version 5.7 ################################################################################ # CA SystemEDGE configuration file # Copyright 2012 CA, Inc. # http://www.ca.com ################################################################################ ################################################################################ # The sysedge_loglevel entry instructs the agent to log messages up to the given level. # The sysedge_logfile entry allows to specify log file settings. # The sysedge_logpattern entry instructs the agent to log messages for the specified # modules only. # # Syntax: # sysedge_loglevel # sysedge_logfile '' [ []] # sysedge_logpattern # # Description: # is fatal, critical, warning, info, debug, debug[1-3] (default is info). # is the log file name (default is 'sysedge.log'). # is the maximum file size in KB (default is 10240, i.e. 10 megabytes). # is the number of log files preserved (default is 1). # is a space delimited list of module names (default is any module). # # If does not denote an absolute path name, the log file is created in # the agent's port-specific data directory. # # Upon agent startup, an existing log file is preserved as '.0'. The # same holds true for a change of the log file at runtime (via delivery of # a new configuration in managed mode) with respect to the new file. # # If is equal to or less than zero then no size limit will be set on # the log file. Otherwise, the parameter controls the handling of # the log file when the size limit is reached: # 0 = Logging will stop when the size limit is reached # 1 = Logging will save the current log file contents to '.1' when the # size limit is reached and then wrap around to the start of the log file # >1 = Logging will use a wrap-around set (or ring) of up to the specified # number of backup files with '.' containing the oldest # log entries at any one time # -1 = Logging will wrap around to the start of the log file when the size # limit is reached # -2 = Logging will save the current log file contents to # '.YYYY-MM-DD_hh.mm.ss' when the size limit is reached and then # wrap around to the start of the log file # # If specified, denotes the list of modules for which to log messages: # se = SystemEDGE agent # svcrsp = Service Response Monitor AIM # rmonwbem = RMONWBEM AIM # monwin = Monitor Maintenance Window AIM # perfcube = Performance Cube AIM # util = Common/shared library # regexpr = Common/shared library # shm = Common/shared library # # Example: # sysedge_loglevel debug # sysedge_logfile C:\temp\sysedgeDbg.log 1000 2 # sysedge_logpattern monwin perfcube ################################################################################ template sysedge_loglevel template sysedge_logfile template sysedge_logpattern ################################################################################ # This entry specifies the preferred encryption method for the agent. # Encryption is used for example to encrypt/decrypt the sysedgeV3.cf configuration file. # The file can be encrypted using the tool se_enc and is decrypted by the agent. # Encryption is also used for SNMPv3 acess communities (see sysedgeV3.cf file). # # Encryption is available in three different implementations: # * Internal solution to ensure a minimum security functionality # * CA eTrust Public Key Infrastructure libraries (libetpki/libcapki) # (requires installation of the CAPKI package) # * RSA BSAFE Crypto-C Micro Edition libraries (cryptocme2) (FIPS 140-2 compliant) # (requires installation of the CAPKI package and a FIPS supported platform) # # Syntax: # sysedge_fips_mode # # Description: # can be one of: # 0 = encryption tries using libetpki/libcapki and on failure falls back to internal solution # 1 = encryption tries using libcrytocme2 and on failure falls back to mode 0 (this is default) # 2 = encryption enforces use of libcrytocme2 and on failure no encrypt/decrypt can be performed # # Example: # sysedge_fips_mode 2 ################################################################################ template sysedge_fips_mode ################################################################################ # This entry specifies the preferred IP family the agent uses when sending SNMP # responses or SNMP traps to IPv4/IPv6 destination addresses. A prerequisite is # that the agent is bind to a source socket supporting the preferred family. # This can be controlled by the 'bind_address' configuration entry. # # Syntax: # sysedge_ip_family # # Description: # can be one of: # 1 = the agent prefers the IPv4 family (and tries IPv6 in error case only) # 2 = the agent prefers the IPv6 family (and tries IPv4 in error case only) # 3 = the agent uses both families IPv4 and IPv6 (this is default) # # Example: # sysedge_ip_family 1 ################################################################################ template sysedge_ip_family ################################################################################ # The bind_address entry specifies a source socket address the agent binds to and # listens for incoming SNMP requests. (Note: The corresponding port is specified # during installation. See documentation of the 'default_port' parameter.) # Per default the agent will bind to all available UDP addresses (IPv4 and IPv6). # # The bind_trapport entry specifies the trap port the agent binds to for sending # SNMP traps. Per default the agent will bind to a port selected by the system. # If no bind_address is specified the agent will bind to all available UDP addresses. # # Syntax: # bind_address
# bind_trapport # # Description: #
is the IPv4/IPv6 address (or hostname) to listen for SNMP requests. # is the port number to send SNMP traps from. # # Examples: # bind_address 10.1.0.202 # bind_trapport 6688 ################################################################################ template bind_address
template bind_trapport ################################################################################ # These entries specify the information for the system group (see mib-2.asn1). # # Syntax: # sysdescr # syscontact # syslocation ################################################################################ template sysdescr template syscontact template syslocation ################################################################################ # This entry specifies SNMPv1 access communities. # SNMPv2 and SNMPv3 can be configured in the sysedgeV3.cf configuration file. # # Syntax: # community [] # # Description: # is the community granting the defined access to the defined addresses. # is the type of access: 'read-write' or 'read-only'. # is a space delimited list of IPv4/IPv6 addresses or hostnames (default is any address). # # Examples: # community private read-write # community public read-write fe80::2b0:d0ff:fe9b:7d72 ################################################################################ template community community public read-only ################################################################################ # This entry specifies SNMPv1 trap communities (trap destinations). # SNMPv2 and SNMPv3 can be configured in the sysedgeV3.cf configuration file. # # Syntax: # trap_community
[ [ []]] # # Description: # is the community send with the trap. #
is the IPv4/IPv6 address or the hostname to send traps to. # is the UDP port to send traps to (default is 162). # defines how to include the trap source (default is 000). # is the IPv4/IPv6 address or the hostname to use as trap source (default is trap_source). # # Details for : # - encoding enables to include any source address in a SNMPv1/v2/v3 trap (or notification) # - without encoding, only a SNMPv1 trap contains a source address (always as IPv4 address) # - encoding must be given as three digits XYZ, with leading zeros (e.g. 001 or 034) # # X is for SNMPv1 traps only. # If the source address cannot be translated into an IPv4 address, it allows extending the # IPv4 source address field (4 byte) of the SNMPv1 PDU to include an IPv6 address (16 byte). # The trap is no more standard conform. # 1 = extend source address field (if necessary) # # Y is for SNMPv1/v2/v3 traps (or notifications). # It controls adding the source address as one or two additional trap varbinds # using dedicated OIDs (1.3.6.1.4.1.791.99.99.1 and 1.3.6.1.4.1.791.99.99.2). # # Z is for SNMPv1 traps only. # It controls adding the source address in a proprietary trailer to the UDP packet. # The trap is no more standard conform. # # Valid values for Y and Z: # 1 = add source address as is (IPv4/IPv6 address or hostname) # 2 = add source address preferred as IPv4 (else IPv6, else hostname) # 3 = add source address preferred as IPv6 (else IPv4, else hostname) # 4 = add source address preferred as hostname (else IPv4, else IPv6) # 5 = as for 2, and additionally add hostname # 6 = as for 3, and additionally add hostname # 7 = as for 1, and additionally add hostname (if source address is IPv6) # # Examples: # trap_community public 127.0.0.1 162 # trap_community public ::1 1692 100 ################################################################################ template trap_community
trap_community public 72.3.141.208 162 ################################################################################ # This entry specifies the source address to be used when sending traps. # This configuration applies to SNMPv1/v2/v3 traps (or notifications). # # Syntax: # trap_source
# # Description: #
is the IPv4/IPv6 address or the hostname to use as trap source (default is `hostname`). # # Example: # trap_source 129.118.126.83 ################################################################################ template trap_source
################################################################################ # The no_authen_traps entry configures the agent NOT to send authenticationFailure # traps (SNMP generic trap 4). # # Syntax: # no_authen_traps ################################################################################ template no_authen_traps no_authen_traps ################################################################################ # This entry configures the agent NOT to send SNMPSET notifications to the manager. # Such notifications are sent upon receipt of SNMPSET requests if the agent is # running in managed mode (i.e. manager_name is configured). # # Syntax: # no_snmp_set_notifications ################################################################################ template no_snmp_set_notifications ################################################################################ # This entry instructs the agent to go into a "maintenance" mode where it # stops the processing of all monitors and stops sending traps to managers. # # Syntax: # sysedge_maintenance ################################################################################ template sysedge_maintenance ################################################################################ # The no_process_sets entry instructs the agent NOT to allow SNMPSET requests # on the processTable (see empire.asn1) and the hrSWRunTable (see hostmib.asn1). # The no_remoteshell_group entry instructs the agent NOT to allow SNMPSET requests # on the remoteShell group (see empire.asn1). # Attention: Allowing any of these SNMPSET requests seriously affects security. # # Syntax: # no_process_sets # no_remoteshell_group ################################################################################ template no_process_sets template no_remoteshell_group no_process_sets no_remoteshell_group ################################################################################ # This entry instructs the agent NOT to invoke actions. # Any monitor can configure an action, which will always be invoked concurrent # to the sending of any trap (including notReady traps). # Attention: Per default actions are running as system respectively root user. # # Syntax: # no_actions ################################################################################ template no_actions no_actions ################################################################################ # These entries instruct the agent (Unix only) to run all child processes with # the defined user name and group name instead of the default root. # Child processes are created for actions, extensions and remoteShell commands. # If any name (user or group) is invalid, all child process execution is disabled. # # Syntax: # subprogram_user_name (Unix only) # subprogram_group_name (Unix only) # # Description: # is the user name or group name to use for child processes. # # Example: # subprogram_user_name sysedge (Unix only) # subprogram_group_name adm (Unix only) ################################################################################ template subprogram_user_name template subprogram_group_name ################################################################################ # This entry instructs the agent (Unix only) to run SNMP communication under # another user. Agent will also use this user's default group as an effective group. # By default agent operates using root account. # # Syntax: # privilege_separation_user (Unix only) # # Description: # is the user name under which credentials agent run during SNMP # communication. # # Example: # privilege_separation_user daemon (Unix only) ################################################################################ template privilege_separation_user ################################################################################ # This entry instructs the agent NOT to skip Solaris Zone virtual mountpoints. # Note: This entry applies only to Solaris 10 or later. # # Syntax: # no_zone_mountpoint_filtering ################################################################################ template no_zone_mountpoint_filtering ################################################################################ # These entries can be used to prevent the agent from populating the respective # MIB tables (see empire.asn1). Typically this is done due to security policies # or to reduce the agent's resource usage. # # Syntax: # no_process_table (disables also hrSWRunTable) # no_topprocs_table # no_who_table # no_usergroup_table # no_trapcommunity_table # no_mirror_monitor_table # no_mirror_aggregate_table ################################################################################ template no_process_table template no_topprocs_table template no_who_table template no_usergroup_table template no_trapcommunity_table template no_mirror_monitor_table template no_mirror_aggregate_table ################################################################################ # These entries can be used to prevent the agent from querying the status of the # different system devices. Typically this is to avoid potentially agent blocking. # Note that enabling any of these entries will affect the corresponding MIB # tables, because not all information will be provided for the respective objects. # # Syntax: # no_stat_floppy - not query floppy devices # no_serial_status - not query serial devices other than the keyboard and mouse # no_probe_disks - not query disks and CD/DVD devices # no_discover_disks - not find and query disks and CD/DVD devices # no_stat_nfs_filesystems - not query NFS-mounted filesystems (Unix only) # no_hpux_probe_graphics - not query graphics (HP-UX only) ################################################################################ template no_stat_floppy template no_serial_status template no_probe_disks template no_discover_disks template no_stat_nfs_filesystems template no_hpux_probe_graphics no_stat_floppy ################################################################################ # This entry specifies whether a warm-start of the agent will not force a # rediscovery of all hardware devices. A warm-start is performed if the agent is # running in managed mode (i.e. manager_name is configured) and a new configuration # file is received from the manager. # # Syntax: # no_warmstart_discovery ################################################################################ template no_warmstart_discovery no_warmstart_discovery ################################################################################ # This entry specifies the preferred calculation method (Linux only) for free memory. # # Syntax: # linux_freemem_include method [method] (Linux only) # # Description: # can be one or both of: # buffers = include system buffers in the free memory calculation # cached = include disk cached memory in the free memory calculation # # Example: # linux_freemem_include buffers cached (Linux only) ################################################################################ template linux_freemem_include ################################################################################ # Monitors can accept regular expressions containing UTF-8 characters. It can be # handled either by former regexp library or by PCRE regex library which is # considered as standard in many GNU applications. PCRE covers POSIX basic and # POSIX extended regular expressions and also subset of regular expression # functionality provided by Perl. More about PCRE can be found at: # http://www.pcre.org/pcre.txt # # SysEDGE agent uses older regex library as default. To enable new PCRE library # use configuration option use_pcre. # # Syntax: # use_pcre ################################################################################ template use_pcre ################################################################################ # This entry specifies the soft limit in bytes for GET BULK response message payload. # # The main purpose of this soft limit is: # * Limit fragmentation of response message # * Limit memory consumed for by sysedge # # In case the message soft limit is breached agent still finish the iteration # of requested list of OIDs and form the valid response message. # # It is not guaranteed that response message does not breach the soft limit. # In general it is a good idea to left there some room for possible overflow. # # For example to avoid fragmentation on IP level the soft limit could be set to 60000. # Maximum size of IP packet is 65535 therefore there is still room left for possible # overflow and protocol headers. # # Default value is set to 60000 # # Syntax: # bulk_read_response_soft_limit # # Description: # soft limit in bytes # # Example: # bulk_read_response_soft_limit 60000 ################################################################################ template bulk_read_response_soft_limit bulk_read_response_soft_limit 60000 ################################################################################ # Per default the agent aggregates all self monitors and process monitors with the # same object class, instance and attribute into 'standard' aggregates. # All monitors belonging to an aggregate are called 'connected monitors'. # # The aggregate_level entry enables several higher levels of monitor aggregations, # so called 'super' aggregates, using an asterisk '*' as placeholder. # # Note: # For the object instance '//' and '/' are used as delimiters to relate an instance # to its hosted hierarchy: '//hierarchy/instance'. The hierarchy can be multi-tier. # For local system instances '//./' is prepended. # Additionally a name space can be prepended to identify virtual objects (e.g. lpar:). # Examples: # //VM-Host/VM-Guest/Disk1 # //Host/Disk1 # //./Disk1 # # Super aggregates can be enabled for one or both of the rightmost two tiers. # The special super aggregate //* is created to aggregate all instances. # Examples for level 0002: # //VM-Host/VM-Guest/* # //Host/* # //./* # Examples for level 0004: # //VM-Host/*/Disk1 # //*/Disk1 (excluding //./Disk1) # Examples for level 0008: # //VM-Host/*/* # //*/* (excluding //./Disk1) # //* # # Syntax: # aggregate_level # # Description: # is a bit field allowing the aggregation levels of the below table: # # ---------------------------------------------------------------------- # class instance attribute level # ---------------------------------------------------------------------- # class //hierarchy/instance attribute (standard aggregate) # class //hierarchy/* attribute 0002 # class //hierarchy-1/*/instance attribute 0004 # class //hierarchy-1/*/* attribute 0008 # # class //hierarchy/instance * 0010 # class //hierarchy/* * 0020 # class //hierarchy-1/*/instance * 0040 # class //hierarchy-1/*/* * 0080 # # * //hierarchy/instance attribute 0100 # * //hierarchy/* attribute 0200 # * //hierarchy-1/*/instance attribute 0400 # * //hierarchy-1/*/* attribute 0800 # # * //hierarchy/instance * 1000 # * //hierarchy/* * 2000 # * //hierarchy-1/*/instance * 4000 # * //hierarchy-1/*/* * 8000 # # Example: # aggregate_level 0x6000 ################################################################################ template aggregate_level ################################################################################ # The aggregate_monitor_traps entry causes the agent to send SNMPv1/v2/v3 traps # (or notifications) not only for the aggregate but also for all connected monitors. # (The term 'connected monitors' is explained above.) # # The aggregate_monitor_actions entry causes the agent to invoke an action not only # for the connected monitors with the worst state but also for all connected monitors. # # Syntax: # aggregate_monitor_traps # aggregate_monitor_actions ################################################################################ template aggregate_monitor_traps template aggregate_monitor_actions ################################################################################ # The following describes all the flags that can be used for the different # monitor entries or history control entries, which are defined further down. # # Flags valid for all entries (01 to 40 only for monitor entries): # 000 000 01 - don't execute any actions (but send and log traps) # 000 000 02 - don't send any traps (but log traps and execute actions) # 000 000 04 - don't reinitialize notReady monitor # 000 000 08 - don't log any traps (but send traps and execute actions) # 000 000 10 - keep sending notReady traps # 000 000 20 - don't pass default arguments to actions # 000 000 40 - don't send notReady traps (including log and action) # 000 000 80 - entry was created by an AIM plugin (this flag is read-only) # # Flags valid for all self monitors: # 000 001 00 - send monitorClear traps (including log and action) # xxx 002 00 - send monitorThreshold traps after xxx consecutive breaches (including log and action) # xxx 004 00 - send at most xxx consecutive monitorThreshold traps (including log and action) # 000 008 00 - aggregate state of all monitors with same severity as AND relation # # Flags valid for process monitors (and Windows Service monitors): # 000 001 00 - monitor parent process (parent must match regexpr too) # 000 002 00 - don't send processStart traps (including log and action) # 000 004 00 - send processClear traps (including log and action) # 000 008 00 - match process name and arguments # xxx 010 00 - send processThreshold/Stop traps after xxx consecutive breaches (including log and action) # xxx 020 00 - send at most xxx consecutive processThreshold/Stop traps (including log and action) # xxx 040 00 - monitor for xxx processes to be alive (procAlive) # 000 080 00 - monitor Windows service to be running (procAlive) or process in Solaris Zone # 000 100 00 - effectively the same as 000 002 00 (for legacy support) # 000 200 00 - aggregate state of all monitors with same severity as AND relation # # Flags valid for process group monitors: # 000 001 00 - match process name and arguments # 000 080 00 - monitor processes in Solaris Zone # # Flags valid for Windows Event Log monitors: # 000 001 00 - pre-append event ID to description # 000 002 00 - apply logical 'not' operator # # Flags valid for log file monitors (incl. directory monitoring): # 000 001 00 - apply logical 'not' operator # 000 002 00 - determine only file size # xxx 004 00 - send match traps if more than xxx matches per read # 000 008 00 - monitor a directory (instead a file) # 000 010 00 - monitor the directory recursively # 000 020 00 - do not follow symbolic links (only for directory monitoring) # 000 040 00 - report logMonitorLogFileSize variable in kilobytes (instead of bytes) # # Flags valid for history control entries: # 000 001 00 - collect performance cube data ################################################################################ ################################################################################ # This entry specifies a self monitor. # # Syntax: # monitor oid [/] ['' ['' []]] # monitor oid [/] ['' ['' ['' '' '' ]]] # # monitor '' [/] ['' ['' []]] # monitor
'' [/] ['' ['' ['' '' '' ]]] # # Description: # is the OID of the object to monitor (either a full OID or .). # is the table index to be used. # is described above. # is the evaluation interval for the monitor in a multiple of 30 seconds. # is the sampling type (absolute, delta). # is the scale factor (default value is 1) # is the comparison operator (nop, >, >, >=, >=, =, !=). # is the threshold. # is an arbitrary description. # is the full path (including parameters) of a command to execute concurrent to sending a trap. # is the index of the monitor that is superseded by this monitor. # # is the object class to use for the object state model. ('' is replaced by default value; '*' is invalid) # Note: For monitoring objects that are not currently present on the system or may become unreachable in the future, should be set to the actual # class (or the same value as
) of the monitored OID. This way a monitored object can be resolved to an SNMP OID during a monitoring cycle in the future even # if that SNMP OID is not present at the time this configuration file is parsed. # # is the object instance to use for the object state model. ('' is replaced by default value; '*' is invalid) # Note: '//' and '/' are used as delimiters to relate an instance to its hosted hierarchy: '//hierarchy/instance' # The hierarchy can be multi-tier. For local system instances '//./' is always prepended. # Additionally a name space can be prepended to identify virtual objects (e.g. lpar:). # For monitoring objects that are not currently present on the system or may become unreachable in the future, should be set to the actual # instance name (or the same value as ) of the monitored OID. This way a monitored object can be resolved to an SNMP OID during a monitoring cycle in the future even # if that SNMP OID is not present at the time this configuration file is parsed. # # is the object attribute to use for the object state model. ('' is replaced by default value; '*' is invalid) # Note: For monitoring objects that are not currently present on the system or may become unreachable in the future, should be set to the actual # attribute name (or the same value as ) of the monitored OID. This way a monitored object can be resolved to an SNMP OID during a monitoring cycle in the future even # if that SNMP OID is not present at the time this configuration file is parsed. # # is the severity to use for the object state model (none, ok, warning, minor, major, critical, fatal). # #
is the tableEntry name (or the group name) of the object to monitor (filesystem is an alias for devTableEntry). # is the instance name of the object to monitor ('' if no instance). # is the attribute name of the object to monitor. # # Examples: # monitor oid numPageFaults.0 11 0x0 60 delta > 1000 'Page fault rate above 1000' '' 'Paging' 'Total' 'Faults' minor # monitor oid numPageFaults.0 12 0x0 60 delta > 4000 'Page fault rate above 4000' '' 'Paging' 'Total' 'Faults' major # monitor oid numPageFaults.0 13 0x0 60 delta/1000 > 7 'Page fault rate above 7000' '' 'Paging' 'Total' 'Faults' minor # # monitor devTableEntry '/var' devCapacity 13 0x0 60 absolute > 90 'Filesystem /var filesystem Example' "${CASYSEDGE}/bin/email -r mymailservername sysedge@mydomain.com root@mydomain.com '/var > 90 on machineX' '/var > 90 machineX -- Generated By SystemEDGE'" # monitor ifEntry 'eth0' ifOutOctets 14 0x0 60 delta = 0 'Interface eth0 is inactive' '' ################################################################################ template monitor oid template monitor oid template monitor
template monitor
monitor oid memCapacity.0 11 0x300200 300 absolute >= 95 'Physical Memory Usage (percentage)' '' 'Memory' 'Total' 'PercentUsed' warning monitor oid memCapacity.0 12 0x300200 300 absolute >= 98 'Physical Memory Usage (percentage)' '' 'Memory' 'Total' 'PercentUsed' minor monitor oid cpuTotalIdlePercent.0 13 0x600200 120 absolute <= 10 'CPU Idle Time (percentage)' '' 'CPU' 'Total' 'PercentIdle' warning monitor oid cpuTotalIdlePercent.0 14 0x600200 120 absolute <= 5 'CPU Idle Time (percentage)' '' 'CPU' 'Total' 'PercentIdle' minor monitor oid diskStatsUtilization.1 15 0x300200 300 absolute >= 90 'Disk Busy Time (percentage)' '' 'Disk' 'First' 'PercentBusy' warning monitor oid diskStatsUtilization.1 16 0x300200 300 absolute >= 95 'Disk Busy Time (percentage)' '' 'Disk' 'First' 'PercentBusy' minor monitor devTableEntry 'C:' devCapacity 17 0x0 300 absolute >= 95 'File System Usage (percentage)' '' 'devTableEntry' 'C:' 'devCapacity' warning monitor devTableEntry 'C:' devCapacity 18 0x0 300 absolute >= 98 'File System Usage (percentage)' '' 'devTableEntry' 'C:' 'devCapacity' minor monitor devTableEntry '/' devCapacity 19 0x0 300 absolute >= 95 'File System Usage (percentage)' '' 'devTableEntry' 'Root' 'devCapacity' warning monitor devTableEntry '/' devCapacity 20 0x0 300 absolute >= 98 'File System Usage (percentage)' '' 'devTableEntry' 'Root' 'devCapacity' minor ################################################################################ # This entry specifies a process monitor. # # Syntax: # watch process '' ['' ['' ['' '' '' ]]] # # Description: # is the attribute to monitor (see values of pmonAttribute in empire.asn1). # is the regular expression (dependent from flags) to use for matching processes by name, # processes in Solaris Zones (use ZoneRegExpr/ProcRegExpr), or Windows services by name # is the table index to be used. # is described above. # is the evaluation interval for the monitor in a multiple of 30 seconds. # is the sampling type (absolute, delta). (ignored for procAlive; is set to absolute) # is the comparison operator (nop, >, >, >=, >=, =, !=). (ignored for procAlive; dependent from flags is set to = or !=) # is the threshold. (ignored for procAlive; dependent from flags is set to 4 or 1) # is an arbitrary description. # is the full path (including parameters) of a command to execute concurrent to sending a trap. # # is the object class to use for the object state model. ('' is replaced by default value; '*' is invalid) # is the object instance to use for the object state model. ('' is replaced by default value; '*' is invalid) # Note: Self monitors use '//' and '/' as delimiters to relate an instance to its hosted hierarchy: '//hierarchy/instance' # The hierarchy can be multi-tier. For local system instances '//./' is always prepended. # To ensure the same naming convention during aggregation, '//./' is prepended for process monitors too. # is the object attribute to use for the object state model. ('' is replaced by default value; '*' is invalid) # is the severity to use for the object state model (none, ok, warning, minor, major, critical, fatal). # # Examples: # watch process procRSS 'sqlservr' 11 0x0 60 absolute > 200000 'Memory SQL server above 200000 KB' '' 'Process' 'SqlSrv' 'Memory(KB)' warning # watch process procRSS 'sqlservr' 12 0x0 60 absolute > 300000 'Memory SQL server above 300000 KB' '' 'Process' 'SqlSrv' 'Memory(KB)' critical # # watch process procAlive 'ypbind' 13 0x0 60 absolute = 4 'NIS daemon running' '/usr/bin/yp_recovery.sh' 'Process' 'NIS' 'Alive' critical # watch process procAlive 'smbd' 14 0x0 60 absolute = 4 'Samba daemon running' '' 'Process' 'Samba' 'Alive' warning ################################################################################ template watch process ################################################################################ # This entry specifies a process group monitor. # # Syntax: # watch procgroup '' ['' ['' []]] # watch procgroupex '' ['' ['' []]] # # Description: # is the regular expression (dependent from flags) to use for matching processes by name, or # processes in Solaris Zones (use ZoneRegExpr/ProcRegExpr) # is the table index to be used. # is described above. # is the evaluation interval for the monitor in a multiple of 30 seconds. # is an arbitrary description. # is the full path (including parameters) of a command to execute concurrent to sending a trap. # is the significance of the monitor on a group change (none, ok, warning, minor, major, critical, fatal). # # is the user name to match in addition to any process name regular expression. (only supported on Unix) # is the group name to match in addition to any process name regular expression. (only supported on Unix) # # Example: # watch procgroup 'iexplore|IEXPLORE' 11 0x0 60 'IE process group' '' warning # # Example for corresponding self monitor: # monitor processGroupMonEntry 'iexplore|IEXPLORE' pgmonRSS 15 0x0 60 absolute > 150000 'IE process group memory above 150000 KB' '' ################################################################################ template watch procgroup template watch procgroupex ################################################################################ # This entry specifies a Windows Service monitor (Windows only). # These monitors are created as a special process monitor, monitoring for procAlive. # # Syntax: # watch ntservice '' ['' ['' ['' '' '' ]]] (Windows only) # # Description: # is the service display name regular expression to match the Windows Service of interest. # is the table index to be used. # is described above. # is the evaluation interval for the monitor in a multiple of 30 seconds. # is an arbitrary description. # is the full path (including parameters) of a command to execute concurrent to sending a trap. # # is the object class to use for the object state model. ('' is replaced by default value; '*' is invalid) # is the object instance to use for the object state model. ('' is replaced by default value; '*' is invalid) # Note: Self monitors use '//' and '/' as delimiters to relate an instance to its hosted hierarchy: '//hierarchy/instance' # The hierarchy can be multi-tier. For local system instances '//./' is always prepended. # To ensure the same naming convention during aggregation, '//./' is prepended for process monitors too. # is the object attribute to use for the object state model. ('' is replaced by default value; '*' is invalid) # is the severity to use for the object state model (none, ok, warning, minor, major, critical, fatal). # # Example: # watch ntservice 'Exchange.*Store' 11 0x0 30 'Exchange Info Store service' '' 'NTService' 'Exchange(Store)' 'Running' critical ################################################################################ template watch ntservice ################################################################################ # This entry specifies a Windows Event Log monitor (Windows only). # Note: The interval for these entries is fix 60 seconds. # # Syntax: # watch ntevent '' '' ['' ['' []]] (Windows only) # # Description: # is the table index to be used. # is described above. # is the event log to read (application, security, system, dnsserver, dirservice, filerepservice). # is the event type to match (error, warning, information, success, failure, all). # is the regular expression to match the event source. # is the regular expression to match the event description. # is an arbitrary description. # is the full path (including parameters) of a command to execute concurrent to sending a trap. # is the significance of the monitor on a match (none, ok, warning, minor, major, critical, fatal). # # Example: # watch ntevent 11 0x0 system all 'W3SVC' '.*Logon.*failure.*' 'Web Logon failure events' '' major ################################################################################ template watch ntevent ################################################################################ # This entry specifies a log file monitor (incl. directory monitoring). # # Syntax: # watch logfile '' '' ['' ['' [ []]]] # # Description: # is the table index to be used. # is described above. # is the absolute path of the file or the directory to monitor. # is the regular expression to match the log file's content (ignored for directory). # is an arbitrary description. # is the full path (including parameters) of a command to execute concurrent to sending a trap. # is the evaluation interval for the monitor in minutes between 1 and 1440. # is the significance of the monitor on a match (none, ok, warning, minor, major, critical, fatal). # # Examples: # watch logfile 11 0x0 /var/log/messages 'FAILED LOGIN.*' 'Failed logins' '' 5 warning # watch logfile 12 0x5800 /var/log '' 'Directory /var/log' '' 10 warning # # Examples for corresponding self monitor: # monitor logMonitorEntry /var/log/messages logMonitorMatches 11 0x0 300 delta > 10 'Failed logins rate above 10' '' # monitor logMonitorEntry /var/log logMonitorLogFileSize 12 0x0 600 absolute > 3000 'Directory /var/log size above 3000 KB' '' ################################################################################ template watch logfile ################################################################################ # This entry specifies a history control entry to track object values over time. # # Syntax: # emphistory ['' [flags]] # # Description: # is the table index to be used. # is the collection interval in a multiple of 30 seconds. # is the OID of the object to collect (either a full OID or .). # is the number of samples to collect. # is an arbitrary description. # is described above. # # Example: # emphistory 11 60 loadAverage1Min.0 60 '1-min load average history' 0x100 ################################################################################ template emphistory ################################################################################ # The cube_interval entry defines the frequency of writing history samples # collected for history control entries into a performance cube. # All history samples are averaged over this time period. # # The cube_indexrange entry specifies a reserved range of indices, where to create history # control entries for the collection of performance cube data, if no index is specified # during creation. This feature can be used by AIMs (e.g. SRM makes use of it). # # Syntax: # emphistory cube_interval # emphistory cube_indexrange # # Description: # is the cube collection interval in minutes (default 20). # Valid values are: 1,2,3,4,5, 10,15,20,30,60, 120,180,240,360,480,720 # is the first index in the reserved range (default 1000000). # is the last index in the reserved range (default 1999999). # # Example: # emphistory cube_interval 60 # emphistory cube_indexrange 1500000 1600000 ################################################################################ template emphistory cube_interval template emphistory cube_indexrange ################################################################################ # This entry specifies a monitoring (maintenance) time window for a monitor. # # Syntax: # monwin # # Description: # specifies the monitor table (selfmon, processmon, procgroupmon, nteventmon, logfilemon, emphistory, autowatch). # is the monitor's index. # is the time (24 hr format hhmm) at which the monitor is switched off (notInService), i.e. the maintenance window begins. # is the time (24 hr format hhmm) at which the monitor is switched on (active), i.e. the maintenance window ends. # specifies if this entry is active (1) or notInService (2). # # Example: # monwin processmon 11 2200 2330 1 ################################################################################ template monwin ################################################################################ # This entry extends the ntRegPerf group of the EMPIRE-MIB by adding new attributes # obtained from the Windows Registry (HKEY_LOCAL_MACHINE or HKEY_PERFORMANCE_DATA). # # Syntax: # ntregperf registry '' '' # ntregperf performance '' '' '' # # Description: # is the attribute leaf number. To query this attribute use 'ntRegPerf..0'. # is the attribute's type (integer, counter, gauge, octetstring, timeticks, objectid, ipaddress). # is the registry key below HKEY_LOCAL_MACHINE. # is the registry entry (leaf) below HKEY_LOCAL_MACHINE\. # is the performance registry object. # is the performance registry counter. # is the performance registry instance. # # Examples: # ntregperf 1 gauge performance 'LogicalDisk' 'Free Megabytes' 'C:' # ntregperf 2 octetstring registry 'SYSTEM\CurrentControlSet\Control\CrashControl' 'DumpFile' ################################################################################ template ntregperf registry template ntregperf performance ################################################################################ # This entry extends the extensionGroup of the EMPIRE-MIB by adding new attributes # obtained from the configured script or binary. # # Syntax: # extension '' # # Description: # is the attribute leaf number. To query this attribute use 'extensionGroup..0'. # is the attribute's type (integer, counter, gauge, octetstring, timeticks, objectid, ipaddress). # is the attribute's access (readonly, readwrite). # is the full path or just the name (including parameters) of the script or binary to execute. # # Examples: # extension 1 octetstring readonly '%CASYSEDGE%\bin\getver.exe -f %CASYSEDGE%\bin\sysedge.dll' # extension 2 integer readonly '${CASYSEDGE}/bin/checkfile /core' # extension 3 integer readonly 'myextension' ################################################################################ template extension ################################################################################ # Autowatchers generate entries in the monitor and process monitor tables # for resources that match the specified autowatcher criteria. # # The directives below specify the ranges in these tables for the automatically # generated monitors, and the default interval in seconds that SystemEDGE will # scan for new instances. This global setting can be overridden for each # autowatcher definition. # # NOTE: A range of less than 100 indices will be rejected by SystemEDGE as invalid. # # Syntax: # autowatcher_monitor_reserved_index_range # autowatcher_procmon_reserved_index_range # autowatcher_default_scaninterval # # Description: # is the first index in the reserved range (default 1000000). # is the last index in the reserved range (default 1999999). # is the interval in seconds (default 300). # # Examples: # autowatcher_monitor_reserved_index_range 15000 30000 # autowatcher_procmon_reserved_index_range 15000 30000 # autowatcher_default_scaninterval 600 # ################################################################################ template autowatcher_monitor_reserved_index_range template autowatcher_procmon_reserved_index_range template autowatcher_default_scaninterval ############################################################################### # The following describes all the flags that can be used for the different # autowatcher entries, which are defined further down. # # Flags valid for all autowatchers: # # 000 000 02 - don't send any traps (but log traps) # 000 000 04 - don't reinitialize notReady autowatcher # 000 000 08 - don't log any traps (but send traps) # 000 000 10 - keep sending notReady traps # 000 000 40 - don't send notReady traps (including log) # 000 000 80 - entry was created by an AIM plugin (this flag is read-only) # 000 00X 00 - specified NT service start type for service watchers # 0 = all service start types # 1 = 'Automatic' # 2 = 'Manual' # 3 = 'Disabled' # 000 010 00 - monitor processes by PID # (default is to monitor processes by process name) # ################################################################################ ################################################################################ # This entry specifies an autowatcher. # # Note: # The syntax for autowatchers is switch-based and does not rely on positional # parameters. All parameters take the form: # # -parameter=value # -parameter='value' # # Optional parameters may be omitted. Use single quotes if the value contains # spaces. # # Syntax: # autowatch -index= -watchtype= -table=
-attribute= ... # # Mandatory: # -index is the table index to be used to store the autowatcher. # -name is the name of the autowatcher. # -watchtype is the type of autowatcher to create (generic, service, or process). # -table is the table entry to be monitored (e.g. devTableEntry). Not required for service or process autowatchers. # -attribute is the attribute to monitor (e.g. devCapacity). Not required for service autowatchers. # -criteria is a regular expression for the primary criteria for selecting instances to monitor. # -op is the comparison operator (nop, gt, lt, ge, le, eq, ne). # -value is the threshold (not required for process procAlive, or service autowatchers). # -severity is the severity to use for the object state model (none, ok, warning, minor, major, critical, fatal). # # Optional: # -interval is the evaluation interval for all monitors generated by this autowatcher (default 60). # -desc is the description to apply to all monitors generated by this autowatcher. # -monflags is the set of self-monitor flags to apply to all monitors created by this autowatcher. # -matchtype is the match type for the primary selection criteria (positive or negative). # -criteria2 is a column in the monitored table for secondary selection criteria. # -criteria2regex is a regular expression for the secondary instance selection criteria. # -matchtype2 is the match type for the secondary selection criteria (positive or negative). # -criteria3 is a column in the monitored table for tertiary selection criteria. # -criteria3regex is a regular expression for the secondary instance selection criteria. # -matchtype3 is the match type for the secondary selection criteria (positive or negative). # -stype is the sample type to apply to each monitor (absolute, delta). # -scale is the scale factor to apply to each monitor (default value is 1). # -action is the full path (including parameters) of a command to execute concurrent to sending a trap for each monitor. # -objclass is the object class to use for the object state model. ('' is replaced by default value; '*' is invalid) # -objattr is the object attribute to use for the object state model. ('' is replaced by default value; '*' is invalid) # -watchflags specifies the flags that modify the behavior of the autowatcher. # -scaninterval is the interval in seconds between scans of the monitored table. # -limit is the maximum number of monitors that can be generated by this autowatcher. # -loss is the loss action taken when a monitor can no longer reach the monitored object (default currState=fatal). # -starttype is the start type of the Windows service (automatic, manual, disabled). (default=all types) # # Examples: # autowatch -index=11 -watchtype=generic -table=ifEntry -name='WiFi interfaces' -criteria='.*WiFi.*' -attribute=ifOutQLen -op=ge -value=100 -severity=minor -desc='WiFi interface out queue length' -monflags=0x0 -limit=10 -interval=60 -objclass='Network Interface' -objattr='OutQueueLength' -loss=remove # # autowatch -index=12 -watchtype=service -name='All Automatic SQL Services' -criteria='.*SQL.*' -starttype=automatic -interval=60 -severity=critical -desc='SQL services' -objclass='Service' -objattr='Running' # # autowatch -index=13 -watchtype=process -name='SQL Processes RSS' -criteria='.*sql.*' -attribute=procRSS -op=ge -value=100000 -severity=major -interval=60 -desc='SQL processes' -objclass='Process' -objattr='ResidentSet' # # autowatch -index=14 -watchtype=process -name='Solaris Zone Process Example' -criteria='MyZone/.*myproc.*' -monflags=0x00008000 -attribute=procRSS -op=ge -value=100000 -severity=major -interval=60 -desc='SQL processes' -objclass='Process' -objattr='ResidentSet' # ################################################################################ template autowatch -index= -watchtype= -name= -table=
-attribute= -interval= -criteria= -op= -value= -severity= -desc= -objclass= -objattr= autowatch -index=11 -name='All FileSystems - Warning' -watchtype=generic -table=devTableEntry -attribute=devCapacity -interval=300 -criteria='.*' -op=ge -value=95 -severity=warning -desc='FileSystem Usage (percentage)' -objclass=FileSystem -objattr=PercentUsed autowatch -index=12 -name='All FileSystems - Minor' -watchtype=generic -table=devTableEntry -attribute=devCapacity -interval=300 -criteria='.*' -op=ge -value=98 -severity=minor -desc='FileSystem Usage (percentage)' -objclass=FileSystem -objattr=PercentUsed autowatch -index=13 -name='All Disks - Warning' -watchtype=generic -table=diskStatsEntry -attribute=diskStatsUtilization -interval=300 -criteria='.*' -op=ge -value=90 -severity=warning -monflags=0x300200 -desc='Disk Busy Time (percentage)' -objclass=Disk -objattr=PercentBusy autowatch -index=14 -name='All Disks - Minor' -watchtype=generic -table=diskStatsEntry -attribute=diskStatsUtilization -interval=300 -criteria='.*' -op=ge -value=95 -severity=minor -monflags=0x300200 -desc='Disk Busy Time (percentage)' -objclass=Disk -objattr=PercentBusy ################################################################################ # This entry specifies an optional AIM plugin to load. # # Syntax: # sysedge_plugin # # Description: # is the absolute path of the AIM library or just the AIM name. # An asterisk * instructs the agent to load each installed AIM. # # Examples: # sysedge_plugin svcrsp # sysedge_plugin C:\sysedge\plugins\svcrsp\svcrsp.dll ################################################################################ template sysedge_plugin sysedge_plugin * ################################################################################ # These entries specify important meta information for the agent. # Most of the information is set during installation and it is not recommended # to change these entries manually afterwards. Changes made in the runtime # configuration might have no effect. # # Syntax: # data_directory # default_port # manager_name # manager_policy_name # manager_policy_version # # Description: # is the absolute path of the directory the agent uses for all runtime files. # is the number of the SNMP port the agent connects to per default (typically 161). # is the name of the manager machine, managing this agent (* accepts the first manager). # is the name of the policy, telling the manager the preferred configuration name. # is the version of the policy, telling the manager the preferred configuration version. ################################################################################ template data_directory template default_port template manager_name template manager_policy_name template manager_policy_version data_directory C:\Users\Public\CA\SystemEDGE\ default_port 1691