Use > Set up Infrastructure Management Templates > Essential System Management Template

Essential System Management Template

The Essential System Management Template monitors the health of all the systems - individual, clusters, and virtual in a data center environment. It monitors the basic functionalities - availability of system services and processes, software resources (CPU, memory, network, and disk), checks for system downtime risks by tracking congestion and bottlenecks in system resources and failed logins and last logins on your system. The Essential System Management Template comprises of specific Aspects to monitor these features.

ClosedHow to Access the Essential System Management Template

  1. Open the Management Templates & Aspects pane:

    Click Administration > Monitoring > Management Templates & Aspects.

  2. Click Configuration Folders > Infrastructure Management > Infrastructure Management Templates > Essential System Management.

User Interface Reference

ClosedManagement Template - General

Provides an overview of the attributes of the Management Template.

UI Element Description
Name

Essential System Management Template
Description Manages the system health by tracking availability and utilization of key system resources.
ID A unique identifier for the Graphic User Interface (GUI) version of the Management Template.
Version ID

A unique identifier for this version of the Essential System Management Template.

Version

The current version of the Management Template. In this instance, the version of the Management Template is 1.200.
Change Log The text that describes what is new or modified in this version of the Management Template.
ClosedManagement Template - Topology View

Provides an overview of the CI type you want to assign to the Management Template.

UI Element Description
Topology View

Systems_Infrastructure is the Topology View for Essential System Management Template. It contains the CI types that you want to manage using the Management Template.
CI Type

This is the type of CI to which the Management Template can be assigned. The Essential System Management Template contains Computer CI Types.
ClosedManagement Template - Aspects

The Essential System Management Template consists of the following Aspects:

ClosedKey System Services Availability

The Aspect monitors the key processes that run in the background to support the different tasks required for the operating system or application.

The Sys_ProcessMonitor policy monitors all the process in the process groups. In the Sys_ProcessMonitorConfig policy, you must specify the process group and location of the procmon.cfg configuration file. You can specify the process group and location of the procmon.cfg configuration file while deploying the Aspect as optional parameters. Alerts are generated whenever the processes defined in the configuration file either do not run as expected or the processes are out of limits during the specified time of the day and day of the week.

After the Aspect is deployed, if the procmon.cfg file is available in the location specified in Sys_ProcessMonitorConfig policy, then the file is overwritten. If the file is not available, then a new file is created in the designated location.

Prerequisites

Following is a syntax for editing Sys_ProcessMonitorand Sys_ProcessMonitorConfig policies before deploying.

ClosedSyntax for ConfigFile Policy 
[ProcessGroupName]
Process name<tab>Argument<tab>Time of the day<tab>Days of Week<tab>Bounds

In this instance,

  • Process Name: Specifies the name of the process to be monitored.
  • Arguments: Specifies the arguments that are used to distinguish between multiple processes running simultaneously. If no arguments are present, an asterisk (*) must be specified.
  • Time of the day: Specifies the time duration (in the 24-hour format) during which a process failure must be reported.
  • Day of Week: Specifies the day or days to report process failure. Each day of week is identified with a number as listed in the table. 0 being Sunday and 6 being Saturday. Numbers should be separated by commas.

  • Bounds: Specifies the number of instances of named processes. You can specify the number of instance as follows:

    n: An exact number

    n: A minimum of n

    -n: A maximum of n

    m-n: A range of m to n

  • @ severity: Specifies the severity of alert messages such as Minor, Major or Critical. Default severity is Warning.

  • @Start: Specifies the command (<cmd>) that must be run during a process failure.

Scenarios and syntax for customizing ConfigFile policy:

Scenario Sample Syntax
To monitor processes all week during every polling interval 
[ProcessGroupName]

processname<tab>Argument<tab>ProcessLimits
/opt/OV/lbin/eaagt/opcmona	*	1
To monitor processes with more than one argument

Syntax: pr3ocessname<tab>Argument1<space>Argument2<tab>ProcessLimits

Arguments should be separated with space.

Example:

[OMi_Mgt]
/opt/OV/bin/oacore	oacore /var/opt/OV/conf/oa/PipeDefinitions/oacore.xml	1
To monitor processes only at specified time of the day or day of the week

Syntax: 

[ProcessGroupName]
processname<tab>Argument<tab>Timeoftheday<tab>Daysofweek<tab>ProcessLimits

Example:

[OMi_Mgt]
/opt/OV/lbin/agtrep/agtrep	-start	5-23	0,1,2,3	1
To mention the severity of the alert message

Syntax:@severity=<severity>

severity can be warning,minor,major,critical

Example: @severity=minor
To mention operator initiated command

Syntax: @start=<command to be executed>

Example: @start=ovc -start agtrep
ClosedKey System Services Availability

This Aspect consists of the following policy templates:

CI Type Policy Template Indicator Policy Description Policy Type
Computer Sys_AIXSyslogProcessMonitor NA This policy template monitors the Syslog processes running on AIX operating systems. Service/Process Monitoring Template
Computer Sys_HPUXSshdProcessMonitor NA This policy template monitors the SSH daemon processes running on HP-UX operating systems. Service/Process Monitoring Template
Computer Sys_HPUXSyslogProcessMonitor NA This policy template monitors the Syslog daemon processes running on HP-UX operating systems. Service/Process Monitoring Template
Computer Sys_LinuxSshdProcessMonitor NA This policy template monitors the SSH daemon processes running on Linux operating systems. Service/Process Monitoring Template
Computer Sys_MSWindowsEventLogRoleMonitor NA This policy template monitors the availability of system services required for event log role service. Service/Process Monitoring Template
Computer Sys_MSWindowsFileServerRoleMonitor NA This policy template monitors the availability of system services required for files server role service. Service/Process Monitoring Template
Computer Sys_MSWindowsNetworkPolicyServerRoleMonitor NA This policy template monitors the availability of system services required for network policy server role service. Service/Process Monitoring Template
Computer Sys_MSWindowsTaskSchedulerRoleMonitor NA This policy template monitors the availability of system services required for task scheduler role service. Service/Process Monitoring Template
Computer Sys_MSWindowsWin2k3FileServicesRoleMonitor NA This policy template monitors the availability of system services required for Win2k3 files services role service. Service/Process Monitoring Template
Computer Sys_RHELSyslogProcessMonitor NA This policy template monitors the Syslog daemon processes running on RHEL operating systems. Service/Process Monitoring Template
Computer Sys_SLESSyslogProcessMonitor NA This policy template monitors the Syslog daemon processes running on SLES operating systems. Service/Process Monitoring Template
Computer Sys_SunSolarisSshdProcessMonitor NA

This policy template monitors the SSH daemon processes running on Sun Solaris operating systems.

 Service/Process Monitoring Template
Computer Sys_SunSolarisSyslogProcessMonitor NA This policy template monitors the system log processes running on Sun Solaris operating systems. Service/Process Monitoring Template
Computer Sys_ProcessMonitor NA Monitor processes and process groups. Measurement Threshold
Computer Sys_ProcessMonitorConfig NA Configfile policy for system process monitoring. ConfigFile

ClosedRealtime Resource Bottleneck

RealtimeAlerts policy detects the bottlenecks in CPU, disk, memory, and networking. The Realtime Configuration policy defines the threshold for these parameters. During a threshold breach, alert messages notify the system administrator with no time delay and reduce the downtime in production environment.

Also, mention the metrics used and that the policy reads the adv.out file which is a result of the output of advisor.pl file.

Note You must enable RTMA license on the Operations Agent node for RealTimeAlerts policy to fetch real time data.

ClosedPrerequisite for deploying the aspect:

You must increase the agent timeout to avoid termination of process before completion of aspect deployment.

Follow these steps to increase the timeout:

  1. Stop the Operations Agent process, run the following command:

    ovc -kill

  2. Edit the default timeout, run the following command: 

    ovconfchg -ns eaagt -set OPC_CONFIGFILE_TIMEOUT 60

  3. Set the control notification to true, run the following command:

    ovconfchg -ns conf.core –set ASYNC_CONTROL_NOTIFY TRUE

  4. Start the Operations Agent process, run the following command: 

    ovc –start
CI Type Policy Template Indicator Description Policy Type
host_node Sys_AIXRealTimeConfig NA Perfd Advisor script for AIX ConfigFile
host_node Sys_MSWindowsRealTimeAlerts NA Log file policy for realtime alerts LogFile Entry
host_node Sys_HPUXRealTimeConfig NA Perfd Advisor script for HP-UX ConfigFile
host_node Sys_MSWindowsRealTimeConfig NA Perfd Advisor script for Windows ConfigFile
host_node Sys_LinuxRealTimeAlerts NA Log file policy for realtime alerts LogFile Entry
host_node Sys_LinuxRealTimeConfig NA Perfd Advisor script for Linux ConfigFile
host_node Sys_SunSolarisRealTimeConfig NA Perfd Advisor script for SunOS ConfigFile
ClosedResource Bottleneck Diagnosis

This Aspect identifies congestions and bottleneck conditions for system resources like the CPU, memory, network, and disk. CPU bottleneck monitoring is based on global CPU utilization and load average (Run Queue Length) Memory bottleneck monitoring is based on memory utilization, free memory available, and memory swap out rate. Filesystem monitoring is based on space utilization level for busiest filesystem on the node. Network monitoring is based on Packet collision rate, packet error rate, and outbound queue length. This Aspect contains the following policy templates:

CI Type Policy Template Indicator Policy Description Policy Type
Computer Sys_CPUBottleneckDiagnosis CPULoad

Detects CPU bottlenecks such as exceeding the thresholds for CPU utilization percentage, processor queue length, and total number of CPUs running on an operating system.

For example, if the threshold for CPU utilization is violated along with threshold for number of processes in the queue waiting for CPU time, the policy sends an alert. The message also displays a list of the top ten CPU utilization processes.

 Measurement Threshold Template
Computer Sys_DiskPeakUtilMonitor DiskUsageLevel Monitors the utilization level of the disk on the system. It checks whether the utilization level is full. Measurement Threshold Template
Computer Sys_MemoryBottleneckDiagnosis MemoryLoad Monitors the physical memory utilization and the bottlenecks. Memory bottleneck condition occurs when the memory utilization is high and the available memory is very low. It causes the system to slow down affecting overall performance. High memory consumption results in excessive page outs, high page scan rate, swap-out byte rate, and page request rate, eventually slowing down the system. The message also displays a list of top ten memory utilization processes. Measurement Threshold Template
Computer Sys_NetworkInterfaceErrorDiagnosis SESSION Monitors the network usage of the system and checks for potential network bottlenecks or errors. Measurement Threshold Template
ClosedSystem Fault Analysis

This Aspect monitors the kernel log file, boot log file, and event log file for critical error conditions and instructions. This Aspect contains the following policy templates:

CI Type Policy Template Indicator Policy Description Policy Type
Computer Sys_LinuxKernelLog NA This policy template monitors the kernel log file /var/log/ and alerts in case of any kernel service failure. It checks for error conditions that match the <*> kernel: <@.service>: <*.msg> failed pattern in the kernel log file. If any matches are found, this condition sends an alert with minor severity. Logfile Entry
Computer Sys_LinuxBootLog NA

This policy template monitors the boot log file /var/log/boot.log and alerts in case of any system boot errors. It checks for the following conditions:

  • Service startup failed - Checks for error conditions that match the <*> <@.service>: <@.daemon> startup failed pattern in the boot log file. If any matches are found, this condition sends an alert with minor severity.

  • Service failed - Checks for error conditions that match the <*> <@.service>: <*.msg> failed pattern in the log file. If any matches are found, this condition sends an alert with critical severity.

 Logfile Entry
Computer Sys_LinuxSecureLog NA This policy template alerts the user in case of any secure login failure. It checks for the error conditions that match the <*> sshd : Failed password for <@.user> from <*.host> port <#> ssh2 pattern. If any matches are found, this condition sends an alert with warning severity. Logfile Entry
Computer Sys_AIXErrptLog NA This policy template monitors the errpt log file /var/opt/OV/tmp/sispi/errpt.log and generates an error report from entries in an error log. It checks for error conditions that match <@.errcode> <2#.mo><2#.dd><2#.hh><2#.mm><2#.yy> <@> <@> <@.object> <*.msgtext> each column in the errpt log file. If any matches are found, this condition sends an alert with warning severity. Logfile Entry
Computer Sys_MSWindowsServer_DNSWarnError NA

This policy template monitors the log file for the Microsoft DNS server service and its corresponding process and forwards the error log entries with a warning, or error severity. The policy looks for the following errors recorded in the DNS log file:

  • The DNS server could not allocate memory for the resource record.
  • The DNS server was unable to service a client request due a shortage of available memory.
  • The DNS server could not create a zone transfer thread.
  • The DNS server encountered an error while writing to a file.
  • The DNS server could not initialize the remote procedure call (RPC) service.
 Windows Event Log
Computer Sys_MSWindowsServer_DHCPWarnError NA

This policy template monitors the DHCP event logs and forwards the event log entries with warning, or error severity. The policy looks for the following errors:

  • Iashlpr cannot contact the NPS service.
  • There are no IP addresses available for BOOTP clients in the scope or superscope.
  • The DHCP server is unable to reach the NPS server for determining the client's NAP access state.
  • There are no IP addresses available for lease in the scope or superscope.
  • The DHCP service failed to initialize the audit log.
  • The DHCP/BINL service on the local computer has determined that it is not authorized to start.
  • The DHCP/BINL service on this workgroup server has encountered another server with IP Address.
  • The DHCP service failed to restore the DHCP registry configuration.
  • The DHCP service was unable to read the global BOOTP file name from the registry.
  • The DHCP service is not servicing any clients because there are no active interfaces.
  • There is no static IP address bound to the DHCP server.
  • The DHCP Server service failed to register with Service Controller.
  • The DHCP Server service failed to initialize its registry parameters.
 Windows Event Log
Computer Sys_MSWindowsServer_NFSWarnError NA

This policy template monitors the NFS event logs and forwards the event log entries with warning, or error severity. The policy looks for the following errors:

  • Server for NFS detected a low disk space condition and has stopped recording audits.
  • The audit log has reached its maximum file size.
  • Server for NFS could not register with RPC Port Mapper.
  • The Server for NFS received a failure from the NFS driver during phase 2 initialization.
 Windows Event Log
Computer Sys_MSWindowsServer_TerminalServiceWarnError NA

This policy template forwards the terminal service event logs entries with warning, or error severity. The policy looks for the following errors:

  • A connection request was denied because the terminal server is currently configured to not accept connections.
  • Autoreconnect failed to reconnect user to session because authentication failed.
  • Terminal Service start failed.
  • The terminal server received large number of incomplete connections.
 Windows Event Log
Computer Sys_MSWindowsServer_WindowsLogonWarnError NA

This policy template monitors the Windows logon and initialization event logs and forwards the error log entries with warning, or error severity. The policy looks for the following errors recorded in the Windows log file:

  • Windows license is invalid.
  • Windows license activation failed.
  • The Windows logon process has failed to switch on the desktop.
  • The Windows logon process has unexpectedly terminated.
  • The Windows logon process has failed to spawn a user application.
  • The Windows logon process has failed to terminate currently logged on user's processes.
  • The Windows logon process has failed to disconnect the user session.
 Windows Event Log
host_node Sys_LINUXBadLogins NA Monitors bad logins in LINUX platform. LogFile Entry
host_node Sys_AIXSu NA Monitors the AIX log file definition of su log file. LogFile Entry
host_node Sys_HPUXBadLogs NA Monitors history of bad logins (/var/adm/btmp logfile) in HP-UX 10.x/11.x platform. LogFile Entry
host_node Sys_SunSolarisSyslog NA NFS server ok [SISPI-SOL-syslog.41] LogFile Entry
host_node Sys_AIXBadLogs NA Monitors the history of failed logins in AIX platform. LogFile Entry
host_node Sys_AIXLogins NA Monitors the history of logins and logouts [OSSPI-AIX-Logins_1] in AIX platform. LogFile Entry
host_node Sys_MSWindowsServer_DNSWarnError NA Forwards DNS event logs entries with Warning or Error severity. Windows Event Log
host_node Sys_HPUXsyslog NA Monitors messages passed into the syslog.log file. LogFile Entry
host_node Sys_HPUXLogins NA Monitors the history of logins and logouts (/var/adm/wtmp logfile) in HP-UX 10.x/11.x platform. LogFile Entry
host_node Sys_AIXSyslog NA Monitors messages concerning services and passed into syslog.log file. LogFile Entry
host_node Sys_SunSolarissnmplog NA Monitors SNMP log file entries. LogFile Entry
host_node Sys_SunSolarisBadLogs NA Monitors the history of failed logins (/var/adm/loginlog) in Solaris platform. LogFile Entry
host_node Sys_SunSolarisLogins NA Monitors the history of logins and logouts (/var/adm/wtmpx file) in Solaris platform. LogFile Entry
host_node Sys_HPUXSu NA Monitors the switch user events in log file (/var/adm/sulog) in HP-UX 10.x/11.x platform. LogFile Entry
ClosedUser Logins

This Aspect checks the number of failed logins and last logins on your system. This Aspect consists of the following policy templates:

CI Type Policy Template Indicator Policy Description Policy Type
Computer Sys_MSWindowsFailedLoginsCollector NA

This policy checks for the number of:

  • Failed login attempts on Microsoft Windows.
  • Invalid logins, either due to unknown username or incorrect password on the managed node.
  • The policy logs individual instances of failed login into the GBL_NUM_FAILED_ LOGINS metric in EPC. By default, the time interval is 1 hour.
 Scheduled Task Template
Computer Sys_MSWindowsLastLogonsCollector NA

This policy template performs the following tasks:

  • Checks for the logon details of all the active local user accounts on Microsoft Windows.
  • Logs individual instances of user logon into the SECONDS_ SINCE_LASTLOGIN metric in EPC. By default, the time interval is 1 hour.
 Scheduled Task Template
Computer Sys_UNIXFailedLoginsCollector NA

This policy checks for the number of:

  • Failed login attempts on RHEL and SLES Linux systems, HP-UX, AIX, and Solaris operating systems.
  • Invalid logins, either due to unknown username or incorrect password on the managed node.
  • The policies log individual instances of failed login into the GBL_NUM_FAILED_LOGINS metric in EPC. By default, the time interval is 1 hour.
 Scheduled Task Template
Computer Sys_LinuxLastLogonsCollector NA This policy checks for the logon details of all the active local user accounts on RHEL and SLES Linux operating systems. The policy logs individual instances of user logon into the SECONDS_SINCE_LASTLOGIN metric in EPC. By default, the time interval is 1 hour. Scheduled Task Template

Note You must have the following pre-requisites for the Sys_UNIXFailedLoginsCollector policy to function correctly when deployed on the Solaris node:

  • Set the following variables in /etc/default/login file

    SYSLOG=YES

    SYSLOG_FAILED_LOGINS=1

  • In /etc/syslog.conf file, check if the following line is present:

    auth.notice ifdef(LOGHOST', /var/log/authlog, @loghost)

  • Refresh syslogd using the following command:

    svcadm refresh system/system-log

Sys_UNIXFailedLoginsCollector policy is deployed in the following paths:

On Solaris nodes: /var/log/authlog

On Linux nodes: lastb command

On HP-UX nodes: lastb command

On AIX nodes: /etc/security/failedlogin log

ClosedSystem Infrastructure Discovery

This Aspect discovers and gathers information regarding the system resources, operating system, and applications on a managed node. This Aspect contains the following policy templates:

CI Type Policy Template Indicator Policy Description Policy Type
Computer OPC_PERL_INCLUDE_INSTR_DIR NA Is used for setting OPC_PERL_INCLUDE_INSTR_DIR in the HP Operations Agent xpl config namespace. Set the value to TRUE for Infrastructure SPI policies to work. Node Info Template
Computer Sys_SystemDiscovery NA

Gathers service information from the managed nodes such as hardware resources, operating system attributes, and applications.

 Service Auto-Discovery Template

Send Help Center feedback