Configuring Windows Remote Monitoring

Microsoft Windows Servers

Remote Monitoring

Windows Remote Monitoring

Remote Host Configuration

Click Add to add remote host configurations.

Host Details

Remote host names

Host Names/File Path

Authentication Type

Select the type of authentication for adding the remote host.

• Negotiate: Negotiate is selected for local computer accounts. In this option, the client sends a request to the server to authenticate. The user name should be specified as username for a local user on the server.
• Kerberos:  Kerberos is selected to authenticate a domain account. In this option, the client and server mutually authenticate using Kerberos tickets. The user name should be specified as domain\username for a domain user.

Connection Protocol

Select the type of connection protocol for adding the remote host.

• HTTP
• HTTPS

Port Number

Enter the remote host port number.  By default, the port number is set to 5985 for HTTP and 5986 for HTTPS.

Reconnect Interval

User Credentials

User Name

Password

Enter the common password of the hosts added in the Host Names/File Path field.

Confirm Password

Reconfirm the password that you entered in the field above.

Monitor Configuration

Operating System Monitoring

Monitoring options

Specify one of the following options:

• Disable OS Monitoring: This option disables both Standard and Advance monitoring options. You can select this option when you want to use only the Custom monitoring.
• Standard Monitoring: This option enables all Standard monitors by default and cannot be disabled. It does not monitor any advanced monitoring options.
• Advance Monitoring: This option monitors both Windows Standard and Windows advanced configurations. Advance monitors need to be enabled explicitly. You can enable and disable all the configuration types.

Memory

Select this checkbox to enable Memory monitoring

Cache

Select this checkbox to enable Cache monitoring.

System

Select this checkbox to enable System monitoring.

Health

Select this checkbox to enable Health monitoring.

Enable Annotation for 'Total processor utilization'

Select this checkbox to enable annotation. Annotation refers to additional details about specific processes that consume the most CPU resources.

CPU Threshold for Annotation (%)

Enable Annotation for 'Memory usage'

Select this checkbox to enable annotation. Annotation refers to additional details about specific processes that consume the most memory resources.

Memory Threshold for Annotation (%)

Processor

Select this checkbox to enable Processor monitoring.

Exclude Criteria

Enter a comma-separated list of processor instances that you want to exclude from monitoring. Wildcard characters are not supported.

For example: 0,1,2.

If you leave this field blank, none of the CPU instances is excluded, and the field is ignored.

Include Criteria

Enter a comma-separated list of processor instances that you want to include for monitoring. Wildcard characters are not supported.

For example: 0,1,2.

If you leave the field blank, all instances are monitored.

Exclude Criteria

Enter a comma-separated list of network interface instances that you want to exclude from monitoring.

For example: Local Area Connection,6TO4 Adapter

Include Criteria

Enter a comma-separated list of network interface instances that you want to include for monitoring.

For example: Local Area Connection,6TO4 Adapter

Exclude Criteria

Enter a comma-separated list of physical disk instances to exclude from monitoring.

For example: 0,1,2

Include Criteria

Enter a comma-separated list of physical disk instances to include for monitoring.

For example: 0,1,2

Exclude Criteria

Enter a comma-separated list of logical disk instances to exclude from monitoring.For example: C:,D:,E:

Include Criteria

Enter a comma-separated list of logical disk instances to include for monitoring.

For example: C:,D:,E:

Exclude Criteria

Enter a comma-separated list of paging file instances that you want to exclude from monitoring.

For example: _Total,C:\pagefile.sys.

Include Criteria

Enter a comma-separated list of paging file instances that you want to include for monitoring.

For example: _Total,C:\pagefile.sys.

List of Processes

Click Add to configure the process manually. 

Process Specification

Configure Process Monitoring 

Process Label

Enter a label to identify a group of processes. The input that you specify must match the regular expression pattern, '^[0-9a-zA-Z_]+$'.

Process Name

Enter a name or a regular expression pattern that matches the names of processes that must be monitored. Enter only the process name without extension.

For example, if the process name is Notepad, enter Notepad. Do not enter Notepad.exe.

Use Regular Expression for Process Name

Select this checkbox to monitor all the processes that contain the process name specified.

Process Arguments

Enter the command line arguments for the processes that you want to monitor.

• To monitor a specific process, enter the process arguments.
• To monitor all the instances of the same process, enter wildcard asterisk ( * )
• If the process argument field is left blank, only the process with no arguments will be monitored.

Example:

C:\Windows\system32\svchost.exe -k NetworkService 
Here, C:\Windows\system32\svchost.exe is considered as no arguments and -k NetworkService is considered as argument.

Use Regular Expression for Process Argument

Select this checkbox to enter process command line arguments by using a regular expression pattern.

Minimum Count

Enter a value that will trigger an alarm when the process count falls below this value.

Maximum Count

Enter a value that will trigger an alarm when the process count rises above this value.

Acceptable Process Owner

Enter a name or regular expression pattern that matches the name of the acceptable process owner.

Use Process Owners for Filtering

Select this checkbox to filter processes based on the process owners.

Process Settings  

Generate alarm on Process stop

Select this checkbox to generate an alarm when the process stops.

Generate alarm on Process start

Select this checkbox to generate an alarm when the process starts.

Restart Command

Enter the command that would be used to restart a stopped process.

Time to terminate runaway Process

Enter the time for which a process is retained and not terminated when the CPU usage for the process exceeds the defined maximum CPU threshold. After the specified time, the process is terminated. The time that you enter must match the following regular expression pattern - ^[0-9]+$.

Automatic Process Monitoring

Disable Automatic Process Monitoring

CPU Threshold in %

Enter the CPU threshold (in percentage) for automatic process monitoring. The value that you enter must match the following regular expression pattern - ^[0-9]+$.By default, this value is set to 90.

Time Duration in secs

Enter the time limit (in seconds) to start the automatic process monitoring. The input that you specify must match the regular expression pattern, '^[0-9]+$'. By default, this value is set to 300.

Disable Automatic Restart

Select this checkbox to disable the automatic restart of the monitored services.

Disable Alert For Paused Services

Select this checkbox to disable alerts for the paused services.

List of Included Services

Click Add to add a list of services to monitor.

Service Details

Generate an Alarm/Warning when service is stopped

By default, when a service is stopped, the PATROL Agent generates an alarm. However, for a particular service, you can specify a Warning instead. This feature is available for the services with a startup type of Automatic only.

Alert State

Select one of the following options to define the type of alert that you want to raise when the service stops:

• Alarm
• Warning

Restart service when stopped

Select this checkbox to restart a stopped service.

Enable process monitoring for the services

Select this checkbox to monitor the processes that are associated with the configured service.

By default, the PATROL Agent monitors only whether services are available. To monitor how much memory and CPU a service executable consumes, you must enable process monitoring for the service. When you enable process monitoring, the PATROL Agent monitors the service executable process and displays the monitored process beneath the NT_SERVICE application.

Use command line for non-responsive services

Select this checkbox to use the command line and enter the command line in the Command line field. This option is used for the non-responsive services.

Command line

Enter the command line name.

Service Name

Service Name

Enter the display name or service name that you want to monitor. Use regular expressions for the display name only.

If you enter the service name, clear the Use Display Name check box.

The KM uses \| characters for OR operation instead of | character.

Example:

• ^Windows.*\|^Application.*
• ^Device Association.*\|^Device Setup.*

Use Display Name

By default, this checkbox is selected. If you have entered a service name in the Service Name field, clear this check box. 

Service Startup Type

Automatic

Automatic Delayed Start

Select this checkbox to monitor automatic delayed start type services.

Automatic Trigger Start

Select this checkbox to monitor automatic trigger start type services.

Manual

Select this checkbox to monitor the services with Startup Type as Manual, Manual (Trigger Start). This checkbox is enabled by default.

Disabled

Select this checkbox to monitor the services with Startup Type as Disabled.

Exclude Services

List of Excluded Services

Click Add to add a list of services that you do not want to monitor.

Service Name

Enter the display name or service name that you want to monitor. Use regular expressions for the display name only.

If you enter the service name, clear the Use Display Name checkbox.

Use Display Name

By default, this checkbox is selected. Clear this checkbox if you have entered a service name in the Service Name field. 

Event Log Configuration 

Event Log

Select this checkbox to enable Event Log monitoring. By default, all Windows event logs are monitored if they are registered in the Windows registry at the following location: 

HKLM\SYSTEM\CurrentControlSet\Services\Eventlog 

List of Event Logs

Log Name

Enter the event log name for which you want to create a filter.

List of Filters

Name

Enter a unique name that represents the event filter, and follow these rules:

• The filter name cannot exceed 127 characters.
• The filter name cannot use the following format: user@domain.com. If this format is used for the filter name, the filter fails to filter events.

Description

Enter a short description of the filter you are creating. This is additional information regarding the filter, and you can change the description at any time.

Report/Notify

Select one of the following options, as appropriate:

• Report the number of events that match the filter criteria during each collection period - If you select this option, PATROL monitors the number of events that match the filter criteria during each collection cycle. Depending on which event types the filter monitors, the following parameters are used to report this data:
  • Number of Error Events (ELMError)
  • Number of Failure Audit Events (ELMFailureAudit)
  • Number of Information Events (ELMInformation)
  • Number of Other Type Events (ELMOtherTypes)
  • Number of Events (ELMStatus)
  • Number of Success Audit Events (ELMSuccessAudit)
  • Number of Warning Events (ELMWarning)
• Notify immediately when an event matches the filter criteria - If you select this option, PATROL immediately changes a parameter to an alarm state when an event matches the filter criteria.Depending on which event types the filter monitors, the following parameters are displayed in an alarm state when an event matches the filter:
  • Notifications of Error Events (ELMErrorNotification)
  • Notifications of Failure Audit Events (ELMFailureAuditNotification)
  • Notifications of Warning Events (ELMWarningNotification)
  • Notifications of Windows Events (ELMNotification)
    (This parameter is active only when you have selected both of the option, Notify immediately and consolidate event types.

Source Details

Use name as a regular expression

Select this checkbox if you have specified a regular expression in the Name field.

Disable case sensitivity

Select this checkbox to disable case sensitivity for the source filtering.

You can specify whether to make filter comparisons in a case-independent manner for the source, user, category, and string options of a Windows event filter. To disable case-independent comparisons for any of the options, make sure that the corresponding Disable Case Sensitivity check box while configuring Windows event monitoring is cleared.

The /PSX_P4WinSrvs/PWK_PKMforMSWinOS_config/EventLogMonitoring/eventlog/EventFilters/filter/FilterDisableCase configuration variable stores information about case-sensitivity of the event filter options.

This variable has five-bit values, depending upon case sensitivity, one bit corresponding to each of Source, User, Category, String, and Computer name, respectively. If any bit value is 1, a case-independent filter comparison is made for the corresponding field.

Set this variable to any of the following values:

• 00000 = none checked (default)
• 11111 = all 5 categories checked
• A combination of 0s and 1s, depending on which of the 5 categories were checked

To disable case-sensitivity in the event filters, set the value of the FilterDisableCase configuration variable to 00000.

Include/Exclude Source List

Select one of the following options, as appropriate:

• Include all event sources in the list
• Exclude all event sources in the list

Event Type Details

Event Types to Monitor

Select Windows event types to filter the events to monitor from the following:

• Critical
• Error
• Warning
• Information
• Verbose
• Success_Audit
• Failure_Audit
• Others

• Select this option if you want various types of events (for example, Warning, Information, Error) to be reported by using one parameter, ELMStatus (or ELMNotification if you configured to be notified immediately when an error occurs while defining the Report/Notify option).
• Clear this checkbox to have separate parameters for each event type that can raise alarms independently.

Event ID Details

Windows Event ID(s)

Select one or more multiple IDs in the following ways:

• Single event ID. For example: 100
• Comma-separated list of multiple event IDs. For example: 100,110,120
• Range of event IDs. For example: 100-120
• Regular expression. For example: 1[0-5]3

Use Event ID as a regular expression

Select this checkbox if you specified a regular expression in the Windows Event ID(s) field.

Select one of the following options, as appropriate:

• Include all event IDs in the list
• Exclude all event IDs in the list

Event Handling

Annotate Graph parameter with event details

Select this checkbox to annotate event details to Graph parameters.

Write event details to a text parameter

Select this checkbox to add event details to text parameters.

Use event details for a recovery action

Select this checkbox to enable using the event details for recovery actions.

Report multiple events as a single event when the event occurs

Enter the number of events that must be reported as a single event depending on the value that you specify in the Time within seconds field.

By default, this value is set to 1.

Time within seconds

Enter the number of seconds that must be used for reporting multiple events as a single event.

By default, this value is set to 0.

Enter text automatic or Filter name to Acknowledge Alarm

Advanced Properties

List of Users

Include/Exclude User List

Select one of the following options, as appropriate:

• Include all users in the list - Specifies that all of the users in the list are monitored by the event filter. Select this option when you only want to monitor specific users.
• Exclude all users in the list - Specifies that all the users except those in the list are monitored by the event filter. Select this option when you want to monitor all the users except for a few specific users that you want to exclude from the event filter.

List of Categories

Include/Exclude Category List

Select one of the following options, as appropriate:

• Include all categories in the list - This option specifies that all of the categories in the list are monitored by the event filter. Select this option when you only want to monitor specific categories.
• Exclude all categories in the list—This option specifies that the event filter monitors all categories except those in the list. Select this option when you want to monitor all categories except for a few specific categories that you want to exclude from the event filter.

String Details

Include String

Enter the string associated with the events that you want to include for monitoring.

When entering a string that includes special characters that are used in regular expressions, such as a dollar sign ($), a period (.), a parenthesis (), or a slash (), you must escape each special character with a slash. For example, if the string is $Error, you must enter the string as \$Error.

• OK: Click to save the configuration.
• Cancel: Click to close the dialog.

Enter the string associated with the events that you want to exclude for monitoring.

When entering a string that includes special characters that are used in regular expressions, such as a dollar sign ($), a period (.), a parenthesis (), or a slash (), you must escape each special character with a slash. For example, if the string is $Error, you must enter the string as \$Error.

• OK: Click to save the configuration.
• Cancel: Click to close the dialog.

Computer Details

Include/Exclude User List

Select one of the following options, as appropriate:

• Include all computers in the list - This option specifies that all of the computers in the list are monitored by the event filter. Select this option when you only want to monitor computers.
• Exclude all computers in the list - This option specifies that the event filter monitors all computers except those in the list. Select this option when you want to monitor all computers except for a few specific computers that you want to exclude from the event filter.

Disable Case Sensitivity

Select this checkbox to disable case sensitivity for computer comparison.

WMI Monitors

Raw Counter Data Configurations