Legal Notices

Copyright 2011 All rights reserved. Under the copyright laws, this manual or the software described within, can not be copied, in whole or part, without the written consent of the manufacturer, except in the normal use of the software to make a backup copy. The same proprietary and copyright notices must be affixed to any permitted copies as were affixed to the original. This exception does not allow copies to be made for others, whether or not sold, but all of the material purchased (with all backup copies) can be sold, given, or loaned to another person. Under the law, copying includes translating into another language or format. Specifications and descriptions subject to change without notice. Trademarks Quest, Quest Software, the Quest Software logo, are trademarks and registered trademarks of Quest Software, Inc in the United States of America and other countries. For a complete list of Quest Software's trademarks, please see http://www.quest.com/legal/trademarks.aspx. Other trademarks and registered trademarks are property of their respective owners. The name Quest Networks, the software, the product name sl360 Tool Suite, Foglight NMS, Foglight, Perspective, and the PacketTrap logo are registered trademarks of Quest Software. PacketTrap Networks (the Software) is copyright 2011 by PacketTrap Networks, a division of Quest Software. All rights are reserved. Microsoft Windows 98, Windows NT, Windows 2000, Windows XP, Windows Server 2003, Vista, Windows 7, Internet Explorer, and Active Directory are trademarks or registered trademarks of Microsoft Corporation. Adobe, Acrobat, and Acrobat Reader are either registered trademarks or trademarks of Adobe Systems Incorporated in the U.S. and/or other countries. Firefox is a trademark of the Mozilla Foundation.

Other product and company names mentioned herein may be trademarks and/or registered trademarks of their respective companies and are the sole property of their respective manufacturers.

Contents
Legal Notices Contents Overview About Foglight NMS What's New in Foglight NMS Using the Quest Foglight NMS Community Contacting Support Getting Started System Requirements Things to Consider Before You Install Foglight NMS Host Server Hardware and Software System Requirements Device and Collection Agent System Requirements Foglight NMS Studio System Requirements SQL Server System Requirements Installing Foglight NMS on a Virtual Machine Logging in to the Foglight NMS Studio Configuring Your SMTP Settings Setting Up Foglight NMS How to Set Up Foglight NMS Adding Sites Adding Groups Enabling Devices for Monitoring 2 4 9 9 9 10 11 13 13 14 15 17 18 18 20 21 22 23 23 24 25 26

Enabling SNMP on a Device Enabling WMI on Windows Devices

Updating Your Version of Foglight NMS Running Network Discovery Pre-Network Discovery Checklist Adding Devices by SNMP Network Discovery Techniques Setting Device Credentials for Network Discovery Adding Devices by Deploying Agents Benefits of Deploying an Agent Installing Agents Manually

28 28
29 31 32 33 34 36 37 38 39

Managing Credentials Applying Smart Policies to Devices Monitoring Devices Monitoring Your Devices By SNMP Monitoring Your Devices by WMI Monitoring Your Devices by Deploying Agents Collecting Syslog, NetFlow, and SNMP Traps Data Using Dashboards Touring the Dashboard View User Interface Customizing Your Dashboard About Gadgets Adding Dashboard Tabs Adding Gadgets to Your Dashboard Editing a Gadget Creating Custom Gadgets Managing Devices Viewing the Current Logged-on User Displaying the Current Logged-on User Viewing the Logged-on User History Monitoring Current Logged-on User for Windows Troubleshooting: How do Isolve the "access denied" error when I use qwinsta.exe/rwinsta.exe or WTSOpenServer Windows API function? Monitoring Data from a Cisco Wireless Access Controller Viewing the Wireless Controller Dashboard Creating Custom Reports for Wireless Access Controllers Connecting Remotely to Devices- Overview Using ExpertAssist Managing Devices Using a Web Proxy

40 41 43 43 44 45 48 50 51 52 53 58 59 61 61 64 64 65 67 69 70 72 73 73 75 75 76

Troubleshooting: How do IAccess Devices That Use Java When Google Chrome Times Out? 77
Configuring the Remote Control Settings Collecting Real-time Data Using Go Live! Verifying the Device Monitor Status Deciphering Error Codes Viewing the Details of a Device Monitoring Avaya VoIP Systems 78 78 79 79 85 86

Preparing the PBX Configuring RTCP Monitoring Configuring CDR Monitoring Adding Node Names Adding an IP CDR Service Setting CDR System Parameters Enabling Intra-switch CDRs Enabling CDR Reporting for Trunk Groups Monitoring Avaya IP Office Systems Avaya IP Office VoIP Systems - Overview Understanding Avaya IP Office Modules Configuring Modules for Avaya IP Office Systems Monitoring Avaya Aura Communication Manager Systems Avaya Aura VoIP Systems - Overview Understanding Avaya Aura Modules Configuring Modules for Avaya Aura Systems Analyzing Traffic Flow Data How Foglight NMS Collects Network Traffic Flow Data Enabling NetFlow Enabling ptFlow Viewing Traffic Flow Information How to Scope Your NetFlow Traffic Data Understanding the Various Groups of Traffic Flow Information Seeing How Traffic Flow Information is Trending Managing Policies Adding New Policies Adding Devices to New Policies Adding Monitors to New Policies Editing Policies About Monitors in Policies Removing Policies Migrating Devices from the Default Policy Creating Custom SNMP Monitors Installing the SNMP MIB Library Creating Custom SNMP Monitors Adding Custom SNMP Monitors from the MIB Browser

87 87 89 90 91 92 93 94 95 95 96 97 99 99 100 102 104 105 105 107 112 114 115 117 120 121 122 122 123 126 132 132 134 136 137 138

SNMP Walking the Device Manually Adding Custom SNMP Monitors Adding Custom SNMP Monitors to Policies Removing Custom SNMP Monitors from Policies Editing Custom SNMP Monitors Deleting Custom SNMP Monitors Viewing Custom SNMPMonitor Details Setting Up Alerts Adding Alerts Escalating Alerts Managing Alert Notification Rules Adding Monitoring Templates to Policies Available Monitoring Templates in Foglight NMS Setting Up Alerts for Custom SNMP Monitors Creating and Running Scripts Understanding Script Types Importing Scripts to Foglight NMS Exporting Scripts from Foglight NMS Patch Management Adding New Patch Management Groups Generating Reports Running Reports Changing Devices in a Report Changing the Report Period Changing the Report Type Creating Custom Reports Scheduling Reports Emailing Reports Exporting Reports Network Maps Touring the Network Map Editor User Interface Creating a Network Map Adding Devices to a Network Map Adding Groups Copying Network Maps

139 142 143 144 145 147 148 151 151 153 154 155 156 163 165 166 166 167 169 169 171 171 173 174 174 175 178 179 180 181 181 183 185 185 186

Editing Your Network Maps Setting the Background Resetting the Background Rebuilding Relationships Deleting Network Maps Updating the Network Map Layout Foglight Native Integration STEP 1: Installing the Dependency Mapping Cartridge STEP2: Installing the NMSAgent Cartridge STEP3: Deploying the NMSAgent STEP4: Selecting the Devices in Foglight NMS for Integration Removing Legacy Foglight Integration Viewing Alerts in FMS Viewing NetFlow Traffic Data in FMS Viewing a Device's Performance in FMS Administration Agent Migration Auto Patch Settings Baseline Configuration Branding Configuration Checking for Updates Flow Configuration License Update Log Alert Configuration Port Management Retention Configuration SMTPSettings Studio Deployment Switching to the New Database User Management Web Service Entry Point API Overview Migrating Your Database Important Information You Should Know Before You Migrate the Database Migrating SQL CE to SQL Server Standard or Enterprise Migrating from SQLServer Standard or Enterprise Index

187 190 191 191 192 192 193 194 195 196 197 198 199 199 200 202 203 203 204 205 205 206 206 207 207 208 208 209 209 210 210 212 212 213 213 i

Overview
About Foglight NMS Foglight Network Management System (NMS) is a robust and complete network monitoring solution that allows you to thoroughly and efficiently manage your network. It is capable of monitoring networks of all sizes, across one or more sites, from small corporate LANs to large enterprises or highly distributed environments. Foglight NMS automatically discovers key metrics for network resources, such as hardware, operating systems, virtual infrastructure, databases, middleware, applications, and services. You can then use this information to easily and quickly pinpoint and diagnose network issues.

What's New in Foglight NMS These features are new to Foglight NMS in this release.
l

Avaya Monitoring Support As a network professional with increased responsibility and continually evolving technology, you may experience the challenge of effectively monitoring VoIP systems. You worry that you have adequate visibility into how your IT infrastructure and VoIP systems are working together and may use any number of point tools to manage and monitor them. StillVoIP implementations often suffer from dropped calls, poor voice quality, and other issues. How do you create the most efficient VoIP monitoring environment, enhance user satisfaction and meet SLAs? Foglight NMS provides in-depth and detailed monitoring of VoIP quality metrics like MOS, Jitter, packet-loss, delay, network utilization and comprehensive set of reports and alerts on all VoIP related voice metrics.

Monitoring for Cisco Wireless Access Controller Devices like Cisco wireless controllers are being used increasingly more to manage all the wireless access points, instead of individually managing access points. Now Foglight NMS has the capability to provide the deep monitoring stats that you are used to at the access point level through a central wireless controller. Out of box monitoring includes: health status, access points managed and their performance, and who is connected to what device.

Application Monitoring Template Ease of use and out of box configuration is a critical foundation piece for Foglight NMS. This exciting new feature automatically groups monitors, alerts, and actions to completely monitor and manage applications. This one-click setup dramatically simplifies configuration time and allows you to spend your time on other projects. You can use a monitoring template across global policies, site policies, or on a particular device.

One-click Help and Tutorial Videos IT infrastructure management is difficult and complex. Our goal is to provide you with resources at your fingertips to help you quickly find answers to your questions. Weve taken a leap forward in 6.2 with a newly launched Knowledgebase that is directly linked from features and configuration screens. With a single-click you can peruse topics in the new Foglight NMS Knowledgebase or you can get feature-specific help from anywhere in the product.

Foglight Native Integration Foglight NMS is now the network monitoring agent for the Foglight Management Server and provides the deep monitoring of network devices and traffic analysis that impacts application performance. Critical metrics of routers, switches and other network gear are sent, stored, and reported on in the Foglight UI.

Importing and Exporting Scripts You can import and export a large number of scripts to/from Foglight NMS. Scripts that you select to import or export must be formatted in XML.

Network Map Enhancements Visual representation of the IT infrastructure is a quick and easy way to identify the root cause of many problems. This release of Foglight NMS has two new improvements for Network Maps: o Ability to show or not show connected devices for the devices already on the map. For example, you can now choose to not show a core switch that is connected to a device.
o

Update the map layout when devices are added or removed. You can drag and drop devices to specific areas on the map and they will not change unless you select this new option.

Using the Quest Foglight NMS Community The Quest Foglight NMS Community is a resource for users to find answers, share ideas, and upload documents. It is a great resource if you are looking for solutions to common questions or

would like to share best practices. You can access the community the following ways:
l

From the Foglight NMSStudio, click the Community button in the main menu. Go to http://communities.quest.com/community/foglight/nms

Registering for the Community If you are new to the Quest Community, click here to create a new account. Your new account allows you to comment on discussions, post documents, and participate in other Community features. If you have an account on Quest.com, click here to log in to the Community with your email address and Quest.com password. You can create a community profile and get started on the community from there.

Contacting Support Support for Foglight NMS is available to sites who have purchased Foglight NMS. You can contact support in the following ways:
l

Email: foglightnmssupport@quest.com Phone: (949) 754-8000, press option 1 or (800) 306-9329 Community: http://communities.quest.com/community/nms Knowledgebase: http://communities.quest.com/community/nms/knowledgebase?view=overview

When you send an email to the Support team, it is recommended that you include "Foglight Network Management System" in the subject line along with a brief description of the issue or question. You should include as many details as possible about the issue, including your contact information, and any other relevant details in the body of the email. Quest Support will create a support ticket and you will receive an email about your case. If you are updating a support case or ticket, you should include the following string in the subject line of your email: "CaseID:8xxxx" where "8xxxx" is your case number that you wish to

update. Keep in mind the string is case sensitive (capital C, I, and D) and there are no spaces. If you follow the syntax protocol, the case will be updated and the support representative will receive an email with your update. Foglight NMSCommunity If you are using the free version of Foglight NMS, you are encouraged to visit the Foglight NMScommunity at to get solutions to questions that you have, share ideas, or view and download documents. To access the community, go to http://communities.quest.com/community/nms. Foglight NMS Knowledgebase You can also visit the Foglight NMSKnowledgebase to see detailed instructions on how to use the features in Foglight NMS. You can access the knowledgebase by going to http://communities.quest.com/community/nms/knowledgebase?view=overview.

Getting Started
This section provides you with an overview setting up customer profiles, deploying the Foglight NMS agent (ptagent) to your customers network, and discovering your devices. You will also learn more about the Foglight NMS architecture, as well as receive an introduction to some of the main features in Foglight NMS.
Topics in this section
l

Foglight NMS Features Overview How to Set Up Foglight NMS Logging in to the Foglight NMS Studio Configuring Your SMTP Settings Pre Network Discovery Checklist Managing Credentials Setting Up Foglight NMS

System Requirements This section contains information on the minimum system requirements for Foglight NMSFoglight NMS. Before you can begin to download Foglight NMSFoglight NMS, you must make sure that your computer meets the minimum system requirements. This document contains information on the minimum system requirements for Foglight NMSFoglight NMS. Before you can begin to download Foglight NMSFoglight NMS, you must make sure that your computer meets the minimum system requirements.
Topics in this section
l

Things to Consider Before You Install Foglight NMSFoglight NMS Host Server Hardware and Software System Requirements Device and Collection Agent System Requirements Foglight NMSFoglight NMSStudio System Requirements

SQL Server System Requirements Installing Foglight NMSFoglight NMSon a Virtual Machine

Things to Consider Before You Install Foglight NMS Installing Foglight NMSFoglight NMS with the default monitor settings, this basic type of installation will perform well on a Dual-Core system with 4 GB of RAM. If you adjust the policies to monitor larger networks or use the Network Traffic Flow module, you need to consider which hardware and system configuration you plan to use. As shown in the tables in the following sections, the minimum system requirements are dependent upon the number of devices that you are monitoring. You must consider the following scalability issues before installing Foglight NMSFoglight NMS:
l

Number of monitored devices: If you monitor 500 or more devices, you may need to do some performance tuning on your system. Amount of data collected for each device: If you increase the number of monitors on a device, a spike in the amount of data collected will occur. Changing the default time intervals: If you set a time interval to collect data every five minutes, using a high performance server is recommended to complete the data collection in an efficient and timely manner. Number of Studio connections: A large number of Studio connections simultaneously accessing the system will impact performance.

To optimize performance when collecting traffic analysis data, it is recommended that you use a dedicated high performance server when the following conditions exist:
l

You configure the application to collect Traffic Flow data from multiple routers or switches. There exists a large amount of traffic conversations. You set up the application to monitor more than 500 devices.

Host Server Hardware and Software System Requirements See the following table for the minimum hardware and software system requirements for your host server. Updating Your .Net Framework Before you can install Foglight NMS, you must upgrade your .Net framework to version 4.0 or higher. When you install Foglight NMS, if you have not upgraded your .Net framework to version 4.0 or higher, the Foglight NMS installer will automatically update your target server. You will see a message indicating that the .Net framework is being upgraded. NOTE: Keep in mind that updating the.Net 4.0 framework on your target server will take several minutes to complete. When the Next button becomes active, you can proceed with completing your product installation. If you are working offline (with no Internet connection available), you must first manually upgrade your server to .Net 4.0 or higher in order to continue with your installation of Foglight NMS. Updating Your Server to SQL Server Standard or Enterprise Edition When you download Foglight NMSFoglight NMS, the application comes with an optimized version of SQLCE installed. This optimized version works whenyou are trying out Foglight NMSFoglight NMSand supports no more than 20 devices at default monitor settings and 1 traffic flow device. If you are monitoring more than 20 devices or running the application in your production environment, you must install Foglight NMSFoglight NMS on SQL Server Standard or Enterprise Edition. NOTE: The following minimum requirements apply when you install the default configuration. Significantly increasing the device monitoring intervals and network traffic collection may cause an additional load on the server, which may require you to increase your RAM and upgrade your CPU power.
Host Server System Requirements

Operating System

For 32-bit or 64-bit:

l

Microsoft Windows 2003 SP2 or later

Host Server System Requirements

l

Microsoft Windows 2008 Server

CPU Memory

Dual Core, 3.0 GHz or higher (Recommended) 4 GB RAM NOTE: You will need to increase the amount of memory based on the high-volume data that you are collecting, such as netflow, syslog, and windows event logs.

Hard Drive Space

50 GB NOTE: You will need a minimum of 3 GB of free space to install the SNMP MIB Library. NOTE: You will need to increase your hard drive space based on the retention settings.

.Net Framework Firewall Exceptions Allowed Programs

Version 4.0 or higher The following are automatically configured during installation:
l

ptserverservice ptagentservice ptstudio

Ports

The following are the firewall rules for inbound connections:

l

5053 (TCP) = (SSL Encrypted Host Server port) 5054 (TCP) = Agent deployment CAB file downloads 5055 (TCP) = (128 AES Encrypted Remote Control Tunnel port) 161 (UDP) SNMP Trap collector 69 (UDP) - TFTP Server 514 (UDP) - Syslog collector 2055 (UDP) NetFlow collector 6343 (UDP) sFlow collector 9555 (UDP) - NetFlow Alternative port #2 collector 9995 (UDP) NetFlow Alternative port #3 collector

Host Server System Requirements

Device and Collection Agent System Requirements See the following table for the minimum hardware and software system requirements for your host server in order to deploy device and collection agents on it. NOTE: When you install a collection agent on Microsoft Windows XP or Microsoft Vista, the limited TCP connections available with these operating systems may impact the monitoring performance. It is recommended that you use Windows Server 2003 or Windows Server 2008 when possible.
System Requirements for Device and Collection Agents

Operating System

For 32-bit or 64-bit:

l

Windows Server 2003 SP2 or later Windows Server 2008 Windows XP SP2 or later Windows Vista SP1 (all versions) Microsoft Windows 7 Ubuntu Server 8 Fedora release 10 Debian 4.0 OpenSuse 11.0 Apple Mac OS X

NOTE: Windows Server 2003 or Windows Server 2008 is required if you are collecting Syslog, NetFlow, ad SNMP Traps data. .Net Framework Ports Version 4.0 or higher The following are the firewall rules for inbound connections:

System Requirements for Device and Collection Agents

5053 (TCP) = (SSL Encrypted Host Server port) 5054 (TCP) = Agent deployment CAB file downloads 5055 (TCP) = (128 AES Encrypted Remote Control Tunnel port) 161 (UDP) SNMP Trap collector 69 (UDP) - TFTP Server 514 (UDP) - Syslog collector 2055 (UDP) NetFlow collector 6343 (UDP) sFlow collector 9555 (UDP) - NetFlow Alternative port #2 collector 9995 (UDP) NetFlow Alternative port #3 collector

Foglight NMS Studio System Requirements You can use the following operating systems and browsers to run the web version of the Foglight NMSFoglight NMS Studio.
l

Microsoft Windows (all versions) Microsoft Internet Explorer 6 or later Mozilla Firefox 3.6 Google Chrome

SQL Server System Requirements See the following table for the minimum SQL Server system requirements. When you download Foglight NMSFoglight NMS, the application comes with an optimized version of SQLCE installed. This optimized version works whenyou are trying out Foglight

NMSFoglight NMSand supports no more than 20 devices at default monitor settings and 1 traffic flow device. If you are monitoring more than 20 devices or running the application in your production environment, you must install Foglight NMSFoglight NMS on SQL Server Standard or Enterprise Edition. NOTE: When you create user account, you need to create a SQL Server login with the db-owner database role on the Foglight NMS database.
System Requirements for SQL Server

Database

For 32-bit or 64-bit:

l

Microsoft Windows SQL Server 2005 Standard or Enterprise Editions Microsoft Windows SQL Server 2008 Standard or Enterprise

CPU Memory

Dual Core, 3.0 GHz or higher (Recommended) 4 GB RAM NOTE: You will need to increase the amount of memory based on the high-volume data that you are collecting, such as NetFlow, syslog, and windows event logs.

Hard Drive Space

50 GB

Additional Hardware Requirements for SQL Server If you choose to run SQL Server on a separate machine from your Foglight NMSFoglight NMSserver, the following requirements apply:
l

You must install SQL server on a physical machine. You must have a minimum of 4 GB of RAM. You must use SQL authentication instead of windows authentication.

If you have SQL Server running on the same box as the Foglight NMSFoglight NMSPlatform Server, it is recommended that you limit the amount of installed memory that SQL Server consumes.

4 GB RAM -> 2 GB RAM 8 GB RAM-> 5 GB RAM 16 GB RAM->12 GB RAM

If your machine is collecting traffic and log data, the following minimum system requirements apply:
Additional Requirements

Operating System Perspective Agent Service Perspective Service Additional RAM per Netflow Device(s) Additional RAM per Netflow Device(s)

2 GB 1 GB 1 GB NoOfFlowDevices * 300MB 1 GB

Installing Foglight NMS on a Virtual Machine Because of intense I/O requirements and a high threshold of additional hardware specifications, installing Foglight NMSFoglight NMS on a virtual machine in a production environment is not recommended. You should install Foglight NMSFoglight NMS in a testing environment to ensure that you, your colleagues, and your sites have the best user experience possible. The following items are the minimum hardware and software system requirements when installing Foglight NMSFoglight NMS on a virtual machine (VM).
l

Operating System: For 64-bit, both Windows Server 2008 or Windows Server 2008 R2 are recommended. You can use Microsoft Windows 7; however, it is not officially supported. CPU: Two physical cores dedicated to perspective VM (no hyper-threading core). Memory: 4 GB RAM. NOTE: If you install SQL server, you must include an additional 4 GB RAM.

You must provide a minimum of 100 MBs of bandwidth dedicated.

You must make sure that your VM is using a physical partition rather than a virtual harddisk.

Logging in to the Foglight NMS Studio After you successfully install Foglight NMS and launch the Studio, you will need the default information to log in to the system:
l

Username: Admin Password: Password

In the Host And Port field , type a valid DNS name or IP address. NOTE: The DNS name is the name of the machine on which you installed Foglight NMS. It is strongly recommended that you use a DNS name instead of an IP Address.

You should also keep the following items in mind before you start to use Foglight NMS:
l

Make sure that you open ports 5053 and 5054 and check that no other application or process is using these ports.

Verify that the Foglight NMS server has been started in Windows Services. You must manually start the service if it is not already started.

Configuring Your SMTP Settings When you first log in to the Studio, the Let's Get Started window appears. This window allows you to set up your administrator account information and configure your SMTP settings. This information is important when it comes to receiving alert notifications and reports that you schedule in Foglight NMS. Alerts and reports are critical components of your business, which keep you informed about network events and issues that may occur. By configuring your SMTP settings, where you will identify the SMTP server name and port and provide the appropriate authentication information (if necessary), these alerts and reports are sent to your email address when they happen. It is recommended that you set up your SMTP settings in the Let's Get Started window; however, you do have the option to set it up at a later time by clicking Configuration -> Administration -> SMTP Settings. To configure the SMTP settings 1. Click Configuration -> Administration -> SMTP Settings 2. In the SMTP Server field, type the name of your SMTP server. 3. In the SMTP Port, type the port number. The default port is 25. 4. If your SMTPserver requires authentication, do the following in the Authentication section:
l

Type the username, password, and domain name to allow Foglight NMS access to the SMTP server.

5. If your email server requires secure socket layer (SSL) encryption, select the Enable SSL check-box. 6. (Optional) In the Send Test Email Message field, type your email address and click Send to verify that you have properly configured your SMTP settings. You will receive a test email shortly thereafter. 7. Click OK to save your changes.

See Also
l

Adding Alerts Scheduling Reports

Setting Up Foglight NMS This section will show you more about getting Foglight NMS up and running.
Topics in this section
l

How to Set Up Foglight NMS System Requirements Adding Sites Adding Groups Enabling Devices for Monitoring

How to Set Up Foglight NMS There are a couple of factors that you must keep in mind when setting up your product:
l

It is recommended that you assign a public DNSto your product platform server instead of using an IP address. Make sure you open the correct outbound and inbound firewall ports. For more information, click here.

The following diagram shows how your product monitors and collects data from your devices and sends it to your Foglight NMS platform server.

See Also System Requirements Enabling Devices for Monitoring

Adding Sites

When you have new sites, you can create profiles for them in Foglight NMSFoglight NMS and then run network discovery to discover the devices in their networks. To create a new sites

1. In the Foglight NMSStudio, click New -> Organization. 2. In the Editor dialog box, type a name and description for the site. This information will appear in the Devices View. 3. Type the host name of the remote site. It is recommended that you use the DNS name of your host; however, you can use the IP address. 4. Click Save. 5. Click Copy URL to download the agent software or click Email URL to send the link to the machine where you want to install the collection agent on the remote site. NOTE: Every remote site needs an agent deployed to it. You will be prompted to select a polling agent or to manually install one. A polling agent is the agent the connects back to your platform server. For more information, see Installing Agents Manually.

To add devices to your new site 1. In the Devices View, select the new site in the Organization drop-down list. 2. Click Add New Devices. 3. Go through the screens of the Network Discovery wizard to discover the devices in a site's network.

See Also
l

Adding Devices by SNMP Adding Devices by Deploying Agent

Adding Groups

You can create multiple groups to organize the various types of devices in a network. For example, you can group similar devices together, such as adding all the desktops in a network to a group called "Desktop". To add a new group

1. In the Foglight NMSFoglight NMS Studio, New -> Group. 2. In the Add a New Group dialog box, type a name for the group.

3. In the Edit Group dialog box, click Add Device Member to start adding devices to the group. 4. In the Select New Device Members, select one or more devices and then click Add. 5. Click Add to finalize your selection and add the devices to the group. 6. Click Save to save your changes.

To edit a group 1. In the tree view, right-click a group and click Edit. 2. (Optional) Type a new name in the Name field. 3. Click Add to add more devices to the group OR Select one or more devices and click Remove to remove the devices from the group. 4. Click Save to save your changes.

To remove a group 1. In the tree view, right-click a group and click Remove. 2. When the message appears, click Yes.

Enabling Devices for Monitoring Before Foglight NMSFoglight NMScan begin monitoring and collecting data from the devices in a network, you must enable SNMP or WMI. You will need to enable the correct protocol depending on the type of data you are collecting.

Simple Network Management Protocol (SNMP) Simple Network Management Protocol (SNMP) is an Internet-standard protocol for managing devices on IP networks. SNMPallows you to collect data from all types of devices, such as desktops, servers, routers, and switches, across any operating system. When you enable SNMP on a device and provide the correct credentials, Foglight NMSFoglight NMS can monitor that device and collect data from it. For more information on how you can enable SNMP, see Enabling SNMP on a Device. Windows Management Instrumentation (WMI) Windows Management Instrumentation (WMI) is a programming interface (API) in the Windows operating system that enables devices and systems in a network, typically enterprise networks, to be configured and managed. WMI is based on Web-Based Enterprise Management (WBEM), which stores all definitions in a Common Information Model (CIM) database. WMI allows network administrators to query and set information on workstations, applications and networks, and can also be used to access the Active Directory. Enabling WMI allows Foglight NMSFoglight NMSto collect the following specific data from Windows-based devices:
l

Microsoft Exchange SQL Active Directory Windows event logs Windows services Hardware Inventory

For more information on how you can enable WMI, see Enabling WMI on Windows Devices. See Also
l

Enabling SNMP on a Device Enabling WMI on Windows Devices

Monitoring Your Devices by SNMP Monitoring Your Devices by WMI

Enabling SNMP on a Device

When you enable SNMP on a device and provide the correct credentials, Foglight NMSFoglight NMS begin to monitor that device and collect data from it. Use the SNMPEnablement tool to enable SNMP on the devices in a network. 1. In the Foglight NMSFoglight NMS Studio, select one or more devices in the Devices View. You can add more devices to your list by clicking Select Targets. 2. Right-click and then click Tools -> Enable SNMP. 3. In the Enable SNMP Wizard, click Next. Foglight NMSFoglight NMSbegins to determine if the devices are available for SNMP Enablement and will display the results. 4. Click Next. 5. Select the SNMP credential that you want to assign to the devices. Click the Manage Credential link to add new credentials to the Encrypted Credential Store. 6. Click Next. NOTE: If necessary, you can modify the preferred credential assigned to each device by selecting it and then clicking Set Preferred. 7. Click Next. SNMPis now enabled on the devices. 8. Click Finish to complete the process.

See Also
l

Monitoring Your Devices by SNMP Enabling Devices for Monitoring

Enabling WMI on Windows Devices

For Windows-based machines running Windows XP or Vista, by default Microsoft installs and configures WMI. Before you can start monitoring your devices by WMI, you must make sure that the following services are running:

Windows Management Instrumentation Windows Management Instrumentation Driver Extensions

To enable WMI 1. Go to the Control Panel and double click Administrative Tools. 2. In the Administrative Tools dialog, double-click Computer Management. 3. Expand Services and Applications, right-click WMI Control and follow the Windows menus.

For more information on troubleshooting WMIrelated-issues on Windows XP, click here. For more information on connecting to WMI remotely on Windows Vista, click here. See Also
l

Monitoring Your Devices by WMI Enabling Your Devices for Monitoring

Updating Your Version of Foglight NMS There are two ways Foglight NMS will update. One approach is to manually update your software and the other approach is to let it automatically update. Manually Updating Your Product 1. From the Foglight NMSStudio main menu, click Administration. 2. In the Administration window, click Check For Updates. 3. Click Update Now to manually apply the software updates. The program will close and then reopen automatically.

Automatically Updating Your Product

Upon launching Foglight NMS, the software will check for any updates available at the patch server. The software automatically pulls the updates and stores them in cache. The updates are applied the next time the software is launched.

Running Network Discovery

Overview Network Discovery scans the entire network, and then populates your database with the devices that you want to monitor and manage with Foglight NMSFoglight NMS. Using various discovery techniques, such as ping and MAC resolution, network discovery provides a complete set of attributes for all devices. Using the data profile created for devices during discovery, Foglight NMSFoglight NMSautomatically assigns them to different policies, known as Smart Policies, that are comprised of monitors that best fit what kind of data you want to collect from the devices. The Network Discovery Wizard appears shortly after you install Foglight NMSFoglight NMS and open it for the first time. However, if you need to add more devices to your database, you can run network discovery again. To run network discovery from the Studio 1. In the Foglight NMSFoglight NMS Studio, click Add Devices. 2. In the Add Devices Wizard, select the method by which you want to add devices:
l

See Adding Devices By SNMP for more information See Adding Devices by Deploying Agents for more information

3. Go through the remaining screens of the wizard to complete the process and click Finish.

Things to Consider Before You Run Network Discovery Although network discovery detects a device in the network, the data profile that it creates for the device may not be complete because of several factors. It is recommended that you consider the following before you run network discovery:
l

Enable SNMPor WMI on your devices in order to monitor and collect data from it. You do not need to enable SNMPon devices where an agent is deployed; however, if the agent is monitoring and collecting data from other devices, such as routers and switches, you will need to enable SNMPon those devices.

NOTE: Enabling WMI allows you to monitor and collect data for Microsoft Exchange, SQL, Active Directory, Windows Event Logs, Windows Services, and Hardware Inventory data types only.
l

Make sure you have the correct credentials. When you run network discovery, you can only enter one credential at a time for each level of security. So you may have to run network discovery more than once to properly discover all devices in the network. You can also set the credentials for a device at a later time using the Set Credential link in the Devices View. If you do not have the correct credentials assigned to a device in Foglight NMSFoglight NMS, Foglight NMSFoglight NMS will not be able to monitor and collect data from that device.

Topics in this section

l

Adding Devices by SNMP Adding Devices by Deploying Agents Managing Credentials Enabling SNMP on a Device Enabling WMI on Windows Devices

Pre-Network Discovery Checklist Foglight NMS installs on your system and starts discovering your devices in less than 15 minutes. However, there are important items that you must have in place in order to optimize your experience with Foglight NMS. This section will help you prepare your system before you run network discovery by providing you with the following checklist of items that you need to implement.

Make sure your server meets the minimum system requirements The Foglight NMS platform server is the main database for monitoring and collecting all data from your devices. To verify that it meets the minimum system requirements, see Host Server Hardware and Software System Requirements for more information. Open the appropriate ports You will need to make sure that all the correct TCP Ports are open on your firewall to allow communication to the Foglight NMS platform server. For more information about inbound ports, see Host Server Hardware and Software System Requirements.

Have your valid WMI credentials available You will need to have all your valid Windows administrative credentials available for the devices that you want to monitor by WMI. After you install Foglight NMS, you can use the WMI enablement tool to enable WMI on your devices. For more information about how you can accomplish this task, see Enabling WMI on Windows Devices. Have your valid read/write SNMP credentials available You will need to have all your valid read/write SNMP credentials available for the devices that you want to monitor by SNMP. After you install Foglight NMS, you can use the SNMP enablement tool to enable SNMP on your devices. For more information about how you can accomplish this task, see Enabling SNMP on a Device. Telnet/SSH access You must have Telnet/SSH access to all your routers, switches, and devices that you want to monitor with Foglight NMS. Compile a list of IPs and/or IP ranges You should make a list of all the IPs or IP ranges that you want to monitor during the Foglight NMS.

Adding Devices by SNMP Foglight NMSFoglight NMScan use SNMP to discover devices in a network and then provide a complete set of attributes for each discovered device. This type of network discovery will gather technical data including hardware, software, and processes for each device, and then identify devices by responding status, protocols, type, and operating system. When you add a device by SNMP, it requires that you provide the SNMPcredentials for the devices and you must make sure that you have the correct port open so that the target machine can accept SNMP packets from that device. 1. In the Foglight NMSFoglight NMS Studio, click Add New Devices. 2. In the Add Devices Wizard, select Add Devices Via SNMPNetwork Discovery. 3. Click Next. 4. In the Enter Targets field, type any one of the following: CIDR, DNS, IP/Subnet Mask or range of IP Addresses. 5. In the Select Network Discovery Techniques section, deselect any of the check-boxes that do not apply to your discovery. For more information on these techniques and configuring the advanced ping settings, see Network Discovery Techniques.

6. In the Choose Device Credentials section, select a credential for each level of security that you want to use to discover each device. For more information on credentials, see Setting Device Credentials for Network Discovery. 7. Click Next to start the discovery process. 8. On page 2 of the Network Discovery Wizard, select the devices on which you want to do a complete discovery. You can use the options in the drop-down list to filter the devices shown on this screen. 9. Click Next. 10. On page 3 of the Network Discovery Wizard, select how you want to assign your devices to a policy. For more information about the Policy Assignment Options, see Applying Smart Policies to Devices. 11. Click Finish to complete the Network Discovery process.

See Also
l

Network Discovery Techniques Setting Device Credentials for Network Discovery Applying Smart Policies to Devices

Network Discovery Techniques

Foglight NMSFoglight NMSprovides 3 different techniques to help you discover the devices in a network. They are:

Exclude Existing Devices in Database

Use this technique if you have previously run network discovery. It does not include devices that are currently in the database in you new search, which allows Foglight NMSFoglight NMSto scan a network faster. Ping Use this technique to send an ICMPcommand to a device. If the ping monitor is working as expected, a device will respond to the request. There are advanced ping settings that you can configure from the Network Discovery Wizard, which is explained further in the following section. MAC Resolution Foglight NMSFoglight NMS uses the MAC Address to uniquely identify and profile a device in the network. Configuring Advanced Ping Settings Foglight NMSFoglight NMS provides a way to configure the ping settings so that you can turn a resolution on to display or turn it off from displaying. Click the Advanced Settings link in the Select Network Discovery Techniques section to modify the following settings:

Ping Timeout (ms) Maximum amount of time in milliseconds that a ping waits for a response from the target IP address. If the target does not respond within the number of milliseconds set, ping assumes it is not working as expected. Ping Packet TTL (Time-To-Live)

Number of hops along the way to the specified address. If you assign a value of 32 to this setting, your ping scan may pass through up to 32 different routers on the way to the remote address before the network throws it away. Pings Per Node You can control the number of ping attempts to send to each address during a scan. When a network containing a Cisco router is scanned, you should set this number to a number greater than 2. If the target IP address is not in the ARP cache of a Cisco router, the router discards the ICMP query while it requests the MAC address of the target IP. The first ping will never arrive at the subnet of the target IP address; however, the Cisco router will respond to the second ping. Delay Between Pings Time in milliseconds between each successive ping to the target address. If you assign a low value to this setting a constant stream of pings is sent to the target IP address. See Also
l

Adding Devices by SNMP

Setting Device Credentials for Network Discovery

When you run network discovery, selecting the correct credentials is essential in order for Foglight NMSFoglight NMS to access the devices in a network. When a device is discovered during a scan of the network, Foglight NMSFoglight NMS will add it to the database. However, if you incorrectly set the credentials for that device (in the product), Foglight NMSFoglight NMS cannot monitor and collect data from it. In the Network Discovery Wizard, choose the correct credential for the devices in the network. Foglight NMSFoglight NMS allows you to select a credential for the following protocols:
l

SNMP Version 1 Credential SNMP Version 2 Credential SNMP Version 3 Credential WMI Credential

From the Network Discovery Wizard, you can add new credentials to the Encrypted Credential Store by clicking the Managing Credentials link. From the Network Discovery Wizard, you can add new credentials to the Encrypted Credential Store by clicking the Managing Credentials link. For more information about credentials, see Managing Credentials. See Also
l

Adding Devices by SNMP

Adding Devices by Deploying Agents The Deploy Agent Wizard allows you to select one or more devices where you can deploy a local or remote agent. Agents can only be deployed to Windows-based machines running Windows XP, Windows Vista, or Windows Server 2003. As you work through the different screens of the wizard, you will select the device where you want to install the agent, determine if SNMPin enabled on the device, learn the status of that device (if it will support an agent deployed on it), set and manage the device's credentials, set the telnet/SSH credentials in order to connect to the device. For more information about the minimum system requirements the agent device needs to meet, such as which ports you need to open, see Device and Collection Agent System Requirements. 1. In the Foglight NMSFoglight NMS Studio, click Add Devices. 2. In the Add Devices Wizard, select Add Devices By Deploying Agents and click Next. 3. In the Deploy Agent Wizard, type a CIDR, DNS, IP/SubnetMask or range of IP addresses in the Enter Targets field. 4. Click Next. NOTE: This process may take a few moments to complete. 5. In the Connectivity Results screen, select a device in the list.NOTE: Check the Status column for information about the devices that were discovered. If the returned results have a "Fail" status, you may not be able to select that device. 6. Click Next.

7. Select a preferred credential and type a username and password. You can create a new credential by selecting (new credential) in the drop-down list. 8. Click Next. 9. In the Set Telnet/SSH Credential screen, select the device on which you are installing an agent and click Set Preferred. 10. Click Next. 11. In the Results screen the Results screen will notify you if the Telnet/SSH credential for the device is valid. 12. Select a device with the correct WMI credential so that you can monitor and collect specific Windows-based data. For more information, see Monitoring Your Devices by WMI. NOTE: Use the Manage Credential link on this screen to edit your existing credentials or to create a new credential. For more information, see Managing Your Credentials. 13. Click Next. The agent will now be deployed to the device. You can view the log in the agent deployment status. 14. Click Finish.

See Also
l

Monitoring Your Devices by Deploying Agents Benefits of Deploying an Agent

Benefits of Deploying an Agent You will experience the following benefits when you deploy an agent on a machine:
l

An agent captures and monitors all data from a machine eliminating the need to enable SNMPor WMI on a device. You can use the Patch Management feature. You can remotely gain access to a machine using Expert Assist. Increase a machine's performance by decreasing the amount of traffic between devices.

Increase the quality of monitored data by missing fewer monitoring intervals than a SNMPconnection. Gives you remote access to various mobile assets, such as laptops. Increase the amount of devices that you can monitor.

See Also
l

Monitoring Your Devices by Deploying an Agent

Installing Agents Manually You can manually deploy an agent on any windows-based machine. When you install an agent manually, you are downloading the agent software from a known location on your Foglight NMSFoglight NMSserver. Also, you can use the Email URL feature to deploy an agent to all the desktops in a network. By emailing the location of the agent software to each desktop owner, they can download the agent software onto their desktops. 1. In the Foglight NMS Studio, click Add Devices. 2. In the Add Devices Wizard, select Add Devices By Deploying Agents. 3. Click Next. 4. In the Deploy Agent Wizard, click Install Manually.

5. In the Manually Deploy Agent dialog, select an operating system and do one of the following:

Click Copy URL to download the agent software from a known location on your Foglight NMSserver. Click Email URL to send the location of the agent software to all the desktops in a network.

6. Click Close.

See Also
l

Adding Devices by Deploying an Agent

Managing Credentials The Encrypted Credential Store is a secure repository of SNMP, WMI, and SSH credentials shared by all tools and gadgets which require them. It uses standard AES 256-bit encryption. Selecting the correct credentials is essential in order for Foglight NMS to access the devices in your network. When a device is found during Network Discovery, Foglight NMS will add it to the database. However, if you incorrectly set the credentials for that device in the Network Discovery Wizard, Foglight NMS cannot monitor and collect data from it. In the Encrypted Credential Store, you can store credentials for the following protocols:
l

SNMP Version 1 Credential SNMP Version 2 Credential SNMP Version 3 Credential WMI Credential Telnet SSH

From the Network Discovery Wizard, you can add new credentials or edit existing credentials by clicking the Managing Credentials link. 1. Click Credentials from tree options in Devices. 2. In the Credentials window, click New.

3. From the drop-down list next to Type select the type of credential protocol you wish to configure and save. The configuration of each of the three choices displayed is described in the following three sections. 4. Click Save. 5. Click Assign, and then in the Select Devices window, select one or more devices to assign the credential to those devices. 6. Click Close to finish.

Applying Smart Policies to Devices When you run a network discovery, Foglight NMScreates an intelligent profile of a device and assigns it to a pre-configured policy called a Smart Policy. A Smart Policy is a product default policy made up of recommended monitors and data gathering time intervals appropriate to a specific type of device, such as a wireless device or desktop device. For example, Foglight NMSassigns a desktop computer to the Desktop Policy, which monitors data specific to desktops such as CPU, memory, and disk volume. Applying Smart Policies during Network Discovery will save you time by automatically assigning all the devices discovered in a site's network to a qualifying Smart Policy. You can edit Local and Global Smart Policies in the Edit Policy window; however, you cannot delete a Global Smart Policy. Smart Policies in your product include:
l

Default Policy NOTE: A device is applied to the Default Policy when Foglight NMS cannot identify what type of device it is. For example, during network discovery, if Foglight NMScannot identify a device's description, OID, or which services are running on it, that device is assigned to the Default Policy. In the Default Policy, all monitors are selected to cover a wide range of devices to make sure that data is monitored and collected from these devices. It is recommended that you migrate these devices from the Default Policy to the appropriate Smart Policy.

Networking Policy Server Policy Desktop Policy

Wap Policy VMware Host Policy

Applying the default Policy to Devices By selecting the Default Policy option in the Network Discovery Wizard, you are assigning the discovered devices to the Default Policy (only the devices that you selected on page 2 of the Network Discovery Wizard are applied to it). After the network discovery process is complete, you can reassign devices in the default policy to a different smart policy or to a policy that you created. See Also
l

Migrating Devices from the Default Policy

Monitoring Devices
In this section you will learn more about how Foglight NMSmonitors the devices in a network.
Topics in this section
l

Monitoring Your Devices by SNMP Monitoring Your Devices by WMI Monitoring Your Devices by Deploying an Agent Collecting Syslog, NetFlow, and SNMP Traps Data

Monitoring Your Devices By SNMP Simple Network Management Protocol (SNMP) is an Internet-standard protocol for managing devices on IP networks. SNMPallows you to collect data from all types of devices, such as desktops, servers, routers, and switches, across any operating system. When you enable SNMP on a device and provide the correct credentials, Foglight NMS can monitor that device and collect data from it. Foglight NMSuses SNMP to gather much of the device performance information from a network. If you choose to monitor your devices by SNMP you must first do the following:
l

Enable SNMP on all the devices that you want to monitor. Assign a credential to the device in Foglight NMS.

The following diagram shows how Foglight NMSuses SNMP to monitor your devices.

See Also
l

Enabling SNMP on a Device

Monitoring Your Devices by WMI Windows Management Instrumentation (WMI) is a programming interface (API) in the Windows operating system that enables devices and systems in a network, typically enterprise networks, to be configured and managed. WMI is based on Web-Based Enterprise Management (WBEM), which stores all definitions in a Common Information Model (CIM) database. WMI allows network administrators to query and set information on workstations, applications, and networks and can also be used to access the Active Directory. Similar to SNMP, monitoring your devices by WMI allows Foglight NMSto collect the following data from Windows-based devices:

Microsoft Exchange SQL Active Directory Windows event logs Windows services Hardware Inventory

The following diagram shows how Foglight NMSmonitors your devices by WMI.

See Also
l

Enabling WMI on Windows Devices

Monitoring Your Devices by Deploying Agents You can choose to deploy one or more agents to your site for monitoring and collecting data. Agents can be deployed to all Windows, Mac, and Linux devices. Foglight NMS can only monitor devices such as routers, switches, and printers need to monitor by SNMP.

A collection agent is the device responsible for monitoring and collecting data from devices that cannot host an agent, such as a router. You can only deploy a collection agents to a windows-based machine. If you deploy an agent to a Mac or Linux device it can only monitor itself and cannot monitor other devices. NOTE: You do not need to enable SNMP or WMI on an agent machine. The following diagram shows how Foglight NMSmonitors your devices by deploying an agent. Note that each desktop and server in this image has an agent deployed on it.

See Also
l

Benefits of Deploying an Agent Adding Devices by Deploying Agents

Collecting Syslog, NetFlow, and SNMP Traps Data You must log on to the device to configure it to collect syslog, NetFlow, or SNMP Traps data. When you configure the device, you must tell it to export or send the data to the IPaddress of the collection agent that is monitoring the device. Additionally, when you collect Syslog and SNMP Traps data from devices, you must make sure that the Syslog Listener and SNMP Traps monitors are configured for the policy or policies to which the devices are assigned. Enabling NetFlow You must enable NetFlow on your devices and configure it to export its data to the collection agent that is monitoring NetFlow. Opening Ports for NetFlow, Syslog, and SNMP Traps In order to collect, syslog, NetFlow, and SNMP Traps data, you must make sure that you open the following ports on the devices from where you are collecting this data.
l

514 (UDP) - Syslog collector 61 (UDP) - SNMP Trap collector 2055 (UDP) - NetFlow collector 6343 (UDP) sFlow collector 9555 (UDP) - NetFlow Alternative port #2 collector 995 (UDP) NetFlow Alternative port #3 collector NOTE: You only need to open one port for NetFlow. If port 2055 is in use by another device, you can select an alternate port to open.

The following diagram shows how Foglight NMScollects syslog, NetFlow and SNMP Traps data.

See Also
l

Enabling NetFlow

Using Dashboards
Overview The Dashboard view is a network management dashboard that displays a high-level overview of network performance, fault management, and device availability across all sites' networks. It provides you with critical device information, such as CPU load, network interface traffic, latency, and other key performance indicators (KPIs), which can expose devices that are not working as expected and reveal problem areas in a network. You can continuously monitor key assets of a network to make sure that it is always running at peak performance. In the Dashboard view, you can do the following:
l

Monitor device availability, CPU load, memory, disk space utilization, network interface traffic, network latency, and packet loss. Perform advanced monitoring of running services, process availability, and performance counters for MS Exchange, SQL, Active Directory. Make an inventory of gadgets include charts, gauges, lists, text, and web links. Compare networks between sites. Create a custom view by dragging and dropping gadgets. Restore the default dashboard settings. NOTE: When you select to restore the default settings, all the gadgets and tabs that you created will be deleted from the Dashboard view. The restored default setting includes only the Top-Ten and Alerts and Logs dashboards.

Topics in this section

l

Touring the Dashboard View User Interface Customizing Your Dashboard Adding Dashboard Tabs About Gadgets Adding Gadgets to Your Dashboard

Creating Custom Gadgets Editing Gadgets

. Touring the Dashboard View User Interface

The Main Elements of the Dashboard View

1 The Dashboard Menu Tab: Use the main menu tabs to navigate through the product. You
can click the Dashboard tab to navigate to your dashboard from any place in the product.

2 Dashboard Menu Buttons: Use the menu buttons for the following:

Adding new dashboard tabs. Adding new gadgets to a dashboard. Restoring the product defaults to your dashboard. NOTE: This action will remove all gadgets and tabs that you added from the dashboard. Refresh the data in your gadgets.

3 Dashboard Navigation Tabs: Each tab represents a unique dashboard. Click a dashboard
name to navigate to that dashboard.

4 Right-Click Menu Options: Use the right-click menu options to customize the Dashboard
view.

5 Divider Bar: The Divider Bar allows you to adjust the size of each column. To activate the
divider bar, place your cursor in the space between the columns. Click and hold the divider bar to move the columns left or right.

6 Gadget: The information displayed in a gadget will vary from gadget to gadget. You can do
the following in a gadget:
l

View the performance and activity of one or more devices in a network. Filter the data by clicking a column header. Edit the way in which data is displayed in a gadget. Move the gadget up in the Dashboard view when you click the gadget title bar. Remove the gadget from your dashboard by clicking the Close link.

Customizing Your Dashboard You can customize your dashboard by doing the following:
l

Create new dashboard tabs to organize your gadgets. For example, you can create a new dashboard that will display only gadgets that are related to call path data. Add new standard gadgets or add custom gadgets that you created. Edit or remove any of the existing tabs or gadgets.

Move gadgets around in the Dashboard view using drag and drop functionality. You can also click on the gadget title bar to move it up on a dashboard. Resize the widths of columns and gadgets by moving the divider bar left or right.

Every Foglight NMS user can customize his or her own dashboard to fit their needs. The dashboard that you customize will be available to view only by you. Other Foglight NMS users cannot see your customized dashboard. Dashboard Tab Right-Click Menu Options You can use the right-click menu options to manage the tabs and gadgets on each dashboard.
l

Configure Columns Defines the number of columns on a dashboard. Existing gadgets on the dashboard are automatically resized based on the number of columns you select.

Clear Gadgets Removes all gadgets from the selected dashboard.

Rename Tab Changes the name of the selected dashboard tab.

Close Tab Permanently removes the selected dashboard and all the gadgets contained within it.

See Also
l

Adding Gadgets to Your Dashboard Adding Dashboard Tabs Creating Custom Gadgets Editing Gadgets

About Gadgets

The Dashboard view offers a wide range of gadgets to present any data being collected about your network. Every gadget takes you through a similar and intuitive configuration wizard that allows you to easily and quickly set one up.

The following table lists all the available gadgets to add and view on a dashboard. Click a gadget name for more information.
Gadget Name Description Monitors the performance counters for the active directory server. Displays a detailed list of triggered alerts. Displays the average latency of one or more nodes by charting the ping results. Displays the average latency of a node based on response time and average packet loss. Location of Gadget Application Performance Alerts and Logs Device Availability Device Availability

Active Directory Alerts In Process Average Latency Chart Average Latency Gauge Average Latency List

Displays the average latency of a list of one or more Device Availability nodes by showing the response time and a color indicator bar. Displays the average latency of a node by changing the color of the text to green or red. Device Availability

Average Latency Text Configuration Backup

Displays the current device configuration file and Alerts and Logs allows you to compare it to a previous configuration file. Monitors call path jitter via IP SLA on Cisco routers. Monitors call path latency via IP SLA on Cisco routers. VoIP VoIP

Call Path Jitter Chart Call Path Latency Chart Call Path MOS Chart Call Path PacketLoss Chart Call Path Statistics CPU Chart CPU Gauge

Monitors call path MOS via IP SLA on Cisco routers. VoIP Monitors call path packet loss via IP SLA on Cisco routers. Monitors call path statistics via IP SLA on Cisco routers. Monitors the CPU usage percentage of a device. Monitors the CPU usage percentage and average usage percentage of a device. VoIP

VoIP Device Performance Device Performance

Gadget Name

Description

Location of Gadget

CPU List CPU/Memory Chart CPU/Memory Gauge CPU/Memory List CPU/Memory Status Device Alerts - Active Device Alerts - All Device Notes Dial Manager Configuration Dial Manager Phone Chart Dial Manager Registration Status Disk Volume Chart Disk Volumes Installed Applications IP Configuration IP SLA Overview Memory Chart Memory Gauge

Monitors the CPU usage percentage of one or more Device Performance devices within a network. Monitors the CPU and memory usage percentage of Device Performance a device. Monitors the CPU and memory usage percentage of Device Performance a device. Monitors the CPU and memory usage percentage of Device Performance one or more devices. Monitors processor and memory usage. Displays the alerts triggered for any given device. Displays the alerts triggered for any given device. Displays notes about any given device. Displays dial manager configuration via IP SLA on Cisco routers. Displays dial manager phones via IP SLA on Cisco routers. Displays dial manager registration status via IP SLA on Cisco routers. Device Performance Alerts and Logs Quest System Info Quest System Info VoIP

VoIP

VoIP

Monitors the disk utilization on a hard drive of a spe- Device Performance cific device Monitors the disk utilization of each drive as a percent of capacity for a device Displays installed applications via SNMP (some devices will require Telnet or SSH) Displays the IP Configuration information for a device. Displays dial manager registration status via IP SLA on Cisco routers. Device Performance Device Performance Device Performance VoIP

Monitors the memory usage percentage of a device. Device Performance Monitors the memory usage percentage and averDevice Performance

Gadget Name

Description age usage percentage of a device.

Location of Gadget

Memory List MSExchange Network Ethernet CRC Errors

Monitors the memory usage percentage of one or more devices in a network. Monitors the performance counters for the MS Exchange server. TBD

Device Performance Application Performance Device Performance

Network Token Ring CRC TBD Errors Network Interface Chart Monitors the network interface performance for a
device.

Device Performance

Device Performance Device Performance Device Performance

Network Interface List Network Statistics Summary Network Traffic Flow

Monitors the network interface performance for a device. Displays network statistics through SNMP.

Displays the NetFlow, sFlow, JFlow, and ptFlow traf- Network Performance fic for a switch or a router. network management tool or web site to display. formance Quest System Info Quest System Info OS Details Alerts and Logs OS Details

Open Source Web Viewer Allows you to choose a browser-based open source Application PerQuest Log Information
Displays all the log files generated in a single view.

Policy Schedules Actions Displays all the scheduled actions in a single view. Running Processes SNMP Traps Software Inventory SQL Server Syslog
Shows all the processes that are currently running on a device. TBD Provides a list of all the applications installed on a device.

Monitors the performance counters for SQL Server. Application Performance Displays all the collected syslog messages for a specific device. Alerts and Logs

Gadget Name

Description Displays detailed system information for a device. Monitors the CPU performance of a list of one or more nodes.

Location of Gadget OSDetails Top 10

System Information Top 10 - Average CPU Usage

Top 10 Average Memory Monitors the memory performance of a list of one or Top 10 more nodes. Usage Top 10 - Average Packet Displays the average packet loss of a list of one or more nodes. Loss Top 10 - Disk Volume Usage
Top 10

Displays the highest average disk volume usage as a Top 10 percentage of drive capacity for a list of devices. Top 10

Top 10 - Highest Average Displays the highest average latency of a list of one or more nodes. Latency Top 10 - Network Interface Usage Top Network Traffic: Applications (for one or multiple targets) Top Network Traffic: Convs (for one target) Top Network Traffic: (for one or multiple targets)

Displays the highest network interface usage for a list Top 10 of nodes. Shows network traffic data, organized by application Top 10 and dependent on the scope that you select when you create the gadget.

Shows network traffic data, organized by conversation and dependent on the scope that you select when you create the gadget. Shows network traffic data, organized by domain and dependent on the scope that you select when you create the gadget.

Top 10

Top 10

Top Network Traffic: End- Shows network traffic data, organized by endpoints Top 10 and dependent on the scope that you select when points (for one or multiple targets) Virtual Machines VMware Host Summary
you create the gadget.

Displays VMware ESX Server virtual machines.

VMware

Displays a summary of VMware ESX Server host infor- VMware mation.

Gadget Name

Description

Location of Gadget

VoIP Active Calls VoIP call History VoIP Phone Status Windows Event Logs Windows Services Wireless Access Point

Displays active calls through IP SLA on Cisco call man- VoIP ager. Displays call history through IP SLA on Cisco call man- VoIP ager. Displays VoIPphone status through IP SLA on Cisco VoIP call manager. Displays all event logs collected for a device, including application, security, and system event logs. Alerts and Logs

Displays critical windows services information, such OS Details as status and start type. Displays information about key variables of a wire- Wireless Performance less access point, such as signal strength and quality. on a network.

Wireless Access Point List Displays information about all wireless access points Wireless Performance Wireless Clients Chart Wireless Clients List Wireless Traffic Chart
Shows how many wireless clients are connected to a Wireless Performance wireless access point within a given time frame. Displays key variables for each client connected to a Wireless Performance wireless access point. Shows the amount of received and transmitted net- Wireless Performance work traffic generated by a wireless device within a specified interval of time.

See Also
l

Adding Gadgets to Your Dashboard

Adding Dashboard Tabs

Adding a dashboard tab allows you to create multiple dashboards that you can customize with any of the available gadgets. For example, you can create a dashboard which contains only gadgets that display information specific to routers. Foglight NMSincludes the following pre-defined dashboards tabs:

Top Ten Alerts and Logs

To add a tab 1. From the Dashboard menu, click Add Tab:

2. In the Add Dashboard Tab dialog, type a unique name.

3. Click OK. The new dashboard tab appears at the end of the list.

See Also
l

Customizing Your Dashboard

Adding Gadgets to Your Dashboard

In the Dashboard view, gadgets provide a quick and convenient way to see the performance and activity of one or more devices in a network. When you double-click a device in a gadget, you can view more details about that device. You can choose to view device information for a single site's network or you can configure a gadget to display information for a device across all your sites' networks. To add a gadget to a dashboard

1. On the main menu, click the Dashboard tab: 2. In the Dashboard view, select the tab where you want to add your new gadget:

3. Click the Add Gadget button:

4. Select the gadget that you want to add and click Next.

NOTE: You can also double-click a gadget name to open the Gadget Configuration wizard. 5. Follow the steps in the wizard to configure your gadget:

NOTE: Depending on the gadget you select, in the Gadget Configuration wizard you may see different options to configure than the options shown in the previous image. 6. Click Finish.

See Also
l

About Gadgets Editing Gadgets

Editing a Gadget

1. On the title bar of the gadget that you want to edit, click the Edit link:

2. In the Gadget Configuration wizard, make your changes. 3. Click Finish to save your changes.

See Also
l

About Gadgets

Creating Custom Gadgets You can show certain types of data in a custom gadget. Using the custom gadgets feature, you can determine what type of data to show and how to organize it in a gadget. After you create a custom gadget, you can add it to the Dashboard View. NOTE: You must be a System Administrator to create a custom gadget. To start creating a custom gadget 1. In the Dashboard View, click Gadget Manager. 2. In the Custom Gadget Template Manager, click Add. Follow the steps below to complete

the process of creating a new custom gadget.

Page 1 of the Custom Gadget template Wizard: What kind of custom gadget is it?

3. In the Custom Gadget Template Wizard, type a name and a description for the custom gadget. NOTE: The description appears only in the wizard and not in the gadget itself. 4. In the Display Data By (Group By) drop-down list, select a data type to set the scope of data displayed in the custom gadget. The selection you make here will determine what options appear in the Available Fields section on page 2 of the wizard. 5. Under What Would You Like To Create This Gadget For?, do the following:
l

If you want the custom gadget to limit the devices displayed in it to one, select Single Device If you want the custom gadget to display data for all the devices in a policy or all the devices across as, select Multiple Devices If you want the custom gadget to include all the devices in a customer's network, select Devices For Single Organization

6. For Choose Gadget Type, select how you want to display your results in the custom gadget. NOTE: Depending on how you group your data, not all of the gadget type options will appear. 7. Click Next.
Page 2 of the Custom Gadget Template Wizard: What and how does the data appear in the custom gadget?

8. In the Available Fields section, select a one or more fields and then click the right arrow button. To add all the fields in a category to the Display These FieldsIn This Order, select the category check-box. NOTE: The selection you made in the Display Data By (Group By)on page 1 of the wizard determines what options appear in this section. 9. (Optional) To remove a default field, select the check-box and click the left arrow button. 10. The order of fields in the Display These FieldsIn This Order section determines the order of the columns in the gadget. To change the order of a field, select its check-box and click the up arrow button to move its column to the left or click the down arrow button to move its column to the right. 11. Click Next.

Page 3 of the Custom Gadget Template Wizard: How is the data sorted in the custom gadget?

12. To make a data field the primary field by which the rows of data in the gadget are sorted, click Primary. By default, if a field is already set as the primary field, then it will become the secondary field. NOTE: Sorting the fields on this page does not change the order of the columns. 13. To make a data field the secondary field by which the rows of data in the gadget are sorted, click Secondary. 14. To make a data field sort from the beginning of the alphabet, the lowest number, or the earliest date, click Ascending. 15. To make a data field sort from the end of the alphabet, the highest number, or the latest date, click Descending. 16. (Optional) Click Defaults to reset the sort order. 17. Click Next. 18. Click Finish. Your new custom gadget appears in the list of gadgets under the Custom Gadgets category.

See Also
l

Adding Gadgets to Your Dashboard

Managing Devices
The Devices view provides many details about an individual device or groups of devices. From this view you can also access the Policy Editor, create network maps, remotely connect to a computer, and analyze a network's traffic. It allows you to quickly view the status of a device and, if a device is down, help you determine what may be causing the error.
Topics in this section
l

Displaying the Current Logged-on User Monitoring Data from a Cisco Wireless Access Controller Collecting Real-time Data Using Go Live! Verifying the Device Monitor Status Viewing the Details of a Device

Viewing the Current Logged-on User When you have multiple sites in your network and you manage more devices, you may need to know information about the user that is currently logged on to a device. You can retrieve the details of the current logged-on user for any Windows-based machine by adding the current logged-on user monitor to a policy. Using this monitor requires that you have the proper WMI credentials set up in the Credentials Store, as well as WMI enabled on the device that you want to monitor.
Topics in this section
l

Displaying the Current Logged-on User Viewing the Logged-on User History Monitoring Current Logged-on User for Windows Troubleshooting: How do Isolve the "access denied" error when I use qwinsta.exe/rwinsta.exe or WTSOpenServer Windows API function?

Displaying the Current Logged-on User

You can follow the steps below in order to properly configure the current logged-on user information to appear in the Devices View. Also, you must make sure that you configure the remote desktop service on the Windows device for which you want to collect the current logged-on user information. To configure this service, go to My Computer -> View System Information -> Remote tab. In the Remote Desktop section, select the Allow Users To Connect Remotely To This Computer check-box, and then click OK to save your changes. NOTE: It is recommended that you install an agent onto the machine where you want to monitor the current logged-on user. STEP1: Add the Current User Logon Monitor to a Policy You will need to add the Current User Logon monitor to the policy where the device resides. You can also view historical data about the current logged-on user by adding the Logged-on User History monitor to the same policy. 1. In the tree view, right-click a policy and click Edit. 2. Click the Monitors Tab. 3. Click Add Monitor. 4. In the Select Data Type dialog box, select Current User Logon and then click OK. 5. Click Save.

STEP2: Add the WMI Credential for the Device You must make sure that WMI is enabled on the device that you intend to monitor for current logged-on user information. For more information about adding new credentials to the credential store, see Managing Credentials. 1. In the tree view, right-click Credential. 2. In the Type drop-down list, select WMI. 3. In the Name field, type a name that you want to assign to this credential. 4. Type the domain name in the Domain field. 5. Type the username of the agent device in the Username field.

6. Type the password of the agent device in the Password field, and then re-type it in the Verify Password field. 7. Click Save.

STEP3: Assign the Credential to the Agent It is important that you add the correct credentials in order for Foglight NMS to access a device to monitor and collect the current logged-on user data from it. 1. In the tree view, click the Agents tab. 2. Select the agent to which you want to assign the credential that you created in the previous section. 3. Click Configure -> Set Credentials. 4. In the WMI drop-down list, select the credential and click Apply. 5. Right-click the agent device again, and then click Go Live! This feature will refresh your database and provide the latest monitoring data. For more information about the Go Live! feature, see Collecting Real-time Data Using Go Live! 6. In the GoLive! Network and Node Diagnostics dialog box, click << Advanced Options. 7. Under Basic Group, select the Current User Logon check-box. 8. Click Run.

STEP4: View the Current Logged-on User Details The current logged-on user information that appears on the Device Overview page includes host name, user, access started, access finished, and idle time. 1. Double-click the agent device. 2. In the device overview, click the Logged-on User tab. You can see who is currently logged-on to the device, how long they have been logged-on, and if they have been idle on the device.

See Also
l

Viewing the Logged-on User History Monitoring Current Logged-on User for Windows

Troubleshooting: How do Isolve the "access denied" error when I use qwinsta.exe/rwinsta.exe or WTSOpenServer Windows API function?

Viewing the Logged-on User History

In order to display the current logged-on user history on the Device Details page, Foglight NMS pulls the user logged-on log information from the Windows Security event log. When a user logs in to their computer or off of it, Windows creates logon and logoff logs as a part of its auditing. For some Windows desktops, the auditing capability may have been turned off. If so, you will need to turn it back on. You must also make sure that the event viewer for security logs is properly configured. If it is not properly configured, the Windows security event log may cause the logon log to not function correctly. Use the following information to help you configure the security event log.:
l

Set the log size to a larger number so that logs are not lost (lost logs may prevent proper tracking) Do not select the Do Not Overwrite Events (Clear Logs Manually) option. This option may cause the functionality to break once the log is full. Keep in mind that selecting the Overwrite Events As Needed (Oldest Events First) option may cause problems if the logs are overwritten before Foglight NMS has a chance to monitor and collect the data. Your user account should have the correct permissions to read event viewer logs remotely.

To view the Logged-on User History, you will need to add the Current User Logon monitor to the policy where the device resides: 1. In the tree view, right-click a policy and click Edit. 2. Click the Monitors Tab. 3. Click Add Monitor. 4. In the Select Data Type dialog box, select Current User Logon and then click OK. 5. Click Save.

6. Locate the device for which you want to view the logged-on user historical data in the Devices View and double-click it. 7. Click the Logged-on User tab. You will see the Logged-on History gadget on this page.

See Also
l

Looking at the Current Logged-on User

Monitoring Current Logged-on User for Windows

This section provides you with specific information that you will need in order to monitor the current logged-on user for a Windows-based machine. Your Windows operating system provides an API that allows you to monitor the current loggedon user session as part of the Windows Remote Terminal Service SDK. For Windows 2000 Professional or Server, the Windows Terminal service is not installed as part of the operating system, but instead it is installed with Windows Service Pack 2. You must configure the Windows Terminal Service or Remote Desktop Service on the target device in order to properly monitor it. If not, Foglight NMS cannot collect the current user logged-on session data. Windows Remote Desktop Service must be running for Foglight NMS in order for the application to pull current user logged-on session data. Foglight NMS application should be able monitor the following Windows OS:
l

Windows XP Windows 2003 Server Windows 2003 Server R2 Windows Vista Windows 2008 Server

Windows 7 Windows 2008 R2 server

Some flavors of Windows, such as Home Edition, do not support Terminal Service or Remote Desktop. Therefore, you cannot collect the current logged-on user data for them. See Also
l

Looking at the Current Logged-on User

Troubleshooting: How do Isolve the "access denied" error when I use qwinsta.exe/rwinsta.exe or WTSOpenServer Windows API function?

This section describes the solution for the access denied error occurs when using qwinsta.exe/rwinsta.exe or WTSOpenServer Windows API function to access to a Windows XP SP2 PC (to read the original article go to http://www.codesoil.net/2007/08/16/big-problem-accessdenied-when-using-qwinstaexe-or-wtsopenserver-api/). The same thing happens when you are trying to connect to a Windows XP SP2 using Terminal Services Manager from a Windows 2003 Server. - Because essentially qwinsta.exe command calls WTS functions (WTSOpenServer, WTSEnumerateSessions, ), you will encounter the same error when using either the command or the API. As a quick answer, check the following points. 1. Ensure you have the correct credential Although you do not need to provide a username and a password when executing qwinsta.exe or WTSOpenServer, Windows use its stored credentials automatically, just like accessing a shared folder. The easiest way to confirm the credential is to use Explorer to access remote servers C$ share. Also, you can use net use command. For those who want to connect to a remote server programmatically using WTSOpenServer API, WNetAddConnection2 function should be enough to make sure you got a piece of credential before calling WTSOpenServer function. Of course the user in the credential should be a use on the remote server who has enough privilege to carry out the operation.

2. Open RPC ports on firewall An API call involves connecting to a remote machine use RPC. In most cases the RPC service is running and you can confirm that from the service management interface. To open RPC ports, simply enable File and Printer Sharing in the Windows Firewall setting. (Generally, if the RPC is blocked by the firewall on remote machine, the error should be "1722 RPC server is unavailable" rather then "5 Access denied") 3. Disable "Force Guest" log on You can change this option from either local security policy or registery. Local security policy : run secpol.msc > Secuirty Settings > Local Policies > Security Options > Network access : Sharing and security model for local accounts, and set to "Classic". Registry : find "forceguest" item in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa, and set it to 0. The two ways are equivalent. If this option is set to 1, remote logged in user will be impersonated as Guest account (and if Guest account is disabled, login fails). Set it to 0 enables user logging in as themselves. 4. If you still receive access denied and it only happens when the remote OS is Windows XP SP2, it is very probably the following case. To confirm, you need a packet sniffer such as Wireshark (a great freeware). When you use a sniffer to capture the SMB packets, you can see the authentication is OK (NTLM if workstation, Kerberos if Windows 2003 domain), but the RPC get nca_s_fault_access_denied (000000005) as error code. This means the remote RPC component failed to execute the requested operation. It is because in Windows XP SP2, it is not allowed to operate on terminal service (Remote Desktop) through RPC by default. To modify this setting to enable Remote Desktop API through RPC, you need to find the following registry key: HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server Then add a DWORD value named AllowRemoteRPC and change its value to 1. I googled it and it seems there is no official document on it. (I dont know why) Access denied error often misleads us into thinking it must be because of the insufficient privilege, or because that the qwinsta.exe command / WTSOpenServer failed to utilized the credential. It wasted me about 5 hours in researching how to attach a credential to a RPC call, and I even got caught deeply into the complicated SSPI/LSA authentication architecture.

Monitoring Data from a Cisco Wireless Access Controller A wireless access controller is a highly scalable and flexible platform that allows you to manage all the wireless access points in a network as a whole rather than individually. Unlike other devices, a Cisco Wireless Access Controller can manage multiple wireless access points. If you have Cisco controllers in your network, Foglight NMS retrieves the following information from a wireless access controller:
l

View the health status of a controller and of the access points it manages Determine which access points are managed by controller Determine which devices are connected to which access points Track device moves between access points View load, noise, interference and coverage of each access point

You can also create an alert or generate a report based on the data collected from a wireless access controller. Configuring Foglight NMS to Monitor Wireless Access Controllers When you add a Cisco wireless access controller to the database during Network Discovery, the device is automatically assigned to the Networking Policy. However, in order for Foglight NMS to start monitoring and collecting data from a wireless access controller, you must add the Cisco Wireless Controller monitor to the Networking policy or to the device itself. You can use the Network Discovery wizard to find the device and add it to the Foglight NMS database. You must make sure that you assign the proper credential to the device in order to monitor and collect data from it. To configure a policy or device to monitor and collect data from a wireless access device 1. In the Devices view, right-click the policy name. NOTE: If you want to add the Cisco Wireless Controller to the device itself, right-click the device and click Configure For Device. 2. Click Edit. 3. Click the Monitors tab. 4. Click the Add Monitor button.

5. In the Select Data Type, select the Cisco Wireless Controller monitor, and then click OK. 6. (Optional) In the list of monitors, change the default monitoring interval. 7. Click Save.

See Also
l

Viewing the Wireless Controller Dashboard Creating Custom Reports for Wireless Access Controllers

Viewing the Wireless Controller Dashboard The Wireless Controller dashboard shows a list of all access points connected to a controller, the health status of each access point, the number of devices connected to each access point, and CPU/Memory/Network Utilization. You can also click an access point link to view CPU, Memory, and Network Utilization for each interface of an access point. You will also see a list of all devices connected to that access point, as well as the device MACaddress, IP address, in/out bytes of data, and when the last connection occurred. To view the wireless controller dashboard 1. In the Devices view, double-click the wireless controller device. 2. Click the Wireless Controller tab. 3. To view the access point device details, double-click a link in the APName column.

See Also
l

Monitoring Data from a Cisco Wireless Access Controller Creating Custom Reports for Wireless Access Controller Devices

Creating Custom Reports for Wireless Access Controllers You can show data from a wireless access controller in a custom report. Using the custom reports feature, you can select to display the data collected from a wireless access controller

and determine how to organize it in the report. After you create a custom report, you can generate it, schedule it, send a PDF or HTML version of the report by email, and export it from Foglight NMS to any location. You can run a report for the following:
l

All access points connected to the wireless controller All access points and all connected devices to all access points Status changes of all access points and controller and asset information Status of all access points during a particular time period

NOTE: You must be a System Administrator to create a custom report. To create a custom report for wireless access controllers 1. In the Studio main menu, click Reports. 2. Click the Report Manager button. 3. In the Custom Report Template Manager dialog, click Add. 4. Type a name and a description for the report. 5. In the Data Display By (Group By) drop-down list, select any one of the following:
l

Wireless Controller Access Point Wireless Controller Access Point Interface Wireless Controller Interface Load Parameter Wireless Controller Interface Statistic

6. Click Next. 7. Select all the fields that you want to display in the report. 8. Click Next. 9. Sort the fields or click Next to continue. 10. Click Finish to save your report.

See Also
l

Monitoring Data from a Cisco Wireless Access Controller Creating Custom Reports

Connecting Remotely to Devices- Overview You can connect remotely to any device in a site's network using the following programs:
l

ExpertAssist Remote Desktop Connection (RDP) VNC SSH Telnet Web Browser Web Proxy

Topics in this section

l

Using ExpertAssist Managing Devices Using a Web Proxy Configuring the Remote Control Settings

Using ExpertAssist ExpertAssist is an advanced, behind the screens remote troubleshooting tool for Windows-based desktops and servers. ExpertAssist can remotely manage devices without interrupting users while they work. It provides more than 45 distinct capabilities to control, manage and gather information from remote computers. These capabilities include file transfer, stopping and starting services, command prompt, registry editing, and local disk manipulation, as well as access to real-time performance information.

ExpertAssist provides the following features:

l

Instantly chat online with a user while you have control of their machine - in real-time Resolve issues on computers behind the scenes without interrupting users as they work Transfer files from a computer at a site to your computer to quickly resolve issues Real-time remote control of end user computers and servers Reduce site downtime by covering all support scenarios Create and run custom scripts Transfer files by point-to-point Manage registry configuration Over 40 different features to support registry, file system, and performance indicators

For more information about integrating ExpertAssist with your product, see the ExpertAssist User Integration Guide. To deploy ExpertAssist in Foglight NMS 1. In Foglight NMSStudio, select a device with an agent deployed on it and then right-click. NOTE: ExpertAssist only works on a device that is an agent. 2. In the Context menu, click Connect -> ExpertAssist. NOTE: It may take a few seconds for the ExpertAssist login page to appear as the application attempts to initialize and connect. 3. Log in to ExpertAssist.

See Also
l

ExpertAssist User Integration Guide

Managing Devices Using a Web Proxy A web proxy is a proxy server that accepts a target URL in a browser window on your machine, processes the request, and then displays the contents of the requested URL in the same browser

window. When you connect to a device using the web proxy feature in the Studio, Foglight NMS creates a secure tunnel to the target device without using VPN. Once the connection is established, you can remotely manage the device. If you have Google Chrome installed on your local machine, the Foglight NMS Studio automatically launches a Chrome browser window in incognito mode. This private browsing window allows you to browse in stealth mode. For more information on Google Chrome's incognito mode, see Using the Incognito mode (private browsing). If you do not have Google Chrome installed, Foglight NMS launches its own web browser window that provides the same secure connection to a device. NOTE: Web proxy only works with devices that have a web server running on port 80. To connect to a device through a web proxy: In the Devices view, right-click the device, and then click Connect -> Web Proxy. See Also
l

Troubleshooting: How do IAccess Devices That Use Java When Google Chrome Times Out? Configuring the Remote Control Settings

Troubleshooting: How do IAccess Devices That Use Java When Google Chrome Times Out?

If you use Google Chrome to access a device that uses Java for its management console, such as the HP-ProCurve 2500 series, the the Java applet may not load properly and will time out. You can use the following workaround to correct this issue: Disable Google Chrome on your machine and use the ptBrowser The ptBrowser is a web browser that Foglight NMS launches if you do not have Goggle Chrome installed. Even if you have Google Chrome installed, you should use the ptBrowser. In the ptBrowser, the Java applet should load properly. Some platforms will also require you to configure the Internet Explorer security settings to allow pages of these types to load. You can also add these pages to the Trusted Sites section of the Internet Explorer security options, and then

reload the page. In order to use the ptBrowser, you will have to temporarily disable Chrome by either renaming the chrome.exe file or by uninstalling it.

Configuring the Remote Control Settings Devices and applications come in all shapes and sizes. You may need to change the settings for each device or application that you work with remotely in order to make it compatible with the laptop or desktop that you are using to connect to it. The Remote Control Settings feature allows you make changes to the screen size and clarity of the remote device or application so that you can effectively and efficiently work remotely. To configure the remote control settings 1. From the Devices View, select the device that you want to connect to through tunneling. 2. Right-click the device and select Settings -> Remote Control. 3. In the Preferred Tunneling Ports section, use the up and down arrows to select the new preferred port number or type it in the field provided. 4. In the RDP Settings section, select a new color depth or select a new preferred resolution in the list. 5. Click Apply and OK to save your changes.

Collecting Real-time Data Using Go Live! The challenge with most break-fix services today is they have no view of what is truly going on within your network. The Go Live! feature provides real-time monitoring and data collection that dramatically reduces the troubleshooting process. To use Go Live! 1. In the Foglight NMS Studio, select a device and right-click it. 2. Click Go Live! The Go Live! dialog appears.

3. In the Select Duration drop-down list, choose how long you want Go Live! to run.

4. (Optional) Click Advanced Options to select the types of data that you want to collect during Go Live! and to set how often you want this data collected. 5. Click Run.

Verifying the Device Monitor Status Foglight NMS provides a status summary that can tell you whether or not a device was successfully polled and if data was collected for each monitor assigned to it. You can also see what monitors are assigned to a device, when the a monitor failed to poll a device, and why the failure occurred. To view the Device Monitor Status 1. In the Devices view, select a device. 2. Right-click the device and then click Settings -> Verify Monitoring Status.

Deciphering Error Codes The following table contains a list of errors that you may see in the Device Monitor Status window. You can also find a description and solution for some of the more common errors.
Error Code Description Solution

agentServiceDown

SNMP request error code

Any one of the following conditions can help you determine why this error is occurring: Target device may not be supporting SNMP Target device may have firewall software running which could be block-

Error Code

Description

Solution

ing the SNMP request from the agent SNMP agent software may not be running on the target machine You may want to make sure that SNMP is enabled on the agent device and the correct credentials are assigned to it.

BadDestination

If you used a network name or alias for the des- Retry the Route tination parameter in the Route command and command, specyou get this message, then the Route command ifying a valid was unable to find the name or alias in the NET-destination. WORKS file on the local computer (the path to the NETWORKS file is \\<Systemroot>\\system32\\drivers\\etc). If you used an IP address, you may have specified an invalid format. For example, you may not have used a dotted decimal format, such as 127, 284.122.107, or 284.122.108). The target device may not be accessable from the agent machine. For example, the destination does not exist.

ERROR_BAD_ARGUMENTS

One or more arguments are not correct. A bad If you entered argument may have been entered or the prod- the bad arguuct is passing bad arguments. ment, you must reenter the proper argument.

Error Code

Description

Solution

OR Contact Support if you determine that the product passed a bad argument. ERROR_FUNCTION_FAILED Function failed during execution. For example, Make sure you a problem occurs when monitoring devices. Try-do not have a ing to collect particular information from firewall devices causes the issue. between the device and Foglight NMS. You can create an ACL to permit data to be collected.

ERROR_INVALID_POINTER

The pointer is not valid. This issue is product specific.

Contact Support

ERROR_NO_NET_OR_BAD_ PATH

The network path was either typed incorrectly, You can try to does not exist, or the network provider is not retype the path currently available. Target machine or domain or contact your is not found or does not exist (it may have been network adminentered incorrectly or not connected to prop- istrator. erly).

NoSuchName

There is no such variable name in this MIB device. The information that the agent device is trying to collect may not be supported.

SNMP may not be configured properly. It is recommended that you make sure you have the proper cre-

Error Code

Description

Solution

dentials assigned to the device. OR Device cannot provide the information requested. Check to see that you are collecting the right type of information from the right type of device. For example, you cannot collect fan speed, CPU temp, or memory from a printer. notImplemented When you use Internet Explorer on your Windows XP-based computer to try to view a web page, you may receive an error message. This issue may occur if either of the following conditions exist:
l

Check to see if SNMP was configured properly. OR

A third-party product is interfering with Device cannot Internet Explorer. provide the information The HTTP 1.1 setting is enabled. requested SNMP monitoring similar to nosuch(same as name. NoSuchName). Check to see that you are collecting the right type of information from the

Error Code

Description

Solution

right type of device. For example, you cannot collect fan speed, CPU temp, or memory from a printer. OR Contact Support RPC_E_SERVERCALL_RETRY- Call was rejected by callee. You may see this LATER error if you are automating Excel through the COM interface, or implementing an RTD server and calling UpdateNotify from a different thread. The error is raised when Excel is not ready to handle your call - for example, if the user is busy editing a cell or pressing the mouse button. This error occurs when the server is heavily stressed. For example, when Foglight NMS is trying to collect data for active directory, exchange, SQL server performance counters while the target machine is under load. It is recommended that you install an agent on the target machine instead of monitoring devices using WMI (remote monitoring).

ServiceUnavailable

The Web server (running the Web site) is currently unable to handle the HTTP request due to a temporary overloading or maintenance of the server. The implication is that this is a temporary condition which will be alleviated after some delay. Some servers in this state may also simply refuse the socket connection, in which case a different error may be generated because the socket creation timed out. Also, when the target application or software is not running.

Check to make sure that the software is running.

Error Code

Description

Solution

TimedOut or Timeout

A remote device is very slow to respond to a request. For SNMP, this error may be caused by assigning the incorrent credentials to the device.

Check the credentials and make sure the devices have enough memory or power to respond quickly. OR Connectivity may be slow.

TtlExpired

TTL expired in transit. The TTL value determines the maximum amount of time an IP packet may live in the network without reaching its destination. It is effectively a bound on the number of routers an IP packet may pass through before being discarded. This message indicates that the TTL expired in transit. Also, if there was an attempt to ping the device with a smaller TTL value.

Open the Policy Editor to increase the TTL value set for the Ping monitor.

usmStatsUnknownUserName The total number of packets received by the SNMP engine which were dropped because s they referenced a user that was not known to the SNMP engine.

Check to make sure that you have the correct SNMP credential assigned.

WBEM_E_NOT_FOUND

When you try to open a Windows Management If a firewall is Instrumentation (WMI) namespace on a com- blocking access puter that is running Windows Server 2003 to WMI, add the Service Pack 2 (SP2), you receive this error WMI namescode. This issue occurs because the WMI repos- pace to the fireitory is corrupted. The WMI service does not wall exclusion handle an item deletion operation for the WMI set. repository correctly. Therefore, the index tree OR

Error Code

Description

Solution

of the WMI repository is corrupted, and the error code that is mentioned in the "Symptoms" section occurs when you try to open a namespace. Also, firewall may be blocking access to WMI.

Make sure that WMI services is running in the Windows service manager.

Viewing the Details of a Device The main devices page provides a quick summary about your device. You can drill-down to the details page to see more information about a device. To view the device details 1. In the Foglight NMS Studio, select a device on the Devices main page. 2. Double-click it to view its details, as shown in the following image:

Monitoring Avaya VoIP Systems

As a network professional with increased responsibility and continually evolving technology, you may experience the challenge of effectively monitoring your VoIP systems. You need adequate visibility into how your IT infrastructure and VoIP systems are working together. You want to use a single tool to effectively manage and monitor issues such as dropped calls, poor voice quality, packet loss, latency and other issues. To effectively run your business you need the most efficient VoIP monitoring system to enhance user satisfaction and meet IP SLAs? With a Cisco and Shoretel VoIP solution coming soon, Foglight NMS now provides a comprehensive VoIP monitoring solution for the different components of Avaya VoIP, specifically Avaya Aura and Avaya IP Office. Using the Avaya VoIP monitoring solution you can:
l

Determine the health of your Avaya infrastructure, including Avaya Communication Manager, PBX systems, IP phones, routers, and switches. Get the Call Detail Records (CDR), which includes currently active calls, as well as calls during any historical period. Monitor MOS score latency, jitter and packet-loss for each call. Get historical reports and trend charts over a specified time period. Create network maps to provide a detailed map of VoIP and network infrastructure across local and distributed environments. Monitor the mix of VoIP and other network traffic to understand the network, bandwidth and capacity utilization and bottlenecks of different applications. Use an agent and/or agent-less approach to monitor your VoIP and network infrastructure distributed at different sites to achieve better scalability and performance. Monitor across multiple domains using physical and virtual infrastructure. Monitor ESX servers, Nexus switches, VMs, etc. Produce a comprehensive and rich set of pre-defined and customizable reports. Receive standard and customizable alerts through e-mail, SMS, etc.

Topics in this section

Preparing the PBX Monitoring Avaya IPOffice Systems Monitoring Avaya Aura Communication Manager

Preparing the PBX

Topics in this section

l

Configuring RTCP Monitoring Configuring CDR Monitoring

Configuring RTCP Monitoring RTCP (Real-Time Transport Control Protocol) is a protocol providing support for applications with real-time properties, including timing reconstruction, loss detection, security, and content identification. It reports information about the RTP (Real-Time Transport Protocol) stream. RTCP provides support for real-time conferencing for large groups within an Internet, including source identification and support for gateways (like audio and video bridges) and multicast-tounicast translators. It also provides information about Jitter, Packet Loss, and other data useful for analyzing voice quality. Foglight NMS obtains metrics from the Avaya Aura VoIP telephony network by collecting RealTime Control Protocol (RTCP) packets that are sent by Avaya endpoints, such as IP phones and gateways. These RTCP packets contain data about the performance of sessions running between the endpoints, including QoS (Quality of Service) measurements, such as network latency, jitter and packet loss. Each one of these measurements can be collected for a call. Foglight NMS can only receive RTCP data if you properly configure the Avaya Aura PBX to send the reporting data to the IP address of the Avaya Aura VoIPserver. NOTE: You cannot collect RTCP data for Avaya IP Office Systems. To set up the PBX

1. Open a SAT session and log on with administrative rights. 2. At the command prompt, type the following: change system-parameters ip-options

3. In the RTCP MONITOR SERVER section, you need to define the IP address and port for Avaya Aura VoIP server. Use the following values: a. In the Default Server IP Address field, type the IP address of the Avaya VoIP server. b. In the Default Server Port field, type 5005, which is the inbound UDP port for Avaya Aura. NOTE: This port is used only for Avaya Aura Communication Systems. Avaya IPOffice Systems do not collect RTCPdata. c. In the Default RTCP Report Period (secs) field, type 5. 4. Press Esc+e to apply and save your changes.

To set up a Network Region Once the VoIP server IP address has been set up on the Avaya PBX, you can set the associated network regions to use either this IP address as the default setting or you can add individual IP addresses can to each region.

1. At the command prompt, type the following: change ip-network-region <n> (where <n> is the IP network region number to be monitored).

2. In the RTCP Reporting Enabled? field, type y. NOTE: The 'y' indicates 'yes'. 3. In the Use Default Server Parameters? field, type y. 4. Repeat steps 2 and 3 for all IP network regions that you want to monitor. NOTE: You can configure only 1 RTCP MONITOR SERVER per IP network region. 5. Press Esc+e to apply and save your changes. The RTCP changes will take effect immediately for all calls, including those already in progress.

Configuring CDR Monitoring Foglight NMS can provide a full range of call history metrics by configuring the Avaya PBX to capture Call Detail Records (CDRs). There are several steps that you must complete to ensure that the CDR is properly configured on the PBX. Click the following links to learn more.
l

Adding Node Names Adding an IP CDR Service

Setting CDR System Parameters Enabling Intra-switch CDRs Enabling CDR Reporting for Trunk Groups

Adding Node Names 1. Open a SAT session and log on with administrative rights. 2. At the command prompt, enter: change node-names ip

3. Complete the following steps:

l

Type the IPaddress of the Foglight NMS server. Type the name of the Foglight NMS server.

NOTE: If the PBX has an S85xx or S87xx series Media Server, then ensure that a valid node name for the CLAN board exists as well. If it has an S8300 series Media Server, then ensure that a valid node name for the PROCR also exists.

Adding an IP CDR Service You can define the CDR link by completing the following steps. 1. At the command prompt, enter: change ip-services

2. To define a primary CDR link, the following details should be completed:

l

Service Type: Set to 'CDR1'. If it already exists, you can define a secondary link by setting the Service Type to 'CDR2'. Local Node: Add the node name for the CLAN (S85xx or S87xx series) or PROCR (S8300 series). Local Port: The Local Port is fixed to 0 as Avaya Aura Communication Manager will initiate the CDR link. Remote Node: Add the node name for the Avaya VoIP server. This node name is the same one that you added in the previous section, Adding Node Names. Remote Port: The Remote Port may be set to a value between 5000 and 64500 inclusive. The default TCP port for the Avaya VoIP server is 50004 for Avaya Aura Communication Manager and 50006 for Avaya IP Office.

3. On page 3 of the IP SERVICES form, disable the Reliable Session Protocol (RSP) from the CDR link by setting the Reliable Protocol field to 'n'.

Setting CDR System Parameters You should set up the CDR System Parameters form of the Avaya SAT program with the required parameters for calls to track and format CDR data. 1. At the command prompt, enter: change system-parameters cdr

2. Make sure you use the following settings: a. CDR Date Format: month/day b. Primary Output Format: unformatted c. Primary Output Endpoint: CDR1 3. Make sure you use the following parameters to define the type of calls that will be recorded and what data will be included in the record:

a. Use Legacy CDR Formats? y This parameter confirms the use of the Avaya Communication Manager 3.x (legacy) formats in the CDR records produced by the system. b. Intra-switch CDR: y If CDRs are required for intra-PBX calls, then you must set the 'Intra-switch CDR?' option to y. This setting captures call record data for internal calls at specific stations. You must specify what those stations are in the INTRA-SWITCH-CDR form. c. Record Outgoing Calls Only? n This parameter allows incoming trunk calls to appear in the CDR records along with the outgoing trunk calls. d. Outg Trk Call Splitting? y This parameter allows a separate call record for any portion of an outgoing conference call or a transfer call. e. Inc Trk Call Splitting? n This parameter does not allow a separate call record for any portion of an incoming conference call or transfer call.

Although you can set all the options to 'n', it is recommended that you use the preceding PBX settings. When you use these recommended settings, the CDRs are captured for most types of calls (conference calls, transfers, attendant) and intra-switch. Unless there is a requirement for any other particular option, the default is 'n'.

Enabling Intra-switch CDRs CDRs are usually only sent when users make calls through a trunk. In the case of an Intra-switch call, which is a call that goes to another phone directly connected to the PBX, you must enable your Avaya system to capture the CDR data for this type of call. Intra-switch CDRs are only available if you enable them for specific extensions. If the Intra-switch CDR field is set to y on Page 1 of the CDR SYSTEM PARAMETERS form, then you will also need to update the INTRASWITCH CDR form by defining the extensions that will be subjected to call detail recording. 1. At the command prompt, enter: change intra-switch-cdr

2. In the Assigned Members field, type the individual extensions for which you want the usage tracked with the CDR records.

Enabling CDR Reporting for Trunk Groups You must verify CDR reporting is enabled for each trunk group for which you want to capture CDR records. 1. At the command prompt, enter: change trunk-group <n> where <n> is the trunk group number

2. Make sure that the CDR Reports field is set to y. 3. Repeat the preceding steps for all trunk groups that you want to report CDR data.

Monitoring Avaya IP Office Systems

Topics in this section

l

Avaya IP Office VoIP Systems - Overview Understanding Avaya IP Office Modules Configuring Modules for Avaya IPOffice Systems

Avaya IP Office VoIP Systems - Overview The Avaya IP Office module allows you to monitor all the components of the Avaya IP Office System which are: Avaya IpOffice. The key component for deploying this VoIP system. You must have the valid SNMP credentials in order to monitor this device. Additionally, you can only monitor one Avaya IpOffice device per module at one time.

IpPhone. You can assign as many IP phones to this role, as well as add multiple IpPhones at one time. The IpPhone role does not require SNMP credentials. Related Devices. Devices that are important to the operation of Avaya IP Office. For example, if there is a switch critical to having an Avaya IP Office system work properly, you can use the Related Devices role to add it the module. All the data collected from these related devices will appear in the VoIP gadgets. Understanding Avaya IP Office Modules There are several easy and quick steps that you must take to configure Foglight NMS start monitoring and managing your Avaya IP Office VoIPsystem. It is also important that you understand how each role in the Avaya IP Office module works and what credentials, if any, you will need for it to work properly. Modules. A module is a collection of devices associated with a site. The collection of devices can be a mix of VoIP devices and devices related to the operation of your Avaya VoIP system. Each site can have multiple modules configured to monitor and manage the VoIPdevices in the network. Roles. A role is the component that contains the different types of devices that exist within a module. For example, the Avaya IP Office module has the following 3 roles:
l

Avaya IpOffice: The key component for deploying this VoIP system. You must have the valid SNMP credentials in order to monitor this device. Additionally, you can only deploy one Avaya IpOffice device per module. IpPhone: You can assign as many IP phones to this role, as well as add multiple IpPhones at one time. The IpPhone role does not require SNMP credentials. Related Devices: Devices that are important to the operation of Avaya IP Office. For example, if there is a switch critical to having an Avaya IP Office system work properly, you can use the Related Devices role to add it the module. All the data collected from these related devices will appear in the VoIP gadgets.

Adding Devices. For more information on how you can add new or existing devices to a module, click here.

Monitors and Alerts. Some roles have a set of predefined monitors associated with them. The set of monitors that appears for each role is driven by the type of data that needs to be collected from the devices in that role. Furthermore, unlike the monitors in a policy you cannot disable any of the monitors in this set. You can change the monitoring intervals for each monitor as well as adjust any settings, if available. Included in the predefined set of monitors for each role are the 3 monitors that are critical for drawing network maps: Port Map, IP Configuration, and Network Interface Configuration. By creating a network map for your Avaya IP Office systems, you can show where these devices are located within a site and how they connect to other network infrastructure. NOTE: You cannot assign custom monitors to an Avaya IP Office module. The Alerts function in the VoIPmodule works the same way as it does in a policy. You can add the following VoIP-related alerts (or any other alerts):
l

Avaya VoIP Average MOS: triggers an alert if the average MOS score for the overall PBX system is greater than a value of 0. Avaya Any Call MOS: triggers an alert if the MOS score for any call is greater than the value of 0. Avaya Any Call Latency: triggers an alert if the latency of a call is greater than the value of 0. Avaya Any Call Packet Loss: triggers an alert if the jitter of a call lasts for an amount of time greater than the value of 0 milliseconds. Avaya PBX Call Volume: triggers an alert if the overall call volume of the Avaya PBX system is greater than a value of 0.

Blackout Schedules: A blackout schedule allows you to disable monitoring, alerts, and actions on a policy or a device when the device or devices will be down due to maintenance. For example, if you add additional memory to a server at a specific time of the day, you can set a blackout schedule so that during this time alerts are not triggered while the device is down. Configuring Modules for Avaya IP Office Systems Before you can start to monitoring and managing your AvayaIP Office system, you must properly configure the module for it. You can have multiple modules configured in Foglight NMS.

The following set of instructions will show you how to set up a module that specifically monitors your Avaya IP Office system. To add a new Avaya IP Office module 1. In the tree view, right-click Module and then click Add New. 2. In the Add Module window, select Avaya IP Office. You can modify the name and description. Each module must have a unique name. 3. Click Add Module. 4. Configure the Avaya IProle by doing the following: a. In the Device section, select a new or existing device and provide the correct credentials for that device. NOTE: For Avaya IpOffice, only one device can be assign to this role at any given time. Click the Monitors and Alerts tab. You can modify any of the monitoring intervals or settings, if available. b. To add alerts: in the Alerts section, click New. c. (Optional) Click the Advanced tab to create a new blackout schedule or select an existing one. 5. Click IpPhone. You will need to do the following to configure this role properly: a. In the Device(s) section, select new or existing devices. You do not need to provide SNMPcredentials for IpPhones. b. Click the Monitors and Alerts tab. You can modify any of the monitoring intervals or settings, if available. c. To add alerts: in the Alerts section, click New. For more information on adding alerts, click here. d. (Optional) Click the Advanced tab to create a new blackout schedule or select an existing one. 6. Click Related Devices. You will need to configure this role by doing the following: a. Select all related devices. A related device is a device that is important to the operation of Avaya IP Office.

7. Click Apply to apply your changes to the module configuration. 8. Click OK to exit the Module Editor.

Monitoring Avaya Aura Communication Manager Systems

Topics in this section

l

Avaya Aura VoIP Systems - Overview Understanding Avaya Aura Modules Configuring Modules for Avaya Aura Systems

Avaya Aura VoIP Systems - Overview The Avaya Aura module allows you to monitor all the components of the Avaya Aura System which are: Avaya Aura Communication Manager. The key component for deploying this VoIP system. You must have the valid SNMP credentials in order to monitor this device. Additionally, you can only monitor one Avaya Aura device per module at one time. Aura Gateway. This device provides the best call-processing quality and availability for your IP infrastructure and extends the power of Avaya Communication Manager software to all users at a site. You must have valid SNMP credentials for your gateway devices. Avaya IP Phone: You can assign as many IP phones to this role, as well as add multiple IP Phones at one time. The IP Phone role requires valid SNMP credentials. Related Devices. Devices that are important to the operation of Avaya IP Office. For example, if there is a switch critical to having an Avaya IP Office system work properly, you can use the Related Devices role to add it the module. All the data collected from these related devices will appear in the VoIP gadgets. MOS Score Settings. The Mean Opinion Score (MOS) is a test used to obtain the human user's view of the quality of the network. This role provides you with the option to customize specific settings so that you can gather metrics, such as MOS, latency, packet loss, and jitter. You can

also use the weightage scale for latency, packet loss, and jitter to weigh how much each one counts when determining the MOS score. Understanding Avaya Aura Modules There are several easy and quick steps that you must take to configure Foglight NMS start monitoring and managing your Avaya Aura CommunicationPlatform. It is also important that you understand how each role in the Avaya Aura module works and what credentials, if any, you will need for it to work properly. Modules. A module is a collection of devices associated with a site. The collection of devices can be a mix of VoIP devices and devices related to the operation of your Avaya Aura platform. Each site can have multiple modules configured to monitor and manage the VoIPdevices in the network. Roles. A role is the component that contains the different types of devices that exist within a module. For example, the Avaya Aura module has the following roles:
l

Avaya Aura Communication Manager: The key component for deploying the Avaya Aura platform. You must have valid SNMP credentials in order to monitor this device. Additionally, you can only deploy one Avaya IpOffice device per module. Aura Gateway. This device provides the best call-processing quality and availability for your IP infrastructure and extends the power of Avaya Communication Manager software to all users at a site. You must have valid SNMP credentials for your gateway devices. Avaya IP Phone: You can assign as many IP phones to this role, as well as add multiple IP Phones at one time. The IP Phone role requires valid SNMP credentials. Related Devices: Devices that are important to the operation of Avaya Aura. For example, if there is a switch critical to having an Avaya Aura platform work properly, you can use the Related Devices role to add it the module. All the data collected from these related devices will appear in the VoIP gadgets. MOS Score Settings: The Mean Opinion Score (MOS) is a test used to obtain the human user's view of the quality of the network. This role provides you with the option to customize specific settings so that you can gather metrics, such as MOS, latency, packet loss, and jitter. You can also use the weightage scale for latency, packet loss, and jitter to weigh how much each one counts when determining the MOS score.

Adding Devices. For more information on how you can add new or existing devices to a module, click here. Monitors and Alerts. Some roles have a set of predefined monitors associated with them. The set of monitors that appears for each role is driven by the type of data that needs to be collected from the devices in that role. Furthermore, unlike the monitors in a policy you cannot disable any of the monitors in this set. You can change the monitoring intervals for each monitor as well as adjust any settings, if available. Included in the predefined set of monitors for each role are the 3 monitors that are critical for drawing network maps: Port Map, IP Configuration, and Network Interface Configuration. By creating a network map for your Avaya Aura platforms, you can show where these devices are located within a site and how they connect to other network infrastructure. NOTE: You cannot assign custom monitors to an Avaya Aura module. The Alerts function in the VoIPmodule works the same way as it does in a policy. You can add the following VoIP-related alerts (or any other alerts):
l

Avaya VoIP Average MOS: triggers an alert if the average MOS score for the overall PBX system is greater than a value of 0. Avaya Any Call MOS: triggers an alert if the MOS score for any call is greater than the value of 0. Avaya Any Call Latency: triggers an alert if the latency of a call is greater than the value of 0. Avaya Any Call Packet Loss: triggers an alert if the jitter of a call lasts for an amount of time greater than the value of 0 milliseconds. Avaya PBX Call Volume: triggers an alert if the overall call volume of the Avaya PBX system is greater than a value of 0.

Blackout Schedules: A blackout schedule allows you to disable monitoring, alerts, and actions on a policy or a device when the device or devices will be down due to maintenance. For example, if you add additional memory to a server at a specific time of the day, you can set a blackout schedule so that during this time alerts are not triggered while the device is down.

Configuring Modules for Avaya Aura Systems Before you can start to monitoring and managing your Avaya Aura platforms, you must properly configure a module for it. You can have multiple modules configured in Foglight NMS. The following set of instructions will show you how to set up a module that specifically monitors your Avaya Aura Communication Platform. To add a new Avaya Aura module 1. In the tree view, right-click Module and then click Add New. 2. In the Add Module window, select Avaya Aura. You can modify the name and description. Each module name must be unique. 3. Click Add Module. Configure the Avaya Aura Communication Manager role by doing the following: a. In the Device(s) section, select a new or existing device and provide valid SNMP credentials for all devices. NOTE: For Avaya Aura Communication Manager, only one device can be assign to this role at any given time. b. Click the Monitors and Alerts tab. You can modify any of the monitoring intervals or settings, if available. c. To add alerts, click New. For more information on adding alerts, click here. d. (Optional) Click the Advanced tab to create a new blackout schedule or select an existing one. 4. Click Aura Gateway. You will need to do the following to configure this role properly: a. In the Device(s) section, select a new or existing device and provide valid SNMP credentials for all devices. b. Click the Monitors and Alerts tab. You can modify any of the monitoring intervals or settings, if available. c. To add alerts, click New. For more information on adding alerts, click here. d. (Optional) Click the Advanced tab to create a new blackout schedule or select an existing one. 5. Click IP Phone. You will need to do the following to configure this role properly.

a. In the Device(s) section, select a new or existing device and provide valid SNMP credentials for all devices. b. Click the Monitors and Alerts tab. You can modify any of the monitoring intervals or settings, if available. c. To add alerts, click New. For more information on adding alerts, click here. d. (Optional) Click the Advanced tab to create a new blackout schedule or select an existing one. 6. Click Related Devices. Do the following to configure this role: a. Select all related devices. A related device is a device that is important to the operation of Avaya Aura platforms. 7. Click MOS Settings. Do the following to customize the settings in this role: a. Click the up and down arrows to change any of the measurements for each metric. b. Drag the weightage scale to adjust the scale for latency, packet loss, and jitter. This action will weigh how much each metric counts when determining the MOS score. 8. Click Apply to apply your changes to the module configuration. 9. Click OK to exit the Module Editor.

Analyzing Traffic Flow Data

Overview Network Traffic Analysis identifies which users or applications are generating traffic on your network and how much network bandwidth they are consuming. For example, you may want to know what specific traffic is clogging your sites' networks. Is it your Exchange server? Is a user streaming YouTube videos or music from iTunes that may be causing bandwidth utilization issues? You can drill-down into applications, conversations, domains, endpoints, and protocols to see how this bandwidth usage is impacting your network and to identify the exact sources of spikes and bursts. Also, you can set up an alert to notify you when these spikes occur. Foglight NMS monitors network traffic by capturing flow information from devices, such as routers, switches, servers, and desktops. By enabling NetFlow on your flow capable devices, you can export traffic flow information from these devices to your Foglight NMS server. NOTE: The Network Traffic Analysis feature supports Cisco NetFlow versions 1, 3, 5, 7, and 9, as well as Juniper, J-Flow, and sFlow. To learn more about how Foglight NMS analyzes network traffic information from devices that are not flow-capable devices (in other words, devices that do not support the more common network analysis protocols such as NetFlow, J-Flow, and sFlow), see Enabling ptFlow.
Topics in this section
l

How Foglight NMS Collects Network Traffic Flow Data Viewing Traffic Flow Information How to Scope Your NetFlow Traffic Data Understanding the Various Groups of Traffic Flow Information Seeing How Traffic Flow Information is Trending Enabling NetFlow Enabling ptFlow

How Foglight NMS Collects Network Traffic Flow Data Capturing flow information from flow-capable devices provides an abundance of information that can help you better manage bandwidth usage on your sites' networks. By enabling your flow-capable devices to export NetFlow information to the server, flow data packets are captured for all of these devices. Foglight NMS takes this information and presents it to you in a very easy-to-read format, which you can use this data to determine how traffic impacts your networks. Additionally, you can generate a report using this information to help your sites plan for future network capacity. The following diagram shows how Foglight NMS collects NetFlow data and sends it to the server. Keep in mind that NetFlow data is sent to the server on port 2055 so you must make sure that it is open and not in use by another device. If it is, you can use and alternative port, such as port 9555 or port 995.

See Also
l

Enabling NetFlow

Enabling NetFlow By enabling Netflow on your devices, you are configuring your devices to export NetFlow data to the Foglight NMS server. The following instructions show you how to enable Netflow on a Cisco router. Enable Cisco Express Forwarding:

router(config)# ip cef In the configuration terminal on the router, issue the following to start NetFlow Export. It is necessary to enable NetFlow on all interfaces through which traffic you are interested in will flow. Now, verify that the router is generating flow stats - try 'show ip cache flow'. Note that for routers with distributed switching (GSR's, 75XX's) the Rendezvous Point CLI will only show flows that made it up to the RP. To see flows on the individual linecards use the 'attach' or 'if-con' command and issue the 'show ip cache flow' on each LC. Enable export of these flows with the global commands. 'ip flow-export source' can be set to any interface, but one which is the least likely to enter a 'down' state is preferable. Netflow will not be exported if the specified source is down. For this reason, we suggest the Loopback interface, or a stable Ethernet interface: router(config)# ip flow-export version 5 router(config)# ip flow-export destination <ip-address> <port> router(config)# ip flow-export source FastEthernet0 Use the IP address of your NetFlow Collector and configured listening port. If your router uses BGP protocol, you can configure AS to be included in exports with command: router(config)# ip flow-export version 5 [peer-as | origin-as] The following commands break up flows into shorter segments. router(config)# ip flow-cache timeout active 1 router(config)# ip flow-cache timeout inactive 15 Use the commands below to enable NetFlow on each physical interface (i.e. not VLANs and Tunnels, as they are auto included) you are interested in collecting a flow from. This will normally be an Ethernet or WAN interface. You may also need to set the speed of the interface in kilobits per second. It is especially important to set the speed for frame relay or ATM virtual circuits. interface <interface> ip route-cache flow bandwidth

Now write your configuration with the 'write' or 'copy run start' commands. When in enabled mode, you can see current NetFlow configuration and state with the following commands: router# show ip flow export router# show ip cache flow router# show ip cache verbose flow

Enabling ptFlow Foglight NMS Traffic Analyzer supports ptFlow technology, as well as industry standards NetFlow, sFlow, and J-Flow. ptFlow is a packet capture and filtering engine that allows users to gather traffic information from non-Flow supported devices such as computers, routers and switches. The results appear just as they would with any traditional flow technology. You can use the following information to configure and deploy ptFlow. Configuration NOTE: It is recommended that you use 2 NICs. You can use one NIC to collect the mirrored traffic and the other NIC to maintain network and Internet connectivity. 1. Establish port mirroring on the router or switch. Port mirroring is used on a network device to send a copy of all network packets seen on one switch port (or an entire VLAN) to a network monitoring connection on another switch port. Port mirroring on a Cisco Systems switch is generally referred to as Switched Port Analyzer (SPAN); some other vendors have other names for it, such as Roving Analysis Port (RAP) on 3Com switches. Please consult your device's manual to see if it supports port mirroring and instructions on how to enable it. 2. In the Details View, select an agent device and right-click it. 3. Click Tools -> Enable Traffic Analysis. 4. In the Traffic Analysis Enablement window, check to see that the Enable ptFlow option is selected. The Enable NetFlow or sFlow option is not available if the device you selected is a Cisco device or if it not an agent device. 5. Click Next. 6. The Foglight NMShost server IP will appear automatically. Select the Ingress (traffic in) and Egress (traffic out) check boxes on all your desired interfaces.

7. Click Save. 8. Click Next, and then click Finish. 9. Click on Devices, select the machine running Foglight NMS and click View Details. ptFlow will appear under Network Traffic Flow.

Deployment Scenarios Case #1: After enabling port mirroring on the Switch or Router, connect the mirrored port to the computer running the Foglight NMS agent (this maybe host server or it may be your deployed agent). Case #2: Insert a hub into your desired location and then connect it to the computer running Foglight NMS agent (this maybe host server or it may be your deployed agent). NOTE: In the images below Perspective = Foglight NMS

Viewing Traffic Flow Information By drilling into the Device details, you can view the various groups of traffic flow information that has been collected from a flow-capable device. In the Network Traffic Flow window, you will see data for applications, conversations, domains, endpoints, protocols, and interfaces. To view network traffic information 1. In the Devices View, double-click a flow-capable device. NOTE: In order to view traffic information from a device, you must enable NetFlow on it.

2. On the Device Details page, click the Network Traffic Flow tab on the left side.

3. To set the scope of the information that you want to view in the chart, do the following:

In the Period drop-down list, select the scope for the reporting time period. For example, if you select This Month, then you will see the traffic flow information captured for the current month. For more information, see How to Scope Your NetFlow Traffic Data. In the Show Top drop-down list, select the number of records that you want to display. Keep in mind, the more records that you select to display, the more time it will take to load these records. In the Top Sort Order, select to view in the information in Bytes or Packets.

4. Click any of the following groups to start to drill down into the details of your traffic flow information: Applications, Conversations, Domains, Endpoints, Protocols, and Interfaces.

For example, in the Applications group, you can see which port the application is using, and how much traffic it has generated. If you select a record, you will see specific information about the endpoint, destination domain name, out packets and in packets, and more. NOTE: The scope that you selected in the previous step will remain in place as you view each group.

See Also
l

How to Scope Your NetFlow Traffic Data Understanding the Various Groups of Traffic Flow Information Seeing How Traffic Flow Information is Trending

How to Scope Your NetFlow Traffic Data How you scope your NetFlow traffic data allows you to look at network traffic patterns that occurred over hours, days, weeks, months, or year. When you get to the hour level, you can drill down to see more granular data. This data can help you see when something happened in your network and help you uncover the source of the problem. Once you have configured and enabled a NetFlow source, you can scope the NetFlow traffic data in the following ways:

This Hour shows data that starts at the top of the hour up until when you select this scope option. For example, if you want to view data for "This Hour" at 10:27 AM today, Foglight NMS shows data from 10:00 AM to 10:27 AM. Past Hour shows data for the previous hour. For example, if you want to view data for the "Past Hour" at 10:27 AM today, then Foglight NMSshows data from 9:00 AM to 10:00 AM. This Day shows all of today's data, which starts at 12:00 AM and stops at the top of the current hour. For example, if you want to view today's data at 10:27 AM, Foglight NMS shows data from today at 12:00 AM through today at 10:00 AM. Past Day shows all of yesterday's data, which starts at 12:00 AM and stops at 11:59 PM. This Week shows data for the current week starting on Monday and continuing through to today. For example, if you want to view data for "This Week" at 10:27 AM today, Foglight NMS shows data from Monday at 12:00 AM through today at 10:00 AM. Past Week shows data for the previous week starting at 12:00 AM on Monday of that week and ending on Sunday at 11:59 PM of the same week. This Month shows data starting on the first day of the current month and continues through to today. For example, if you want to view data for "This Month" at 10:27 AM, Foglight NMS shows data starting on the first day of the month at 12:00 AM through today at 10:00 AM. Last Month shows data from the previous month starting on the first day of that month at 12:00 AM and continues through to the last day of that month at 11:59 PM. This Year shows data starting on the first day of the current year and continues through to today. For example, if at 10:27 AM today you want to view data for "This Year", Foglight NMS shows all available data starting on January 1st at 12:00 AM through today at 10:00 AM. Past Year shows data for the previous year starting at 12:00 AM on January 1st of that year through December 31st of that same year at 11:59 PM.

Understanding the Various Groups of Traffic Flow Information Foglight NMS captures the various groups of traffic flow information and displays the information on the Device Details page. Applications

For each application shown in the list, you can see which port the application is using, and how much traffic it has generated. Select an application in the list and you will see more specific information about the endpoint, destination domain name, out packets and in packets, and more. Conversations The Conversation group shows you which nodes are going to which domain names or devices in a network. By selecting a conversation in the list, you can see which device has the highest number of conversations. If there is a spike in the data, you will see which user or device is causing this spike. Using the color-coding, you can look at the spike and then find the user or device in the Top Conversations list that is causing this spike in traffic. You can discover which user caused the spike, where they went, what port they were using, and the amount of traffic that was generated. You can also see the amount of time how long the traffic was generated for. This color coded chart provides you with a quick look at whos doing what on the network at what time, over which port. Domains The Domains group displays all the different web sites that your users are visiting, the amount of traffic generated, and the amount of time they spent surfing the web. If you double-click on a source IP, you can see the specific conversation for a domain on that IP address. Endpoints The Endpoints group displays traffic flow information between 2 devices. If you select an endpoint, you can see that this person is going to this system using this application. Clicking the Trend Chart button, you can see the spikes in the data when this action occurred. Again if you double-click , it shows you the specific conversations that took place between this user and this endpoint. Protocols The Protocol group displays the type of traffic that is being generated on your network and which protocols are consuming the most network bandwidth.

Network Engineers may find this information particularly helpful. For example, if you notice on the chart that there is more UDP traffic on your network than expected, you can see where and by whom is generating the traffic. Interfaces If you are collecting traffic from multiple interfaces on a switch, the Interface group allows you to easily identify which port the problem application is using. See Also
l

Viewing Traffic Flow Information

Seeing How Traffic Flow Information is Trending By default, a pie chart displays how the different conversations in a group compare to each other. However, Foglight NMS also provides a way for you to see how the data is trending. Pie Charts By default, Foglight NMS presents traffic flow information in a pie chart. As you can see in the following image, the pie chart is broken down into color-coded sections, where each color represents a specific conversation that occurred for a given group.

Trend Charts If you want to see how a particular conversation is trending, select it in the list of conversations, and then click the Trend Chart link. As you can see in the following image, this chart will show you if any spikes occur during the defined time period, and how much traffic is generated for this particular application or IP address.

NOTE: You can use the Pie Chart link on this page to return to the Pie Chart after viewing the Trend Chart. See Also
l

Viewing Traffic Flow Information

Managing Policies
Overview A policy defines how you manage and work with the information collected from your devices. In Foglight NMS, you can create local and global policies. Local Policies Local policies encompass devices, monitors, alerts, scheduled actions, and blackout schedules so that any configuration changes you make occur from one central location. In a local policy you can:
l

Create and save permanent policies that are assigned to designated target a single IP or a range of IPs and device groups. Define what and how often data is monitored and collected from your devices. Create custom SNMPmonitors. Set alerts to automatically notify you when an issue arises or the network's performance declines. Schedule an action to fix issues and restore the network to peak performance. Disable alerts, notifications, and scheduled actions from occurring during specific times and situations.

Global Policies Global policies work very similar to local policies. Like local policies, global policies encompass devices, monitors, alerts, scheduled actions, and blackout schedules so that any configuration changes you make occur from one central location. However, in a global policy you can:
l

Create cross-site policies. You can assign devices from different sites' networks to a single policy. You can change a setting for an individual device without applying that change to all the devices in the policy.

Topics in this section

l

Adding New Policies Editing Policies Removing Policies Migrating Devices from the Default Policy

Adding New Policies In addition to the built-in Smart Policies, you can create your own policies to manage data collected from a sites' networks. 1. In the Foglight NMS Studio, click New -> Policy. 2. Click OK. When the Policy Editor window appears, by default the Device tab is the tab that is active. 3. (Optional) Type a description in the provided field. 4. Click Add to add a device. To learn how to add devices to your policy see Adding Devices to New Policies. NOTE: You can add devices from different sites' networks to one policy. The Source column in this dialog tells you which device belongs to which site. 5. Click the Monitors tab. To learn how to add monitors to your new policy, see Adding Monitors to New Policies. 6. Click the Custom Monitors Tab. To learn how to add custom monitors to your policy, see Adding Custom Monitors to Policies. 7. Click the Alerts tab. To learn how to add alerts to your policy, see Adding Alerts. 8. Click the Scheduled Actions tab. To learn how to schedule an action for your policy, see Creating Actions for Policies. 9. Click the Blackout Schedule tab. To learn how to disable alerts and notifications during specific hours, see Creating New Blackout Schedules. 10. Click Save to save your changes and close the window.

See Also

About Monitors

Adding Devices to New Policies After you create a new policy you can start to add devices to it. Global Policies work across sites so you can add devices from different sites' networks to them. 1. Open the Policy Editor window for your new policy. 2. In the Device Members tab, click Add. 3. In the Select New Device Members dialog, navigate to the devices that you want to add and select them. NOTE: You can add devices from different sites' networks to one policy. The Source column in this dialog tells you which device belongs to which site. NOTE: You can select a single IPaddress or a range of IP addresses (using the Shift key). 4. Click Add. The IPaddresses that you selected appear in the window below. 5. Click Select and then click Yes. 6. Click Save to save your changes and close the Edit Policy window.

See Also
l

Adding New Policies

Adding Monitors to New Policies Monitors define what and how often data is monitored and collected from a sites' devices. When you add a monitor to your new policy, choose one that fits best with the devices in your policy. For example, if your new policy contains only VoIP devices, you will want to select the VoIP-related monitors, such as VoIP Call History, VoIP Active Calls, VoIP Manager Status, and VoIP Manager Settings. Some monitors also have additional settings that you can modify to customize the information that your product monitors and collects from a device. To add a monitor to a policy

1. In the Edit Policy window, click the Monitors tab. 2. Click Add Monitor. 3. In the Select Data Type dialog, select the monitor that you want to add to your new policy. 4. Click OK. 5. Click the button to select how often you want data collected from the devices assigned to that policy. 6. (Optional) If applicable, click Settings to customize the data collected from a device. 7. Click Save to save your changes and close the Edit Policy window.

See Also
l

Adding New Policies About Monitors in Policies

Editing Policies There are several changes to a policy that you can make in the Edit Policy window. For local policies, any change that you make will affect all the devices in that policy. For global policies, you can change any setting for an individual device without applying that change to all the devices in the policy. To edit a policy 1. In the tree view, in the Policies section, right-click a policy. 2. Click Edit. The Edit Policy window appears. NOTE: You must have System Administrator privileges to edit and remove global policies.

Editing the Devices Section You can add or remove the designated target devices that are assigned to a policy. Add one or more devices by doing the following:

1. In the Device Members tab, click Add. 2. In the Select New Device Members dialog, navigate to the devices that you want to add and select them. NOTE: You can select a single IPaddress or a range of IP addresses. 3. Click Add. The IPaddresses that you selected appear in the window below. 4. Click Select and then click Yes when the message box appears. 5. Click Save to save your changes and close the Edit Policy window.

Remove one or more devices by doing the following: 1. In the Device Members tab, select one or more devices. 2. Click Remove. 3. When the message box appears, click Yes.

Editing the Monitors Section If you applied the Smart Policy feature when you ran your network discovery, specific policies are automatically assigned recommended monitors and default time settings. When you edit the Monitors section of a policy, you can select additional monitors, remove existing monitors, and change the monitoring time interval. Add additional monitors to a policy by doing the following: 1. In the Edit Policy window, click the Monitors tab. 2. Click Add Monitor. 3. In the Select Data Type dialog, select the monitor that you want to add to your policy. 4. Click OK. 5. Click the button to select how often you want data collected from the devices assigned to that policy. 6. (Optional) If applicable, click Settings to customize the data collected from a device. 7. Click Save to save your changes and close the Edit Policy window.

Remove existing monitors in a policy by doing the following: 1. In the Monitors Tab, select the monitor that you want to remove by clicking in the shaded gray area located on the left-hand side. 2. Click Remove Monitor. 3. When the message box appears, click Yes. 4. Click Save to save your changes and close the Edit Policy window.

Change how often you monitor a device by doing the following: 1. In the Monitors Tab, navigate to the monitor that you want to edit. 2. Click the icy. button to select how often you want data collected from the devices in the pol-

3. Click Save to save your changes and close the Edit Policy window.

Changing a Setting for an Individual Device For Global Policies only, you can change how often you monitor a individual device and any settings for that device without applying your changes to all other devices in the policy. 1. In the tree view, in the Global Policies section, select a policy. 2. Select a device in the Devices view. 3. On the toolstrip, click Monitors And Alerts -> Configure For Device. 4. In the Device Policy Editor window, for the device that you want to edit, do one or both of the following:
l

Update how often you monitor the device by clicking the time interval.

button to select a new

Update the settings for that device by clicking Settings and then redefining filters or selecting or deselecting check boxes. NOTE: Device settings will vary for each device.

5. Click Save to save your changes and close the Device Policy Editor window.

See Also
l

About Monitors in Policies Adding New Policies

About Monitors in Policies Foglight NMS provides the following built-in monitors, which you can view when you click the Monitors tab in the Edit Policy window. Some monitors also have additional settings that you can modify to customize the information that your product collects from a device. If applicable, you will find the name of these settings and a brief description in the provided tables.
l

System Information Collects the device IPaddress, device types and roles, operating system, domain, and other detailed system information for a device.

Network Interface Configuration Collects the interface name , MAC address, and other network interface information for a device.

Ping Sends an ICMP (ping) command to a device. If the device does not respond to the request, the Ping monitor may not be working as expected.
Setting Ping Timeout (ms) Description

Maximum amount of time in milliseconds that Ping will wait for a response from the target.
Number of hops along the way to a specific address. With a setting of 100, your Ping Scan may pass through 100 different relay points on the way to the remote address before the network discards it.

Ping Packet TTL (Time-To-Live)

Pings Per Node

Establishes the number of Ping attempts sent to each address during a scan. When your product scans networks containing Cisco routers, you should set this number to a number above two (2). If the target IP address is not in the ARP cache of a Cisco router, the router discards the ICMP query (Ping) while it requests the MAC

Setting

Description

address of the target IP. The first Ping will never arrive at the subnet of the target IP address. In this situation, the Cisco router responds to the second Ping.
Delay Between Pings (ms)

Time in milliseconds between each successive Ping to a target address. If you set this value to a very low number, it will send a constant stream of Pings to a target IP address

CPU Monitors the number of processors, current usage, and average usage over time from a device.

Memory Monitors the memory currently in use, available free memory, and total memory capacity of a system.

Disk Volumes Provides disk usage and total capacity per volume for a device. Results are available in raw numbers and as percentages.

Programs Installed Provides a detailed list of all the software programs installed on a device.

Running Processes Provides name, path, CPU, and memory consumption for all the processes running on a device.

System Information Provides device IP Address, device type and roles, operating system, domain, and other detailed system information for a device.

Web Server Sends a HTTP or HTTPs request to a device. If the device does not respond or returns an incorrect string, the web server monitor may not be working as expected.
Setting Timeout (ms) Port Description Maximum amount of time in milliseconds that Ping will wait for a response from the target Web server port

Setting HTTP or HTTPS

l

Description Type of traffic for the monitor

Active Directory Monitors the status and performance of application specific counters for Active Directory server.

Exchange Server Monitors the status and performance of application specific counters for MS Exchange server.
Setting Services Specific Processes Counters Description Captures Imap4, POP3, and Transport data Captures system processor and store data Captures transport queues and logical disk data

SQL Server Monitors the performance counters for SQL Server.

Setting Services Specific Processes Counters Description Captures SQL Browser and writer data Captures system processor and privileged time data Captures database transactions, buffer manager, latches and locks data

Windows Services Monitors critical windows services for up, down, disabled status and detailed information.

DNS, NETBIOS DNS monitor sends a DNS lookup request and ensures a value is returned.
Setting Resolve NetBIOS Name Resolve LMHost Resolve Host Resolve Forward DNS Description Resolves the NetBIOS name during the monitoring process Resolves the LMHost during the monitoring process Resolves the Host during the monitoring process Resolves the Forward DNS during the monitoring process

POP3 Connects to a POP3 enabled server using the POP3 server and port information provided. Once connected, an attempt is made to retrieve the number of messages on the server and also to read the 1st message in the list. If the attempt fails, the POP3 server may not be working as expected.

SMTP Connects to a SMTP server using the SMTP and port information provided. Once connected, an attempt is made to send a test message to the recipient selected using the SMTP server. If the attempt fails, the SMTP server may not be working as expected.
Setting Mail Recipient Description Enter the email address for the test message

VMware Collects data from the VMware Server. Monitors key variables on VMware performance, active VMs, and VM attributes.

Network Interface Traffic Monitors network interface performance for a device by showing the percent of capacity or throughput. Tracks the inbound and outbound traffic for each network interface in the device.

Network Statistics Provides network statistics (netstat) information of active connections and their state for a device.

IP Configuration Provides IP configuration details, such as IP Address, Subnet Mask, and Default gateway, for a device.

Port Map Provides a map of ports for a device.

Network Statistics Summary Provides Network Statistics for the following: Last Boot Time, SNMP In Packets, SNMP Out Packets, ICMP In Messages, In Errors, In Destinations Unreached, In Time Exceeds, In Parm Probes, In Source Quenches, In Redirects, In Echoes, TCP Max Connections, Current Established, Active Opens, Passive Opens, Failed Attempts, Established Resets, In Errors Out Resets, UDP In Datagrams, Out Datagrams, No Ports, and In Errors.

TCPPorts Creates a TCP port client and attempts to connect to the defined port to determine if the port is opened or closed.
Setting Timeout (ms) Selected Ports Port List Description Maximum amount of time in milliseconds that the connection will wait for a response from the target Enter the ports to be monitored (separate ports by a comma)

Syslog Listener Receives, logs and displays syslog messages from routers, switches, and any other syslog enabled device. Filter by facility, severity, date, host name, and key word.
Setting Facility Severity Description TBD TBD

NetFlow/sFlow/JFlow/ptFlow Collector Provides in-depth visibility into traffic network patterns and usage to determine how traffic impacts the overall health of the network. Drill down into applications, conversations, devices will identify the exact sources of spikes and burst to take proper actions. Learn how to enable NetFlow, sFlow, JFlow, and ptFlow.
Setting TCP, UDP or ICMP Discard IP Traffic Description Deselect these check-boxes if you do not wish to view that type of traffic Allows the user to disregard all traffic from the entered IPs

Configuration Backup - Cisco, HP, and Juniper Automatically backup configurations files for your Cisco, HP and Juniper routers and switches. NOTE: HP and Juniper require Telnet read/write credentials. Config files can be viewed and compared all in the same interface.

Setting Timeout (ms) Backup

l

Description Maximum amount of time in milliseconds that the connection will wait for a response from the target Select running config and startup config

Application Event Logs Receives and displays complete information for application event logs from Windows devices for you to detect occurrences or problems. Ability to set filters by event type.
Setting Event Type Description Collect errors, warnings and/or information logs. Use the Ctrl key to select more than one log file type.

Security Event Logs Receives and displays complete information for security event logs from Windows devices for you to detect occurrences or problems. Ability to set filters by event type.

System Event Logs Receives and displays complete information for system event logs from Windows devices for you to detect occurrences or problems. Ability to set filters by event type.
Setting Event Type Description Collect errors, warnings and/or information logs. Use the Ctrl key to select more than one log file type.

Cisco Wireless Monitors wireless networks and sees into wireless access points, clients and sessions. Monitors key variables on access points, including signal strength and quality.

VoIPManager Settings Displays the Dial Manager Configuration information for a device.

VoIP Manager Status Lists the VoIP phone status information for a device.

VoIP Active Calls Lists the active VoIP calls information for a device.

VoIP Call History Displays VoIP call history information for a device.

IP SLA Displays IP SLA Overview, Call Path Statistics, Call Path Jitter Chart, Call Path MOS Chart, Call Path Latency Chart, and Call Path Packet Loss Chart information for a device.

Call Manager Registration Status Monitors the active, registered and unregistered phone of a VoIPsystem.

See Also
l

Editing Policies

Removing Policies You must have System Administrator privileges to remove a policy from your product. Additionally, you cannot delete a Global Smart Policy. 1. In the tree view, under Policies, select the policy that you want to delete and then rightclick. 2. In the context menu, click Remove. 3. When the message appears, click Yes. The policy no longer appears in the list.

See Also
l

Adding New Policies Editing Local and Global Policies

Migrating Devices from the Default Policy A device is applied to the Default Policy when Foglight NMS cannot identify what type of device it is. For example, during network discovery, if Foglight NMScannot identify a device's description, OID, or which services are running on it, that device is assigned to the Default Policy. In the Default Policy, all monitors are selected to cover a wide range of devices to make sure that data is monitored and collected from these devices. It is recommended that you migrate these devices from the Default Policy to the appropriate Smart Policy. To migrate a device from the Default Policy

1. In the tree view, select the Local or Global Default Policy. A list of devices appears in the Devices view. 2. Select the device that you want to migrate and then right-click. 3. In the context menu, click Monitors and Assets -> Reassign to New Policy. 4. In the Select Policy Reassignment dialog, select a policy. 5. Click Select to save your changes and close the dialog. If you look in the tree view, you will see that the device has been reassigned to its new policy, which is indicated by the increase in device numbers.

See Also
l

Applying Smart Policies to Devices

Creating Custom SNMP Monitors

Overview Foglight NMS provides pre-defined monitors that collect key data for most of the common devices in a network. When you create a custom SNMPmonitor, you can define any Object Identifier (OID) in order to monitor any SNMPdevice (regardless of the manufacturer or type of device). For example, you can monitor temperature on a switch, fan speed on a router, and battery status on a UPS. Custom SNMP monitors enable Foglight NMS to provide complete SNMP coverage on any network. Foglight NMS has an extensive MIB database that determines the friendly name for each OID. Additionally, you can convert MIB values into the units of measurement that are most useful to you. Custom SNMP monitors work just like the pre-defined monitors included with Foglight NMS. You can scheduled alerts that will notify you of the status of any SNMP monitor, as well as create reports and graphs. To create custom SNMPmonitors in Foglight NMS There are several places in Foglight NMS where you can create a custom monitor, edit an existing one, or double-click a custom monitor to assign it to a policy.
From the Edit Policy window:

When you create a custom monitor for a policy, the custom monitor applies to all the devices in that policy. 1. Right-click a policy and then click Edit. 2. In the Edit Policy window, click the Custom Monitors tab.

From a device:

You can create a custom monitor that is specific to a device and applies only to that device. 1. In the Devices View, select a device and right-click it. 2. In the context menu, click Monitors And Alerts -> Configure For Device. 3. In the Device Edit window, click the Custom Monitors tab.

From the Administration window:

The Custom Monitor Database is a central library for all custom SNMP monitors. You can create, edit, and delete custom monitors from this library. When you modify a custom monitor assigned to a global policy, that policy is updated. 1. On the Foglight NMS main menu, click Configuration -> Administration. 2. Under the Configuration section, double-click the Custom Monitors icon.

Topics in this section

l

Installing the SNMP MIB Library Creating Custom SNMP Monitors Adding Custom Monitors to Policies Editing Custom Monitors Deleting Custom Monitors Viewing the Custom Monitor Details

Installing the SNMP MIB Library A management information base (MIB) is a virtual database used for managing the entities in a communications network. The SNMPMIB Library in Foglight NMS is a repository of over 15,000 devices that you can use for SNMP walks, SNMPtraps, and custom monitors. Updates to the

library are published every quarter; however, you only need to download the library one time. You must install the library before you can start creating a custom SNMP monitor. To install the MIBlibrary 1. On the Main menu, click Configuration -> Administration. 2. Double-click the SNMP MIB Library icon.

3. In the Update SNMP MIB Library dialog, click Start Download.

NOTE: Initially, the status of the MIB Library appears as Library is not installed. The status will change to "Library Is Current" after you download the library. 4. Click Finish.

Creating Custom SNMP Monitors Click a link to learn more about the different ways you can create a custom monitor:
l

To create a custom monitor by browsing the MIB library for an SNMP OID To create a custom monitor by using the SNMP Walk Utility Tool To create a custom monitor by manually adding an OID

Adding Custom SNMP Monitors from the MIB Browser You can browse the MIB library to locate an OID. In the MIB library, drill-down into the folders by double-clicking them. When you drill-down to a OID, select it to view its details and create your custom monitor. NOTE: This option is available only after you install the MIBlibrary. You must install the library before you can start creating a custom monitor from the MIB browser. 1. From the Custom Monitor tab, click Add Custom Monitor. 2. On the Custom Monitor Database pop-up window, click Add From MIB Browser.

3. In the SNMP OID Browser pop-up window, drill-down in the tree view and select a MIB Library OID.

Click the Name or OID radial buttons to change how you sort the OIDs in the tree view. 4. Click Create Custom Monitor From Selected. 5. In the Custom Monitor pop-up window, you can edit the friendly name, description, and select the value type. NOTE: If you select Value as the Value Type, then select the Value scale and Display scale. 6. Click Save to create your custom monitor.

Finding Vendors in the MIB Library There is a complete list of vendors in the MIB Library. You can view the list when you open the SNMP OID Browser window. In the tree view, click Private -> Enterprises and a list of supported vendors appears.

If you do not find your vendor in the list, use the Give Feedback feature to send the MIBs to the Foglight NMSteam. When the library The library will be updated to include new MIBs and vendors. See Also
l

Assigning Custom Monitors to Policies Editing Custom Monitors

SNMP Walking the Device Foglight NMS provides the SNMP Walk Utility tool, which is built into the custom SNMP monitor framework. This tool will walk any device with a valid SNMP credential. When the walk is complete and a variable identified, you can create a custom SNMPmonitor.

1. From the Custom Monitor tab, click Add Custom Monitor.

2. In the Custom Monitor Database pop-up window, click Add From SNMP Walk to add the SNMP OIDs from the SNMP walk remote tool.

3. In the Select Device To Run SNMP Walk Against window, select a device and click Select.

NOTE: If you want to select a different device later, in the SNMP Walk Tool dialog, click Change Device. 4. In the SNMP Walk Tool pop-up window, select a valid credential in the drop-down list, such as a public SNMP type.

5. Select an OID in the drop-down list.

6. Click Get to retrieve the OIDs for the selected device. NOTE: You must select the credential and OID for the device to prevent an error from occurring. If the OIDs are not selected for the specified IP Address, check that the device supports the OID and the credential used has access to that OID. If not, the OIDs are not listed. NOTE: If you want to stop the process of getting the OIDs by click Stop Walk. 7. Select an OID in the list.

NOTE: If you want to clear to clear the results of your previous walk and start a new walk, click Clear. 8. Click Create Custom Monitor From Selected. When the message appears, click Yes. 9. In the Custom Monitor pop-up window, select the appropriate values and click Save to add the new custom monitor to the list. 10. Click Save to save your changes.

See Also
l

Assigning Custom Monitors to Policies Editing Custom Monitors

Manually Adding Custom SNMP Monitors If you know the OID of a SNMP-enabled device you can manually enter it to add your custom monitor. 1. From the Custom Monitor tab, click Add Custom Monitor. 2. In the Custom Monitor Database pop-up window, click Add OID Manually. 3. In the Manually Add OID dialog, type an OID.

4. In the Select Device To Run SNMP Walk Against window, select a device and click Select. 5. In the SNMP Walk Tool pop-up window, select a valid credential in the drop-down list, such as a public SNMP type. 6. Select an OID in the OIDdrop-down list. 7. Click Get to retrieve the OIDs for the selected device. 8. Select an OID in the list. 9. Click Create Custom Monitor From Selected. When the message appears, click Yes. 10. In the Custom Monitor pop-up window, select the appropriate values and click Save to add the new custom monitor to the list. 11. Click Save to save your changes.

For more information on the SNMPWalk Tool, see SNMP Walking the Device. See Also
l

Assigning Custom Monitors to Policies Editing Custom Monitors

Adding Custom SNMP Monitors to Policies From the Edit Policy window, you can add a custom monitor to the database, and then assign it to the policy. Additionally, set how often your custom monitor monitors and collects data from a device or disable it. 1. In the Foglight NMS Studio, select a policy and right-click. 2. In the context menu, click Edit. 3. In the Edit Policy window, click the Custom Monitors tab. 4. Click Add Custom Monitor. 5. In the Custom Monitor Database, select an existing custom monitor or create a new one. For more information about creating a new custom monitor, see Creating Custom SNMPMonitors.

6. Double-click your selected custom monitor. 7. In the Assign Custom SNMP Monitor to Policy, under Monitor Settings, select how often you want data monitored and collected from the devices in the policy.

8. Under Test Monitor, click Run Test (Required). You must run a test against a device before you can add the custom monitor to the policy.

9. In the Select Device To Test Against, select a device and click Add.

10. If the test was successful, select an OID.

11. Click OK. 12. Click Save to save your changes.

See Also
l

Creating Custom SNMP Monitors Removing Custom Monitors from Policies

Removing Custom SNMP Monitors from Policies Remove a custom SNMP monitor from a policy by doing the following: 1. In the Custom Monitors tab, select a custom monitor. 2. Click Remove Custom Monitor.

3. When the message appears, click Yes.

After you confirm your action the selected custom monitor is removed from the policy; however, it is not deleted from the custom monitor database. You can choose to reassign the removed custom monitor to the same policy or to a different one. See Also
l

Assigning Custom Monitors to Policies Deleting Custom Monitors

Editing Custom SNMP Monitors There are several places in Foglight NMS where you can edit or delete a custom SNMP monitor.
From the Edit Policy window:

From this window, you can only edit custom SNMP monitors assigned to the policy. You can change how often a custom SNMP monitor collects data from a device, or disable it to stop it from collecting data. You cannot edit the friendly name or description of a custom monitor assigned to a policy. 1. In the Edit Policy window, click the Custom Monitors tab. 2. Select the custom monitor that you want to edit. 3. Click Edit Custom Monitor.

4. In the Assign Custom Monitor to Policy, select how often you want data monitored and collected from the devices in the policy in the Monitoring Interval drop-down list.

5. If you want to disable your custom monitor, de-select the Enabled check-box. 6. Click OK to save your changes.

From a device:

You can edit a device-specific custom monitor. Edit the friendly name, description, how often you monitor and collect data from a device, and enable or disable a custom monitor. Your changes will apply only to that device. 1. In the Devices View, select a device and right-click it. 2. In the context menu, click Monitors And Alerts -> Configure For Device. 3. In the Device Edit window, click the Custom Monitors tab. 4. Select a custom monitor. 5. Click Edit Custom Monitor. 6. Make the necessary changes to your custom monitor, such as modifying how often data is collected or enabling or disabling it. 7. Click OK to save your changes.

From the Monitors and Alerts link on the Devices View:

1. Select a device in the Devices View. 2. In the Device details, on the toolstrip, click the Monitors and Alerts link.

3. Click Configure For Device. 4. In the Device Edit Monitor and Alerts window, click the Custom Monitors tab.

5. Select a custom monitor. 6. Click Edit Custom Monitor. 7. Make the necessary changes to your custom monitor, such as modifying how often data is collected or enabling or disabling it. 8. Click OK to save your changes.

See Also
l

Removing Custom Monitors from Policies Deleting Custom Monitors

Deleting Custom SNMP Monitors The following steps will show you how to permanently delete a custom monitor from the database. If you delete a custom monitor assigned to a policy, it will be deleted from that policy as well. 1. On the main menu, click Configuration -> Administration. 2. Under Configuration, click the Custom Monitors icon. 3. In the Custom Monitor Database window, select the custom monitor that you want to delete. 4. Click Delete Monitor.

5. When the message appears, click Yes.

See Also
l

Removing Custom Monitors From Policies

Viewing Custom SNMPMonitor Details The following information is available to view from the Device Details. To see the details of a device, select a device and double-click it. Viewing Trend Charts When you create a custom monitor, if you select the Trend Chart check-box the data collected by the custom monitor displays in a chart to show you how your device performed over a period of time. NOTE: The Trend Data check-box is not available for all data types. 1. In the Device Details, click the Custom Monitoring tab.

2. In the Custom Monitoring - Trendable gadget, click the Trend Chart link.

NOTE: If you have multiple custom monitors associated with a device, a unique trend chart is generated for each one.

Viewing the Device Status The Device Details also provides you with a way to see the status of all the monitors added to a device. 1. Click Settings -> Verify Monitoring Status on the Device Details page.

2. Device Monitor Status pop-up window appears.

Setting Up Alerts
Overview When you set up alerts in Foglight NMS, you will automatically receive an email which notifies you if any issues arise in the network. These alerts allow you to fix the issues before they impact a user. You can configure alerts for multiple conditions that meet the needs of your network. An alert can monitor network events, traffic, and conditions to create a performance baseline, which makes sure that you are not inundated with false-positive alerts from normal network activity. Additionally, you can set up critical alerts to be escalated to one or more users until the problem is resolved or you can suppress alerts from triggering during scheduled network maintenance. You can also set up an alert for interrelated events or conditions.
Topics in this section
l

Adding Alerts Escalating Alerts Adding Monitoring Templates to Policies Setting Up Alerts for Custom SNMP Monitor

Adding Alerts Adding an alert to your policy allows you to stay informed of any issues that may arise. You can configure an alert to when you add an alert, you need to configure the conditions for which that alert will be triggered and what actions should be taken to resolve the issue. You can also escalate the alert if it is not resolved. 1. In the Edit Policy window, click the Alerts tab. 2. Click Add Alert. 3. Type a name for the alert. 4. In the drop-down lists, select a Severity and Priority. 5. In the Notifications section, select one or more of the following check-boxes:

Notify On Conditions Met. This option notifies you by email after the your configured conditions have been met. Notify On Actions Complete. This option notifies you by email after an action has been taken to resolve the issue. Notify On Alert Reset. This option notifies you by email after an alert has been reset.

6. (Optional) In the Notification Target Override To and CC fields, type an email address. If you have a user already set up to receive alert notifications, this option overrides that person and sends an email to the email address that you enter in the To or CC fields. 7. In the Alert Reset Options, select whether you want the alert to be automatically or manually reset. 8. In the Conditions, Actions, and Escalations section, configure a new condition, action, escalation, or reset option.
l

New Condition You can set the performance thresholds for monitors which determines when an alert is triggered. Set a condition for all monitors. NOTE: A condition will only work if the associated monitor is enabled for a device. For example, the CPU monitor must be enabled for an alert to work on CPU over 90%.

New Action Foglight NMS can take action on a device if the conditions are met. The inventory of actions includes: For Windows: Start Service, Stop Service, Pause Service, List Services, Create Process, Kill Process, List Process, List Process Top CPU Usage, List Process Top Memory Usage, List Process Top Read from Disk, List Process Write to Disk, List Network Statistics, Shutdown Restart, IP Config Info for Host, Route Table Info for Host. For Linux: Start Linux Process, Kill, Linux process, List Active Connections, List Daemon Processes, List Directory Details, List File System Details, List Installed Packages, List IP Config Details, List Memory Status, List Network Statistics, List Routing Table, List Running Processes, List Top CPU Details, Shutdown Linux. For Networking: Send a Syslog message.

New Escalation

You can set up a notification to be sent when an alert has not been reset or addressed for a specific period of time. For example, if an alert is not reset after 30 minutes, Foglight NMS will send another notification to the entire IT Department.
l

New Reset Condition You can set the performance thresholds that need to be met in order for an alert to be reset. This option ensures that the device returns to optimal performance.

9. Click Ok to complete the process. 10. Click Save to save your changes.

See Also
l

Escalating Alerts

Escalating Alerts When an alert is not reset by a user, Foglight NMS escalates the alert to one or more users. In order to send the escalated alert to a specific user, you must assign an escalation rank to that user in the User Management section of the Administration View. The escalation rank is the priority by which users are notified. Once you establish the escalation ranking order, you can return to the policy, open an alert, and add a new escalation to it, as well as define the parameters for it. Setting the Escalation Rank for a User

1. In the Foglight NMSStudio, click Configuration -> Administration. 2. Click User Management. 3. In the list of users, select a user to which you want to assign a rank. 4. Click Notifications. 5. Click Add Rule. 6. Select a site in the Organization drop-down list.

7. In the Escalation Rank field, select a number. For example, if you assign "1" as the rank, then this user is the first person notified when an alert is escalated. 8. Click OK.

Adding a New Escalation to an Alert 1. Select a policy to edit and then click the Alerts tab. 2. Select an alert and click Edit Alert. 3. Click the New Escalation link. 4. In the Escalation dialog, do the following to define the escalation parameters:
l

In the After field, select the amount of time that passes between each email that is sent to the user. In the Trigger field, select the number of times a user will be notified before the alert is escalated to a different user or is placed back in to "Alert in Process" status.

5. Click OK.

See Also
l

Managing Alert Notification Rules

Managing Alert Notification Rules For each user you add to Foglight NMS, you can specify who will receive alert notifications by creating a rule in the User Management tool. You can also set which users will be notified when an alert has been escalated. 1. From the Foglight NMS Studio, click Configuration -> Administration. 2. Click User Management. 3. Click Notifications. 4. Select a user in the list. You can click Add Rule to add a new rule to the selected user or click Edit Rule to edit an existing rule. 5. Click OK to save your changes.

NOTE: You can also access the Alert Notification Rules dialog from the Edit Policy Window. Click the Alerts tab, and then click the Manage Alert Notification Rules link. See Also
l

Escalating Alerts

Adding Monitoring Templates to Policies In one simple click, monitoring templates allow you to add application-specific monitors, such as Backup Exec, to a policy or a device. When you assign monitoring templates to a policy, all the devices in that policy will inherit the monitors and alerts from the monitoring templates assigned to it. Adding a monitoring template will automatically add all the appropriate windows services and event logs for an application to the policy. In addition there are alerts and reset conditions. You can modify any of the conditions and alert triggers as needed. To add a monitoring template to a policy 1. In the tree view, right-click a policy. 2. Click Edit. 3. In the Policy Editor, click the Alerts tab. 4. Click the Add Template button. 5. To add all the conditions and monitors in a template, select the check-box next to the template name. 6. (Optional) Deselect the check-box next to any condition that you do not want to add to the alert template. 7. (Optional) To send a notification to a user when a condition is not met, select the Notify On Conditions Met check-box. 8. (Optional) To send a notification to a user when action is taken to resolve a condition, select the Notify On Actions Complete check-box. 9. (Optional) To send a notification to a user requesting that the alert be reset, Notify On Alert Reset.

10. Click Add. 11. Click Save.

After you add the monitoring template, you can edit the alert, as well as see a list of all the conditions, actions, and reset conditions associated with it. In the Policy Editor, select the alert in the list, and click Edit Alert. Available Monitoring Templates in Foglight NMS The following table shows the products for which you can create a monitoring template and the windows services and events associated with a given template.
Product Name

Services Monitored Service Name

Event Source Monitored

Acronis 1. Acronis Remote 1. Acronis Agent Backup and Agent Service 2. MMS Recovery 11 2. Acronis Managed 3. ARSM Machine Service 3. Acronis Removable Storage Management Service Acronis 1. Acronis Scheduler 1. AcrSch2Svc True Image 2 Service 2. afcdpsrv Home 2012 2. Acronis Nonstop 3. syncagentsrv Backup Service 3. Acronis Sync Agent Service avast! Anti- 1. avast! Net Client 1. avast! Net Client Service virus Service 2. avast! Antivirus 2. avast! Antivirus Backup of Exchange 2010 1. Backup Exec Agent Browser 2. Backup Exec Device & Media Service 1. BackupExecAgentBrowser 2. BackupExecDeviceMediaService 3. BackupExecJobEngine 4. BackupExecRPCService
1. AVAST

1. Acronis True Image Echo Server 2. Acronis True Image for SBS

Product Name

Services Monitored Service Name

Event Source Monitored

3. Backup Exec Job Engine 4. Backup Exec Server 5. Backup Exec Remote Agent for Windows Systems 6. Backup Exec Error Recording Service 7. Backup Exec Management Service Citrix XTE Server

5. BackupExecAgentAccelerator 6. bedbg 7. BackupExecManagementService"

1. Citrix Tools for Vir-1. xensvc tual Machines Serv- 2. CitrixUSB ice 3. XenGuestAgent 2. Citrix USB Service 3. Citrix Xen Guest Services

Domain Con-1. DNS Client troller - Win-2. File Replication dows 2003 Service 3. Intersite Messaging

1. Dnscache 2. NtFrs 3. IsmServ 4. kdc 5. Netlogon

1. Directory Service

4. Kerberos Key Dis- 6. W32Time tribution Center 5. Net Logon 6. Windows Time Domain Con-1. DNS Client troller - Win-2. File Replication dows 2008 Service 3. Intersite Messaging 1. Dnscache 2. NtFrs 3. IsmServ 4. kdc Netlogon, Time-Service, KerberosKey-Distribution-Center

5. Netlogon 4. Kerberos Key Dis- 6. W32Time tribution Center 7. NTDS

Product Name

Services Monitored Service Name

Event Source Monitored

5. Net Logon 6. Windows Time 7. Active Directory Domain Services 8. Remote Procedure Call (RPC) 9. Security Accounts Manager 10. Active Directory Web Services 11. DFS Namespace eTrust ITM 1. eTrust Antivirus 8.x Realtime Service 2. eTrust ITM Job Service 3. eTrust ITM RPC Service McAfee Antivirus

8. RpcSs 9.SamSs 10. ADWS 11. Dfs

1. InoRT 2. InoTask 3. InoRPC

1. eTrust ITM 2. InoculateIT Server

1. McAfee McShield 1. McShield 2. McAfee AntiSpam Service 3. McAfee Firewall Core Service 2. MSK80Service 3. mfefire 4. McNASvc

1. mfehidk 2. McLogEvent

5. McMPFSvc 4. McAfee Network 6. McProxy Agent 7. McODS 5. McAfee Personal 8. McComponentHostService Firewall Service 9. mcmscsvc 6. McAfee Proxy 10. mfevtp Service 7. McAfee Scanner 11. McNaiAnn 8. McAfee Security Scan Component Host Service 9. McAfee Services

Product Name

Services Monitored Service Name

Event Source Monitored

10. McAfee Validation Trust Protection Service 11. McAfee VirusScan Announcer Microsoft 1. Microsoft Exchange Exchange Event Server 2003 2. MicrosoftExchange File Distribution 1. MSExchangeES 2. MSExchangeFDS 3. IMAP4Svc 4. MSExchangeIS 1. EXPROX

5. MSExchangeMailboxAssistants 3. 6. MSExchangeMailSubmission MicrosoftExchange 7. MSExchangeMGMT IMAP4 8. MSExchangeMonitoring 4. MicrosoftExchange 9. MSExchangeRepl Information Store 10. MSExchangeSA 5. 11. MSExchangeSearch MicrosoftExchange 12. MSExchangeSRS Mailbox Assistants 13. SQLBrowser 6. 14. SQLSERVERAGENT MicrosoftExchange 15. SQLWriter Mail SubmissionService 16. MSExchangeMTA 7. Microsoft Exchange Management 8. MicrosoftExchange Monitoring 9. MicrosoftExchange ReplicationService 10. MicrosoftExchange System Attendant 17. POP3Svc 18. RESvc

Product Name

Services Monitored Service Name

Event Source Monitored

11. MicrosoftExchange Search Indexer 12. MicrosoftExchange Site Replication 13. SQL Server Browser 14. SQL Server Agent (MSSQLSERVER) 15. SQL Server VSS Writer 16. Microsoft Exchange MTA Stacks 17. Microsoft Exchange POP3 18. Microsoft Exchange Routing Engine

Quick Heal 1. Quick Update Serv-Quick Update Service Antivirus ice

SharePoint 1. Windows Share- 1. SPAdmin 3.0 Point Services Admin-2. SPSearch istration 3. SPTimerV3 2. Windows SharePoint Services Search 3. Windows SharePoint Services Timer 4. Windows Share4. SPTrace 5. W3SVC

Windows SharePoint Services 3 Search, Windows SharePoint Services 3, Office SharePoint Server, Office Server Search

Product Name

Services Monitored Service Name

Event Source Monitored

Point Services Tracing 5. World Wide Web Publishing Service

SQL Server 1. SQL Server 2008 (MSSQLSERVER)

1. MSSQLSERVER 2.SQLSERVERAGENT

2. SQL Server Agent 3. MsDtsServer100 (MSSQLSERVER) 4. SQLWriter 3. SQL Server Integration Services 10.0 4. SQL Server VSS Writer

MSSQLSERVER, MSSQLServerADHelper100, MSSQLServerOLAPService, Report Manager (MSSQLSERVER), Report Server (MSSQLSERVER), Report Server (WMI10), Report Server Windows Service (MSSQLSERVER), SQL Server Reporting Services (MSSQLSERVER), SQLBrowser, SQLCTR, SQLDumper, SQLISPackage100, SQLISService100, SQLNCLI10, SQLSERVERAGENT, SQLVDI, SQLWEP, SQLWriter

Symantec Symantec Scan AntiVirus Engine for Caching

symcscan

Symantec AntiVirus for Messaging

Symantec Scan Engine

symcscan

Symantec AntiVirus for Server

1. Symantec Embed- 1. SQLANYs_sem5 ded Database 2. semsrv 2. Symantec End3. semwebsrv point Protection Manager 3. Symantec Endpoint Protection

1. Symantec Mail Security for Microsoft Exchange 2. Symantec

Product Name

Services Monitored Service Name

Event Source Monitored

Manager Webserver

Trend 1. Trend Micro Com- 1. TrendCCGI Micro mon CGI 2. TrendMicro Infrastructure Client/Sever 2. Trend Micro Man- 3. TrendMicro_NTP Security agement Infra4. TMCM Agent structure 3. Trend Micro Network Time Protocol 4. Trend Micro Control Manager

Trend 1. ScanMail EUQ Micro Scan- Monitor Mail 2. ScanMail for Microsoft Exchange Master Service 3. ScanMail for Microsoft Exchange Remote Configuration Server 4. ScanMail for Microsoft Exchange System Watcher

1. EUQ_Monitor 2. ScanMail_Master 3. ScanMail_RemoteConfig 4. ScanMail_SystemWatcher

1. Trend ScanMail for Exchange 2. Trend Micro ScanMail for Microsoft Exchange

Trend 1. Trend Micro Secu- 1. ofcservice Micro Secu- rity Server Master 2. TmListen rity Server Service 3. TMiCRCScanService 2. Trend Micro Secu- 4. Amsp rity Agent Communicator 3. Trend Micro Smart Scan Service 4. Trend Micro Solu-

1. Trend Micro Security Server

Product Name

Services Monitored Service Name

Event Source Monitored

tion Platform

WSUS 3.0

1. Background Intel- 1. BITS ligent Transfer Serv- 2. MSSQL$MICROSOFT##SSEE ice 3. W3SVC 2. Windows Internal 4. WSusCertServer Database (MICROSOFT##SSEE) 3. World Wide Web Publishing Service 4. WSusCertServer

1. Windows Server Update Services

Setting Up Alerts for Custom SNMP Monitors When you have finished adding your custom monitors, you can set up alerts and conditions for each one by editing the policy for a device. An alert for a custom SNMP monitor is created the same way you create an alert for system monitor. Within a policy, the Alerts section includes a condition for custom SNMPmonitors. You can create a new condition for your alert that sets up the notifications and actions for the custom SNMPmonitor to make sure you stay informed of any issues before they impact users. To set up an alert for a custom monitor 1. In the Devices View, right-click a device and then click Alerts and Monitors -> Configure For Device. 2. In the Device Edit Monitor and Alerts window, click the Alerts tab. 3. Click Add Alert. 4. In the Alert dialog, click the new condition link and select Custom Monitor. 5. Select a monitor in the list and click Select. You can now assign the appropriate condition criteria and set the time span for the alert. 6. In the Value drop-down list, specify the value. 7. Type a valid integer value in the text box below the Value drop-down list.

8. Select the span and define the trigger criteria. 9. Click OK. The alert condition appears in the Conditions, Actions, and Escalations text box located in the Alert pop-up window. NOTE: You can only set one condition for each custom monitor. If you select a custom monitor that already has a condition, an error message displays. 10. Click OK to save the alert. 11. Click Save to save your changes to the policy. The alert is added to all the devices in that policy. When the monitor interval has elapsed and the condition is met, the alert triggers and displays in the Alert Triggered list.

See Also
l

Creating Custom SNMP Monitors Adding Custom SNMP Monitors to Policies

Creating and Running Scripts

Overview The scripting feature allows users to add, edit, and schedule custom scripts using any generic script language, including bash, VBscript, Jscript, Perl, and PowerShell. You can register custom interpreters so that any scripting language can be used. In addition, you can package scripts into functional IF-THEN-ELSE logic groups to complete more advanced maintenance and remediation tasks. Scripting is controlled by five functional sections which you can view by clicking the scripting dashboard in the tree view. The five functional sections are as follows: 1. Script Status This section shows the status of scripts that are currently running only. Double-clicking on a status line item will show the target machines that the scripts are running on, the current status for each target, and the current status for each script running on that target. 2. Script Library This section lists all the custom scripts that are currently in the database. These scripts include read-only scripts provided with the software, sample scripts, and custom scripts created by the users. The application supports any scripting language, and individual scripts can be customized to use custom parameter syntax. 3. Script Packages This section lists all the script packages in the database. A script packages organizes multiple scripts into functional blocks, either simple ordered lists of scripts, or IF-THEN-ELSE logical blocks that can check conditions and run different scripts based on the success or failure of the IF conditions. 4. Script Schedules This section lists all the script schedules in the database. A script schedule is a list of script packages than are to be run on a system, along with a schedule for the scripts and a list of target devices on which the lists can be run. Both Windows and Linux script packages can be added to the same schedule, and the packages will only run on the devices for which the packages were designed. 5. Logs This section includes the log output from all scripts that run on the system. Double-clicking on the log output will bring up more details and the full output from the script. Here

you can see the results of the script, as well as IP address of the machine, Date, Severity, Schedule Name and Hostname.

Topics in this section

l

Understanding Script Types Importing Scripts to Foglight NMS Exporting Scripts from Foglight NMS

Understanding Script Types There are 3 types of scripts in Foglight NMS:

l

Standard: By default, the script type is set to standard when you add a new script. You can update and delete standard scripts from Foglight NMS.If you import a script and select to overwrite the existing standard script in the system, then the script is updated. Read-only: You cannot update read-only scripts in Foglight NMS, but you can view it and/or create a copy of it. The copy that you create is a standard script. If you import a script and select to overwrite the existing script is the system, Foglight NMS creates a copy of the script named "Copy of <original script name>". System: You cannot view, copy, or export system scripts. If you import a script and select to overwrite the existing script in the system, you will receive an error message.

NOTE: If you choose not to overwrite a script, you can update the existing script without receiving any error messages. Importing Scripts to Foglight NMS You can simultaneously import a large number of scripts to Foglight NMS. Scripts that you select to import must be formatted in XML. Before you can import a script, Foglight NMS will validate the XMLfile to make sure that it is free of errors. To see a list of the fields that are validated, click here. If any errors are discovered, the scripts will fail to import into the script and the errors will appear in a pop-up window.

If the scripts are successfully parsed, Foglight NMS will continue to process the scripts and do the following:
l

Read-only scripts will be imported as standard scripts. This action occurs because you cannot add read-only scripts to Foglight NMS. If you try to import a script that already exists in Foglight NMS, you will receive a confirmation message informing you that those scripts will be overwritten. You have the option to overwrite the existing scripts or to ignore the scripts and continue importing the remaining scripts. When you choose to overwrite existing scripts, the file name will remain the same except if the script is read-only. The new standard script is renamed using the following format: "Copy of <original script name>".

To import a script 1. In the Studio main menu, click Configuration -> Scripting. 2. Click the Import button. 3. Navigate to the scripts that you want to import. 4. Type a file name and click Save. NOTE: All scripts are imported as XML files and it must have valid XML-formatted content. If the format of the XML file is not valid format you can not import it into Foglight NMS.

Exporting Scripts from Foglight NMS You can simultaneously export a large number of scripts from Foglight NMS. Scripts that you select to export must be formatted in XML. Foglight NMS provides 2 ways in which you can export a script:
l

Click the Export button in top right corner of the Scripts view. This option will open a pop-up window that allows you to select the path where you want to export the script and type a file name for the newly exported script. All scripts are exported in XML. Select an individual script from the Script Library and the click the Export option in the context menu. This option opens a pop-up window that allows you to select the path

where you want to export the script and type a file name for the newly exported script. This script will be exported in XML.

NOTE: You cannot export a system script. If you try to export a script using the Export option in the context menu, you will receive and error message. To export a script using option 1 1. In the Studio main menu, click Configuration -> Scripting. 2. Click the Export button. 3. Navigate to the location where you want to export the script. 4. Type a file name and click Save.

To export a script using option 2 1. In the Studio main menu, click Configuration -> Scripting 2. In the tree view, select a script from the Script Library or Script Packages tab. NOTE: You cannot export system scripts. 3. Right-click the selected script and click Export. 4. In the Export Script Package window, navigate to the location where you want to export the script. 5. Type a file name. 6. Click Save.

Patch Management
Overview You can automatically manage and control critical Windows updates using the Patch Management feature. This feature gives you the ability to make sure that a site's devices are protected with the latest security patches and updates. Patch Management provides you with the following capabilities:
l

Complete automation for patch discovery and deployment Ability to create multiple patch groups to meet a site's needs Real-time alerts for successes and failures Comprehensive history and reporting at the device level Individually manage each update at a granular level

You can only create a patch management group on a Windows-based machine with an agent deployed on it.
Topics in this section
l

Adding Patch Management Groups

Adding New Patch Management Groups You can do the following when you create a new patch management group:
l

Add or remove devices Configure a type of update scan Schedule the group to check for updates and install them on a given date and at a specific time Configure the group to automatically download updates Control each individual update at a granular level

To add a new patch management group 1. In the Foglight NMS Studio, click Configuration -> PatchManagement. 2. Click Add New Patch Management Group. 3. Type a name and a description. 4. Click Add Device Member. 5. Select a device and click Add. 6. Click the Settings tab and do the following:
l

To configure the Windows Automatic Configuration settings, select the Configure Windows Automatic Update Setting and select the appropriate Automatic Update Mode in the drop-down list. Schedule a date and time when the scan will take place. If you have selected to control Windows updates with Patch Management, you can set the date and time when the update is installed.

7. Select an update in the list to edit the patch. You can choose to approve the patch, set it for pending approval, or reject it. 8. (Optional) Select Monitor Windows Updates for a read only list of patch updates. 9. Click Save to save your changes.

Generating Reports
Overview You can generate an instant report or schedule a report for all the data that Foglight NMScollects from the devices in a network. Reports can be instantly printed, emailed, and saved. You can drill-down into specific time periods and events or change the chart type. The report scheduler allows you to email reports on a daily, weekly, or monthly basis to colleagues and executive management. Use the Reports feature to do the following:
l

Deliver critical information about devices that is easy to read Quickly configure time periods and data types for any device Schedule reports for executive management Plan future resource requirements using historical trend data

Topics in this section

l

Running Reports Creating Custom Reports Scheduling Reports Emailing Reports Exporting Reports

Running Reports You can run an instant report for any device in the network, which displays in the Reports View. Once you designate a device, any report that you click on in the list automatically generates a report for that device.

NOTE: You can brand any report with your own company information using the Branding Configuration tool in the Administration section of Foglight NMS. Running an Individual Report An individual report is a report whose scope is limited to one device in a network. 1. In the Foglight NMSStudio, click Reports on the main menu. 2. From the list of reports, double-click an individual report that you want to run.

3. Select the device that you want to display in the report and click OK. The report displays as a graph or a list in the Reports View.

Running a Group Report

A group report is a report whose scope includes data from multiple devices. Group reports include Network Performance Reports, Network Traffic Flow Reports, VoIP Reports, and Custom Reports that have been designated as group reports. 1. In the Reports View, from the list of reports, double-click a group report that you want to run.

2. In the Select Target dialog box, select the devices that you want to display in the report and click OK.

See Also
l

Changing the Device in a Report Changing the Report Type Changing the Report Period

Changing Devices in a Report For individual reports, once you select a device to run a report against, all other reports that you generate will use the previously selected device. To generate an individual report using the data collected from a different device, you must change the device. You can select a device from any site's networks. 1. In the Foglight NMS Studio, click Select Device.

2. Select a new device to run the report against. 3. Click OK. The report displays as a graph or a list in the Reports View.

For group reports, you can also change which devices to display in the report. 1. In the Foglight NMS Studio, click Select Device. 2. In the Select Target dialog box, select a different site in the drop-down list and/or select a different policy. 3. Click OK.

See Also
l

Running Reports

Changing the Report Period You can change the report time interval by using the Report Period drop-down list in the Reports View. This option allows you to view data for the device over different periods of time.

See Also
l

Running Reports

Changing the Report Type You can choose to view any of the reports in the list at any time. Each new report you run uses the same device that you previously selected. There are 2 ways you can change a report type in the Reports View.

In the Reports drop-down list, select the new report that you want to view.

Double-click a device in the Reports list.

See Also
l

Running Reports Changing the Device in a Report Changing the Report Period

Creating Custom Reports You can show certain types of data in a custom report. Using the custom reports feature, you can determine what type of data to show and how to organize it in the report. After you create a custom report, you can generate it, schedule it, send a PDF or HTML version of the report by email, and export it from Foglight NMS to any location. NOTE: You must be a System Administrator to create a custom report.

To start creating a custom report 1. In the Reports View, click Report Manager. 2. In the Custom Report Template Manager, click Add. Follow the steps below to complete the process of creating a new custom report. STEP1: What kind of custom report is it? In this section you will define the type of custom report that you want to create. 3. In the Custom Report Template Wizard, type a name and a description for the custom report. NOTE: The description appears only in the wizard and not in the report itself. 4. In the Display Data By (Group By) drop-down list, select a data type to set the scope of data displayed in the custom report. The selection you make here will determine what options appear in the Available Fields section on page 2 of the wizard. 5. Under What Would You Like To Create This Report For?, do the following:
l

If you want the custom report to be an individual report, which limits the devices displayed in it to one, select Single Device If you want the custom report to be a group report, which allows you to select all the devices in a policy or all the devices across your sites, select Multiple Devices If you want the custom report to include all the devices in a site's network, select Devices For Single Organization

6. For Choose Report Type, select how you want to display your results in the custom report. NOTE: Depending on how you group your data, not all of the report type options will appear. 7. Click Next. STEP2: What and how does the data appear in the custom report? In this section you will define the type of data that you want to see in the report and the format in which the data will appear. 8. In the Available Fields section, select a one or more fields and then click the right arrow button. To add all the fields in a category to the Display These FieldsIn This Order, select

the category check-box. NOTE: The selection you made in the Display Data By (Group By)on page 1 of the wizard determines what options appear in this section. 9. (Optional) To remove a default field, select the check-box and click the left arrow button. 10. The order of fields in the Display These FieldsIn This Order section determines the order of the columns in the report. To change the order of a field, select its check-box and click the up arrow button to move its column to the left or click the down arrow button to move its column to the right. 11. Click Next. STEP3: How is the data sorted in the custom report? In this section you will define the order in which the data appears in the report. 12. To make a data field the primary field by which the rows of data in the report are sorted, click Primary. By default, if a field is already set as the primary field, then it will become the secondary field. NOTE: Sorting the fields on this page does not change the order of the columns. 13. To make a data field the secondary field by which the rows of data in the report are sorted, click Secondary. 14. To make a data field sort from the beginning of the alphabet, the lowest number, or the earliest date, click Ascending. 15. To make a data field sort from the end of the alphabet, the highest number, or the latest date, click Descending. 16. (Optional) Click Defaults to reset the sort order. 17. Click Next. 18. Click Finish. Your new custom report appears in the list of reports under the Custom Reports category.

See Also
l

Running Reports

Scheduling Reports You can schedule reports to run and then you can distribute them by email to your colleagues and executive management. The report scheduler allows you to email reports on a daily, weekly, or monthly basis. 1. In the Reports View, click Scheduled Reports. 2. In the Scheduled Reports dialog, click Add. 3. Locate the report that you want to schedule and select it. A report dialog box appears.

4. In the Description field, type a name for the report 5. (Optional) Disable the report by deselecting the check-box 6. In the Report Period drop-down list, select the time interval you want to show in the report. 7. Click Notifications and type the email address of the recipient of this report. Click OK. 8. Click Recurrence and select how often during a given time period you want the report generated and select the dates when you want to start and stop generating the report. 9. Click Select Target to select a device to run against in the report. 10. Select a format for the report. You can send the report as either a PDF or HTML file. 11. Click OK to schedule the report and complete the process.

Editing Scheduled Reports 1. In the Scheduled Reports dialog, select a report to edit. 2. Click Edit. 3. Make your changes in the report dialog. 4. Click OK to save your changes.

Removing Scheduled Reports 1. In the Scheduled Reports dialog, select the report that you want to delete. 2. Click Remove. NOTE: You can also click Remove All to delete the all the scheduled reports at one time. 3. When the message appears, click Yes.

Emailing Reports You can send an HTML or PDF version of a report by email. 1. In the Reports View, click Email and then select a format for the report that you want to send. 2. In the Report Email Information dialog, type an email address for the main recipient of the report.

3. (Optional) In the CC field, type a secondary email address. 4. Click OK to send the report.

See Also
l

Running Reports

Exporting Reports You can export a report to any location in your network. 1. In the Reports View, click Export.

2. In the Save As dialog, do the following:

l

Select where you want to save your report In the File Name field, type a name for the report In the Save As Type field, select the file type. You can export the report as a HTMLor PDFfile.

3. Click Save.

See Also
l

Running Reports Emailing Reports

Network Maps
Overview Foglight NMSprovides the Network Mapping feature, which allows you to create a functional and interactive topology of your sites' networks. You can use your network maps to quickly view the status of a network, find out if there are any broken connections between devices, determine where devices are located in an office, and view the details of any device in the map. For existing network maps, Foglight NMScan detect if the map is out of date and automatically begin to retrieve the latest monitored data. Foglight NMS will also update your map by removing devices that are no longer part of the network. NOTE: To create and view network maps, you need to install Adobe Flash Player.
Topics in this section
l

Touring the Network Map User Interface Creating Network Maps Adding Groups Editing Network Maps

Touring the Network Map Editor User Interface

The Main Elements of the Network Map Editor Window

1 Main Editor Toolbar: Use these buttons to add or remove background images, update your
map to retrieve the latest monitored data, and add devices or groups to your network map.

2 Zoom In / Zoom Out Buttons: You can choose how much you want to see of your network
map. You can zoom in to get a close-up view of your network map or zoom out to see more of it at a reduced size. To return to the default view, click the arrow button.

3 Pan Window: You can pan to reposition the view in your network map. Panning does not
change the location or magnification of nodes in your network map; it changes only the view. You can also double-click anywhere in the pan window to quickly reposition your network map.

4 Device or Node: A network map is made up of nodes, where each node represents a device
in a network. You can select multiple nodes at a one time to edit them simultaneously. To select

multiple nodes, click and hold your pointing device and drag your cursor over the nodes that you want to select. NOTE: In the Network Map View, you can double-click a device to view its details.

5 Connections Between Nodes: Each connection, represented by a line, links one node to one
or more other nodes. The direction of a line indicates the source of the data. NOTE: In the Network Map View, if a device is running as expected, the line is green. If a device is down, the line is red. If there is an issue with a device, the line is green; however, a yellow dot appears next to the device. Black lines are drawn to unmanaged devices, which are devices that do not provide any Port Map data.

6 Device Layout Drop-Down List: When you select a new device layout in the drop-down list,
Foglight NMSautomatically rearranges the nodes and their connections in your network map.

7 Group Icon: You can select a group to add devices to it, delete it from your map, change the
size of the icon, or rename it.

8 Node and Group Edit Buttons: Use these buttons to remove a device or group from your network map or change the size of it. The Rename Selected Group button appears only when you select a group. Creating a Network Map Each network map that you create is unique to a site and cannot include devices from other sites' networks. Also, the devices that you select to add to a map are the only devices that will appear in the map. If you want to show related devices, select the Add Related Network Nodes check-box. 1. In the Studio tree view, right-click Network Maps, and then click Add New.

2. In the Add Network Map dialog, type the name of your new map.

3. Click OK. 4. In the Network Map-Select Device(s) to Add, select one ore more devices to add to your map and then click Add.

NOTE: If you want to remove a device from the list, select it and then click Remove. You can continue to add your other devices to your network map by clicking the second Add button at the bottom of the dialog box. 5. Click Save to save your changes.

See Also
l

Editing Network Maps Adding Groups

Adding Devices to a Network Map

In any given network, most devices are connected to one another. For example, a laptop may be connected many different devices, such as a server, router, printer, or desktop. Likewise, those devices may be connected to other similar devices in the network. Foglight NMS provides the following ways to add devices to a network map: Show only a selected set of devices: You can select a specific set of devices and add them to a map. If the devices you selected are connected to other devices, those connected devices are not automatically added to the map. 1. In the Studio, select a network map to edit by right-clicking on it, and then click Edit. 2. Click Add Nodes. 3. In the Select Device To Add dialog, select all the devices that you want to add to the map. 4. You will need to click Add twice: First, click the Add button to add the selected devices in the Selected section, and then click Add.

Show all related devices: Related devices are devices that are connected to existing devices on a map, but were not automatically added to it. You can select the Add Related Network Nodes check-box to redraw the map to show these devices.

Adding Groups

Creating a group in your network map allows you to group your devices together according to type of device or site. For example, if your organization has multiple offices in different cities across the country, you can download an image of the country and create a group for each site. You can then appropriately position those groups on the background image. To move a group around, select a group node and drag it to the appropriate location on the background image. To add a group 1. Open the Network Map Editor. 2. In the toolbar, click Add Groups.

3. In the Add Network Map Child, type a name to describe the group and then click OK. 4. Click Save to save your changes.

To add devices to a group 1. Select a group and double-click.

2. Click Add Devices.

3. In the Network Map - Select Devices To Add, select one or more devices. 4. Click Add.

See Also
l

Editing Network Maps

Copying Network Maps

You can make a copy of an existing map by doing the following: 1. In the tree view, right-click the network map that you want to copy. 2. Click Copy.

3. In the Copy Network Map, click Yes.

See Also
l

Editing Network Maps

Editing Your Network Maps Initially, the network map that you create shows only the devices that you selected. When you edit a network map, you can make the following changes:
l

Add a background image, such as an office layout or blueprint. Organize your devices into a group by type Move the nodes around the map by dragging and dropping them Add new devices Resize the nodes Select a different layout for the devices Update your map to show changes to the network, if any Rename the map or group

To edit your network map You can select multiple nodes at a one time to edit them simultaneously. To select multiple nodes, hold your left mouse button and drag your cursor over the nodes that you want to select. 1. In the tree view, right-click the network map that you want to edit.

2. Click Edit. The Network Map Editor window appears.

NOTE: The following steps are optional. Click the corresponding link for more information. 3. Click Reset Background to clear a background image from the network map. 4. Click Set Background to add a background image to your network map. 5. Click Rebuild Relationships to update your map (if there were any changes to the network) and redraw the lines between devices. 6. Click Add Devices to add more devices to the network map.

7. Click Add Group to add a child group to the network map. You can also edit the group node by changing its name and size. 8. To remove a device from the network map, select the device and then click Delete.

9. To change the size of a node, select the node and click Set Size. 10. To move the devices around your map, select one or more devices and then drag and drop it to the desired location. 11. In the drop-down list, select a different layout.

You must click Save to save your changes.

See Also
l

Touring the Network Map User Interface Setting the Background Resetting the Background Rebuilding Relationships Adding Groups Copying Network Maps

Setting the Background

Adding a background image, such as an office layout image, to your network map allows you to visualize exactly where devices are located at a site. If you have a organization that has multiple offices in different cities across the country, you can download an image of that country and create a group for each site. You can then position those groups appropriately on the background image. For more information about groups, see Adding Groups.

To move devices and groups around on your background image, select and drag a node to the appropriate location on the background image and then drop it. You can add a background image to your map by clicking the Set Background button in the Network Map Editor and then selecting an image file.

See Also
l

Editing Network Maps Resetting the Background

Resetting the Background

If you added a background image to your map you can delete it by clicking the Reset Background button in the Network Map Editor.

See Also
l

Editing Network Maps Setting the Background

Rebuilding Relationships

When you rebuild device relationships in a network map, if anything has changed in the network, Foglight NMSredraws the lines between each device. If a site removes a device or changes the way one device is connected to another the lines between the devices are automatically updated. If there are any changes to a network, you can refresh your network map by clicking the Rebuild Relationships button.

See Also
l

Editing Network Maps

Deleting Network Maps

You can delete a network map by doing the following: 1. In the tree view, right-click the map that you want to delete. 2. In the context view, click Remove. 3. In the Remove Network Map dialog, click Yes.

See Also
l

Editing Network Maps

Updating the Network Map Layout

When you add new devices to your network map, the map is not automatically redrawn. You can choose to update a map by selecting the Update Layout check-box.

Foglight Native Integration

Overview Foglight NMS is the network monitoring agent for the Foglight Management Server (FMS). By unifying the products' capabilities together, the critical metrics gathered while monitoring devices such as routers and switches shows you how they impact application performance. This integration provides the ability to monitor the status and performance of network devices (including switches and routers) through the Foglight browser interface. Also, alerts generated by these network devices appear in the Foglight dashboard. You must have the following products/cartridges installed in order for FoglightNative Integration to work.
l

Foglight Management Server (FMS) version 5.6.3 or vFoglight Management Server 6.6.1 NOTE: It is recommended that you do not install Foglight NMSon the same machine as FMS.

Foglight Network Management Server (NMS) version 6.2 or later Dependency Mapping Cartridge version 5.6.2 or later This cartridge is used to store and display all NetFlow data. You will need this cartridge for NetFlow data to appear in Foglight.

NMS Agent Cartridge version 560-20120424-1420 or later This cartridge is used to call a web service in Foglight NMS.By default, this agent is installed on the same machine as the Foglight Management Server.

You must complete each one of the following steps in order to properly configure Foglight Native Integration:
l

STEP1: Installing the Dependency Mapping Cartridge STEP2: Installing the NMS Agent Cartridge STEP 3: Deploying the NMSAgent STEP 4: Selecting the Devices in Foglight NMS for Integration

Other topics in this section

l

Removing Legacy Foglight Integration Viewing Alerts in FMS Viewing NetFlow Traffic Data in FMS Viewing a Device's Performance in FMS

STEP 1: Installing the Dependency Mapping Cartridge The Foglight Cartridge for Dependency Mapping provides the ability to discover and monitor dependencies, and to use that information to build and update Foglight services. The cartridge provides Netstat agents to collect dependency data from hosts, a set of dashboards for viewing dependencies and managing services, and an extensible dependency model. In order for NetFlow, JFlow, sFlow, and ptFlow data that was monitored and collected in Foglight NMSto appear in the Foglight dashboard, you must install the Dependency Mapping cartridge. To install the Dependency Mapping Cartridge 1. Open Foglight. 2. In the Foglight console, click Administration. 3. In the Navigation section, under Cartridges, click Inventory. this page shows you a list of all the cartridges installed. 4. Click the Browse button. 5. Navigate to the folder with the Dependency Mapping cartridge, select it, and then click Open. You should make sure that the Enable On Install check-box is selected. 6. Click the Install Cartridge button. This installation It may take a few moments for the installation to complete. 7. Click OK when the cartridge operation result message appears. The list displays all the cartridges that are installed. You can click a cartridge for more details.

To complete the integration process, you must proceed to STEP 2: Installing the NMS Agent Cartridge. STEP2: Installing the NMSAgent Cartridge The NMSAgent cartridge is used to call a web service on the Foglight NMS server. This service pulls collected data from devices monitored by Foglight NMS to display and store in FMS.You will have the ability to view your Foglight NMSdata and devices alongside data and hosts in FMS. You can also see more network traffic data in FMS. This cartridge contains the agent software that you must deploy and activate in order to obtain Foglight NMSdata. By default, this agent is installed on the same machine as the Foglight Management Server. NOTE: You must also have the Dependency Mapping cartridge installed to properly integrate Foglight NMS with Foglight. For more information, see STEP 1: Installing the Dependency Mapping Cartridge. To install the NMSAgent cartridge 1. Open Foglight. 2. In the console, click Administration. 3. In the Navigation section, under Cartridges, click Inventory. this page shows you a list of all the cartridges installed. 4. Click the Browse button. 5. Navigate to the folder with the NMS Agent cartridge, select it, and then click Open. You should make sure that the Enable On Install check-box is selected. 6. Click the Install Cartridge button. This installation It may take a few moments for the installation to complete. 7. Click OK when the cartridge operation result message appears. The list displays all the cartridges that are installed. You can click a cartridge for more details.

To complete the integration process, you must proceed to STEP 3: Deploying the NMSAgent.

STEP3: Deploying the NMSAgent After you install the NMSAgent cartridge you will need to deploy the NMS agent software. By default, this agent is installed on the same machine as the Foglight Management Server. NOTE: You must complete the following steps in sequential order so that the agent is deployed correctly. Step 1: Deploy the Agent Package 1. Go back to the Administration page. 2. In the Navigation panel, under Agents, click Status. 3. On the Agent Status page, click the Deploy Agent Package button located in the bottom left corner. 4. In the Host drop-down list, select the host name, which is the machine that is currently running the Foglight application. 5. In the Package drop-down list, select NMSAgent.gar. This package will only appear in the list after you install the NMSAgent cartridge. 6. Click Deploy. 7. When the deployment successfully finishes you will see a green check mark in the Status column. Click OK.

Step 2: Creating the Agent 1. On the Agent Status page, click the Create Agent button located directly below the Deploy Agent Package button. 2. In the Agent Type list, select NMSAgent. 3. Select the Generate Name check-box to create a name that is based on the server name and NMSagent. 4. When the agent is successfully created you will see a green check mark in the Status column. Click OK. NOTE: You will notice that the agent is not yet running in the system because the Activate

button is still enabled. Before you can activate the agent, you must edit the agent's properties.

Step 3: Editing the Agent Properties 1. On the Agent Status page, click the Edit Properties button. 2. Click the Modify Properties for all NMSAgents agent link. 3. Under NMSSettings, in the NMSURL field, type the URL of the server that is running Foglight NMS. For example, if you are logging in to Foglight NMS over an non-secure port, type http://localhost:5054. 4. Type the username to log into Foglight NMS. 5. Type the password that will log you in to Foglight NMS. 6. Click Save to apply your changes. 7. Click the Back To Agent Status button. 8. Click Activate. 9. When the agent is successfully created you will see a green check mark in the Status column. Click OK.

It may take a few minutes for the agent to access Foglight NMS and start collecting metrics from it. While you wait for the process to finish, check the log file to see the status of the deployment or if there are any error messages. To complete the integration process, you must proceed to STEP4: Selecting Devices for Integration. STEP4: Selecting the Devices in Foglight NMS for Integration Before Foglight Management Server (FMS) can pull data from Foglight NMS, you must select the devices from which data will be pulled. After FMS pulls the initial set of data from Foglight NMS, it will continue to pull data from the selected devices at specific intervals. Devices are checked every:
l

20 minutes for new triggered alarms. 5 minutes for new CPU, Memory, Disk Space, and Network Interface data.

1 hour for new NetFlow traffic data.

To select devices for Foglight integration 1. In the Studio, click Configuration -> Administration. 2. Under 3rd Party Integration, click the Foglight Native Integration icon. 3. In the Foglight Integration Device Selection window, select all the devices that you want to store and display data for in FMS. 4. Click Save.

NOTE: You must complete the following steps before Foglight Native Integration is complete and will work properly:
l

STEP 1: Install the Dependency Mapping cartridge STEP2: Install the NMSAgent cartridge STEP 3: Deploy and activate the NMS Agent

Removing Legacy Foglight Integration Foglight NMS only allows one integration configuration at any given time. If you are currently using the older version of Foglight Integration, you must disable it before you can switch to the new Foglight Native Integration configuration. Keep in mind that once you remove the previous version of Foglight Integration, it is permanently removed and you cannot return to it. The data already sent to Foglight will not be lost. To remove Foglight Integration 1. From the Studio, click Configuration -> Administration. 2. Click the Foglight Integration icon. 3. On the Configuration tab, click the Remove button. This action will disable your current Foglight Integration. 4. Click Close.

Viewing Alerts in FMS Foglight pulls only the alerts in process from Foglight NMS. Foglight checks every 20 minutes to see if new alerts were triggered in Foglight NMS and pulls them over for display in the Alarms dashboard. Use the Alarms dashboard to view the state of these alarms across your monitored environment and take immediate action on them. This dashboard shows alarm counts by time, allowing you to identify excessive alarm counts or outage events. To see the alarms that were pulled from Foglight NMS, in the Foglight navigation panel, click Dashboards -> Alarms.

Viewing NetFlow Traffic Data in FMS Using the Dependency Mapping feature in Foglight, NetFlow data that was monitored and collected in Foglight NMS can be displayed in Foglight. The View Dependencies by Host dashboard allows you to look at the relationship between a selected device and other components in a network. It contains the following tabs:
l

Graph: presents the dependency topology for a selected host, in graphical format. Tabular: presents the following dependency data for a selected object.

NOTE: Keep in mind that all of flow data, NetFlow, JFlow, sFlow, and ptFlow, is stored and displayed in FMS. To open the Dependency Browser dashboard 1. In the Foglight navigation panel, under Dashboards, expand the Dependency Mapping module and click Dependency Browser. 2. Click View Dependencies By Host. By default, the graph format appears. 3. Click the NAVIGATOR slider to set the zoom level or to move to a specific area of the graph. 4. Click the Tabular tab to toggle to this view.

Viewing a Device's Performance in FMS After you configure Foglight Native Integration and select the devices in Foglight NMS, you will see metrics for the following data types in the Foglight dashboard:
l

CPU Memory Disk Space Network Interface Traffic NetFlow Traffic Triggered Alerts

In the Foglight console, the CPU, Memory, Disk, and Network columns allow you to obtain a concise overview of your devices performance in these metric categories. The values in these columns - and the popups and drilldowns available from them - change with the dashboard's time range. These columns display recent and current values for each metric category. Recent values are displayed as a sparkline in the Utilization column. When you click on a data type column, more information is provided in the following dashboards:
l

CPU Details: Click CPU to display and use this dashboard to identify the top CPU consumers on the host, see the top processes utilization trends, and view charts for CPU utilization process load. Memory Details: Click Memory to display and use this dashboard to investigate overall memory utilization on the host and the amount of memory the top processes are consuming. The Top Memory Consumers table lists both resident and virtual sizes for the top processes. Disk Details: Click Disk to display and use this dashboard to identify the top disk I/O consumers on the host, see the utilization trends of the top CPU processes, and view charts for disk size and bytes read and written. Network Details: Click Network to display and use this dashboard to investigate the aggregate network utilization of the host and view the activity of your network connections.

To view device metrics in the Foglight console 1. From the Foglight navigation panel, in the Hosts module, select Hosts -> Active Hosts Summary. 2. Hover the cursor over the sparkline or current value in the CPU, Memory, Disk, and Network column for that host. A popup appears. It contains a utilization chart for that metric. 3. To investigate further, click the sparkline or current value. A dashboard appears that contains details for that metric category. NOTE: If some of the devices that you selected in Foglight NMS do not show up on the summary page it may be because data has not been recently collected for it. You may want to check that the credentials are set properly for the device in Foglight NMS.

Administration
Overview This guide provides information about the configuration options available in Foglight NMS. You can access the Administration View by clicking Configuration -> Administration in the Studio's main menu. The Administration View is made up of 2 sections: the configuration options and a platform summary. The platform summary shows the information about your Foglight NMSPlatform Server, including:
l

IP Address Current version of Foglight NMS installed on it Number of interfaces currently being monitored Number of devices in your database Number of users

Refer to the topics in this section for more information on configuring your administration settings.
Topics in this section
l

Agent Migration Auto Patch Settings Baseline Configuration Branding Configuration Check for Updates Flow Configuration License Update Log Alert Configuration

Port Management Retention Configuration SMTP Settings Studio Deployment Switching to the New Database User Management

. Agent Migration 1. From the Foglight NMSStudio, click Configuration -> Administration. 2. In the System section of the Administration View, click Agent Migration. 3. Select the site to migrate agents from and to. 4. Choose one or more devices in the list and click Migrate. Agent migration is complete. The agent appears in the new site in the devices section.

Auto Patch Settings There are two ways Foglight NMS will update. One approach is to manually update your software and the other approach is to let it automatically update. In the Auto Patch Settings window, you can disable automatic patching by deselecting the check-box. If you disable auto patch settings, you will need to use the Check For Updates feature to download and install the latest patch. Manually Updating Foglight NMS 1. From the Foglight NMSStudio main menu, click Administration. 2. In the Administration window, click Check For Updates. 3. Click Update Now to manually apply the software updates. The program will close and then reopen automatically.

Automatically Updating Foglight NMS

Upon launching Foglight NMS, the software will check for any updates available at the patch server. The software automatically pulls the updates and stores them in cache. The updates are applied the next time the software is launched. See Also
l

Updating Your Product

Baseline Configuration The performance baseline automatically analyzes collected data to identify changes in network behavior and establishes a baseline to represent the regular and expected activity of the devices in a network. The established baseline accurately reflects your organizations use of its IT infrastructure by taking into account patterns and variations in usage. For example, one such pattern may be an increase in processor utilization on Monday mornings at 9:00 am. The performance baseline continuously logs subsequent activity of a device and compares it to the baseline. When Foglight NMSdetects irregular behavior, it sends out a qualified alert. This alert contains details that you can use for troubleshooting and remediation.
l

Helps generate reports about the device monitors that vary during a business cycle that are more accurate Identifies abnormal increases and decreases in network utilization, performance, and quality, which cuts down the repair time Eliminates false positive alerts caused by normal behavior on the network Reduces manual configuration for administering setting and thresholds

To set a baseline 1. In the Foglight NMS Studio, click Configuration -> Administration. 2. Click Baseline Configuration. 3. In the General section, determine the number of weeks from which you want to a calculate baseline. This setting can range from 1 to 4 weeks. You will start to receive alerts based on performance baseline after one week of data collection and analysis, even if your performance baseline is set for 4 weeks.

4. In the Weekday Grouping section, determine the week day groupings. You can group the days of the week to make a baseline more accurate and reflect how the network is utilized in your company. To group any set of days, simply give those days the same number. For example, if your network load is the same Monday to Friday but lower on the weekends, then set Monday to Friday to the same number (for example, 1) and set Saturday and Sunday to a different number (for example, 2). If you want each day to have its own baseline, set each day to a different number. NOTE: All settings take effect immediately, and can be changed at any time. Branding Configuration You can brand this software by uploading your company icon and background images. These images rebrand the software for all users that log in to the Studio or Web Studio. Use the Branding Configuration dialog to implement the look and feel of Foglight NMSfor your particular brand. Your changes will take effect the next time the user logs into the Studio or Web Studio. 1. Enable branding: Check the box to enable this feature. 2. Company name: This name will appear in all dialogues in the Studio. 3. Contact email: Set the email address that will appear. 4. Copyright text: The entered text will appear to the right of the copyright logo. 5. Logo Image: Click the Set button to browse for a logo image. 6. Background Image: Click the Set button to browse for a background image. 7. Logo/Background preview: Displays a preview of the changes.

Checking for Updates Foglight NMS comes with a robust software updating system that makes sure the product is always running the latest release. To manually update 1. In the Foglight NMSStudio, click Configuration -> Administration. 2. Check For Updates to see if an update is available.

3. Click Update Now to apply the software updates. TheProgram will close and open automatically.

To automatically update Upon launching Foglight NMS, the software will check for any updates available at the patch server. The software automatically pulls the updates and stores them in cache. The updates are applied the next time the software is launched. Flow Configuration Foglight NMS can filter network flow data (NetFlow, sFlow, and Jflow) based on size of conversation. Set the noise threshold for individual conversations (source IP, destination IP, source port, destination port and protocol) for each interval. Foglight NMSdiscards conversations that fall below the threshold for each time period. The following filter thresholds are available:
l

1-minute-data noise threshold 5-minute-data noise threshold 30-minute-data noise threshold 2-hour-data noise threshold 1-day-data noise threshold

License Update The License Update Wizard provides you with information about your current license and allows you to attach a product to the license, if necessary. It will also download updates for the following components: Network Flow Analyzer Module, Remote Agent Module, VoIP Monitoring Module, and Wireless Monitoring Module. NOTE: To configure the proxy settings, click Configure Proxy Server. 1. In the Foglight NMS Studio, click Configuration -> Administration. 2. Click License Update.

3. To attach a product to the license, type the product key into the Product Key Field and click Apply. 4. Click Finish.

Log Alert Configuration 1. In the Foglight NMS Studio, click Configuration -> Administration. 2. Click Log Alert Configuration. 3. Click the Add Rule link. 4. In the Entry Type drop-down list, select a type of log. 5. If you want the user to receive only a specific type of log; in the Entry Subtype drop-down list, select the alert log type. 6. If you want the user to receive only logs with a specific level of severity, in the Severity drop-down list, select a level. 7. In the To and/or CC fields, type an email address or click the button to select a name from the User List. 8. Click OK.

Port Management Port Management configuration allows the administrator to change the display of certain TCP ports. For example, TCP port 5054 can be configured to display login in the TCP Monitor configuration screen. The Port Management settings also appear in Netflow / Ptflow Application results as well. 1. Click Port Management under Utilities in the Administration section. 2. Scroll down the list to re-name a specific port. Or, scroll to the bottom of the list to add a new port and description. 3. Click OK to complete the process.

Retention Configuration You can adjust the data retention settings to monitor certain data types. These types include DNS, MAC, ports, network adapter configuration, hardware inventory, software inventory, process, Windows services, Exchange, SQL Server, active directory, base device information, system event log, application event log, event log, Syslog, Cisco config, HTTP, SMTP, POP3, network services, and network addresses. Any administrator can adjust the number of days retained. 1. In the Foglight NMSStudio, click Configuration -> Administration. 2. Click Retention Configuration. 3. In the pop-up window, modify any of the settings. 4. Click OK.

SMTPSettings Foglight NMSsends alerts notifications and scheduled reports by email. These alerts and reports are critical components for any IT department to stay informed of any issues. It is recommended that you configure your SMTP settings as soon as possible. 1. Click Configuration -> Administration -> SMTP Settings 2. In the SMTP Server field, type the name of your SMTP server. 3. In the SMTP Port, type the port number. The default port is 25. 4. If your SMTPserver requires authentication, do the following in the Authentication section:
l

Type the username, password, and domain name to allow Foglight NMS access to the SMTP server.

5. If your email server requires secure socket layer (SSL) encryption, select the Enable SSL check-box. 6. (Optional) In the Send Test Email Message field, type your email address and click Send to verify that you have properly configured your SMTP settings. You will receive a test email shortly thereafter. 7. Click OK to save your changes.

Studio Deployment Use this option to install the thin client studio on a site's machine. 1. In the Foglight NMSStudio, click Configuration -> Administration. 2. Click Studio Deployment. 3. Select a site. 4. Click Copy URL or Email URL to select the location. You can paste the URL into a Web browser to launch the Studio.

Switching to the New Database The new Foglight NMS database provides the following benefits:
l

Better performance. The new data base can process larger loads of data for more devices. Keep the data for much longer. Previously, data was retained for 1 year. Upgrading to the new database allows you to store data for up to 36 months. Retain and archive the full details of your data. Currently, the data is rolled-up into specific data points, which are easily viewed on a chart or graph. With the new database, you can drill down into those data points to view the lowest monitoring resolution for the last hour using the Open Web API feature (the current UI does not have any drill down capabilities, but they will be available soon in a future release).

Important Information to Know Before You Make the Switch When you switch to the new database you will no longer be able to view the existing monitoring data in the Studio because it is stored in the old database format. After you switch databases, the application stores and retrieves all monitoring data using the new database format. 1. From the Studio, click Configuration -> Administration. 2. Double-click the Switch to New Database button.

3. Click Yes to proceed.

User Management You can create, edit, manage, and delete additional users. The User Management option has three types of users: System Administrator, Organization administrator, and Read-only. A System Administrator can view and make changes to all sites. Also, the System Administrator can create and manage users of all levels. The Organization administrator can view and manage specific sites as determined by a System Administrator. The Organization Administrator cannot create and manage additional users. To create a user configuration 1. Click New. 2. In the User Detail section, provide the following information: Username User's e-mail address In the Authority drop-down list, set the users privileges. The three levels are Readonly, Organization Administrator, and System administrator. Password Verify password by re-typing the password Invite user to connect via Hostname/IP: sends an email invitation for the user to connect with the selected Hostname/IP Click Preferences to set the Auto-run go live settings when device details is selected

3. In the Organization section, select one or more sites to which your user will have access. 4. Click Save.

Web Service Entry Point API Overview Use Foglight NMSmonitoring data in other applications or build your own reporting functionality using the Open API function. The Open API provides standard web service methods for extracting monitoring data from Foglight NMSand returning it in HTML, XML, or JSON formats. A sample .NET application is provided with source code that has examples for using all of the web service methods.

You can retrieve the Open APIfiles and related documentation from the following 2 places:
l

In the Program Files folder, open the OpenApiSdk.zip file in the Server folder. Click here to download the files.

Migrating Your Database

Overview This topic will guide you through the process of migrating your database from the default SQL CE (Compact Edition) to SQL Standard or Enterprise edition. When you download Foglight NMS, it comes with an optimized version of SQL CE installed. This optimized version works when you are trying out Foglight NMS; however, if you are running Foglight NMS in your production environment, it is recommended that you migrate your data to a server running SQLServer Standard or Enterprise.
Topics in this section
l

Important Information You Should Know Before You Migrate the Database Migrating SQL CE to SQL Server Standard or Enterprise Migrating from SQLServer Standard or Enterprise

Important Information You Should Know Before You Migrate the Database You should keep the following items in mind before you begin to migrate your database.
l

Certain types of data, specifically monitoring data and asset management data, cannot be migrated to the new database. However, all configuration information including devices, policies, and alerts that you created, as well as all other configuration data, will migrate to the new database. It is recommended that you create the database in advance, and create a SQL Server user account (login) and a password so that you can log in to the system. You may also want to restrict the amount of memory that SQL Server uses. The amount of memory that the SQL server uses will depend on which applications are installed on the server. Make sure that you set the recovery mode to Simple.

Migrating SQL CE to SQL Server Standard or Enterprise 1. Launch the Database Administration program by selecting AllPrograms -> Quest Networks -> Foglight NMS -> Database Administration. 2. Click Yes to stop the service. You need to stop the services in order to commit any changes that you made. 3. In the Login dialog box, type your database administration credentials. 4. In the Database Administration dialog box, click Migrate Data from Current Database To A New Database. 5. Next you will need to specify which server you want to migrate your data and provide the authentication credentials for that server. Under Target Database, click Select. 6. In the Server Name field, type the IP address or DNS name of the server. 7. Select the authentication type. If you select SQL Server Authentication, you will need to provide the correct SQL server credentials. NOTE: It is strongly recommended that your SQL Server system is installed locally on the machine currently running the server source database. 8. Click OK. 9. In the Database field, select the name of an existing database or type a new name that you want to assign to the database. 10. Click Migrate. This action may take several minutes. 11. Click Close to restart the service.

Migrating from SQLServer Standard or Enterprise 1. Follow steps 1 through 4 in the previous section. 2. Under Target Database, in the Database Type drop-down list, select SQL Server Compact Edition. 3. Click Browse to navigate to the folder where you want to migrate your data. 4. Click OK.

5. Click Migrate. 6. Click OK to restart the service.

Index
A Active Directory Adding Alerts adding devices by SNMP agent Alert Notification Rule alert notifications B background image Branding Configuration C change the device collection agent Community configure ping settings creating credentials credentials assigning to agent current logged-on user Custom Reports custom script D data collecting 27 40 27-28, 32-33, 36-37, 40, 43 66 64 173 165 35 173 17, 46, 48 10 190 172 27 151 31 33 45 155 154

database benefits of new switch to new deploy agents deploying agents device generate reports devices monitor monitoring agent SNMP WMI discover devices E editing credentials enable SNMP WMI enable WMI for current logged-on user Encrypted Credential Store escalated alert escalation rank G Global Policy 120 65 40 153 153 40 48 26, 28, 31, 46 26, 29, 31, 46 34 46 43 44 26 171 37 45 209 209

group network map patch management group report H hardware system requirements host server system requirements I individual report individual reports installing agents IP address L listener Listener M MAC Address MAC resolution Microsoft Exchange monitor SNMP monitoring WMI monitoring devices monitoring intervals 44 26 15 43 35 31 27 48 48 37 23 172 173 17 15 185, 190 169 173-174

monitors current logged-on user N NetFlow how to scope data ports for Network Discovery network map background image copying create creating groups rebuild relationships Network Performance Reports network traffic Network Traffic Flow Reports New Action New Condition New Escalation New Reset Condition P patch management patching your product ping configure settings delay between packetTTL per node timeout platform server port 80

48 64

48 114 48 31, 33, 35 190 186 183 185 191 173 14-15 173 152 152 152 153

169 29, 203 31, 35 35 36 36 36 35 23 77

ports 2055 (UDP) 514 (UDP) 61 (UDP) 6343 (UDP) 9555 (UDP) 995 (UDP) inbound outbound production environment protocols SNMP V1 SNMP V2 SNMP V3 WMI public DNS R remote connect using a web proxy Reports View rule S scalability scoping NetFlow traffic data services share best practices Simple Network Management Protocol smart policies SNMP enabling

33, 37, 48 48 48 48 48 48 48 23 23 15, 19 36, 40 36 36 36 36 23

77 171 154

14 114 28 11 43 31, 34 27, 37 26

SNMP Enablement tool SNMP Traps data software system requirements SQL SQL CE SQL Server system requirements studio system requirements switch new database syslog system requirements hardware host server software SQL Server studio virtual machines T techniques tunneling web proxy U updating automatically manually User Management

28 48 15 27 15, 18 15, 19 18 18 209 48 15 17 15 18 18 20

34 76

29, 203 29, 203 153-154

V virtual machine system requirements VoIP Reports W web proxy Windows-based Devices Windows event logs Windows Management Instrumentation Windows services WMI 76 27 27 44 27 27 20 173