Monitor Properties
All monitors have the same sections in the property editor; most of these sections have the same properties regardless of the monitor type and only one section contains monitor-specific properties such as port numbers, credentials or validation levels that vary for different monitor types. The monitor properties are described below.
|
Regular Reporting allows to send reports by email
on regular basis (daily, weekly or monthly); click on ellipsis button to open the correspondent settings window:-
Monitor Definition section has a number of monitor-specific properties which vary depending on the monitor type. Below is a summary table for the default monitor types; plugins may add other monitor types with their respective properties.
Monitor Type Properties Basic connectivity PING none
TCP Port (integer)
UDP Port (integer)
Data in Hex to be sent to the server
Expect Echo Response - if TRUE, the monitor compares the server response with the data it sends; otherwise any response is acceptable.
Mail SMTP Port (integer)
User Account for Aauthentication - indicates whether user authentication is necessary and what credentials to use. The default credentials are defined by the $AdminUser and $AdminPassword variables so they change automatically when you update your credentials in the Global Settings dialog.
Test Message - specifies whether a test message should be sent and defines the fields of this message. A text editor form opens when you define the message body.
Secure Connection Type - allows to make use of SSL (Secure Socket Layer)-based security connections. Options are:
- None
- TLS, if available (default)
- TLS
- SSLPOP3 Port (integer)
User Account for Authentication - the same as for SMTP
Secure Connection Type - allows to make use of SSL (Secure Socket Layer)-based security connections. Options are:
- None
- TLS, if available (default)
- TLS
- SSLIMAP Port (integer)
User Account for Authentication - the same as for SMTP
Secure Connection Type - allows to make use of SSL (Secure Socket Layer)-based security connections. Options are:
- None
- TLS, if available (default)
- TLS
- SSLInternet HTTP URL (string) defines a URL to poll. Only the relative part of a URL (path on the server) is taken into account. The URL property uses a special edit control which makes it impossible to change the host name; it always matches the name of the parent host. This prevents creating a host A and a monitor on it that accesses a host B; such monitor configurations are hard to maintain so we avoid them. However you can enter an URL schema ( http:// vs. https://).
Port (integer). The default port numbers for http:// and https:// are 80 and 443, respectively. Make sure to specify them correctly.
Request Method: either GET or POST. For POST requests, the POST Data property provides the request body to be sent to the server. This may be convenient if you test a HTML form or XML web service operation.
Accepted Response Codes: generally, all server response codes starting with 400 are considered erroneous. If the server replies with such a response code, the resource being requested is considered unavailable and the monitor enters the Down state. However you can accept such response codes by adding them to the comma-separated list of Accepted Response Codes. There is no need to add 200 to this list; it is always accepted.
Response Validation and String to Match: specify whether a particular string should be searched in the HTTP response and whether it should or should not be present. The default setting is 'None' (no response validation).
Login and Password: contain the credentials to be supplied to the HTTP server in case it requires authentication. The credentials are not sent if the server does not ask for them. Basic, Digest and NTLM authentication methods are supported. When the server does not accept the credentials, a message in the Log View panel indicates the server HTTP response code of 403 or 401 and the monitor enters the Down state, unless you accept these codes as explained above.
Proxy server settings (type and URL) allow you to specify a proxy server to be used. By default, direct connection is established.
Note: the default settings for a HTTP monitor (direct GET request to the default page without content validation) will suffice in many cases.
Some web applications redirect user to another page through HTML tags such as META HTTP-EQUIV=REFRESH. The HTTP monitor does not parse HTML as a web browser and does not follow such links. It is recommended to indicate actual page URL as it is shown in your browser after all possible redirections if you wish to monitor such applications.
Web Transaction Monitor This monitor is an advanced variant of the HTTP one and allows testing Web application transactions as a whole. Use this monitor to check that both the HTTP server itself and Web application hosted there behave correctly.
A transaction consists of a sequence of related HTTP requests which are sent to the server in a row. Using the built-in browser (WTM Recorder) a transaction may be easily recorded starting from the Login procedure. At each step an HTTP response may be validated against the stored keyword to check if the transaction is on the right track.
The Sequence of HTTP Requests is the number of HTTP requests forming a transaction. In order to modify monitor settings and/or record a transaction press the [...] button. A Web Transaction Monitor configuration form will appear.
FTP Port (integer)
User Account for Authentication - the same as for SMTP
Accepted Response Codes - the same as for HTTP
Use SFTP protocol checkbox means to use SFTP protocol instead of FTP.
Note that SFTP does not define response codes; however, SFTP authentification errors are mapped as response code 530; one can add it to Accepted response codes list if necessary.
DNS This monitor allows testing DNS servers. Use this monitor to check that DNS server works in general, or that it can resolve a given host name to an IP address, or that it can resolve mail servers for a given domain.
Use System DNS Servers - specifies whether to use the default DNS server from the system settings or this host as a DNS server.
Port (integer) - specifies on which port the DNS server is listening for connections. The default setting is 53.
Request Type and Request Data - are used either to check that a DNS server works in general by executing an NS-type request for "." domain, or to get an IP address for the host name specified in Request Data, or to get the list of mail servers (MX-records) for the domain in Request Data.
Response Validation and Valid Response - specify whether a response from the DNS server should be validated by comparing it with a given string. Response Validation can be set to one of the three values:
- No - don't check the response;
- Yes (exact match) - if a response from the DNS server completely matches a string from the Valid Response property, then the monitor will return Ok and performance will be set to overall response time in milliseconds, otherwise the monitor will return the Down state;
- Yes (partial match) - if a response from the DNS server contains a substring from the Valid Response property, then the monitor will return Ok and performance will be set to overall response time in milliseconds, otherwise the monitor will return the Down state.
When a response from the DNS server contains several answers, they are sorted and concatenated together, separated by ';'. For example "1.2.3.4;9.8.7.6"
Network SNMP Custom OID (SNMP variable to monitor) is an object identifier of a variable to poll. It should denote a variable that will be used to calculate performance in accordance with the next two settings, Counter Type and Divide returned value by. For counters of type Current Value and Delta, non-integer variables are not supported since they cannot be interpreted as performance values. However, for the remaining counter types Value has changed and Value is allowed, non-integer variables are permitted.
SNMP Version is the protocol version.
Community String is the SNMP community string; many systems use the string public as the default value. This property is only used by the SNMP v1 and v2 monitors.
SNMP V3 User and SNMP V3 Password should be set for the SNMP v3 monitors requiring authorization. Leave these fields empty if the SNMP service or user account has no authorization enabled. The SNMP V3 Authentication Mode setting should indicate the digest algorithm used for authentication, either MD5 or SHA1.
SNMP V3 Encryption Key should be set for the SNMP v3 monitors requiring secure connection. This string should be at least 8 characters long. It is used to calculate DES key to encrypt the messages on transport level. Leave this setting empty if the SNMP service or user account has no message security enabled.
Port is the SNMP service port, usually 161.
Below is a brief tutorial on SNMP monitoring.
You should specify an SNMP variable to monitor by entering a numeric object identifier value for it. You can either enter it directly in property editor or open an SNMP browser dialog and select one of the variables supported by the host. If you see unknown OIDs in a browser you can search for their description using the online resources, such as http://www.mibsearch.com, then download and import the MIB file that describes the variables. When you create a new SNMP monitor, SNMP browser opens automatically.
Please note that when entering OID value manually you should append a zero node .0 to each object identifier denoting a scalar object and a row number starting from one to each object identifier denoting a column in a tabular object. For instance, 1.3.6.1.2.1.1.3.0 is a system uptime counter and 1.3.6.1.2.1.2.2.1.16.1 is an outgoing traffic counter for the first network interface. When using the SNMP browser, OID values are constructed automatically.
Some SNMP counter values increase over time and their absolute values are not of interest but deltas are. For instance a counter can return total number of bytes sent by the network interface while it is important to monitor number of bytes sent per second. To automate this task, the Counter Type property can be used. Its Current Value setting indicates that actual counter value should be regarded as performance while its Delta setting instructs the monitoring service to calculate deltas of each two subsequent performance values divided by number of seconds between polls. Note that Delta counters do not show any value until the second poll.
The next counter type, Value has changed, reports 1 if a value returned by current poll differs from value returned by previous poll and 0 if they match. The state of such counters is also undefined for the first poll since it is not possible to detect changes when there is no previous value. You can define Performance Warning Levels of [0,0] and Performance Warning Iterations of 1 for such counters; in this case, a value of 1 would cause a state transition to Performance Warning state and it would be possible to send alert messages on value changes by registering an alert for the Performance Warning state.
The last counter type, Value is allowed, reports 0 if a value returned by current poll belongs to a list of allowed values and 1 when it is does not. It is easy to remember that a value of 1 signals a problem as in case of a previous counter (disallowed or changed value, respectively). The allowed value list is contained in an Allowed Values field which is a multiline text. Each value takes one line; use \n to define values that contain newline character and empty line to define empty string values. You should format the values same way as they are formatted in an SNMP browser. As for the previous counter, you can define Performance Warning Levels of [0,0] and Performance Warning Iterations of 1 for such counters; in this case, a value of 1 would cause a state transition to Performance Warning state and it would be possible to send notification messages for disallowed values by registering an alert for the Performance Warning state.
For the counters of types Value has changed and Value is allowed, their current values are written to the system log on each change and you can see them in a Log Panel. Don't use these counters to monitor values that change constantly, such as timers. This will generate huge logs. Such counters are mostly intended to observe variables that have known and / or limited sets of allowed values and change infrequently. They are also suitable for monitoring non-integer variables.Divide returned value by property may be used to normalize the performance values. For instance, the sysUpTime counter defined by the SNMPv2-MIB that has numeric value of 1.3.6.1.2.1.1.3.0 returns performance values measured in hundredths of a second. To convert such values to hours you can specify the Divide returned value by setting of 360000 (100msec * 60sec * 60min).
Resources Disk space Path (UNC or local path) - is the path to a network shared folder or local directory. A directory dialog appears if you click the button in the property value area; it allows selecting a share. You can also check space on special shares such as C$ on hosts where you have administrator rights. When you create a new Disk space monitor, a directory dialog opens automatically.
In order to monitor local disk space in the absence of network connection you should create a host polled by IP address 127.0.0.1 and use local paths to the directories on this host. Using the UNC names will most probably fail even if they denote directories on your computer.
User Account for Authentication - specifies what Windows account to use. By default, the monitoring service account defined on the Credentials page in the Global Settings dialog is used; however, you can specify the credentials of another user who has rights to access the folder.
File The properties are similar to the Disk Space monitor properties. A file dialog opens when you edit the Path (UNC or local path) property. When you create a new File monitor, a file dialog opens automatically.
In order to monitor local files in the absence of network connection you should create a host polled by IP address 127.0.0.1 and use local file names on this host. Using the UNC names will most probably fail even if they denote files on your computer.
Windows Service Service Name - is a short name of the service (not its display name) shown on its property page available from the Services dialog (such as W32Time on the screenshot).
User Account for Authentication - has the same meaning as this property for the Disk Space monitor.
WMI Query WMI Monitor - specifies what resource should be monitored. There are four predefined monitors (CPU Load (%), Available Memory (MB), the number of Bytes Sent/sec or Bytes Received/sec through all network interfaces per second). Besides, you can specify an arbitrary query by selecting the Custom (run WMI Query) value in the text field. In addition to the standard WMI query format you can use an extended format: search for SUM(counter) or COUNT(counter) from the WMI data source. For instance:
SELECT SUM(BytesSentPersec) FROM Win32_PerfFormattedData_Tcpip_NetworkInterface
- this query calculates the total number of bytes sent on all network interfaces.
SELECT COUNT(*) FROM WIN32_Service WHERE Name='WebClient' AND Started=TRUE
- this query returns 0 if the 'WebClient' service is stopped or does not exist and 1 if it is started. It may be regarded as an alternate way of monitoring the Windows Service operability (besides using the Windows Service monitor).
If you don't use SUM or COUNT keywords then the data in the first column of the first row from the result set returned by a query is interpreted as an INTEGER number (performance value).
WMI namespace - namespace to use. Windows system performance counters use root\cimv2 namespace. Other products use their own namespaces. For example, Microsoft Exchange declares several useful WMI data source under root\MicrosoftExchangeV2 namespace; one example is exchange_SMTPQueue data source with properties like NumberOfMessages.
User Account for Authentication - has the same meaning as this property for the Disk Space monitor.
Divide returned value by property may be used to normalize the returned value. For instance, WMI counters may return 64-bit data such as free space left on HDD in bytes, and such values should be scaled down to fit 32-bit signed integer range supported by IPHost.
Databases MS SQL database Port (integer, typically 1433).
Instance - database instance name (can be often found by running 'select @@servername' query).
Database name - database name.
Use Trusted Connection - whether to use trusted connection to authenticate; if no, user name and password should be entered in the fields below.
User Name, Password - credentials for accessing the database. The default credentials are defined by the $AdminDomain\$AdminName and $AdminPassword variables so they change automatically when you update your credentials in the Global Settings dialog.
SQL Expression - is a SELECT statement to execute. The first column of the first row of the result set returned will be interpreted as as an INTEGER number (performance value).
MySQL database Port (integer, typically 3306).
Database name - database name.
SQL Expression - is a SELECT statement to execute. The first column of the first row of the result set returned will be interpreted as as an INTEGER number (performance value).
User Name, Password - credentials for accessing the database. The default credentials are defined by the $AdminName and $AdminPassword variables so they change automatically when you update your credentials in the Global Settings dialog.
Use SSL Connection - whether to use secure (SSL) connection to authenticate.
Trusted CA Path - the path to a directory that contains trusted SSL CA certificates in PEM format.
ODBC database System DSN or Connection String - is either a data source name (DSN) registered on the host computer where the monitoring service is running or an ODBC connection string. When DSN form of this parameter is used, it identifies an ODBC data source record that stores name of the database instance and options sufficient to obtain ODBC connection. You can define a data source on the Data Sources (ODBC) page of the Administrative Tools system dialog available from Control Panel.
Note: the data source should be registered as System DSN in order to be accessible by the monitoring service. The service cannot access User DSNs since it runs under the Local System account by default, not under some user account. For the same reason, please do not use the Windows NT Authentication when connecting to the database. Specify valid database user credentials directly in DSN settings instead.
When ODBC connection name rather than a DSN is specified in this parameter, it should be a complete connection string containing all parameters sufficient to establich ODBC connection. For example, the below connection string may be used to connect to the IPHost monitor database storing the monitoring system configuration and performance data:
DRIVER=Firebird/InterBase(r) driver; UID=SYSDBA; PWD=masterkey; DBNAME=localhost/3055:C:\ProgramData\IPHost Network Monitor\data\NMS.FDB; CLIENT=C:\Program Files\IPHost Network Monitor\firebird\bin\fbclient.dll; CHARSET=UTF8; DIALECT=3;
This connection string assumes that you are using the default installation path and that an ODBC driver for Firebird available here is installed.
SQL Expression - is a SELECT statement to execute. The first column of the first row of the result set returned will be interpreted as as an INTEGER number (performance value).
User Name and Password - credentials for authentication, recognized by your database server. They may also be defined in the DSN settings in which case these two fields may be left empty. When using a connection string rather than DSN, you can specify the credentials as part of this string or as separate parameters, and separate parameters (when specified) take the precedence over the ones provided in a connection string.
Oracle database Port (integer, typically 1521).
Database Name - database instance name.
SQL Expression - is a SELECT statement to execute. The first column of the first row of the result set returned will be interpreted as as an INTEGER number (performance value).
User Name, Password - credentials for accessing the database. The default credentials are defined by the $AdminUser and $AdminPassword variables so they change automatically when you update your credentials in the Global Settings dialog.
Custom monitors Script or Program This type of monitor allows runnung an external program, batch file or Windows Scripting Host script such as Visual Basic script and to interpret the script output as the performance value. Use it to monitor anything that is not covered by the standard monitor types.
Path to Program File - is a script or program file name that you can enter manually or select using the File Open dialog. Default location to look for script and program monitors is a scripts subdirectory of a program installation directory and it contains some useful monitors described here intended to monitor directory size, file content and HTTP response content.
Program Parameters - program arguments; make sure to quote parts of this string that should be considered as a single argument and which may contain spaces.
Program Type - is a combo-box with two options. Select Run program to run binary .exe file or batch script; select Run script to start Windows Scripting Host script.
Program Mode - is a combo-box with two options. Standard mode is simple: script should return zero on success and should also print integer or decimal performance value to stdout; in case of an error, non-zero should be returned and error message should be printed. Another mode, Nagios Plugin, may be used to plug in monitors that conform to Nagios Plugin API. In this mode the plugin can also calculate the monitor performance state; plugin response code of 1 (Nagios WARNING) is mapped to IPHost Performance Problem. You can take Nagios plugins say here, compile them with Cygwin or other C compiler and use them through the IPHost polling engine to perform specific monitoring tasks not covered by other IPHost monitors.
Divide returned value by - has same meaning as for SNMP monitor; allows to scale performance numbers to make them valid signed 32-bit integers. In particular, specify a value of 0.001 to convert milliseconds to seconds (divide them by 1/1000, that is, multiply by 1000).
Run monitor As - specifies what Windows account to use. By default, the Monitoring Service Account is used (this is normally the LocalSystem), another option is to use the Default User Account defined on the Credentials page in the Global Settings dialog; you can also use the Custom Account specifing the credentials of another user who has rights to execute the program.
SSH (Remote Script or Program) This type of monitor allows connecting to a remote host over SSH and running any command there. Execution results are interpreted as a performance value. Use it to remotely monitor anything that is not covered by the standard monitor types. In particular, you can integrate any already deployed monitoring capabilities for UNIX-based hosts with the IPHost alerting and reporting engine, be it custom scripts, Nagios plugins or interfaces provided by other systems. You can also just measure SSH connecting time with this monitor.
Port (integer, typically 22)
Test Host Key - when this property is set to Yes, the value of the next property, Host Key Fingerprint is compared with the actual fingerprint used by the destination host. When they don't match, the credentials are not sent to that host and the monitor is considered Down. You can get a current host fingerprint from the error message in the log view pane and paste it to the Host Key Fingerprint property to make this check succeed.
Authentication Type - this property defines the authentication method to use. Authentication By password uses the User Name and Password values. Authentication By public key uses the values of Path to Public Key File and Path to Private Key File (these should be obtained using the ssh-keygen utility as explained here and registered on your SSH server) as well as the Passphrase for Private Key. The last authentication method, By public key or password, makes attempts of authenticating in both ways, first by public key, next by password.
Execute Script - is a combo-box with three options. You can run scripts or commands using either Standard or Nagios mode as explained here. In this case, the next property, Script to Execute, specifies the command to run on the server. You can use shell commands, pipes and so on in this command line. The last option, No, just measure response time, disables script execution on the server. Instead, the SSH monitor in this mode just measures the SSH connection time in milliseconds.
Divide returned value by - has the same meaning as for the SNMP monitor; allows scaling performance numbers to make them valid signed 32-bit integers. In particular, specify the value 0.001 to convert milliseconds to seconds (divide them by 1/1000, that is, multiply by 1000).
-
An Alerting section - allows defining alerts that should take place on state changes. Overview of the alerfing framework can be found here.
A monitor can inherit its alerting rule from the host or monitor type (this is the default setting). In this case all changes you make in the parent alerting rule will apply to this monitor automatically. A monitor can also use a custom alerting rule with individual alerts. Finally, you can assign one of the global alerting rules to a monitor; for instance, E-mail to Administrator that is created automatically when IPHost Network Monitor is installed can be assigned.
In order to modify an alerting rule assigned to the monitor, press the [...] button near the combo box in the value are of an Alerting Rule property. An Alerting Rule editor form will appear where you can add alerts and assign them to monitor state changes. Note that you may be actually modifying a global alerting rule or an alerting rule assigned to the host or monitor type and these changes affect the other monitors that use the same rule. You can use the radio button group at the bottom of the form to create a custom alerting rule from the global rule and avoid affecting other monitors; just select the 'alerting rule for monitor' setting there. You can also 'publish' a current alerting rule as global and assign some meaningful name to it.
The Alert List window and Alert Editor that can be opened from Alerting Rule Editor when you press the Add or Edit buttons are described on the Global Settings page (the same forms are used to edit the global lists of alerts and alerting rules in the Global Settings dialog).
-
An Availability Monitoring section specifies how to detect Down and Extended Down states. Down State Timeout, seconds value specifies for how long to wait for response and Number of Repetitions of Timeout for Down defines how many attempts to make before deciding that a monitor is Down. Extended Down Latency, seconds is the number of seconds in a Down state after which a monitor enters an Extended Down state (you can specify more serious alerts for this state, such as sending a notification message to the higher level manager since the problem hasn't been fixed quickly by an the administrator). These settings may be inherited from the monitor type or customized as explained here.
-
A Performance Monitoring section specifies how to detect Performance Warning and Performance Problem states. For some monitors only the upper bounds of performance value are meaningful; for some such as File, both lower and upper bounds may be defined and finally there are pure availability monitors such as Windows Service that don't have this section at all. If you don't want to define a performance threshold for some level, you can simply select No setting value for it. As for availability, you can specify a repeat count value for polling; only when it is exceeded and the performance problem is still there will it be detected and a state change will take place. This setting is intended to avoid false alarms on problems caused by temporary reasons. Performance settings may be inherited from the monitor type or customized as explained here.