELM Server machine and make a connection to the IPC$ share on the Agent machine. You can use the following syntax: net use \\SERVER\IPC$ /user:abcde\12345 where: SERVER is the name of the Agent machine ABCDE is the name of the domain or machine containing the account you're using is the name of the account with administrative rights Are there any services in a Stop Pending or Start Pending state on the Agent? This may prevent ELM from installing an Agent service. You can use a command-line utility included with ELM to check this. The utility, SM.EXE is a command line utility that can query the Service Control Manager on a local or remote machine. It's usage is: Local machine - SM /dis Remote machine - SM \\SERVER /dis If you see any Start Pending or Stop Pending services, you will need to get them at a stable state (started or stopped) before you can install the Agent service. Have any special security modifications been made to the Agent system? These include things like restrictive registry or NTFS permissions, revoking of user rights assignments, and as previously mentioned, the removal of the ADMIN$ share. If none of these solutions resolves your issue, please contact TNT Software's Product Support Group for assistance. 14

21 Troubleshooting Service Agent Communications If an Agent does not send, or does not appear to be sending, data to your ELM Server(s), there a few things to check to make sure things are installed and configured properly. The easiest path for troubleshooting these situations is to check the basic things first. Is the Agent service running, or is the Agent disabled? The Agent will only monitor, collect and transmit data when the TNT Agent service is running and the Agent is enabled. Has the Agent been configured to collect data? From the ELM Server, double-click the Agent that is not sending data, and look at the Monitor Items tab. Do you still have IP connectivity and good name resolution between the ELM Server and Agent? IP connectivity and healthy name resolution are essential for ELM to operate properly. Have the ELM TCP/IP ports been blocked through a firewall, packet filtering or some other mechanism? By default, the TNT Agent listens on TCP port 1253, and the ELM Enterprise Manager Server listens on TCP Port Try telnetting to the appropriate ports in each direction: - From the ELM Server, try to Telnet to port 1253 on the Agent - From the Agent, try to Telnet to the appropriate port on the ELM Server Once you establish a Telnet session in either direction, press ENTER two times. You should receive version information. If you do not receive this message, or if you are unable to connect to the port, check the following: - On the end that fails, run netstat -a -p tcp at a command prompt. This will show all listening ports and connections. You should see the Agent listening on TCP port 1253 and the ELM Server listening on TCP port 1251, or whatever ports you have configured. If you do not see this entry, restart the application on the failed end (either Agent or ELM Server). Does the Agent Status show a registered ELM Server? From the ELM Server, double-click the Agent and navigate to the Agent Status tab. This will display the Agent's status, which may indicate a problem, such as a failure to execute a monitor item or a failure to communicate with the ELM Server. Is the Agent in cache mode? If the Agent is unable to transmit data to the ELM Server when it has something to send, the Agent will go into cache mode. Each time the Agent has something new to send (e.g., a new event or alert), it checks to see if it can connect to the ELM Server. If it can, it will dump its cache. The Agent Status tab can display whether or not an Agent is in cache mode. Is the ELM Server running on NT Workstation, Windows 2000 Professional or Windows XP? These operating systems have a hard-coded limit of 10 inbound TCP/IP connections. Once there are 10 established connections, no new connections will be able to be established until one or more connections is freed up. You can use the netstat command to count the number of TCP/IP connections in use. The suggested resolution is to upgrade to a Windows Server family product. If none of these solutions resolves your issue, please contact TNT Software's Product Support Group for assistance. 15

22 Chapter 4 Monitor Items Creating and Using Monitor Items Monitor Items are individual items that you want to monitor or collect. For example, to collect event log entries from a Windows NT, Windows 2000, Windows XP or Windows 2003 computer, you would use an Event Collector. To monitor files in the file system, you would use a File Monitor. Generally speaking, you can assign one or more Monitor Items to one or more Agents. ELM Enterprise Manager includes several Monitor Items: Agent Monitor. This is used to monitor an ELM Service Agent. Agent Monitors perform regular heartbeat checks on Service Agents. If the Server Agent does not respond or is slow in responding, a variety of actions and notification options can be triggered. Cluster Monitor. This is used to monitor the various Cluster API for events related to cluster, cluster resource and cluster group activity. ELM Server Monitor. This is used to enable a Service Agent to monitor availability of the ELM Server. Event Alarm. Event Alarms are used to trigger action and/or notification when an event does or does not occur. Event Alarms can be configured for Windows NT, Windows 2000 and Windows XP Agents. Event Collector. Event Collectors are used to collect events from the event logs on Windows NT, Windows 2000, Windows XP and Windows You can specify the events you want to collect based on a variety of event criteria, including event type, source, event ID, and event details. Exchange Monitor. This enables you to perform end-to-end monitoring of Microsoft Exchange 5.5 and/or Exchange This type of monitoring allows you to specify a custom quality of service (QoS) threshold for internal delivery, and to be notified when that threshold is not met. File Monitor. This is used to monitor non-circular text files on Service Agents. You can monitor individual log files, an entire directory of files, or an entire directory tree of files. FTP Monitor. This is used to monitor a specific FTP URL. If you are using a Service Agent, then the Service Agent will periodically establish an FTP connection to the URL and port specified. If you are using a Remote Agent or an IP (Remote) Agent, the FTP polling is performed by the ELM Server. If the response is negative or slower than expected a variety of actions and notification options can be triggered. IIS Monitor. The IIS Monitor is used to monitor Internet Information Server 4.0 (Windows NT), Internet Information Services 5.0 (Windows 2000), 5.1 (Windows XP) and 6.0 (Windows 2003). The IIS Monitor periodically checks the state of IIS for state changes and broken paths. In addition, it internally executes a File Monitor (no separate File Monitor configuration necessary) to parse the IIS log files for failed requests, and connection attempts from blocked addresses (e.g., addresses blocked via IIS security). 16

23 Link Monitor. This monitor item periodically spiders/crawls your Web site using the URL you specify as a starting point. It can check for broken links and Quality of Service. TCP Port Monitor. If you need to monitor a TCP port on any TCP/IP-based system or device, you can use a Port Monitor to do so. Simply specify the port you wish to monitor and the expected response time in seconds. Performance Alarm. Performance Alarms monitor performance objects, counters and instances and can generate a variety of tification Methods when a counter or instance of a counter is greater than, less than or equal to your specified threshold for your specified duration. Performance Collector. This Monitor Item is used to collect and store performance data from Windows NT, Windows 2000, Windows XP and Windows A Performance Collector is a group of performance counters that are collected at the same time. You can use multiple Performance Collectors that contain different groups of counters, or a single Performance Collector that contains all of the counters you want to collect. Ping Monitor. This is used to send period ICMP echo requests to the Agent(s) being monitored. You can specify the size of the echo request packets and the number of packets that are sent. POP3 Monitor. POP3 Monitors are used to periodically check a POP3 mailbox for availability. If you are using a Service Agent, then the Service Agent will periodically establish a POP3 connection to the specified mailbox. If you are using a Remote Agent or an IP (Remote) Agent, the POP3 polling is performed by the ELM Server. If the response is negative or slower than expected a variety of actions and notification options can be triggered. Process Monitor. If you need to monitor individual processes, you can do so with a Process Monitor. The Process Monitor is multi-functional; it can let you know when a process has exceeded the threshold of CPU usage you specify, and it can track when processes are instantiated or terminated. Service Monitor. Service Monitor items are used to monitor individual services and devices on Windows NT, Windows 2000, Windows XP or Windows Service Monitors can generate action or notification when a service or device is stopped, started, paused or resumed. In addition, Service Monitors can alert you when it finds a service or device set to Automatic startup that is not running. SMTP Monitor. SMTP Monitors are used to keep tabs on SMTP hosts, gateways and services. If you are using a Service Agent, then the Service Agent will periodically establish an SMTP connection to the server and port specified. If you are using a Remote Agent or an IP (Remote) Agent, the SMTP polling is performed by the ELM Server. If the response is negative or slower than expected a variety of notification options can be triggered. SNMP OID Monitor. ELM includes an SNMP Monitor that enables you to query an SNMP Object ID (OID) and trigger notification if the value is greater than, less than or equal to a specified value. The SNMP Monitor includes an object browser that enables you to query the objects on an SNMPcapable computer, and select specific objects for monitoring. SQL Monitor. Using SQL Monitors, you can periodically execute SQL queries against a database and generate a variety of actions and notification options if the results returned are different from what is expected. SQL Monitors support both Windows NT and SQL Server authentication, making them easy to fit into your existing SQL security environment. Web Page Monitor. Web Page Monitors are used to monitor web pages (HTTP and HTTPS). The system to which the Web Page Monitor is assigned (e.g., the ELM Server or a Service Agent) periodically fetches the specified URL. If the response is negative, slower than expected, or if the content has been changed, a variety of actions and notification options can be triggered. WMI Monitor. If you are using Windows Management Instrumentation--the Microsoft implementation of Web-Based Enterprise Management (WBEM)--you can use WMI Monitors to query a WMI namespace and database. If the results of the query change, a variety of actions and notification options can be executed. SNMP Receiver. The ELM Server can receive SNMP Traps and display them with and without Object IDs as part of the trap messages. Syslog Receiver. The ELM Server can receive Syslog messages from any TCP or UDP-based Syslog client. 17

24 Monitor Item Properties Each Monitor Item has a set of Properties that are associated with it. The actual tabs displayed on the Monitor Item properties dialog box differ depending on which Monitor Item is being examined. Below is a sample Properties dialog for an Event Collector: Tab Event Filter Criteria Agents Test Monitor Schedule Properties Description The Event Filter Criteria is used to provide a mechanism for isolating an event or a set of events. Displays a list of Agents. Checked Agents have this monitor item assigned to them. Used to test the monitor item. Used to set monitor item execution interval and on/off periods. Lists the various internal properties and values for this object. Some Monitor Items also include a checkbox for Default. When checked, this monitor item will automatically be assigned to any new (appropriate) Agents that you create. Monitor Item Best Practices Below are some guidelines for using Monitor Items: Only Service Agents can execute Monitor Items in real-time. For Remote Agents, we recommend a Scheduled Interval of 10 seconds or greater. Disabled Monitor Items do receive some cycles from the ELM Server, so for best performance you should keep the number of disabled Monitor Items to a minimum. Assign multiple similar Monitor Items sparingly. If you assign multiple Event Collectors, you may receive unwanted events, or receive the same events multiple times. Some Monitor Items include the ability to execute Actions. Leverage this for additional management power! When using Remote Agents, the Monitor Items are executed remotely by the ELM Server. You can use the ELM Server s performance object to get metrics on the Monitor Item job queue. 18

25 Creating Monitor Items Event Alarms Event Alarms are used to trigger action and/or notification when an event does or does not occur within a specified time period. Event Alarms can be configured for Windows NT, Windows 2000, Windows 2003, and Windows XP Agents. Unlike the Event Collector Monitor Item which collects events from event logs, the Event Alarm only monitors the log for the presence or absence of events. How To Create an Event Alarm Event Alarms are used to trigger Action and/or tification when an event is or is not found in the Event Logs on the specified Windows NT, Windows 2000, Windows XP and Windows 2003 computers. You can specify the event(s) you want to look for based on a variety of event criteria, including event type, source, event ID, and event details.» To create an Event Alarm: 1. Right-click on the Monitor Items container in the ELM Console and select All Tasks New Monitor Item. The Create Monitor Wizard will appear. Click Next to continue. 2. Select Event Alarm from the Monitor Type dropdown and click Next to continue. 3. The Event Filter Criteria dialog box will appear. Select the criteria you want to look for, and click Next to continue. The Actions dialog box will appear. 4. The Actions dialog box has two tabs: Events found. Use this tab to select the Action(s) you want taken when one or more matching events are found. Events not found. Use this tab to select the Action(s) you want taken when one or more matching events are not found. 5. Click Next to continue. The Test Monitor Item dialog box will appear enabling you to test the Event Alarm before using it. To do this, select an Agent on from the Agent dropdown and click the Start Test button. 6. Click Next to continue. The Agents dialog box will appear. Check the checkbox for each Service Agent to which you want to apply the Event Collector. 7. Click Next to continue. The Schedule dialog box will appear. On the Occurrence tab, set the frequency at which the matched condition should trigger the specified action. On the Scheduled Interval tab, set the frequency at which you want to execute this Event Collector. Leaving the interval at the default of 1 second will enable you to monitor your event logs in real-time. On the Scheduled Hours tab, configure the hours and days you want this Event Collector active. 8. Click Next to continue. The Name dialog will appear. Enter a Name and Description. 9. Click Finish to save the Event Alarm. 19

26 Event Collector Event Collector Monitor Items are used to collect some or all events from the Agent(s) being monitored. Events can be collected based on any combination of event criteria: Computer Name Event Log Username Event Source Event ID Event Category Event Message When a new event occurs, it will first be checked against the Event Collector Monitor item properties to see if it should be sent to the ELM Server. If the event's type matches one of the selected checkboxes, the event will be received by the ELM Server. If the event type is not one of the selected types, the ELM Server will not receive the event. This is true regardless of whether you are using a Service Agent or a Remote Agent. How To Create an Event Collector Event Collectors are used to collect some or all of the events from the Event Logs on Windows NT, Windows 2000, Windows XP and Windows 2003 computers in real-time or at specified intervals. You can specify the events you want to collect based on a variety of event criteria, including event type, source, event ID, and event details.» To create an Event Collector: 1. Right-click on the Monitor Items container in the ELM Console and select All Tasks New Monitor Item. The Create Monitor Wizard will appear. Click Next to continue. 2. Select Event Collector from the Monitor Type dropdown and click Next to continue. 3. The Event Type dialog box will appear. By default, all event types are checked. If you do not wish to collect events of a specific type, clear the appropriate checkbox(es). 4. The Test Monitor Item dialog box will appear enabling you to test the Event Collector before using it. To do this, select an Agent on from the Agent dropdown and click the Start Test button. 5. Click Next to continue. The Agents dialog box will appear. Check the checkbox for each Service Agent to which you want to apply the Event Collector. 6. Click Next to continue. The Schedule dialog box will appear. On the Scheduled Interval tab, set the frequency at which you want to execute this Event Collector. Leaving the interval at the default of 1 second will enable you to monitor your event logs in real-time. On the Scheduled Hours tab, configure the hours and days you want this Event Collector active. 7. Click Next to continue. The Name dialog box will appear. Enter a Name and Description and click Finish to save the Event Collector. 20

27 Cluster Monitor A Cluster Monitor is a cluster-aware component that provides extensive and configurable monitoring of Windows NT, Windows 2000 and Windows 2003 clusters via the Cluster API. A Cluster Monitor can be used to monitor any or all of the seven sets of Cluster APIs in real-time: Cluster Management. Cluster Monitor uses this set of APIs to collect cluster events, information on cluster objects (including the quorum), and overall cluster state information. This includes cluster-related events that do not get logged to the event logs. Check the Cluster Events checkbox to monitor the cluster through these APIs. Cluster Database Management. Cluster Monitor uses this set of APIs to monitor the cluster database. The cluster database, which contains data on all physical and logical elements in a cluster, is stored in the Registry. Check the Quorum Events and Registry Events checkboxes to monitor the cluster through these APIs. Group Management. These APIs are used to monitor cluster failover groups (also known as Resource Groups) by tracking and reporting group status and membership changes. Check the Group Events checkbox to monitor the cluster through these APIs. Network Interface Management. Cluster Monitor uses these APIs to monitor the network interface(s) and report status changes, including those interfaces not monitored by the Cluster Service. Check the Network Events checkbox to monitor the cluster through these APIs. Network Management. These APIs are used to monitor events related to networks being monitored by the Cluster Service. The Cluster Service monitors all networks available for use by the Cluster Service as the heartbeat network. Check the Network Events checkbox to monitor the cluster through these APIs. de Management. Cluster Monitor uses these APIs to monitor and track node status, cluster membership and resource ownership. Check the de Events checkbox to monitor the cluster through these APIs. Resource Management. These APIs are used to monitor clusters at the Resource level, including the initiation of operations on the resource (stopping, starting, etc.). Check the Resource Events checkbox to monitor the cluster through these APIs. Registry Events. These APIs are used to monitor cluster registry activity. Check the Registry Events checkbox to monitor the cluster through these APIs. A Cluster Monitor can only be assigned to Cluster Agents for physical nodes. It cannot be assigned to an IP Agent, a Workstation Agent, a Server Agent or a Cluster Resource (e.g., a virtual server or cluster resource group). When using a Cluster Monitor, the Agent type (e.g., Service Agent or Remote Agent) must be the same for both physical nodes. For example, if you are using a Service Agent on one node, you must use a Service Agent on the other node. If you are monitoring cluster nodes, but you are not using a Cluster Monitor to monitor Cluster APIs, then you can use Agents of either type for each node. How To Create a Cluster Monitor Cluster Monitors are used to monitor Windows NT, Windows 2000 and Windows 2003 clusters (via Cluster APIs). API messages can be generated as events or alerts by the Cluster Monitor.» To create a Cluster Monitor: 1. Right-click on the Monitor Items container in the ELM Console and select All Tasks New Monitor Item. The Create Monitor Wizard will appear. Click Next to continue. 2. Select Cluster Monitor from the Monitor Type dropdown and click Next to continue. 21

28 3. Configure the Cluster Monitor settings. You can monitor the following cluster events. te that these are events that are monitored via Cluster APIs. These are not events that are logged to the Event Logs on your clusters. To collect those events, use an Event Collector. Cluster Events. Internal cluster events, information on cluster objects, and overall cluster state information. Quorum Events. Internal quorum events. Network Events. All network and network interface events, including the private "heartbeat" network and interfaces that are not monitored by the cluster service. de Events. de status, cluster membership and resource ownership events. Group Events. Tracking and reporting of group status and membership changes for cluster Resource Groups. Resource Events. Monitoring of individual resources, including the initiation of operations on the resource (stopping, starting, failed, etc.). Registry Events. Monitoring of the cluster database, which is stored in the Registry. 4. Click Next to continue. The Monitor Action dialog will appear. When the state, value or condition of a monitored item changes, you can specify what Actions are to be taken. Select the Monitor Action(s) you want to use and click Next to continue. 5. If you have one or more Service Agents already installed on a cluster, you can test the Cluster Monitor before using it. To do this, select a Service Agent on a clustered system from the Agent dropdown, select the Action or condition you want to test, and click the Start Test button. 6. Click Next to continue. The Agents dialog box will appear. Check the checkbox for each Service Agent to which you want to apply the Cluster Monitor. 7. Click Next to continue. The Schedule dialog box will appear. On the Scheduled Interval tab, set the frequency at which you want to execute this Cluster Monitor. On the Scheduled Hours tab, configure the hours and days you want this Cluster Monitor active. 8. Enter a Name and Description and click Next to continue. Leave the Enabled checkbox checked to activate the Cluster Monitor immediately. If you want this Cluster Monitor assigned to all newly created Service Agents (Cluster Agents only), then check the box that says Make this item a default selection for new items. 9. Click Finish to save the Cluster Monitor. ELM Server Monitor An ELM Server Monitor enables Service Agents to perform regular heartbeat checks on the ELM Server. If the ELM Server does not respond or is slow in responding, a variety of actions and notification options can be triggered. You can configure the ELM Server Monitor to restart the ELM Server by putting a check in the Attempt to restart the ELM Server when the heartbeat check fails checkbox. When an ELM Server is shutdown gracefully, a flag is written to the Windows registry on the ELM Server computer: HKLM\Software\TNT Software\<ELM Product>\3.1\Settings\rmalShutdown = 0x (1) A value of 1 indicates a normal shutdown. When the ELM Server service is restarted, this flag (e.g., the rmalshutdown value) is removed from the registry. Before a Service Agent will attempt to restart a stopped ELM Server it will read the registry to see if the flag is present. If the flag exists, the Service Agent will not attempt to restart the ELM Server. If the flag does not exist, the Service Agent will attempt to restart the ELM Server (if configured to do so). 22

29 te If you want the Service Agent to restart a stopped ELM Server, the Service Agent must run under a user account with administrative rights on the ELM Server (e.g., rights sufficient to enable it to start a service). In addition, because restarting the ELM Server requires the reading of a registry setting on the ELM Server computer, the Service Agent must have remote access to the ELM Server's registry with the appropriate permissions to determine whether or not the rmalshutdown flag is present. By default, a warning event will be generated if the ELM Server response takes longer than 5 seconds. If the Service Agent and the ELM Server communicate over slow or very busy network links, you should consider increasing this value. To do this, simply change the value in the Warn if slower than seconds from 5 to the desired amount. To generate a warning each time the response is slower than the number of seconds specified, check the box that says Continue to warn after first failure. If you only want to be notified the first time the ELM Server responds slower than the number of seconds specified, uncheck this box. How To Create an ELM Server Monitor An ELM Server Monitor enables Service Agents to perform regular heartbeat checks on the ELM Server. Service Agents assigned this Monitor Item will attempt socket connections at the configured intervals. If the socket connection attempt fails, the Service Agent will look for the presence of the rmalshutdown registry flag to determine whether or not to restart the ELM Server. If the ELM Server does not respond or is slow in responding, a variety of actions and notification options can be triggered.» To create an ELM Server Monitor 1. Right-click on the Monitor Items container in the ELM Console and select All Tasks New Monitor Item. The Create Monitor Wizard will appear. Click Next to continue. 2. Select ELM Server Monitor from the Monitor Type dropdown and click Next to continue. 3. Configure the ELM Server Monitor settings. You can have the Service Agent attempt to restart a stopped ELM Server by checking the Attempt to restart ELM Server when heartbeat check fails checkbox. By default, a warning event will be generated if the ELM Server response takes longer than 5 seconds. If the Service Agent and the ELM Server communicate over slow or very busy network links, you should consider increasing this value to 15 or 20 seconds. You may need to experiment with this value to determine the appropriate setting for your environment. To do this, change the value in the Warn if slower than seconds from 5 to the desired amount. To generate a warning each time the response is slower than the number of seconds specified, check the box that says Continue to warn after first failure. If you only want to be notified the first time the Service Agent responds slower than the number of seconds specified, uncheck this box. 4. Click Next to continue. The Monitor Action dialog will appear. When the state, value or condition of a monitored item changes, you can specify what Actions are to be taken. Select the Monitor Action(s) you want to use and click Next to continue. 23

30 5. You can test the ELM Server Monitor before using it. To do this, select a Service Agent from the Agent dropdown, select the Action or condition you want to test, and click the Start Test button. When testing the ELM Server Monitor, the Service Agent must be running under a user account with administrative rights on the ELM Server. te that the test does not actually restart the ELM Server service. 6. Click Next to continue. The Agents dialog box will appear. Check the checkbox for each Service Agent to which you want to apply the ELM Server Monitor. 7. Click Next to continue. The Schedule dialog box will appear. On the Scheduled Interval tab, set the frequency at which you want to execute this ELM Server Monitor. On the Scheduled Hours tab, configure the hours and days you want this ELM Server Monitor active. 8. Give the ELM Server Monitor any desired Name and Description. Leave the Enabled checkbox checked to activate the ELM Server Monitor immediately. If you want this ELM Server Monitor assigned to all newly created Service Agents, then check the box that says Make this item a default selection for new items. 9. Click Finish to save the ELM Server Monitor. Exchange Monitor In order to monitor Microsoft Exchange Server via MAPI, the ELM Server transmits small messages from a mailbox on one server in your Exchange organization (the Source Mailbox) to another mailbox on another server in your Exchange organization (the Destination Mailbox). If the message is not received by the Destination Mailbox within the specified quality of service threshold, or not received at all, the configured Action(s) will be executed. In the Source Mailbox field, click the ellipses button to select the mailbox where you want the messages to originate. In the Destination Mailbox field, click the ellipses button to select the mailbox to where you want the messages sent. Set the quality of service threshold in the Warn if not received in seconds field. To generate a warning each time the quality of service threshold is not met, check the box that says Continue to warn after first failure. If you only want to be notified the first time the quality of service threshold is exceeded, uncheck this box. How To Create an Exchange Monitor ELM Enterprise Manager includes an Exchange Server Monitor that enables you to perform end-to-end monitoring of Microsoft Exchange 5.5 or Exchange This type of monitoring allows you to specify a custom quality of service (QoS) threshold for internal delivery, and to be notified when that threshold is not met. To do this, the ELM Enterprise Manager Server uses three mailboxes in your Exchange organization for each Exchange Monitor: Administrator mailbox. This mailbox is used to establish a MAPI session to an Exchange Server in your organization. is sent to/from this mailbox; it is used for session purposes only. Source Mailbox. This is one of the two end-points; in this case, this is the originating mailbox. 24

31 Target (Destination) Mailbox. This is the other end-point; in this case, this is the destination mailbox. Messages sent between these two mailboxes are normally automatically removed. You should not need to perform any mailbox maintenance on any of the end-point mailboxes you use. However, there is no guarantee that every message will be auto-deleted. Therefore, you should periodically look in the source and target mailbox to verify that all messages have been removed. When a message is sent from the source mailbox, an internal clock is started. If the message is not received by the target mailbox within your QoS threshold, the assigned actions will be executed. te Creating an Exchange Server Monitor requires the MAPI subsystem to be installed on your ELM Enterprise Manager Server. This is accomplished by installing one of the many Exchange Server clients on to your ELM Server. Due to its lightweight nature, the Exchange 5.0 client is the recommended client; however, any Exchange client, including any version of Microsoft Outlook will work. In addition, you must also set the Exchange client as the default client in Control Panel Internet Options Programs . If you do not do this, you will receive a message that no default mail client was configured. You can create multiple Exchange Monitors, enabling you to monitor end-to-end mail delivery between all Exchange servers in your organization.» To create an Exchange Monitor: 1. Right-click on the Monitor Items container in the ELM Console and select All Tasks New Monitor Item. The Create Monitor Wizard will appear. Click Next to continue. 2. Select Exchange Monitor from the Monitor Type dropdown and click Next to continue. ELM Enterprise Manager will verify the existence of the required MAPI subsystem files. If those files are not present, an error message will appear and you will not be able to continue. 3. The Exchange Monitor dialog will appear. Click the ellipses button ( ) and select an Administrative mailbox. Click Next to continue. 4. Using the ellipses buttons, select a source and destination mailbox. Selecting source and destination mailboxes on different servers can be used to perform end-to-end monitoring of your Exchange infrastructure. 5. Set the Warn if slower than seconds to the desired quality of service threshold. 6. To generate a warning each time the response is slower than the number of seconds specified, check the box that says Continue to warn after first failure. 7. Click Next to continue. The Monitor Action dialog will appear. When the state, value or condition of a monitored item changes, you can specify what Actions are to be taken. Select the Monitor Action(s) you want to use and click Next to continue. 8. The Schedule dialog box will appear. On the Scheduled Interval tab, set the frequency at which you want to execute this Exchange Monitor. Leaving the interval at the default of 1 second will enable you to monitor your event logs in real-time. On the Scheduled Hours tab, configure the hours and days you want this Exchange Monitor active. 25

32 9. Click Next to continue. Enter a Name and Description and make sure Make this a default selection for new items is not checked. 10. Click Finish to save the Monitor Item. 11. Click OK to acknowledge the item creation. When prompted to create another item, click. File Monitor As the name implies, File Monitors can be used to monitor individual files, an entire directory of files, or an entire directory tree of files. File Monitors can only parse non-circular text files. File Monitor cannot be used to monitor binary files, locked files or circular files (files that overwrite themselves by starting back at the beginning of the file. te The File Monitor can only be used with Service Agents. It cannot be used with Remote Agents or IP Agents. Each File Monitor can include multiple matches; that is, you can look for multiple strings in each file. Each match added to the File Monitor will cause a new subtab for that match to be created under the Actions tab of the File Monitor properties. This enables you to specify different Actions for each match. How To Create a File Monitor To monitor a log file, ASCII file, or text file (or a directory of ASCII or text files), you would use a File Monitor.» To create a File Monitor: 1. Right-click on the Monitor Items container in the ELM Console and select All Tasks New Monitor Item. The Create Monitor Wizard will appear. Click Next to continue. 2. Select File Monitor from the Monitor Type dropdown and click Next to continue. 3. Enter a Name and Description and click Next to continue. 4. The File Monitor Search Definition dialog box will appear. Use the Add button to add a search path. Each File Monitor supports one or more search paths. A search path can be a file or, by using wildcards, a group of files. For example, to search all Internet Information Server logs, use a search path of C:\WINNT\SYSTEM32\LOGFILES\*.LOG, and check the Search Subfolders checkbox. This will cause all log files (HTTP, SMTP, NNTP, and FTP) in all of the subdirectories to be searched for the strings specified in the Add Match dialog box. Click Add for each search path you want to use. 5. Click Next to continue. The Add Match dialog box will appear. Enter the word or string you want to search for. You can click the Insert Variable button to insert a variable in the search string. You can use the asterisk (*) as a wildcard character, a pipe ( ) as an OR operator, an ampersand (&) as an AND operator, and an exclamation point (!) as a NOT operator. For example, to parse a flat file for the word error OR the word failed, use the following example syntax: *error* *failed* 6. Click Add for each string or word you want to search for. Click Next to continue. 7. The Monitor Action dialog box will appear. Configure the following options and click Next to continue. 26

33 FTP Monitor Enable. When this box is checked, the Monitor Item is enabled and will execute as configured. Uncheck this box to disable the Monitor Item. Create New Alert Entry. Selecting this checkbox to cause an Alert to be generated and posted to the Alerts container within the MMC snap-in. Create Application Event Log Entry. Selecting this enables you to cause a customizable event to be logged to the Application log. Use the Variables button to specify any additional variables you want the event to include. Net Send Message. Using this option enables you to send a popup message over the network. The target system must have the Messenger Service (NT/2000/XP/2003) or WinPopUp (Win9x/WinMe) running in order to receive the Net Send Message. Use the Browse button to browse for a target computer, or manually enter the name of the computer to which you want to send messages in the Computer Name field. Run Command. This option provides a mechanism for executing a batch file, running a command line application or launching a script (CScript or WScript). Use the Edit button to create and edit any scripts or command line parameters you want to execute. 8. The Test Monitor Item dialog box will appear enabling you to test the File Monitor before using it. To do this, select an Agent on from the Agent dropdown and click the Start Test button. 9. Click Next to continue. The Agents dialog box will appear. Check the checkbox for each Service Agent to which you want to apply the File Monitor. 10. Click Next to continue. The Schedule dialog box will appear. On the Scheduled Interval tab, set the frequency at which you want to execute this File Monitor. Leaving the interval at the default of 1 second will enable you to monitor your event logs in real-time. On the Scheduled Hours tab, configure the hours and days you want this File Monitor active. 11. Click Finish to save the File Monitor. As its name implies, an FTP Monitor item is used to monitor the status and availability of an FTP site. Any valid and accessible FTP server can be monitored by the ELM Enterprise Manager Server or a Service Agent. The Server will make an application-layer FTP connection to the Agent at your specified interval. Both anonymous and authenticated connections are supported. In addition, you can specify the port on which to connect. By default, the Server connects on port 21. Because the ELM Enterprise Manager Server can make the actual FTP connection, you can monitor FTP server availability on any operating system running FTP server software (e.g., Windows, Unix, Linux, vell, Solaris, etc.). You can configure the following options for FTP Monitor items: Username. This can be a specific username or you can set it to anonymous. Password. This is the password for the account specified in the Username field. If you entered anonymous for the username, then enter any SMTP address as the password. FTP Port. This is the port to which you want the FTP Monitor to connect. By default, TCP port 21 is used. However, you can specify any valid TCP port that you are using on your FTP server. 27

34 Warn if slower than seconds. In addition to checking availability, you can also monitor your FTP server's performance by monitoring how quickly a response is returned. By specifying a value for this field, you can cause a warning message to be generated whenever the response from the FTP server exceeds the threshold you specify here. Continue to warn after first failure. By default, ELM will notify you once when the FTP server is unavailable. By checking this box, you can specify that a message be sent at each interval that the FTP server is checked. How To Create an FTP Monitor FTP Monitors are used to monitor FTP sites. If you are using a Service Agent, then the Service Agent will periodically establish an FTP connection to the URL and port specified. If you are using a Remote Agent or an IP (Remote) Agent, the FTP polling is performed by the ELM Server. If the response is negative or slower than expected a variety of notification options can be triggered.» To create an FTP Monitor: 1. Right-click on the Monitor Items container in the ELM Console and select All Tasks New Monitor Item. The Create Monitor Wizard will appear. Click Next to continue. 2. Select FTP Monitor from the Monitor Type dropdown and click Next to continue. 3. Enter a Name and Description and click Next to continue. 4. The FTP Site Monitor dialog box will appear. a. Enter the Username and Password you want to use to connect to the FTP server. b. In the FTP Port field, enter the port number on which your FTP server is listening. Most FTP servers listen on TCP port 21. c. In the Warn if slower than field, enter the quality of service threshold in seconds. d. If you want continuous warnings after the first warning is sent, check the box that says Continue to warn after first failure. 5. Click Next to continue. The Monitor Action dialog box will appear. This dialog box has three tabs: Failed, Quality of Service, and Success. Configure the following options for each tab, and click Next to continue. Enable. When this box is checked, the Action is enabled and will execute as configured. Uncheck this box to disable the Action. Create New Alert Entry. Selecting this checkbox to cause an Alert to be generated and posted to the Alerts container within the ELM Console. Create Application Event Log Entry. Selecting this enables you to cause a customizable event to be logged to the Application log. Use the Variables button to specify any additional variables you want the event to include. Net Send Message. Using this option enables you to send a popup message over the network. The target system must have the Messenger Service (Windows NT, Windows 2000, Windows 2003, or Windows XP) or WinPopUp (Win9x/WinMe) running in order to receive the Net Send Message. Use the Browse button to browse for a target computer, or manually enter the name of the computer to which you want to send messages in the Computer Name field. 28

35 IIS Monitor Run Command. This option provides a mechanism for executing a batch file, running a command line application or launching a script. Use the Edit button to create and edit any scripts or command line parameters you want to execute. 6. The Test Monitor Item dialog box will appear enabling you to test the FTP Monitor before using it. To do this, select an Agent on from the Agent dropdown and click the Start Test button. 7. Click Next to continue. The Agents dialog box will appear. Check the checkbox for each Service Agent to which you want to apply the FTP Monitor. 8. Click Next to continue. The Schedule dialog box will appear. On the Scheduled Interval tab, set the frequency at which you want to execute this FTP Monitor. On the Scheduled Hours tab, configure the hours and days you want this FTP Monitor active. 9. Click Finish to save the FTP Monitor. The IIS Monitor is used to monitor Internet Information Server 4.0 (Windows NT), and Internet Information Services 5.0 (Windows 2000), 5.1 (Windows XP) and 6.0 (Windows 2003). The IIS Monitor periodically checks the state of IIS for state changes and broken paths. In addition, it internally executes a File Monitor (no separate File Monitor configuration necessary) to parse the IIS log files for failed requests, and connection attempts from blocked addresses (e.g., addresses blocked via IIS security). A broken path is when IIS and the file system are out-of-sync. When this happens, and depending on where the broken path exists, Internet Services Manager may display a red "stop sign" icon next to the virtual directory with the broken path. Failed requests are any HTTP response code that represents a failure. This includes all HTTP 500 and 400 level response codes, as well as all HTTP 300 responses except for HTTP 304. Any HTTP 200 response is considered a success. te The IIS Monitor can only be used with Service Agents. It cannot be used with Remote Agents or IP Agents. By default, the IIS Monitor monitors all virtual servers. This is done through the use of an asterisk (*) wildcard. You can monitor specific virtual servers by removing the asterisk entry and replacing it with the name of the virtual servers you want to monitor. To remove the asterisk entry, click it once to select it, and then click the Del button. To add additional virtual servers, enter the name of the virtual server in the field next to the Add button, and then click the Add button to add it to the list. If you want to be notified above and beyond the first failure message, check the box that says Continue to warn after first failure. How To Create an IIS Monitor» To create an IIS Monitor: 1. Right-click on the Monitor Items container in the ELM Console and select All Tasks New Monitor Item. The Create Monitor Wizard will appear. Click Next to continue. 29

36 Link Monitor 2. Select IIS Monitor from the Monitor Type dropdown and click Next to continue. 3. The IIS Monitor dialog will appear. By default, the IIS Monitor monitors all virtual servers. This is done through the use of an asterisk (*) wildcard. You can monitor specific virtual servers by removing the asterisk entry and replacing it with the name of the virtual servers you want to monitor. To remove the asterisk entry, click it once to select it, and then click the Del button. To add additional virtual servers, enter the name of the virtual server in the field next to the Add button, and then click the Add button to add it to the list. If you want to be notified above and beyond the first failure message, check the box that says Continue to warn after first failure. Click Next to continue. 4. The Monitor Action dialog will appear. When the state, value or condition of a monitored item changes, you can specify what Actions are to be taken. Select the Monitor Action(s) you want to use and click Next to continue. 5. The Test Monitor Item dialog box will appear enabling you to test the IIS Monitor before using it. To do this, select an Agent on from the Agent dropdown and click the Start Test button. 6. Click Next to continue. The Agents dialog box will appear. Check the checkbox for each Agent to which you want to apply the IIS Monitor. 7. Click Next to continue. The Schedule dialog box will appear. On the Scheduled Interval tab, set the frequency at which you want to execute this IIS Monitor. Leaving the interval at the default of 1 second will enable you to monitor IIS in real-time. On the Scheduled Hours tab, configure the hours and days you want this IIS Monitor active. 8. Click Next to continue. The Name dialog box will appear. Enter a Name and Description and click Finish to save the IIS Monitor. To automatically assign this IIS Monitor to all newly created Agents that are appropriate for this type of Monitor Item, check the box that says Make this item a default selection for new items. 9. Click Finish to save the IIS Monitor. The Link Monitor periodically spiders/crawls your Web site using the URL you specify as a starting point. It can check for broken links and Quality of Service. Link Monitors can only be used with Service Agents. You can customize the behavior of the Link Monitor: URL. Enter the URL you wish to use as a starting point for the Link Monitor. Username. If a username is required to access the above URL, enter in this field. Password. If you entered a username in the Username field, enter the password for that username in this field. Max Pages. If you want to limit the number of pages visited by the Link Monitor, enter the maximum number of pages visited in this field. By setting this field to zero (0), the Link Monitor will visit and spider all pages linked from the starting URL, until the Max Levels has been reached. Max Levels. This is the maximum number of visited levels within the same domain. If you wish to limit the number of levels traversed, you can enter a maximum number of levels in this dialog. By setting this field to zero (0), the Link Monitor will visit and spider all pages linked from the starting URL, until the Max Pages has been reached. 30

37 Warn if average response time is more than. This field is used to check Quality of Service of the checked links. You can configure the Link Monitor to warn you if any page is not retrieved within this QoS threshold. Proxy Server. If the TNT Agent needs to go through a proxy server in order to access the page(s) to be checked, enter the name (e.g., host name or FQDN) of the Proxy Server. Port. If you are using a Proxy Server, use this field to specify the port on which the Proxy Server listens for requests. How To Create a Link Monitor» To create a Link Monitor: 1. Right-click on the Monitor Items container in the ELM Console and select All Tasks New Monitor Item. The Create Monitor Wizard will appear. Click Next to continue. 2. Select Link Monitor from the Monitor Type dropdown and click Next to continue. 3. Configure the Link Monitor as desired: URL. Enter the URL you wish to use as a starting point for the Link Monitor. Username. If a username is required to access the above URL, enter in this field. Password. If you entered a username in the Username field, enter the password for that username in this field. Max Pages. If you want to limit the number of pages visited by the Link Monitor, enter the maximum number of pages visited in this field. By setting this field to zero (0), the Link Monitor will visit and spider all pages linked from the starting URL. Max Levels. This is the maximum number of visited levels within the same domain. If you wish to limit the number of levels traversed, you can enter a maximum number of levels in this dialog. Warn if average response time is more than. This field is used to check Quality of Service of the checked links. You can configure the Link Monitor to warn you if any page is not retrieved within this QoS threshold. Proxy Server. If the TNT Agent needs to go through a proxy server in order to access the page(s) to be checked, enter the name (e.g., host name or FQDN) of the Proxy Server. Port. If you are using a Proxy Server, use this field to specify the port on which the Proxy Server listens for requests. 4. Click Next to continue. The Exclude URL dialog will appear. 5. To exclude a URL, enter it in the Enter URL to be excluded field, and then click the Add button. To remove an excluded URL, select it in the These URLs will not be visited during the spidering operation field and click the Remove button. Click Next to continue. te You can use the asterisk as a wildcard to perform pattern matching in your exclusion list. For 31

38 example, if you wanted to exclude everything under you can enter the following as an exclusion: 6. The Monitor Action dialog will appear. When the state, value or condition of a monitored item changes, you can specify what Actions are to be taken. Select the Monitor Action(s) you want to use and click Next to continue. 7. The Test Monitor Item dialog box will appear enabling you to test the Link Monitor before using it. To do this, select an Agent on from the Agent dropdown and click the Start Test button. 8. Click Next to continue. The Agents dialog box will appear. Check the checkbox for each Agent to which you want to apply the Link Monitor. 9. Click Next to continue. The Schedule dialog box will appear. On the Scheduled Interval tab, set the frequency at which you want to execute this Link Monitor. On the Scheduled Hours tab, configure the hours and days you want this Link Monitor active. 10. Click Next to continue. The Name dialog box will appear. Enter a Name and Description and click Finish to save the Link Monitor. To automatically assign this Monitor Item to all newly created Agents that are appropriate for this type of Monitor Item, check the box that says Make this item a default selection for new items. 11. Click Finish to save the Link Monitor. Performance Alarms A Performance Alarm is a condition where a selected performance counter, or instance of a counter, is less than, greater than, or equal to a specific value. Performance Alarms specify what action is to be taken when a performance counter or instance meets the specified criteria. Performance Alarms are a great way to proactively manage your Windows systems. By configuring Alarms, you'll be able to take action at the first sign of trouble. You can configure Alarms to send messages and network messages, and even execute commands, batch files and applications. How To Create a Performance Alarm Performance Alarms monitor performance objects, counters and instances and can generate a variety of tification Methods when a counter or instance of a counter is greater than, less than or equal to your specified threshold for your specified duration.» To create a Performance Alarm: 1. Right-click on the Monitor Items container in the ELM Console and select All Tasks New Monitor Item. The Create Monitor Wizard will appear. Click Next to continue. 2. Select Performance Alarm from the Monitor Type dropdown and click Next to continue. 3. Enter a Name and Description and click Next to continue. 4. The Performance Alarm Watch dialog box will appear. a. In the Object drop-down, select the Performance Object you want to monitor. If the object you want to monitor is not listed, you can add additional 32

39 objects and counters by clicking the Add button and following these instructions. b. In the Counter drop-down, select the Performance Counter you want to monitor. c. To monitor all instances of a particular counter, leave an asterisk in the Instances field. To monitor a single instance, or a specific set of instances, click the Add/Remove button, enter the instance(s) you want to monitor and click Close. Alternatively, you can enter multiple instances directly in the Instances field; be sure to separate each instance with a semi-colon. d. In the Condition field, enter the condition you want to match (e.g., less than, greater than, equal to, and so forth). e. Enter the value you want to match in the Value field. f. In the Occurs field, enter the number of consecutive times this condition can be met before triggering notification. 5. Click Next to continue. The Monitor Action dialog will appear. When the state, value or condition of a monitored item changes, you can specify what Actions are to be taken. Select the Monitor Action(s) you want to use and click Next to continue. 6. The Test Monitor Item dialog box will appear enabling you to test the Performance Alarm before using it. To do this, select an Agent on from the Agent dropdown and click the Start Test button. 7. Click Next to continue. The Agents dialog box will appear. Check the checkbox for each Service Agent to which you want to apply the Performance Alarm. 8. Click Next to continue. The Schedule dialog box will appear. On the Scheduled Interval tab, set the frequency at which you want to execute the Alarm. Leaving the interval at the default of 1 second will enable you to monitor the performance counter or object in real-time. On the Scheduled Hours tab, configure the hours and days you want this monitor active. 9. Click Finish to save the Performance Alarm. Performance Collector Performance Collectors are sets of one or more performance objects, counters and/or instances that are grouped together for collection and aggregation. ELM Enterprise Manager and ELM Performance Manager come pre-populated with a variety of Performance Collectors. You can edit any of these or create your own custom Performance Collectors. Each Performance Collector is comprised of three parts: the counters being collected; the frequency of the collection (e.g., every 30 minutes, every hour, etc.); and the days on which collection occurs. ELM comes pre-populated with a variety of Performance Objects and Counters. If the object, counter or instance you want to collect or monitor is not listed, you can very easily add it from a Windows NT, Windows 2000, Windows XP or Windows 2003 computer that publishes the counter. How To Use Performance Collectors Performance Collectors are used to collect and store performance data from Windows NT, Windows 2000, Windows XP and Windows A Performance Collector is a group of performance counters that are collected at the same time. You can use multiple Performance Collectors that contain different groups of counters, or a single Performance Collector that contains all of the counters you want to collect. 33

40 » To use Performance Collector: 1. Right-click on the Monitor Items container in the ELM Console and select All Tasks New Monitor Item. The Create Monitor Wizard will appear. Click Next to continue. 2. Select Performance Collector from the Monitor Type dropdown and click Next to continue. 3. Enter a Name and Description and click Next to continue. 4. The Performance Counter dialog box will appear. The initial view of this field will be a list of defined Performance Object. If the object you want to monitor is not listed, you can add additional objects and counters by following these instructions. Expand each object containing counters you want to monitor and put a check in the box for each Performance Counter you want to collect. 5. Click Next to continue. The Summary dialog box will appear. Use this dialog box to aggregate (e.g., average) the collected data. Aggregating data is a great way to manage the size of the database used to store the collected performance data. An aggregated database will contain detailed data for the most recent collection period and summary data for historical periods. Data can be aggregated every week, once a month or once a quarter, or you can turn it off completely. a. Use the On field to select the day on which aggregation will take place. b. Use the At field to specify the time. te You do not need to aggregate your data. This feature is intended as a convenience for those customers who need to minimize the size or growth of their performance data database. Aggregating (summarizing) on a weekly basis, for example, will replace a week s worth of data with an average for that week. If you need to maintain specific counter data for all collection intervals, do not aggregate the data. Ping Monitor 6. Click Next to continue. The Test Monitor Item dialog box will appear enabling you to test the Performance Collector before using it. To do this, select an Agent on from the Agent dropdown and click the Start Test button. 7. Click Next to continue. The Agents dialog box will appear. Check the checkbox for each Agent to which you want to apply the Monitor Item. 8. Click Next to continue. The Schedule dialog box will appear. On the Scheduled Interval tab, set the frequency at which you want to collect the performance data. On the Scheduled Hours tab, configure the hours and days you want performance data collection active. 9. Click Finish to save the Performance Collector. The Ping Monitor is used to send period ICMP echo requests to the Agent(s) being monitored. You can specify the size of the echo request packets and the number of packets that are sent. 34

41 In the Packet Size (bytes) field, specify the size of the ICMP echo request (e.g., the size of each ping packet), in bytes, that you want sent at each ping interval. In the Repeat (packets) field, enter in the number of packets you want sent at each interval. Use the Continue to perform action after first failure checkbox to specify that the Action be executed each time the Ping Monitor returns a failure code (e.g., Ping failed). When enabled, the Success Action will be executed if all echo requests succeed. When enabled, the Warning Action will be executed if at least one echo request fails. When enabled, the Failed Action will be executed if all echo requests fail. te By default, the Ping Monitor will only log execute the configured Action(s) once (when the state changes). It will not report at each interval. For example, the first time the Ping Monitor is executed, it will generate a success message. If the ping is successful at the next interval, it will not execute the configured Action(s) because the state has not changed. If you want the Ping Monitor to execute its configured Action(s), you can do so by adding a registry entry to the Agent computer (for Service Agents) and/or to the ELM Server computer (for Remote Agents). Below is the registry entry (REG_DWORD, Value=1) that needs to be added: Service Agents (enter on each Agent): HKLM\Software\TNT Software\ELM Manager Agent\3.1\Settings\PingMonitorTakeActionAtEachInterval EEM Remote Agents (enter on ELM Enterprise Manager Server): HKLM\Software\TNT Software\ELM Enterprise Manager\3.1\Settings\PingMonitorTakeActionAtEachInterval How To Create a Ping Monitor» To create a Ping Monitor: 1. Right-click on the Monitor Items container in the ELM Console and select All Tasks New Monitor Item. The Create Monitor Wizard will appear. Click Next to continue. 2. Select Ping Monitor from the Monitor Type dropdown and click Next to continue. 3. Enter a Name and Description and click Next to continue. 4. The Ping Monitor dialog box will appear. a. In the Packet Size field, enter the size of each packet sent (in bytes). b. In the Repeat field, enter the number of packets you want to send. enter the quality of service threshold in seconds. c. If you want continuous warnings after the first warning is sent, check the box that says Continue to warn after first failure. 5. Click Next to continue. The Monitor Action dialog will appear. When the state, value or condition of a monitored item changes, you can specify what Actions are to be taken. Select the Monitor Action(s) you want to use and click Next to continue. 6. The Test Monitor Item dialog box will appear enabling you to test the Ping Monitor before using it. To do this, select an Agent on from the Agent dropdown and click the 35

42 POP3 Monitor Start Test button. 7. Click Next to continue. The Agents dialog box will appear. Check the checkbox for each Agent you to ping. 8. Click Next to continue. The Schedule dialog box will appear. On the Scheduled Interval tab, set the frequency at which you want to execute this Ping Monitor. On the Scheduled Hours tab, configure the hours and days you want this Ping Monitor active. 9. Click Finish to save the Ping Monitor. POP3 Monitors are used to periodically check a POP3 mailbox for availability. If you are using a Service Agent, then the Service Agent will periodically establish a POP3 connection to the specified mailbox. If you are using a Remote Agent or an IP (Remote) Agent, the POP3 polling is performed by the ELM Server. If the response is negative or slower than expected a variety of notification options can be triggered. The following fields are available for POP3 Monitors: Port. Specify the port to which the POP3 Monitor should connect on your POP3 server. By default, POP3 communications occurs over port 110. You can specify any valid TCP port that is being used by your POP3 server. Warn if slower than seconds. In addition to checking availability, you can also monitor your POP3 server's performance by monitoring how quickly a response is returned. By specifying a value for this field, you can cause a warning message to be generated whenever the response from the POP3 server exceeds the threshold you specify here. Username. Because POP3 mailboxes are associated with a user (and therefore require authentication to access them), you can (and should) specify a username that has a POP3 account on the POP3 servers being monitored. This can be an administrator mailbox, a general user mailbox, or a custom POP3 mailbox you create specifically for this POP3 Monitor. Password. This is the password for the account specified in the Username field. Continue to warn after first failure. By default, ELM will notify you once when the POP3 server is unavailable. By checking this box, you can specify that a message be sent at each interval that the POP3 server is checked and found to be unavailable. How To Create a POP3 Monitor» To create a POP3 Monitor: 1. Right-click on the Monitor Items container in the ELM Console and select All Tasks New Monitor Item. The Create Monitor Wizard will appear. Click Next to continue. 2. Select POP3 Monitor from the Monitor Type dropdown and click Next to continue. 3. Enter a Name and Description and click Next to continue. 4. The POP3 Server Monitor dialog box will appear. a. In the Port field, enter the port number on which your POP3 server is listening. Most POP3 servers listen on TCP port 110. b. In the Warn if slower than field, enter the quality of service threshold in seconds. 36

43 c. Enter the Username and Password you want to use to connect to the POP3 server. This username and password must be associated with a valid POP3 mailbox on the monitored server. d. If you want continuous warnings after the first warning is sent, check the box that says Continue to warn after first failure. 5. Click Next to continue. The Monitor Action dialog will appear. When the state, value or condition of a monitored item changes, you can specify what Actions are to be taken. Select the Monitor Action(s) you want to use and click Next to continue. 6. The Test Monitor Item dialog box will appear enabling you to test the POP3 Monitor before using it. To do this, select an Agent on from the Agent dropdown and click the Start Test button. 7. Click Next to continue. The Agents dialog box will appear. Check the checkbox for each Service Agent to which you want to apply the POP3 Monitor. 8. Click Next to continue. The Schedule dialog box will appear. On the Scheduled Interval tab, set the frequency at which you want to execute this POP3 Monitor. On the Scheduled Hours tab, configure the hours and days you want this POP3 Monitor active. 9. Click Finish to save the POP3 Monitor. Process Monitor As its name implies, the Process Monitor is used to monitor processes on an Agent. The Process Monitor is multi-functional; it can let you know when a process has exceeded the threshold of CPU usage you specify, and it can track when processes are instantiated or terminated. In addition, it can generate a Warning or Error when the number of instances of a particular process exceeds your custom value. Each Process Monitor item supports multiple matches. Use the Add button to add an additional match. Use the Delete button to remove a listed match. Double-click any listed item to edit it. You can use the asterisk (*) as a wildcard character, a pipe ( ) as an OR operator, the ampersand (&) as an AND operator, and the exclamation point (!) as a NOT operator. For example, to monitor all processes except the System Idle process and the _Total (All) process, use the following syntax:!idle&!_total (All) You can generate a Warning event when CPU utilization by a monitored process meets or exceeds the value specified in the Warning when % Processor Time is Greater Than field, and you can generate an Error event when CPU utilization by a monitored process meets or exceeds the value specified in the Error when % Processor Time is Greater Than field. By default, a Warning is generated when any process uses more than 50% of the CPU time, and an error is generated when any process uses more than 75% of the CPU time. Process Monitors can also notify you when a process is instantiated, or when a running process terminates. These settings can be found on the New Process and Process Ended tabs of the Process Monitor's Monitor Action dialog box. You can also be alerted when the number of instances of any process exceeds your specified Process Count. Use the Warning when Process Count is greater than and Error when Process Count is greater than fields to specify Process Count thresholds. 37

44 How To Create a Process Monitor If you need to monitor individual processes, you can do so with a Process Monitor. The Process Monitor is multi-functional; it can let you know when a process has exceeded the threshold of CPU usage you specify, when any process is instantiated or terminated, or when the number of instances of any process exceeds a specified threshold.» To create a Process Monitor: 1. Right-click on the Monitor Items container in the ELM Console and select All Tasks New Monitor Item. The Create Monitor Wizard will appear. Click Next to continue. 2. Select Process Monitor from the Monitor Type dropdown and click Next to continue. 3. Enter a Name and Description and click Next to continue. 4. The Process Monitor Definition dialog box will appear. a. Click the Add button to add a process to be monitored. The Add Process Name dialog box will appear. Enter the name of the process you want to monitor. You can use the asterisk (*) as a wildcard character, a pipe ( ) as an OR operator, the ampersand (&) as an AND operator, and the exclamation point (!) as a NOT operator. For example, to monitor all processes except the System Idle process and the _Total process, use the following syntax:!idle&!_total b. Use the Delete button to remove a listed match. c. Double-click any listed item to edit it. d. You can execute a Warning action when CPU utilization by a monitored process meets or exceeds the value specified in the Warning when % Processor Time Greater Than field. e. You can execute an Error action when the CPU utilization by a monitored process meets or exceeds the value specified in the Error when % Processor Time Greater Than field. f. You can execute a Warning action when the number of instances of a given process exceeds your specified Process Count threshold in the Warning when Process Count is greater than field. g. You can execute an Error action when the number of instances of a given process exceeds your specified Process Count threshold in the Error when Process Count is greater than field. 5. Click Next to continue. The Monitor Action dialog will appear. When the state, value or condition of a monitored item changes, you can specify what Actions are to be taken. Select the Monitor Action(s) you want to use and click Next to continue. 6. The Test Monitor Item dialog box will appear enabling you to test the Process Monitor before using it. To do this, select an Agent on from the Agent dropdown and click the Start Test button. 7. Click Next to continue. The Agents dialog box will appear. Check the checkbox for each Service Agent to which you want to apply the Process Monitor. 8. Click Next to continue. The Schedule dialog box will appear. 38

45 On the Scheduled Interval tab, set the frequency at which you want to execute this Process Monitor. On the Scheduled Hours tab, configure the hours and days you want this Process Monitor active. 9. Click Finish to save the Process Monitor. Service Monitor Service Monitor items are used to monitor services and devices on Windows NT, Windows 2000, Windows XP and Windows 2003 computers. Service Monitor items are used to monitor and respond to service and device state changes (e.g., started to stopped, stopped to started, etc.). In addition, Service Monitor items enable you to be notified of any services or devices that are set to Automatic startup but aren't currently running. If you have a service or device that is set to Automatic startup but not running, the Service Monitor item will generate an event to notify you about this condition. If you want to be continuously notified about this condition, put a check in the box labeled Continue to notify when AutoStart service is stopped after first failure. This will cause an event to be logged about this condition at each interval specified for the Service Monitor item. te If a service or device is set to Manual startup but not running, ELM will not generate an event. The only time an event of this type is generated is when the service or device is set to Automatic startup and not currently running. How To Create a Service Monitor Service Monitor items are used to monitor individual services and devices on Windows NT, Windows 2000, Windows XP and Windows Service Monitors can generate notification when a service or device is stopped, started, paused or resumed. In addition, Service Monitors can alert you when it finds a service or device set to Automatic startup that is not running, as well as take corrective action to restart the failed service.» To create a Service Monitor: 1. Right-click on the Monitor Items container in the ELM Console and select All Tasks New Monitor Item. The Create Monitor Wizard will appear. Click Next to continue. 2. Select Service Monitor from the Monitor Type dropdown and click Next to continue. 3. Enter a Name and Description and click Next to continue. 4. The Service Monitor Definition dialog box will appear. a. Click the Add button to add a Service to be monitored. The Add Service Name dialog box will appear. You can use the Browse button to browse for a specific computer on the network and select a service or device directly from that computer. You can also manually enter the name of the Service you want to monitor. You can use the asterisk (*) as a wildcard character, a pipe ( ) as an OR operator, the ampersand (&) as an AND operator, and the exclamation point (!) as a NOT operator. b. Use the Delete button to remove a listed match. c. If you put a check in the Continue to tify when AutoStart service is stopped after first failure check box, you will receive continuous warnings 39

46 about any services or devices that are set to Automatic startup but not currently running. 5. Click Next to continue. The Monitor Action dialog will appear. When the state, value or condition of a monitored item changes, you can specify what Actions are to be taken. Select the Monitor Action(s) you want to use and click Next to continue. te The Run Command option is very useful for quickly restarting failed services. SMTP Monitor 6. The Test Monitor Item dialog box will appear enabling you to test the Service Monitor before using it. To do this, select an Agent on from the Agent dropdown and click the Start Test button. 7. Click Next to continue. The Agents dialog box will appear. Check the checkbox for each Service Agent to which you want to apply the Service Monitor. 8. Click Next to continue. The Schedule dialog box will appear. On the Scheduled Interval tab, set the frequency at which you want to execute this Service Monitor. On the Scheduled Hours tab, configure the hours and days you want this Service Monitor active. 9. Click Finish to save the Service Monitor. SMTP Monitors are used to keep tabs on SMTP hosts, gateways and services. If you are using a Service Agent, then the Service Agent will periodically establish an SMTP connection to the server and port specified. If you are using a Remote Agent or an IP (Remote) Agent, the SMTP polling is performed by the ELM Server. If the response is negative or slower than expected a variety of notification options can be triggered. Port. Specify the port to which the SMTP Monitor should connect on your SMTP server. By default, SMTP communications occurs over TCP port 25. You can specify any valid TCP port that is being used by your SMTP server. Warn if slower than seconds. In addition to checking availability, you can also monitor your SMTP server's performance by monitoring how quickly a response is returned. By specifying a value for this field, you can cause a warning message to be generated whenever the response from the SMTP server exceeds the threshold you specify here. Continue to warn after first failure. By default, ELM will notify you once when the SMTP server is unavailable. By checking this box, you can specify that a message be sent at each interval that the SMTP server is checked and found to be unavailable. How To Create an SMTP Monitor» To create an SMTP Monitor: 1. Right-click on the Monitor Items container in the ELM Console and select All Tasks New Monitor Item. The Create Monitor Wizard will appear. Click Next to continue. 2. Select SMTP Monitor from the Monitor Type dropdown and click Next to continue. 40

47 3. Enter a Name and Description and click Next to continue. 4. The SMTP Server Monitor dialog box will appear. a. In the Port field, enter the port number on which your SMTP server is listening. Most SMTP servers listen on TCP port 25. b. In the Warn if slower than field, enter the quality of service threshold in seconds. c. If you want continuous warnings after the first warning is sent, check the box that says Continue to warn after first failure. 5. Click Next to continue. The Monitor Action dialog will appear. When the state, value or condition of a monitored item changes, you can specify what Actions are to be taken. Select the Monitor Action(s) you want to use and click Next to continue. 6. The Test Monitor Item dialog box will appear enabling you to test the SMTP Monitor before using it. To do this, select an Agent on from the Agent dropdown and click the Start Test button. 7. Click Next to continue. The Agents dialog box will appear. Check the checkbox for each Service Agent to which you want to apply the SMTP Monitor. 8. Click Next to continue. The Schedule dialog box will appear. On the Scheduled Interval tab, set the frequency at which you want to execute this SMTP Monitor. On the Scheduled Hours tab, configure the hours and days you want this SMTP Monitor active. 9. Click Finish to save the SMTP Monitor. SNMP Monitor Simple Network Management Protocol (SNMP) is a network management standard used in TCP/IP networks. Every SNMP-capable computer includes manageable objects that are defined in one or more management information bases (MIBs). Manageable objects include network identification, statistics and other protocol information, hardware and software configuration, and performance data. Each object within a MIB is identified by its object-identifier (OID), which is universally unique. ELM Enterprise Manager includes an SNMP Monitor that enables you to query an SNMP Object ID (OID) and trigger notification if the value is greater than, less than or equal to a specified value. The SNMP Monitor includes an object browser that enables you to query the objects on an SNMP-capable computer, and select specific objects for monitoring. te By default, the SNMP OID Monitor and the SNMP OID tification Method use a root of of the SNMP OID tree. By adding the following registry value to the ELM Server, you can specify a different OID root: Key: HKCU\Software\TNT Software\<product>\<version>\Wizard\Settings\SnmpRootOID Value: ".1.3.x.y.z" Type: String Value Where: <product> is either ELM Enterprise Manager, ELM Log Manager or ELM 41

48 Performance Manager <version> is the product's major version (e.g., 3.0) x.y.z is the root branch you want. How To Create an SNMP Monitor» To create an SNMP OID Monitor: 1. Right-click on the Monitor Items container in the ELM Console and select All Tasks New Monitor Item. The Create Monitor Wizard will appear. Click Next to continue. 2. Select SNMP Monitor from the Monitor Type dropdown and click Next to continue. ELM Enterprise Manager will verify the existence of the required SNMP subsystem files. If those files are not present, an error message will appear and you will not be able to continue. 3. The SNMP Monitor dialog will appear. Enter the name of the Host Computer you want to monitor. Enter the name of the Community to which the Host Computer belongs. Click the Display Options from Computer/Community button. This will cause the Object Name dropdown to be populated with the OIDs from this Host Computer. Select the OID you want to use in the query, along with the condition and value you want to match. You can also specify a timeout threshold and number of retries for this monitor item. 4. Click Next to continue. The Monitor Action dialog will appear. When the state, value or condition of a monitored item changes, you can specify what Actions are to be taken. Select the Monitor Action(s) you want to use and click Next to continue. 5. The Test Monitor dialog box will appear. Select the Action or condition you want to test and the Agent you want to test against. Then, click the Start Test button. 6. Click Next to continue. The Schedule dialog box will appear. On the Scheduled Interval tab, set the frequency at which you want to execute this SNMP Monitor. On the Scheduled Hours tab, configure the hours and days you want this SNMP Monitor active. 7. Click Next to continue. Enter a Name and Description and if desired, check the Make this a default selection for new items checkbox. 8. Click Finish to save the Monitor Item. 9. Click OK to acknowledge the item creation. 42

49 SQL Server Monitor Using SQL Monitors, you can periodically execute SQL queries against a database and generate a variety of actions and notification options if the results returned are different from what is expected. SQL Monitors support both Windows and SQL Server authentication, enabling you to deploy them in your environment without having to modify your security architecture. How To Create an SQL Monitor» To create an SQL Monitor: 1. Right-click on the Monitor Items container in the ELM Console and select All Tasks New Monitor Item. The Create Monitor Wizard will appear. Click Next to continue. 2. Select SQL Monitor from the Monitor Type dropdown and click Next to continue. 3. Enter a Name and Description and click Next to continue. 4. The SQL Database Monitor dialog box will appear. Enter the query you want executed. 5. Click Next to continue. Enter the Username and Password used to access the SQL Server. If you are using integrated Windows authentication, check the Use Integrated Logon check box. 6. Click Next to continue. The Monitor Action dialog will appear. When the state, value or condition of a monitored item changes, you can specify what Actions are to be taken. Select the Monitor Action(s) you want to use and click Next to continue. 7. The Test Monitor Item dialog box will appear enabling you to test the SQL Monitor before using it. To do this, select an Agent on from the Agent dropdown and click the Start Test button. 8. Click Next to continue. The Agents dialog box will appear. Check the checkbox for each Service Agent to which you want to apply the SQL Monitor. 9. Click Next to continue. The Schedule dialog box will appear. On the Scheduled Interval tab, set the frequency at which you want to execute this SQL Monitor. On the Scheduled Hours tab, configure the hours and days you want this SQL Monitor active. 10. Click Finish to save the SQL Monitor. TCP Port Monitor You can monitor any valid TCP port using a TCP Port Monitor item. Because the ELM Server (and not an Agent) makes the actual connection to the port, you can monitor TCP port availability on any operating system (e.g., Unix, Linux, vell, Solaris, etc.), provided that you have TCP/IP connectivity to that system from the ELM Server. Each TCP Port Monitor can poll a single port. There are a couple parameters for the TCP Port Monitor items that you can specify: Port. This is the port you want to monitor. Warn if slower than seconds. In addition to checking availability, you can also monitor your port's response time. By specifying a value for this field, you can cause a warning message 43

50 to be generated whenever the response from the port exceeds the threshold you specify here. Continue to warn after first failure. By default, ELM will notify you once when the port is unavailable. By checking this box, you can specify that a message be sent at each interval that the port is checked. How To Create a TCP Port Monitor» To create a Generic TCP Port Monitor: 1. Right-click on the Monitor Items container in the ELM Console and select All Tasks New Monitor Item. The Create Monitor Wizard will appear. Click Next to continue. 2. Select TCP Port Monitor from the Monitor Type dropdown and click Next to continue. 3. Enter a Name and Description and click Next to continue. 4. The Generic TCP Monitor dialog box will appear. a. In the Port field, enter the port number you want to monitor. b. In the Warn if slower than field, enter the quality of service threshold in seconds. c. If you want continuous warnings after the first warning is sent, check the box that says Continue to notify after first failure. 5. Click Next to continue. The Monitor Action dialog will appear. When the state, value or condition of a monitored item changes, you can specify what Actions are to be taken. Select the Monitor Action(s) you want to use and click Next to continue. 6. The Test Monitor Item dialog box will appear enabling you to test the Port Monitor before using it. To do this, select an Agent on from the Agent dropdown and click the Start Test button. 7. Click Next to continue. The Agents dialog box will appear. Check the checkbox for each Service Agent to which you want to apply the Port Monitor. 8. Click Next to continue. The Schedule dialog box will appear. On the Scheduled Interval tab, set the frequency at which you want to execute this Port Monitor. On the Scheduled Hours tab, configure the hours and days you want this Port Monitor active. 9. Click Finish to save the Port Monitor. Web Page Monitor Web Page Monitors are used to monitor web pages (HTTP and HTTPS). The system to which the Monitor Item is assigned (e.g., ELM Server or Agent) will periodically fetch the specified URL. If the response is negative, slower than expected, or if the content has been changed, a variety of notification options and Actions can be triggered. The following fields are available on the Web Page Monitor Wizard dialog box: URL. This is the URL you want to monitor. It can be an HTTP or HTTPS URL. By default, HTTP communication occurs over TCP port 80 and HTTPS communication occurs over TCP port 443. If you are using a different port, you can specify that port as part of the URL. For example, to monitor a web page on that is listening on port 8080, you would use the 44

51 following URL: Warn if slower than seconds. In addition to checking availability, you can also monitor your Web server's performance by monitoring how quickly a response is returned. By specifying a value for this field, you can cause a warning message to be generated whenever the response from the Web server exceeds the quality of service threshold you specify here. Username. If you need to specify a username and password to access the URL listed in the URL field, you can enter that username in this field. te If you are accessing the URL via a proxy server, this is NOT the username used for Proxy server or firewall authentication. This username is for the Web server that contains the URL being monitored only. Password. This is the password for the account specified in the Username field. Continue to warn after first failure. By default, ELM will notify you once when the Web server is unavailable. By checking this box, you can specify that a message be sent at each interval that the Web server is checked and found to be unavailable. Warn if content changes. Check this box to cause a warning to be generated if the content of the monitored URL is different from the last time the Web Page Monitor retrieved the URL. Run At Server. By checking this box, the Web Page Monitor will always be executed on the ELM Server by the ELM Server service account. If you leave the box unchecked, the Web Page Monitor will be executed on the assigned Agents by the Agent's service account. Proxy Server. If the ELM Server or Agent need to access the monitored URL through a proxy server, enter the name, fully-qualified domain name or IP address of the proxy server in the Proxy Server field. Enter the appropriate port for the proxy server in the Proxy Port field. How To Create a Web Page Monitor Web Page Monitors are used to monitor HTTP and HTTPS URLs. The ELM Enterprise Manager Server periodically establishes an HTTP connection to the server and port specified. If the response is negative, slower than expected, or if the content has been changed, a variety of notification options can be triggered. te that Web Page Monitors do not need to be assigned to Agents. Therefore, you can create as many Web Page Monitors as you like, regardless of how many Agents you are using or Agent licenses you have purchased. However, if you want an Agent to execute the Web Page Monitor, then you must assign the Web Page Monitor to an Agent.» To create a Web Page Monitor: 1. Right-click on the Monitor Items container in the ELM Console and select All Tasks New Monitor Item. The Create Monitor Wizard will appear. Click Next to continue. 2. Select Web Page Monitor from the Monitor Type dropdown and click Next to continue. 3. Enter a Name and Description and click Next to continue. 4. The Web Page Monitor dialog box will appear. a. In the URL field, enter the URL you want to monitor. By default, ELM Enterprise Manager will attempt to connect to this URL using TCP port 80 for HTTP connections and TCP port 443 for HTTPS connections. If the Web server is listening on something other than these ports, you can specify the port as 45

52 part of the URL (e.g., b. In the Warn if slower than field, enter the quality of service threshold in seconds. c. If you want to be notified if the content of the URL changes, check the Warn if content changes checkbox. d. If authentication is required for access to the URL being monitored, you can specify an authorized account in the Username and Password fields. e. If you want continuous warnings after the first warning is sent, check the box that says Continue to warn after first failure. f. If you want the Web Page Monitor executed by the ELM Server, check the Run at Server checkbox. Otherwise, leave this box unchecked, and assign the Web Page Monitor to the desired Agents. 5. Click Next to continue. The Monitor Action dialog will appear. When the state, value or condition of a monitored item changes, you can specify what Actions are to be taken. Select the Monitor Action(s) you want to use and click Next to continue. 6. The Schedule dialog box will appear. On the Scheduled Interval tab, set the frequency at which you want to execute this Web Page Monitor. On the Scheduled Hours tab, configure the hours and days you want this Web Page Monitor active. 7. Click Finish to save the Web Page Monitor. WMI Monitor The WMI Monitor periodically queries the Windows Management Instrumentation database, alerting you when the results of the query change. Windows Management Instrumentation (WMI) is Microsoft's implementation of a Web-Based Enterprise Management (WBEM)-compliant model that supports uniform system and applications management. WMI is based on the Common Information Model adopted by the Distributed Management Task Force. WMI is a key component of Microsoft Windows management services, and an integral part of Windows 2003, Windows 2000, and Windows XP. WMI is also available for Windows NT from here. Monitoring with a WMI monitor item is accomplished using a query of the WMI namespace (typically root\cimv2). This query, which you must manually formulate and enter, can be created using VBScript or JScript. In the Namespace field, enter the name of the WMI namespace that you want to query. te We recommend that you leave this at the default setting. Unless you have manually changed your WMI namespace, the default for Windows systems is root\cimv2. In the Query field, enter the query you wish to execute. 46

53 The first time the query is run, the results are logged. If on any subsequent query the results are different, you can trigger one of several Actions: an Alert, a customizable Warning event in the Application log, a customizable network message, or a batch file, executable or script. How To Create a WMI Monitor If you are using Windows Management Instrumentation--the Microsoft implementation of Web-Based Enterprise Management (WBEM)--you can use WMI Monitors to query a WMI namespace and database. If the results of the query change, a variety of notification options can be executed. WMI monitor items periodically query the Windows Management Instrumentation database and generate alerts when the results of the query change.» To create a WMI Monitor: 1. Right-click on the Monitor Items container in the ELM Console and select All Tasks New Monitor Item. The Create Monitor Wizard will appear. Click Next to continue. 2. Select WMI Monitor from the Monitor Type dropdown and click Next to continue. 3. Enter a Name and Description and click Next to continue. 4. The Windows Management Instrumentation Monitor dialog box will appear. a. In the Namespace field, enter the name of the WMI namespace that you want to query. Unless you have manually changed your WMI namespace, the default for Windows systems is root\cimv2. b. In the Query field, enter the query you wish to execute. The first time the query is run, the results are logged. If on any subsequent query the results are different, you can trigger one of several notification methods: an Alert, a customizable Warning event in the Application log, a network message or a batch file, executable or script. 5. Click Next to continue. The Monitor Action dialog will appear. When the state, value or condition of a monitored item changes, you can specify what Actions are to be taken. Select the Monitor Action(s) you want to use and click Next to continue. 6. The Test Monitor Item dialog box will appear enabling you to test the WMI Monitor before using it. To do this, select an Agent on from the Agent dropdown and click the Start Test button. 7. Click Next to continue. The Agents dialog box will appear. Check the checkbox for each Service Agent to which you want to apply the WMI Monitor. 8. Click Next to continue. The Schedule dialog box will appear. On the Scheduled Interval tab, set the frequency at which you want to execute this WMI Monitor. On the Scheduled Hours tab, configure the hours and days you want this WMI Monitor active. 9. Click Finish to save the WMI Monitor. Monitor Item Actions In ELM Enterprise Manager, many Monitor Items all include the ability to generate notification and/or execute Actions. There are four Actions that can be executed by a Monitor Item: Create a New Alert Entry 47

54 Create an Application Event Log Entry Send a Network Message Run a command When the state of a monitor item changes, you can specify what actions are to be taken. These actions - also called tification Methods - are intended to alert an administrator to the monitor item state change, take corrective action, or both. You have four actions that are available to you: Create New Alert Entry. Selecting this checkbox to cause an Alert to be generated and posted to the Alerts container within the Console snap-in. Create Application Event Log Entry. Selecting this enables you to cause a customizable event to be logged to the Application log on the ELM Server. Net Send Message. Using this option enables you to send a popup message over the network. The target system must have the Messenger Service (Windows NT, Windows 2000, Windows 2003, or Windows XP) or WinPopUp (Win9x/WinMe) running in order to receive the Net Send Message. Use the Browse button to browse for a target computer, or manually enter the name of the computer to which you want to send messages in the Computer Name field. te The Message field that appears on this dialog applies to the above actions. Use the Variables button to specify any additional variables you want the event to include. Run Command. This option provides a mechanism for executing a batch file, running a command line application or launching a script (CScript or WScript). Use the Edit button to create and edit any scripts or command line parameters you want to execute. As illustrated below, Actions occur based on a Monitor Item s result. For example, if an event is not found in the event log, the Event Alarm can send a network popup message to an administrator s workstation. 48