Windows Process (NT_PROCESS)

Add and configure monitor types to a monitoring solution

You can add and configure monitor types for the compatible PATROL monitoring solutions that are located in the Deployable Package Repository. For a list of monitoring solutions and monitor types that you can configure, see Monitoring Solutions and KMs . To configure custom monitoring solutions, ensure the solution is structured correctly; for details, see  Developing a PATROL Knowledge Module .

1. Ensure that the Monitoring tab is selected. By default, this tab is selected. If not, click it.

2. Click New Monitor Configuration.

3. In the Add Monitor Configuration dialog box, configure the following properties:

   Property	Description
   Monitoring Solution	Name of the monitoring solution. A solution can have many Knowledge Modules (KMs) under it.
   Version	Version of the selected monitoring solution
   Monitor Profile	Name of the monitor profile to which the monitor types that you want to enable are associated. Each solution contains multiple monitoring profiles that help to reduce unnecessary monitoring. Each monitoring profile is associated with a group of monitor types. If a profile has monitor types that require you to enter information, they are listed in the Monitor type list, and you can configure them. If the profile has no monitor types that require input, all the monitor types are enabled by default and the Monitor Type list is disabled. To view all the monitor types that belong to a selected profile, click the Click to view Monitor Types option. The monitor types that belong to a profile are pre-determined. You cannot add or remove them from a profile.
   Monitor Type	Name of the monitor type that you want to configure. You can select one from the list: All - All the monitor types will have default values. Monitor type other than All - You must configure the monitor type. The configuration options vary depending on the monitor type that you select. For documentation or more information, click the Help icon next to the list. The online documentation for that monitor type is displayed.

4. Click OK. The configured monitor type is added as a new row in the Monitoring page.
   
5. To continue adding configuration details, repeat the previous steps for a different monitor type, version, profile, or solution.
6. To modify a monitor configuration, click the action menu for that configuration and select Edit. Modify the configuration and click OK.
7. To delete a monitor configuration, click the action menu for that configuration and select Delete. After you save the policy, the deleted monitor type configuration is removed from the selected PATROL Agents.

After you save or update a policy, the monitor type configurations are pushed to the selected PATROL Agents.

Back to top

Configure filters to include or exclude data and events

After you configure the monitor types in the PATROL Agents, they send the collected data and the generated events to the Infrastructure Management server. You can configure filters to control the data and events that are sent to the Infrastructure Management server per parameter. 

You can filter the data either from a specific Agent or from a specific monitor type. The supported filtering options are as follows:

• Send events only
• Send trended performance data only
• Send trended performance data and events
• Send no trended performance data and no events

Configure polling intervals

Specify the time interval between two consecutive data polls. You need to specify a separate poll interval for every parameter. 

1. Click the Polling Intervals tab. 
2. Add a polling interval:
   1. Click Add Polling Interval.

   2. Select values for the following options:

      - Monitoring Solution  - Version - Monitor Type - Parameter - Parameter Polling Interval

   3. Click OK. The polling interval is added to the table in the Polling Interval page.
3. To add more polling intervals, repeat the previous step. 
4. To modify the properties of a polling interval: Click the action menu associated with that polling interval, and select Edit.
5. To delete a polling interval: Click the action menu associated with that polling interval and select Delete.

Back to top

Define thresholds on PATROL Agents

Configure range-based thresholds for attributes of a monitor type on the PATROL Agents. You can specify whether the thresholds apply to a monitor type or to an instance of a monitor type.

1. Click the Agent Threshold tab.

2. Click Add Agent Threshold.  

   Specify values for the following properties:
   

   Property	Description
   Monitoring Solution	Monitoring solution
   Version	Version of the monitoring solution
   Monitor Type	Monitor type
   Note: For some monitoring solutions, the Monitor Type list displays the internal names while for other monitoring solutions, both the internal and external names are displayed. For example, for Citrix Xen Host, both the internal (VSM_XEN_HOST) and external (Citrix Xen Host) names are displayed.
   Monitoring Scope	Scope of the threshold. Select one of the following options: All Instances of the Monitor Type: The threshold applies to the monitor type. Monitor Instances: The threshold applies to a specific instance of the monitor type. To identify the instance, specify the instance ID in the SID box.   Click here to know the steps to determine the SID of a monitoring instance Log on to BMC TrueSight Infrastructure Management Operator console. In the navigation pane, select Devices > Grid View. Click any device. The Show Monitors page is displayed.  Hover the mouse over the specific monitor instance, and the tool tip displays the SID for the instance. Note down the SID. You can use the SID value when you configure the agent threshold. If you want to specify multiple SIDs, you can use regular expressions to search for multiple matching instance SIDs. If you use regular expressions to search for the matching instance SIDs, ensure that you have selected Is a Regular Expression.   Click here to view the supported characters for regular expressions Character Expression Description ^ Beginning of line Only finds the search term if the term is at the beginning of a line $ End of line Only finds the search term if the term is at the end of a line . Any character Matches any single character except a line break * Zero or more Matches zero or more occurrences of the preceding expression, making all possible matches [] Any one character in the set Matches any one of the characters within the []. To specify a range of characters, list the starting and ending characters, separated by a dash (-), as in [a-z]. [^] Any one character not in the set Matches any character not in the set of characters following the ^ \< Beginning of word Matches only when a word begins at this point in the text \> End of word Matches only when a word ends at this point in the text
   Monitoring Attribute	Monitoring attribute Note: Some monitoring attributes are designated as key performance indicators (KPIs). Depending on the monitored environment and version, the list of KPIs might appear differently in the Operator console.
   Threshold Ranges: Configure border and threshold ranges for the selected monitoring attribute.
   For Border Thresholds, Threshold 1, and Threshold 2:
   Enable	Select this check box for the type of threshold that you want to configure.
   Min, Max	Minimum and maximum values for the range. Notes: For threshold 1 range: The minimum value of the border range must be less than or equal to the minimum value of the threshold 1 range. For threshold 2 range: The maximum value of the border range must be greater than or equal to the maximum value of the threshold 2 range. If the minimum and maximum values of threshold 1 are equal to those of the border threshold values, then threshold 2 is not used because threshold 1 uses the entire range of border threshold.
   Select Event Severity	Severity type to be associated with the event. Select one of the following options: OK Warning Critical When the configured threshold is violated, the triggered event is of the selected severity.
   Trigger an Event	Condition to trigger an event. Select one of the following options: Immediately on threshold violation: Triggers an event immediately after a threshold violation. After threshold violation occurs N times: Triggers an event after the threshold is violated after the specified (N) number of times. Ensure that you specify a value greater than 0 in the N box. After all auto-recovery actions fail: Triggers an event after the recovery actions that are configured at the PATROL Agent fail.

3. Click OK. The threshold is added to the table on the Agent Threshold page.

Back to top

Create server-level thresholds

You can create thresholds for the monitor instances on the Infrastructure Management server. For information about the types of thresholds, see Thresholds, KPIs, and baselines.

 
To configure the server thresholds:

1. Click the Server Threshold tab.
2. Click Add Server Threshold.    

3. Specify values for the following properties:
   

   
   

   Option	Description
   Monitoring Solution	Name of the monitoring solution. A solution can have many Knowledge Modules (KMs) under it.
   Version	Version of the monitoring solution.
   Monitor Type	A list of monitor types for the selected solution.
   Monitor Instance Name	Name of the monitor instance. Depending on your requirement, specify the monitor instance information in one of the following formats: - Name of the monitor instance - A regular expression that can match multiple instances.   Click here to view the supported characters for regular expressions Character Expression Description ^ Beginning of line Only finds the search term if the term is at the beginning of a line $ End of line Only finds the search term if the term is at the end of a line . Any character Matches any single character except a line break * Zero or more Matches zero or more occurrences of the preceding expression, making all possible matches [] Any one character in the set Matches any one of the characters within the []. To specify a range of characters, list the starting and ending characters, separated by a dash (-), as in [a-z]. [^] Any one character not in the set Matches any character not in the set of characters following the ^ \< Beginning of word Matches only when a word begins at this point in the text \> End of word Matches only when a word ends at this point in the text   - Name of a monitor instance with the associated device in the following format: deviceName/instanceName. Also, select the Associate with a Device check box.
   Monitoring Attribute	Monitoring attribute Note: Some monitoring attributes are designated as key performance indicators (KPIs). Depending on the monitored environment and version, the list of KPIs might appear differently in the Operator console.
   Threshold: Configure the threshold parameters for the threshold type that you have selected. You can select either of the following types: Absolute, Signature, and Abnormality.
   Threshold types Parameter Description Absolute, Signature Severity Severity type to be associated with the event. Select one of the following options: Minor Major Critical When the configured threshold is breached, the triggered event is of the selected severity. Absolute, Signature, Abnormality Duration The length of time, in minutes, that the data values must breach the threshold, before an event is generated. For example, you could specify that the attribute data value must remain above the baseline for 10 minutes before an event is generated. By specifying this parameter, you can reduce the number of events generated by an absolute threshold. Threshold Value An absolute value that is above and beyond the baseline value. If you set a threshold, an abnormality will be generated only when it violates both the set baseline and the threshold value. Outside Baseline Type Type of baseline. Select one of the following options: Not Enabled Auto Hourly Daily Weekly Hourly and Daily All By selecting a baseline type to combine with the absolute threshold, you can ensure that an event is not generated unless the data value breaches both the threshold value AND the selected baseline (Hourly, Daily, Weekly, Daily and Hourly, or All baselines). Thereby, you can reduce the number of events generated by an absolute threshold. Absolute Comparison A comparison operator to specify when a breach occurs. You can specify when the data value is greater than, less than, greater than or equal to, less than or equal to, or equal to the specified threshold value. Absolute Generate Predictive Event Select the check box if you want an early-warning predictive event to be generated 2-3 hours before the absolute threshold is breached. This enables you to get some lead time to take an action, if required. Absolute Auto Close Events Select the check box to specify that the events generated by a breach of the threshold be automatically closed if the data values that are collected are not breaching the threshold anymore. If you do not select this option, you can manually close such events in the TrueSight console. Signature, Abnormality Above/Below Threshold Select Above or Below depending on whether the collected data values must be above or below a baseline before an event is generated. Minimum Sampling Window The number of data points that must be collected or the amount of time that must pass (depending on the attribute) before an event is generated. At least five data points are required before an event is generated for any threshold type. If your minimum sampling window is set too small to allow at least 5 data points, then Infrastructure Management will wait until five data points have been collected before generating the event, regardless of the value entered into the sampling window. Example for abnormality threshold: If you set a minimum sampling window to 10 minutes on a specific monitor attribute but the polling rate of that monitor is 5 minutes, 25 minutes must pass before an abnormality is generated. For this reason, BMC recommends to use lower polling rates for monitors. Absolute Deviation (%) An absolute number above or below a baseline that the collected data values must reach before an event is generated. Example for abnormality threshold: For example, if you set a daily abnormality threshold for the Total Number of Disk I/O Request attribute for the VMware Disk Performance monitor type, and you set the absolute deviation to 3, then an abnormality event would not be generated until the Daily baseline for the total number of VMware disk I/O requests plus three additional requests had been made. If the Daily baseline for VMware disk I/O requests was 45, then an abnormality event would be generated when 48 VMware disk I/O requests were made. Percent Deviation (%) The percent of the baseline above or below the baseline that the collected data values must reach before an event is generated. Example for abnormality threshold: If you set a hourly abnormality threshold for for the Average Disk Throughput attribute for the VMware Disk Performance monitor type, and you set the percentage deviation to 10, then an abnormality event would not be generated until the value of the data collected reached the Hourly baseline for the average VMware disk throughput plus an additional 10 percent of the baseline value. If the Hourly baseline for average VMware disk throughput was 2500 KB per second, then an abnormality event would be generated when the VMware disk throughput became 2750 KB per second

4. Click OK.  
5. To modify parameters of a threshold, click the action menu for that threshold and select Edit.
6. To remove a threshold, click the action menu for that threshold and select Delete. After you save the policy, the deleted threshold configurations are removed from the selected PATROL Agents.
   After you save or update a policy, the new threshold configurations are pushed to the selected PATROL Agents.

Back to top

Configure PATROL Agents

You can configure the properties of a PATROL Agent and specify the action that the Agent must perform when the policy is applied.

For more information, see Specifying objects in an authorization profile .

1. Click the Agent tab.

2. Specify the following properties:
   

Property	Description
Agent Default Account
User Name	The user name that you want to use to run the PATROL Agent. The user name must have access permissions to the PATROL Agent directory. Note: You need to provide an Agent user name and password only if they are different from what was previously configured.
Password	Password for the specified user name
Confirm Password	Password for the specified user name
Restart Agent	Select this check box if you want to restart the PATROL Agent after the policy is applied. Notes: You must select this check box if you want the user name change to take effect. While editing a policy, if you select Restart Agent and provide the same default account information as what was provided while creating the policy, the PATROL Agent is not restarted. To restart the PATROL Agent, use the Query Agent screen. For more information, see Performing actions on a PATROL Agent
Tag	Tags that you want to assign to the PATROL Agent. The format of each tag is tagName:tagDescription. If the tag description contains spaces, enclose the description within double quotes. You can also provide multiple tags, separated by commas. For example, tag1:"Brief Description",tag2:"Description".
Integration Service	An Integration Service or an Integration Service cluster that you want to set as the PATROL Agent phone home. The supported values are as follows: Single Integration Service Integration Service Cluster
Event Configuration Properties
Event Forwarding Destination	Destination where the events that are generated by the PATROL Agents must be sent to. The supported destinations are as follows: Integration Service Settings: Enables you to use the settings on the Integration Service to which the PATROL Agent is connected Cells: Enables to send the events to one or more cells. In the Event Cell List box, specify the cells to which you want to send the events, separated by commas. The format of each cell is cellName/cellPort, where cellName is the name of the cell and the cellPort is the port number through which the agent communicates with the cell. For example, cell1/1111,cell2/1203 Also, in the Event Cell Shared Key box, specify the shared key which is used for encryption. The default shared key is mc.  Do not send events: Stops sending the events
Event Format Container	String to append to the name of the events that are generated by the PATROL Agents. The default string is BiiP3.

Back to top

Configure actions performed by Infrastructure Management server

Specify actions to be performed on the Infrastructure Management server when the policy is applied. The actions apply to all devices that are associated with the PATROL Agent and all the monitor instances that the Agent monitors.

1. Click the Server tab.
2. Specify values for the following properties:

Back to top

Define and manage configuration variables

You can define individual configuration variables or import them from a ruleset file (.cfg).

The PATROL Agent configuration is saved in a set of configuration variables that are stored in the Agent's configuration database. You can control the PATROL Agent configuration by changing the values of these configuration variables. Also, you can define a configuration variable, and the definitions are set on PATROL Agent when the policy is applied.