Configuring monitor policies to collect data

Monitor policies are a set of rules that enable administrators to deploy configurations to PATROL Agents by using monitoring solutions. Monitor policies provide instructions and information about what information to monitor. For example, you can collect information about the CPU and memory utilization of your Windows environment.

A monitor policy is applied to the PATROL Agents based on conditions such as Agent name, Agent port, Agent version, Agent tag, and so on. PATROL Agents collect performance data and generate events for availability metrics. 

When PATROL Agents are deployed and monitor policies are configured, the Agents receive the appropriate configuration and begin monitoring. When an existing policy is modified, the changes are automatically applied to the Agents.

As a tenant administrator, you can create, edit, delete, copy, enable or disable, and filter monitor policies. You can also view an audit trail of all updates made to monitor policies. For more information, see Defining monitor policies.

In BMC Helix Operations Management, go to Configuration > Monitor Policies to view monitor policies and perform the following operations on them:

• Create, copy, edit, or delete
  ContactDeleting a large number of policies is a maintenance activity and should be done in a controlled manner. Conctact BMC Support if you want to delete a large number of policies at once.
• Enable or disable
• Share
• Unlock
  This option is enabled if another user is editing it. By unlocking the policy, changes made by the other user might be lost.
• View the Agents on which the policy is applied

The following monitor policies are available out-of-the-box:

• Predefined policy for Linux
• Predefined policy for Windows
• Policy for rotated API key push
  This is a policy for pushing the rotated API key to PATROL Agents. This read-only policy is created when you choose to rotate the API key in BMC Helix Portal and is displayed under the Internal policy filter. For subsequent rotations, this policy stores the rotated (updated) API key in the /SecureStore/mca/tenant/apiKey configuration variable. The system also generates an Information event to provide notification about the key rotation. The rotated API key is used for data ingestion from PATROL Agents.
  For instructions about creating an API key, see Using API keys for external integrations.

You can add the following details to a monitor policy:

• (Mandatory) Monitoring configuration
  A monitoring solution is a pre-defined set of metrics that monitor the health and performance of a specific device or service. BMC monitoring solutions are composed of monitor types and attributes.
  It is mandatory to configure the monitoring solution. After you configure the monitoring solution in the policy, the system understands the monitoring solution to monitor through the policy.
• (Optional) Restrictions on collecting data
  When you configure a monitor policy, data is collected by the PATROL Agents on monitor types. Monitor types (also referred to as Application Classes) are the object class to which the application instances belong. A monitor type is a way of classifying the data that is to be collected.
  The collected data is sent to BMC Helix Operations Management. If you do not want to collect data on all attributes in an instance, you can restrict the data from being sent to BMC Helix Operations Management by deactivating Agent-side data collection. 

  You can configure the following types of filters to restrict data:

  • Attribute-level filter - When you apply this filter, only the instance information is sent to BMC Helix Operations Management. Information about the attributes of the instance is not sent to BMC Helix Operations Management.

  • Instance-level filter - When you apply this filter, information about attributes and instances is not sent to BMC Helix Operations Management. If you have instances in a parent-child hierarchy, you must configure instance-level filters separately for each sub-node of the parent and child.

• (Optional) Polling intervals
  A polling interval is the frequency at which you want to collect data. In a monitor policy, you can specify the time interval between consecutive data polls. If you don't specify the polling interval, the default polling interval of the monitoring solution is considered.
• (Optional) Configuration variables

  The PATROL Agent configuration is saved in a set of configuration variables that are stored in the Agent's configuration database. You can control the PATROL Agent configuration by changing the values of these configuration variables. After you define a configuration variable, the definitions are enabled on the PATROL Agent when the policy is applied to it. Configuration variables that are defined on PATROL agents are retained even after the policy is disabled. However, you can delete the configuration variables by purging the PATROL Agent.

Policy precedence

Policy precedence is the priority for policy execution. It ranges from 0 to 999. A lower number indicates a higher priority. Policy precedence controls the configuration applied to the PATROL Agents and servers when conflicting or overlapping configurations are defined between two or more monitor policies.

If two policies attempt to manage the same variable, such as /AgentSetup/historyRetentionPeriod, the PATROL Agent resolves the conflict by evaluating the precedence of the involved policies.

Click here to see some examples...

Example: with conflict	Example: without conflict
Policy A: Precedence number - 099 Includes configuration for the amount of history the Agent should retain. /AgentSetup/historyRetentionPeriod - 7 (retention in days)	Policy A: Precedence number - 699 Includes configuration for monitoring the following Microsoft Windows services: Windows Update Service Windows Time Windows Firewall
Policy B: Precedence number - 070 Includes configuration for the amount of history the Agent should retain. /AgentSetup/historyRetentionPeriod - 1 (retention in days)	Policy B: Precedence number - 499 Includes configuration for monitoring the following Microsoft Windows services: Windows Event Logs Windows Worldwide Publishing
When monitor policies A and B are applied to a PATROL Agent
The Agent resolves the conflict that is related to the /AgentSetup/historyRetentionPeriod variable by evaluating the precedence values of the policies. Because Policy B (070) has a lower precedence value than Policy A (099), Policy B (070) is applied to the Agent. Therefore, the retention period is set to 1 day. Remember the rule: Lower the number, higher the precedence.	The Agent is configured according to the union of policy A and policy B because there are no conflicts. All the Windows services configured in policy A and policy B

BMC recommends that you define a precedence numbering system. This can help you group related monitor policies to the numeric ranges of the precedence numbers.

See the following table for suggestions...

Precedence range	Applicable for	Additional information
001 – 049	Temporary policy overrides	Use for a short term for specific monitor policies until a complete policy is developed.
050 – 099	Monitor policies for low-level behavior management in Agents	Use for monitor policies that you always want to enforce. For example, Agent tuning, event propagation.
100 – 299	Monitor policies that are specific to a logical group of servers	Use for monitor policies such as vCenter monitoring, Exchange Servers, Oracle Servers, Location Related Servers or Services, Agent tuning overrides, and so on.
300 – 499	Specific platform variance monitor policies	Use for monitor policies such as Remote OS monitoring, Windows 2008 monitoring, Linux 6.7 monitoring, Specific Windows services, Specific UNIX processes, and so on.
500 – 699	Standard platform monitor policies	Apply as a standard to large groups of Agents. For example, All Windows, all Linux, and so on.
700 – 899	Other platform monitor policies	Use for examples such as Storage, Network, SNMP, PING, AWS, Azure, and so on.
950 – 999	Prepackaged monitor policies	Reserved for the BMC prepackaged monitor policies. You get these policies when you import the PATROL repository.

File-based monitoring

When you configure a monitor policy, you can upload configuration files for Agents that support file-based monitoring, where configuration files store all the required information for monitoring, such as the remote host name. You do not have to upload the configuration files manually on each Agent that supports file-based monitoring. You can add a single or multiple configuration files for an Agent while creating the monitor policy.

Scenario Sarah is an administrator at Apex Global. She uploads configuration files on PATROL Agents so that the knowledge modules (KMs) or monitoring solutions can collect data based on the inputs in the files. Sarah is looking for an alternative to manually uploading the files because of the following challenges: Sarah needs to log in to each PATROL Agent while she uploads the file. She does not always have access to each PATROL Agent every time and needs to rely on other administrators to complete her work. She needs to configure the monitoring separately for every file that she uploads. Sarah can upload configuration files while she creates or edits a monitor policy in BMC Helix Operations Management. She can include multiple configuration files in the same policy.

On the Configuration > Monitor Policies page, the following monitor policies are available out-of-the-box:

• Predefined policy for Linux
• Predefined policy for Windows
• Policy for rotated API key push

Configuring a monitor policy

1. In BMC Helix Operations Management, navigage to Configuration > Monitor Policies.
2. Click Create.
3. On the Create Monitoring Policy page, add a unique name and description for the monitor policy. 
   BMC recommends that you organize policies according to the precedence numbers when creating and editing policies. You can also include policy-specific information in the policy names.
4. Add the associated user group for the policy. 
   An associated user group is the user group that the logged-on user belongs to. If the user belongs to multiple user groups, select the appropriate user group for the policy.
5. If you want to share the policy with the user group that you selected, select the  Share with User Group  checkbox.

6. Add a unique precedence number to the policy.
   You can add a custom value in this field, or use the arrows to increase or decrease the value.

7. If you want to enable the policy immediately, select  Enable Policy . You can enable it later from the Monitor Policies page.

8. Add the PATROL Agent selection criteria based on which the policy must be applied to the Agents by performing the following steps:

   1. Add one of the following boolean operators:

      • Agent Host Name: Host name of the computer on which the PATROL Agent is installed.
        Important: The value for the matches property must be a strict regular expression. Refer to the following regular expression examples that can be used:

        • virtual_machine -- To select Agents that match the exact string "virtual_machine"

        • .?virtual_machine.* -- To select Agents that match the sub-string "virtual_machine{*}"

        • ^((?!clm-pun-s).)*$ -- To select Agents that do not match the sub-string  "clm-pun{*}"

      • Agent Port: Port number through which the PATROL Agent listens for incoming connections from the PATROL console.
        Use port numbers from 1025 to 65535.

      • Agent Version: Version of the PATROL Agent

      • Agent Operating System: Operating system of the computer on which the PATROL Agent is installed.

      • Agent IP Address: IP address of the computer on which the PATROL Agent is installed. If you select the within operator for the Agent IP Address, only IPv4 range is supported.

      • Agent Tag: Tag applied on the PATROL Agent.
        Important: The agent tag value cannot contain special characters such as single quotation marks ('), double quotation marks ("), ampersand (&), angle brackets (< >), pipe (|), and braces ({ }).

   2. Select an operator to create the condition. The available operators depend on the property that you select.
   3. Specify a value for the selected property.
   4. (Optional) To add more than one condition, click ; to remove an existing condition, click .
   5. (Optional) To group the conditions, use the following parentheses and Boolean operators from their corresponding lists:
      • (
      • ((
      • (((
      • )
      • ))
      • )))
      • AND
      • OR

9. Add the monitoring configuration by performing the following steps:

   1. Click the Monitoring configuration tab.

   2. Select the monitoring solution name and version.
      A monitoring solution is the KM that you have deployed.

   3. Select the monitor profile and monitor type that you want to monitor.
      To view documentation about a monitor profile or monitor type, click the Help icon next to the list.
   4. Specify values for additional configurations.
      To view information about an option, move the mouse over the option to view the tooltip. Use the monitor type documentation for more information about the configurations.
   5. Click OK.
      Repeat these steps to add more monitor profiles.
   6. (Optional) For the KMs that support file-based monitoring, add the configuration files while creating the monitor policy by performing the following steps.
      You can upload configuration files only on PATROL Agents version 23.3.00 or later.
      1. After all the configurations are added, click Yes to the message asking if you want to upload the configuration file.
         If the KM does not support file-based monitoring, you will not see the message.
         The Monitor Configuration Files dialog box opens.
      2. Click Add.
      3. In the Target File Path field, select the path of the target monitoring solution that will use the configuration files.

      4. In the File field, select the configuration file from the local drive. 
         Important: The file size of all files combined must be less than 1 MB.

      5. Click Add.
         Important: You can add or edit the configuration files only for PATROL Agents version 23.3.00 or later. If a PATROL Agent is upgraded to version 23.3.00 after you created and enabled a monitor policy, you must disable the policy and enable it again to be able to upload configuration files from the monitor policy.

10. (Optional) Restrict data collection on attributes by performing the following steps:
    1. Click the Deactivate Collection tab.
    2. Click Deactivate Agent Side Collection, and select a solution and its version.
    3. Select a related monitor type from the list. In Scope, select one of the following options:
       • If you want to specifically filter data and events from an attribute, select Attribute, and then select an attribute from the Monitor Attribute list. The default value is All.

       • If you want to specifically filter data and events from an instance on the PATROL Agent, select Instance, and then enter the instance name in the Instance SID field. By default, the Monitor Attribute is set to All.
         For the Instance SID field, you can also use a regular expression.
         Important: The instance SID is not the monitoring instance name that is displayed in the BMC Helix Operations Management console.
         If you want to use a regular expression, select the Is a Regular Expression check box.
         The value for the matches property must be a strict regular expression. Given below are some examples of regular expressions that can be used:

         • CPU_0
           To select Agents that match the exact string "CPU_0"
         • .*?CPU_0.*
           To select Agents that match the sub-string "CPU_0"
         • ^((?!clm-pun).)*$
           To select Agents that do not match the sub-string "clm-pun"
11. (Optional) Configure polling intervals by performing the following steps:
    1. Click the Polling Intervals tab.
    2. Click Add Polling Interval, and select values for all the options.
    3. Save the polling interval
12. (Optional) Import or add configuration variables by performing the following steps:
    • To import configuration variables:
      Important: The import operation supports only REPLACE, DELETE, and DELVAR operators. If the .cfg file contains the MERGE or APPEND operators, the file cannot be imported. You must delete these operators before importing the file.
      1. Click the Configuration Variable tab.
      2. Click the common action menu in the table and select Import.
      3. Browse for the configuration file (.cfg) to be imported.
      4. Click Open.
         The variables from the file are added to the table.
    • To add configuration variables:
      1. Select one of the following operations:
         • REPLACE: Replaces the current value of the variable on the PATROL Agent if the variable already exists. Otherwise, a new variable is created with the specified value.
         • DELVAR: Deletes the variable from the PATROL Agent.
         • DELETE: Deletes the value of the variable, and the variable remains empty
      2. Add a variable value.
         The following values are for the defaultAccount and SecureStore variables:
         • defaultAccount
         • For this configuration variable, specify the value in the userName/password format. The password can be a plain text or a PATROL Agent-encrypted string.
           Examples:
           patrol/patAdm1n
           patrol/FA4E70ECEAE09E75A744B52D2593C19F
         • SecureStore
           For this configuration variable, specify the value in the context/data format. The context and data can be a plain text or a PATROL Agent-encrypted string.
           Examples:
           MY_KM1;MY_KM2;MY_KM3/mysecretdata
           “EDC10278901F8CB04CF927C82828595B62D25EC355D0AF38589CE4235A246F8C63F24575073E4ECD”
           where “EDC10278901F8CB04CF927C82828595B62D25EC355D0AF38589CE4235A246F8C63F24575073E4ECD” is the encrypted form of "MY_KM1;MY_KM2;MY_KM3/mysecretdata"
      3. Save the configuration variable.
      4. Verify the updated configuration variable on the PATROL Agent. Perform the following steps:
         1. Go to Configuration > Managed Devices.
         2. For the PATROL Agent where you want to verify the updated configurable variable, click the action menu and then click Query PATROL Agent.
         3. On the Agent Connection page, enter the PATROL Agent user name and password, and click Connect.
         4. In the Command field, click the  button.
         5. In the Select Command window, select All pconfig variables and click Apply.
            
         6. Click Execute. You can see all the configurable variables in the Results area. Verify the changes that you made.
            
13. Save the monitor policy.

Viewing the audit trail of monitor policies

As a tenant administrator, you can use the BMC Helix Audit Dashboard in BMC Helix Dashboards, to view the trail of the changes that were made to monitor policies. You can view the trail of the following operations:

• Create, edit, delete
• Policy status change
• Policy applied on the PATROL Agent