PATROL KM for Microsoft Windows OS configuration variables

InactiveonMissingPerfObj

Specifies whether the KM inactivates itself when a Microsoft performance object is disabled.

This configuration variable can also be associated with any other KM.

0, 1

Empty (0)

Migrate37

Specifies whether the KM migrates the configurations from the registry at every discovery cycle.

0, 1

0

EnablePSLPcfgCache

Specifies whether a cache is created for pconfig variables in PATROL Agent namespace.

BMC does not recommend to enable this option for PATROL Agent 9.0.20 or later.

0, 1

Empty

AlarmThreshold

The alarm threshold used when automatic monitoring is enabled

Greater than 0

NA

AutoDiscoveryTimeLimit

The length of time that a process can exceed the AlarmThreshold before the KM automatically monitors the process.

• integer > = 0
• -1 turns off this feature

NA

CollectionCount

The number of processes that the KM collects performance data for at one time.

Integer greater than 0

NA

DisablePatrolGroup

Specifies whether the KM automatically creates instances for the PATROL group

Note: You must also remove the instances from the list of monitored instances using the Configure Manual Process Monitoring > Remove Processes menu command.

• 0 = instances are created
• 1 = instances are not created

Empty

DisablePatrolRestart

Specifies whether the PATROL agent restarts if it exceeds the processor% threshold.

0, 1

Empty

StatusNumberofProcessesToDisplay

Specifies how many processes the KM displays in the View Process Status dialog box.

• Integer > = 0
• All

All

StatusSortKey

The column that is used for sorting the View Process Status dialog box.

An existing column

Pid

StatusSelectedColumns/list

Comma-separated list of columns the KM displays in the View Process Status dialog box.

User%,Memory Usage,VM size,Page Faults/sec,Handles,Threads,Arguments

NA

EnableAlarmIfProcessDown

Specifies whether the KM generates an alarm when a process terminates.

Yes, No

Yes

EnableAlarmIfProcessStarts

Specifies whether the KM generates an alarm when the process starts.

Yes, No

No

ProcessName

The name of the monitored process.

Process name

Process name

StartupCommand

Path to an executable command, including any appropriate command-line arguments that the KM uses to start the process when the process goes down.

Directory path

Empty

TimeLimitForKillRunAwayProcess

Length of time (in minutes) that the process can remain in a run-away state before the KM terminates the process.

A run-away process is defined as a process that exceeds the PROCProcessorTimePercent parameter alarm threshold for the length of time specified by this variable.

Integer > = 0; a number of minutes

Empty

GroupList/list

List of the groups to which the process belongs.

Group names

NA

ArgumentList/list

List of arguments for the configured process.

Arguments

NA

UserDefinedProcess

Specifies whether the process is a user-defined process.

Yes, No

Yes

DisplayName

Contains the display name of the process instance.

ProcessOwner

Contains the user name or regular expression for the acceptable owners.

ProcessSettings

Contains the comma-separated values of minimum and maximum threshold count for a process instance.

UseOwnerFilter

Contains a list of two comma-separated properties The first property indicates whether the process owner filtering is on or off.

The second property indicates whether to display the annotation for the PROCOwnerCheck parameter.

Valid values are:

• 0: annotation on
• 1: annotation off

AutoResetServiceConfig

Enables and disables the automatic resetting of specific service monitoring flags.

Valid values are:

• 0 = disabled
• 1 = enabled

Empty

DisableAnnotation

Specifies whether annotations are enabled or disabled for the NT_SERVICES application parameters.

Valid values are:

• 0 or blank = enabled
• 1 = disabled

Empty

DisableServiceRestart

Global setting that specifies restart properties for all services.

For more information about using this variable, see Ensuring that services are restarted as desired.

Valid values are:

• 0 = yes, automatic restart
• 1 = no automatic restart

0

DisableServiceMonitoring

Global setting that specifies whether services are monitored.

Valid values are:

• 0 = by default all services are monitored
• 1 = disables service monitoring

Empty

MonitorManualServices

Specifies whether manual services are monitored.

Valid values are:

• 0 = disabled, manual services are not monitored
• 1 = enabled, manual services are monitored

Empty

removedServiceList

Contains a list of services that have been removed by the PATROL user Note: The default value 'NULL' indicates that no services are removed.

NULL

UseBackwardCompatibleName

Enables you to remove the SERVICES prefix from NT_SERVICES instance names

Note: You must enter this variable manually; the KM does not create it.

In version 3.9.00 of PATROL KM for Microsoft Windows OS, the NT_SERVICES instance names were changed; they were prefixed with SERVICES. This naming convention is not fully backward compatible.

Valid values are:

• 0 or blank = prefix
• 1 = no prefix

NA

PausedServiceDisableAlert

Enables you to remove alerts for paused services.

0, 1

Empty

/ServiceList/<ServiceID>/TriggerStartSvc

Specifies whether the service is trigger start or non-trigger start.

Valid values are:

• Y = Trigger start
• N = Non trigger start

NotRespondCmd

The path to an executable that the KM runs if the variable MonitorNotRespond has a value of 1.

Path to an executable

NA

SvcConfigVars

Comprises of the following variables:

• OverrideGlobalServiceMonitoring
• IgnoreAutoResetConfig
• Alarm
• WarningAlarm
• AutoRestart
• Monitor
• MonitorProcess
• MonitorNotRespond
• OverrideGlobalServiceRestart
• OverrideMonitorManualServices (Note: This variable is available since version 4.8.00 of the KM.)
  

To activate a particular service, set the value of the corresponding bit to 1 in /PSX_P4WinSrvs/PWKPKMforMSWinOS_config/ServiceMonitoring/ServiceList/Service Name/SvcConfigVars" = {REPLACE = "0,0,0,0,0,1,0,0,0,0"}

The comma separated values correspond to the variables in the order as mentioned above.

Service Startup Type configuration variable has to be applied along with "SvcConfigVars" variable to override default monitoring.
/PSXP4WinSrvs/PWK_PKMforMSWinOS_config/ServiceMonitoring/ServiceList/ServiceName/StartupType
Value = "Automatic" / "Manual" / "Disabled" (startup type Service)

Depends on the type of service whether manual, automatic or disabled

Alarm  

Specifies whether to alarm when the service goes down.

Valid values are:

• 0 = no alarm
• 1 = yes, alarm

NA

AutoRestart  

Specifies whether to restart the monitored service.

Valid values are:

• 0 = no restart
• 1 = yes, restart

NA

IgnoreAutoResetConfig

Specifies whether the global auto reset feature applies to this service This variable can be set only through PATROL Configuration Manager.

Valid values are:

• 0 = yes, automatic reset
• 1 = no automatic reset

0

Monitor

Specifies whether to monitor the service By default, only automatic and running manual services are monitored.

Valid values are:

• 0 = no monitoring
• 1 = yes, monitor

NA

MonitorProcess

Specifies whether the process associated with the service is monitored.

Valid values are:

• 0 = no
• 1 = yes

0

MonitorNotRespond

Specifies whether the KM runs the command specified by the NotRespondCmd variable.

• 0 = no
• 1 = yes

0

OverrideGlobalServiceRestart

Specifies whether the AutoRestart variable for the monitored service overrides the global DisableServiceRestart variable.

You can set this variable only by using PATROL Configuration Manager.

Valid values are:

• 0 = do not override
• 1 = override

NA

OverrideGlobalServiceMonitoring

Specifies whether the MonitorProcess variable for the monitored service overrides the global DisableServiceMonitoring variable

You can set this variable only by using PATROL Configuration Manager.

Valid values are:

• 0 = do not override
• 1 = override

NA

WarningAlarm

Specifies whether the service triggers a warning instead of an alarm.

Valid values are:

• 0 = alarm
• 1 = warning

0

BackupDir

Specifies the location of the backup directory for the event log.

Note: If the directory entered for the backup directory does not exist, the Backup and Clear Eventlog recovery action fails.

Directory path*Example:* D:\temp

NA

IncludeAll

Specifies whether all event logs are discovered or only those configured to be monitored.

Valid values are:

• 0 = only configured
• 1 = all

1

OverrideParameterAutoActivate

Specifies whether to automatically activate and automatically inactivate event log parameters based on the current configuration.

You can also use this variable to inactivate or activate other parameters.

For example, you could use the following variable to inactivate the NT_HEALTH parameters: .../HealthMonitoring/OverrideParameterAutoActivate

Valid values are:

• 0 = use auto configure
• 1 = do not use auto configure

0

OverrideParameterFileFreeSpacePct AutoActivate

Specifies whether the parameter ELMEvFileFreeSpacePercent automatically activates and inactivates based on the current configuration.

This variables applies to all event logs. You can also apply this variable to specific event logs.

Valid values are:

• 0 = use auto configure
• 1 = do not use auto configure

0

UseCheckPoint

Specifies whether the event log uses a checkpoint value to guarantee that no events are missed if the PATROL Agent is not running or the KM is not loaded for a period of time.

This is a global setting that can be overridden by individual event log configurations.

Valid values are:

• 0 = do not use
• 1 = use

0

MaxResourceIdleRetainPeriod

The maximum amount of time, since last accessed, that an event description resource DLL is held in cache.

Greater than 0

300 seconds

InclusionList/list

List of event logs that are monitored.

List of event logs

NA

ExclusionList/list

List of event logs that are not monitored.

List of event logs

NA

DisablePEMInfoEvents

Specifies whether to disable information events generated by XPC (psx_server.xpc).

Valid values are:

• 0 = do not disable information events
• 1 = disable information events

0

TogglePEMOriginData

Determines whether the event is displayed in the event log name format or the detailed format in PEM (PATROL Event Manager).

Valid values are:

• 0 = event log name format
• 1 = detailed format

0

ForwardAllNTEventstoPEM

Specifies whether all occurring events are sent to PEM (PATROL Event Manager).

Valid values are:

• 0 = do not send
• 1 = send

0

ForwardFilteredNTEventstoPEM

Specifies whether all events that match the configured event filters for the event log are sent to PEM (PATROL Event Manager).

Valid values are:

• 0 = do not send
• 1 = send

0

OverrideSummaryAutoCreate

Specifies whether the default behavior to automatically create the Summary instance is overridden.

Valid values are:

• 0 = do not override (create)
• 1 = yes, override (do not create)

0

OverrideParameterFileFreeSpacePct AutoActivate

Specifies whether the parameter ELMEvFileFreeSpacePercent automatically activates and inactivates based on the current configuration.

This variable applies to a specific event log. You can also apply this variable globally to all event logs.

Valid values are:

• 0 = use auto configure
• 1 = do not use auto configure

0

UseCheckPoint

Specifies whether the event log uses a checkpoint value to guarantee that no events are missed if the PATROL Agent is not running or the KM is not loaded for a period of time

Valid values are:

• 0 = do not use
• 1 = use

0

CheckPoint

The last event log record that was successfully recorded.

Greater than 0

0

EventFilters/child_list

A list that details the defined event filters.

List of event filters

Summary

FilterEnabled

Specifies whether the event filter is enabled Disabled event filters are not discovered and do not collect events.

Valid values are:

• 0 = not enabled
• 1 = enabled

1

CreateInstance

Specifies whether an application instance is created for the event filter.

An application instance is not required to collect data.

However, if an instance is not created, the only way to retrieve the data collected by the event filter is too subscribe to the event filter data.

Valid values are:

• 0 = not created
• 1 = created

1

ParentInstance

Allows the parent application instance of an event filter to be changed.

If this value is set, the event filter instance is created with the specified parent instance.

Path to valid PATROL application instance

NA

AcknowledgeBy

Specifies how the event filter is acknowledged If the value of this variable is the name of another event filter, the event filter is automatically acknowledged when the referenced event filter criteria is satisfied.

Manual, automatic, or filtername

auto-matic

Annotation

Specifies whether the parameter data point is annotated with event text.

Valid values are:

• 0 = do not annotate
• 1 = annotate

0

ConsolidateEventTypes

Specifies whether event types are consolidated.

Valid values are:

• 0 = do not consolidate
• 1 = consolidate

0

ConsolidationNumber

Number of events that occur within a specified time and are reported as one event.

Integer less than 35791394

1

ConsolidationTime

The time period in which events must occur to satisfy the consolidation criteria.

Integer less than 35791394

0

EventReport

Specifies whether event descriptions are reported by means of a text parameter.

Valid values are:

• 0 = do not report
• 1 = report

0

EventType

Specifies the type of events that are filtered:

• 1 = Error
• 2 = Warning
• 4 = Information
• 8 = AuditSuccess
• 16 = AuditFailure
• 32 = OtherType
• 64 = Critical
• 128 = Verbose

A valid value is any summation of these types. For example, to monitor both Warning and AuditFailure events, use a value of 18 (2 +16).

1, 2, 4, 8, 16, 32, and the sums of any or all of these numbers

For security event log: 25 All other event logs: 1

FilterDescription

Text that describes the event filter.

No restrictions

NA

IncludeAllCategories

Specifies whether all event categories are monitored.

If all categories are monitored (1), then the CategoryList variable represents an exclusion list. Otherwise, it represents an inclusion list.

1

CategoryList/list

A list of event categories that are included or excluded from monitoring, depending on the value of the variable IncludeAllCategories.

List of event categories

NA

IncludeAllEventIds

Specifies whether all event IDs are monitored If all event IDs are monitored (1), then the EventIdList variable represents an exclusion list.

Otherwise, it represents an inclusion list.

Valid values are:

• 0 = not monitored
• 1 = monitored

1

EventIdList/list

A list of event categories that are included or excluded from monitoring, depending on the value of the variable, IncludeAllEventIds.

List of event IDs

NA

IncludeAllSources

Specifies whether all sources are monitored If all sources are monitored (1), then the SourceList variable represents an exclusion list.

Otherwise, it represents an inclusion list.

Valid values are:

• 0 = not monitored
• 1 = monitored

1

SourceList/list

A list of sources that are included or excluded from monitoring, depending on the value of the variable, IncludeAllSources.

List of event sources

NA

IncludeAllStrings

Specifies whether all text strings are monitored If all text strings are monitored (1), then the StringList variable represents an exclusion list.

Otherwise, it represents an inclusion list.

Valid values are:

• 0 = not monitored
• 1 = monitored

1

StringList/list

A list of text strings that are included or excluded from monitoring, depending on the value of the variable, IncludeAllStrings.

List of text strings

NA

IncludeAllUsers

Specifies whether all users are monitored If all users are monitored (1), then the UserList variable represents an exclusion list.

Otherwise, it represents an inclusion list.

Valid values are:

• 0 = not monitored
• 1 = monitored

1

 UserList/list

A list of users that are included or excluded from monitoring, depending on the value of the variable, IncludeAllUsers.

List of text strings

NA

RetainEventDescriptions

Specifies whether event descriptions are stored in the PATROL Agent namespace for retrieval.

Valid values are:

• 0 = do not retain
• 1= retain

0

Scheduling

The type of collection used for collecting event data.

Valid values are:

• 0 = Notification
• 1 = Polling
• 2 = Both

1

MaxRecords

The maximum number of records that are held in psx_server.xpc memory for the filter.

Greater than 0

3010

SubscriberList/list

Lists the subscriptions that exist for the parent event log and filter.

Subscribers

Empty

DisplayName

Specifies the label that the KM places under the filter instance

Note: You must manually enter this variable; the KM does not create it.

Setting this variable does not change the instance name/namespace. This variable is read only at initial filter creation or parent instance change.

Label for filter

NA

FilterDisableCase

Specifies whether the filter comparisons are made in a case-independent manner.

This variable has five bit values, depending upon case sensitivity, one bit corresponding to each of Source, User, Category, String, and Computer name, respectively.

If any bit value is 1, a case-independent filter comparison is made for the corresponding field.

Valid values are:

• 00000 = none checked (default)
• 11111 = all 5 categories checked
• a combination of 0s and 1s, depending on which of the 5 categories were checked

0000

Computer NamesList/list

Lists the computers that are included for monitoring or the computers that are excluded from monitoring, depending on the value of the IncludeAllCompList variable.

List of computers

Empty

Include AllCompList

Indicates whether all computers are monitored.

Valid values are:

• 0 = none of the computers are monitored by default, and the ComputerNamesList variable is an inclusion list
• 1 = all of the computers are monitored, and the ComputerNamesList variable is an exclusion list

Enabled

Specifies whether the subscriber (subscription) is enabled.

0, 1

1

Filter

Specifies the name of the filter that notifies the subscriber when monitored events are detected.

Filter name

Empty

Function

Specifies the function that the Subscriber calls when notified of events.

Function name

Empty

Library

Specifies the location of the library that contains the function that the Subscriber calls.

Library name

Empty

Specifies the location of the

Added a new PCONFIG variable for filtering Windows events while subscribing it from Windows Event System. The value of this variable will be XML query.

EventForwardingHeartbeat

Specifies the heartbeat configuration that is passed to the PEM API.

Number that is calculated using valid values: 5000 <= x <= 1800000

30000

EventForwardingRetries

Specifies the number of times the KM attempts to send an event.

Number that is calculated using valid values: 2 <= x <= 10

4

EventForwardingTimeout

Specifies the timeout configuration that is passed to the PEM API.

Number that is calculated using valid values: 5000 <= x <= 1800000

30000

MaxFilterRecords

Specifies the maximum number of records that the KM holds in XPC (psx_server.xpc ) memory for any filter.

Number > 0

3010

ReportAccountName

Specifies whether the KM obtains account names from the SID.

0, 1

0

OverrideParameterAutoActivate

Specifies whether job object parameters are automatically activated or inactivated based on the current configuration.

Valid values are:

• 0 = auto configure
• 1 = do not auto configure

0

ManualAcknowledge

Specifies whether the PROCStatus parameter is manually acknowledged.

Valid values are:

• 0 = auto acknowledge
• 1 = manually acknowledge

0

MonitorProcess

Specifies whether job object assigned processes are monitored.

Valid values are:

• 0 = do not monitor
• 1 = monitor

1

IncludeAll

Specifies whether all job objects are discovered or only the job objects specifically configured to be monitored.

Valid values are:

• 0 = only configured objects
• 1 = all

1

InclusionList/list

The job objects that are monitored.

List of job objects

NA

ExclusionList/list

The job objects that are excluded from monitoring.

List of job objects

NA

CollectionCount

Number of processes for which performance data is collected at one time.

Greater than 0

NA

AnnotateProcStatus

Specifies whether the PROCStatus parameter is annotated.

Valid values are:

• 0 = no
• 1 = yes

1

DestroyAcknowledgeProcess

Specifies whether to destroy acknowledged process instances.

Valid values are:

• 0 = no
• 1 = yes

1

AnnotateTopProcs

Specifies whether the parameter NT_CPU/CPUprcrProcessorTimePercent for the _Total instance is annotated with the top N CPU-consuming processes.

Valid values are:

• 0 = no
• 1 = yes

1

AnnotateProcCount

Number of top processes to include when annotating the NT_CPU/CPUprcrProcessorTimePercent parameter.

Integer greater than 0

10

DisableAnnotation

Specifies whether annotations are enabled or disabled for the NT_CPU (icon labled Processor) application parameters.

Valid values are:

• 0 or blank = enabled
• 1 = disabled

ExclusionList/list

The processors that are excluded from monitoring.

List of processors

NA

IncludeAll

Specifies whether all processors are monitored (except for the ones specifically excluded).

Valid values are:

• 0 = no
• 1 = yes

1

InclusionList/list

the processors that are monitored This variable is ignored unless the /ProcessorMonitoring/IncludeAll variable is set to 0.

List of processors

NA

CPUprcrStatus

the last count of the processors that are monitored

Integer

0

IncludeAll

Specifies whether all network interfaces (less those excluded) are monitored.

Valid values are:

• 0 = no
• 1 = yes

1

InclusionList/list

The pagefiles that are monitored.

This variable is ignored unless the /PagefileMonitoring/IncludeAll variable is set to 0.

List of pagefiles

NA

ExclusionList/list

The pagefiles that are excluded from monitoring

List of pagefiles

NA

IncludeAll

Specifies whether all network interfaces (less those excluded) are monitored.

Valid values are:

• 0 = no
• 1 = yes

1

InclusionList/list

The network interfaces that are monitored This variable is ignored unless the /NetworkInterfaceMonitoring/IncludeAll variable is set to 0.

List of network interfaces

NA

ExclusionList/list

The network interfaces that are excluded from monitoring

List of network interfaces

NA

InclusionList/list

The physical disks that are monitored.

List of device numbers

NA

ExclusionList/list

The physical disks that are excluded from monitoring.

List of device numbers

NA

IncludeAll

Specifies whether all physical disks are discovered.

Valid values are:

• 0 = no
• 1 = yes

1

MaxReloadCounters

Specifies the maximum number of times that the KM can issue the %RELOAD_COUNTERS command.

Integer > 0

Empty (no limit)

RemovedPDList

Stores the physical disk instances that have been removed under the NT_PHYSICAL_DISKS_CONTAINER application class.

List of deleted instances

NA

FTP/Active

Specifies whether the NT_FTP KM is activated.

Valid values are:

• 0 = no
• 1 = yes

1

ICMP/Active

Specifies whether the NT_ICMP KM is activated.

Valid values are:

• 0 = no
• 1 = yes

1

IP/Active

Specifies whether the NT_IP KM is activated.

Valid values are:

• 0 = no
• 1 = yes

1

IPX/Active

Specifies whether the NT_IPX KM is activated.

Valid values are:

• 0 = no
• 1 = yes

1

NETBEUI/Active

Specifies whether the NT_NETBEUI KM is activated.

Valid values are:

• 0 = no
• 1 = yes

1

NETBIOS/Active

Specifies whether the NT_NETBIOS KM is activated.

Valid values are:

• 0 = no
• 1 = yes

1

TCP/Active

Specifies whether the NT_TCP KM is activated.

Valid values are:

• 0 = no
• 1 = yes

1

UDP/Active

Specifies whether the NT_UDP KM is activated.

Valid values are:

• 0 = no
• 1 = yes

1

InclusionList/list

The logical disks that are monitored.

List of logical disks

NA

ExclusionList/list

The logical disks that are excluded from monitoring.

List of logical disks

NA

IncludeAll

Specifies whether all logical disks are discovered.

Valid values are:

• 0 = no
• 1 = yes

1

MaxReloadCounters

Specifies the maximum number of times that the KM can issue the %RELOAD_COUNTERS command.

Integer > 0

Empty (no limit)

DeletedLDList

Stores a list of the deleted logical disk instances.

List of logical disk instances

Non AggregateParamValue

Changes the values generated by the following parameters:

• LDldFreeSpacePercent
• LDldFreeMegabytes
• LDldDiskSpaceUsed

Valid values are:

• 1 = values shown for a particular drive instance do not consider the mount drives
• 0 = value shown is an aggregate of a particular drive instance and all of its mount drives

InclusionList/list

List of registry keys that are monitored.

List of registry keys

NA

AnnotateValueChange

Specifies whether the RegValueChanged parameter is annotated.

Valid values are:

• 0 = no
• 1 = yes

1

DisableAnnotation

Specifies whether annotations are enabled (0 or blank) or disabled (1) for the NT_PRINTER application parameters.

Valid values are:

• 0 or blank = enabled
• 1 = disabled

NA

InclusionList/list

The printers that are monitored.

List of printers

NA

ExclusionList/list

The printers that are excluded from monitoring.

List of printers

NA

IncludeAll

Specifies whether all printers are discovered.

Valid values are:

• 0 = no
• 1 = yes

1

TestConnectivity

Specifies whether the KM pings the printer to test connectivity.

Valid values are:

• 0 = no
• 1 = yes

0

ProcessorContentionThreshold

Threshold for resource contention

0 to 100

30

MemoryContentionThreshold

Threshold for memory contention

0 to 100

80

OverrideParameterAutoActivate

Specifies whether the WMIAvailability parameter is automatically activated or inactivated based on the current configuration on Windows NT 4.

Valid values are:

• 0 = auto configure
• 1 = do not auto configure

0

OverrideAutoConfigUpdate

Specifies whether the Win32_WMISetting.HighThresholdOnEvents property is auto-corrected using the HighThresholdOnEvents configuration variable.

Valid values are:

• 0 = auto correct
• 1 = do not auto correct

0

HighThresholdOnEvents

Minimum required value for the WIN32_WMISetting

Greater than 0

2000000

ConfigureOptionUsed

Allows you to configure the KM by using three options.

The KM looks for a crash dump file as well as the event (ID 6008).

Valid values are:

• 1 = Event (ID 6008) - only monitors the event id, 6008.
• 2 = Crash Dump - only monitors the crash, Dump.
• 3 = Default - monitors crash dump or event as per registry configuration.

3

NT_EVENTLOG.OSdefaultAccount

Allows you to provide a valid user name and password for the PATROL Agent default account.

The KM functions without specifying the PATROL Agent default account. Except for the Windows event log KM, the PATROL KM for Microsoft Windows works with a blank user name and password for the PATROL Agent default account. When you enter a blank user name and password for the PATROL Agent default account, XPC (psx_server.xpc ) runs under the local system account.

The Windows event log KM requires a valid user name and password to connect to the PATROL Agent using PEMAPI.

hosts

Specifies a comma separated list of the remote hosts that have been added for monitoring.

winRMTimeOut

Provides a way to configure the timeout that is used, when the following WinRM error is encountered:

The WS-Management service cannot complete the operation within the time specified

The timeout value must be specified in milliseconds.

For example: For 5 minutes set the value as 300000

Time out in milliseconds

connectionProtocol

Specifies the protocol (HTTP or HTTPS) that is used for remote host connection.

Valid values are:

• 1: HTTP
• 2: HTTPS

userAccount

Specifies the user account which is used to connect to the remote host.

accountProfile

Specifies the shared credential, if it has been used for remote host connection.

profileList

Specifies a comma separated list of the profiles (shared credentials).

hostList

Specifies a comma separated list of the monitored remote hosts with the respective profile.

userAccount

Specifies the user name for each profile.