Sysload How to

Solved : Monitoring cores, getting notifications and other questions

Tue, 08 Jun 2010 17:30:05 +0200

Hi,

I have some other questions on SP Analyst, so here they are.

a/ Is it possible to monitor each core of a Quad Core CPU?

b/ Is it possible to get a notification (sms, email�) when an agent becomes unreachable?

c/ When an event persists, how to get notified (sms, email�) periodically?

d/ When an agent is having a network issue and a triggered event will not be sent to the Management Server, would the event be sent after the network has recovered?

e/ If there is network issue with the machine where the Alert Manager is installed, does this mean no event reaction will be carried out? Would a second Alert Manager on another machine help?

f/ Can you explain to me what does 2*NB_CPU mean in the sldrmd.ini?

MetaProc= TotalCpuUse > 90 and NumberOfWaitingThreads > 2*NB_CPU; 15

J.

Solved : SP Portal – How to customize Availability/Health thresholds in SPP reports (Sun, Cloud,…)?

Mon, 12 Apr 2010 22:01:09 +0200

Can I customize Availability/Health thresholds in SP Portal reports (Sun, Cloud,�)?
I want it to be more optimistic

Solved : Execute automatic reactions

Wed, 02 Dec 2009 15:14:54 +0100

Sysload offers different means of executing reactions to events.

SP Analyst console:
- Just for "waking up" the console user.
- Not designed to execute third-party programs or scripts.

SP Analyst alert manager (dedicated module):
- Receives events through management server.
- Supports Windows only.
- Is best at running central reactions (e.g. forward event via SNMP trap).
- Dedicated installation.
- Configuration through configuration files.

SP Analyst script monitor (installed together with operating system type agents):
- Receives events directly from agent collector.
- Installed with the operating system agent (and so supports Windows, Unix, Linux).
- Is best at running local reactions (e.g. re-start an application).
- Configuration through console graphic interface.

SP Monitor:
- Product dedicated to event management.
- Receive SP Analyst agent events or events from any other source.
- Can run different reaction types (e-mail, send SNMP trap, run command, etc.).
- All configured with the SP Monitor graphic interface.

Solved : Script Monitor: how to let Script Monitor receive alerts through a firewall?

Tue, 13 Oct 2009 13:46:38 +0200

Script Monitor needs to listen to alerts coming from Collectors. For this it uses a communication port, for reception (inward communication, from the Collectors to Script Monitor).

By default, the listening port number of Script Monitor is a dynamically allocated. It means when Script Monitor starts, it looks for a free port on the machine and picks one up. Therefore one cannot know in advance which port number is going to be used. Script Monitor then informs the Collectors of the port it has picked up, and asks the Collectors to send their alerts on that port.

The fact that the port is dynamically allocated is fine at most customer sites. But it is not suitable in case there is a firewall between the Collectors and Script Monitor. Indeed, how to know which port to open on the firewall for alerts to go through? In that case the listening port of Script Monitor can be forced to a fixed value. This way one can know in advance which port to open on the firewall.

Fixing the listening port is done by setting the parameter 'Smd_Port' in the 'COMM' section of the Script Monitor configuration file ('sldsmd.ini').

Solved : Observer: is it possible to configure the same reaction for several alerts without necessarily selecting them all?

Tue, 13 Oct 2009 13:43:56 +0200

Yes, it is possible to select several alerts for a station to be monitored, by entering the names of alerts separated with commas.

Solved : Oracle: Specific measures to be able to analyze an Oracle DataBase with a Sysload agent, when this DB also hosts the Sysload Data Center

Tue, 13 Oct 2009 13:42:42 +0200

During the installation procedure of the agent you will have to specify a different Oracle username from the one used by the DataCenter.

In fact installation is going to erase every user of the specified pre-existent name in the base and then recreate it. It will have for consequence to erase all the objects belonging to this user, meaning all the tables and the other objects of the Datacenter. This is why you should not use the DataCenter Oracle username!!!

Solved : SP Analyst console: Create a generic agent in the console

Tue, 13 Oct 2009 13:38:40 +0200

Manually define a new agent. Select the platform of the agent and set the name of the station to "-".

The purpose of generic agents is to be able to define generic dashboard models (charts only).

How to proceed:

1) Define a dashboard with charts on a real machine
2) Change the dashboard parameters to select the generic machine
3) Save the dashboard

Next time the dashboard model is opened in the console, the generic agent is replaced by the first real agent of the same type found in the central list of agents.

Solved : Oracle: how to send an external alert (coming from a script for example) to an Oracle DB Agent?

Tue, 13 Oct 2009 13:30:29 +0200

Use the sldalert tool delivered with all system agents.

Syntax to send an alert to an Oracle agent is:

sldalert - has oracle-b {* | < database name >}-t < name of alert >-m

This way you can either send an alert to all databases or only to the one you specified (alias given in the Sysload configuration).

Type command �sldalert� without argument to have the detail of the other possible parameters.

Solved : Task Manager: how to schedule a task based on Sysload command lines ?

Tue, 13 Oct 2009 13:28:13 +0200

Such tasks can be schedulded using Sysload Task Manager. Refer to the corresponding paragraph in the User Manual.

Find below an example of the scheduling of a HTML report production :

[PERIODIC_TASK_4]
hourly = every_5min
command_1 = $(SYSLOAD)\Console\console.exe
arguments_1 = -h "$(SYSLOAD)\Console\modeles\services.wks"

It is also possible to schedule a task based on Sysload commands using Windows Scheduled Tasks (2K & XP).

Choose to Add Schedulded Task and select the Observer console as the target application.
Check the "Open advanced properties for this task when I click finish" option .

In the next dialog box modify the "Execute" field by adding the required options and parameters (files to use�) to the command line.

Then refine the scheduling parameters.

Or alternatively use a product like UniJob or a Job Scheduler such as Dollar Universe!

Solved : Observer: how to generate a HTML report in command line?

Tue, 13 Oct 2009 13:25:34 +0200

HTML reports can be produced directly from the command line using the following syntax:

[path to Sysload]\console\console -h report1,report2...

Where report1, report2 refer to existing workspaces. Therefore you have to use the exact name of the workspaces, including the file extension ".wks".

If the workspaces files are stored in another directory than the console.exe file you will have to precise the path to those files.

E.g.:

[path to Sysload]\console\console -h models/services.wks

Solved : Observer: how to directly print a graphical element from the command line ?

Tue, 13 Oct 2009 13:24:34 +0200

Charts, Top windows, for instance, can be directly printed from the command line using the following syntax:

[path to Sysload]\console\console -p model

Where model refers to a chart, a Top window, etc. Therefore you have to use the exact name of the file to be printed, including the file extension .dhb, .top, .arp...

If the files are stored in another directory than the console.exe file you will have to precise the path to those files.

E.g.:

[path to Sysload]\console\console -p models/monitoring_NT.dhb

Solved : All Agents: how to detect a server is down?

Tue, 13 Oct 2009 13:22:57 +0200

Well, when the server is down, maybe the Sysload collector will not be able to send any alert.

To receive an alert when the server is down, you need an external source to detect it. Another server ( B ) has to detect that the server ( A ) is down.

The following can be used to tell the server is down when the Sysload agent on the server is down.

Configure Script Monitor of B to listen to alerts from A. Configure this Script Monitor to write a message into its log file when an agent is not responding. Then configure Log Analyzer of machine B to look at the log file of Script Monitor of B and to send an alert when a line says an agent is not responding.

- Configuration file of Script Monitor ( sldsmd.ini on machine B ):

Maj_node=60
Log_node=1

[STNS]
A (replace by real name or IP address)

- Configuration file of Log Analyzer ( sldlogd.ini on machine B ):

# Script Monitor < 4.81

[FILE]
file=c:\program files\sysload\sldsmd\sldsmd.log
format={%s* pdev - %s not responding %s*}
analyze={$4=* THEN "c:\program files\sysload\sldrmd\sldalert.exe" -t Server -m Server $4 is down}

# Script Monitor >= 4.81
# pdev - Subscribing A, not responding (port=9501)

[FILE]
file=c:\program files\sysload\sldsmd\sldsmd.log
format={%s* pdev - Subscribing %s, not responding %s*}
analyze={$1=* THEN "c:\program files\sysload\sldrmd\sldalert" -t Sysload -p 1 -m Collector not running -s begin -x $5}

Solved : All Agents: What is disk saturation, how to solve that problem?

Tue, 13 Oct 2009 13:12:49 +0200

Disk saturation means the disk is "constantly" accessed: Programs may have to wait before being able to read or write data from/to disk.

Like traffic jams on holidays start / end periods when people go to same desitnations (sea, ski resourts...). To avoid this, people can go to different holiday destinations and this way the traffic will be balanced on the diffent available roads. Or they use motorways, or leave home at different times.

On the server:
- Data can be spread over several disks.
- Disks that have faster access times can be used.
- Or try to run the different programs that access the disks at different times (off-peak periods).

Solved : Unix Solaris Collector - Technical sheet

Tue, 13 Oct 2009 13:07:41 +0200

DISKS

The Solaris agent detects disks of the following types only:
- sd0
- ssd0
- dad0
- cmdk0

Others are not seen.

On the machine where the Solaris agent is running, run the following command:
- 'sar -d 1 1'

One can then see if Collector can see the disks installed on the machine (or SAN).

Solved : All agents: Make a chart on system uptime

Tue, 13 Oct 2009 13:05:40 +0200

Sysload is primarily designed for performance management and does not provide a specific metric on server uptime as such.

Nevertheless there is one way that Sysload can handle it:
- Define an entity of type Application on a process that is always there when the system is up (e.g. entity called 'System' on process 'system.exe' on Windows).
- The metric Application > Uptime for that Application entity can be considered as the uptime of the server.

Solved : All Agents: Communicating with Sysload agents behind a firewall

Tue, 13 Oct 2009 13:04:19 +0200

Communicating with Sysload agents behind a firewall:

- To display information on the console, open the port 9501 (for the System Collector) and 9502 (for File Server).
- To receive alerts, fix the port no. used by the console (keyword "pevt" in section "[EVNT] of the sld.ini file) and open that port in the "agent towards console" direction.

If the security policy does not allow to open the communication in the" agent towards console" direction, then you can use Sysload Alert Gateway,

- For Sysload Token Server, port 9555 has also to be opened in the "agent towards Token Server" direction.

If the security policy does not allow it, then you may use Sysload Token Server Gateway.

Solved : All Agents: how to query a Sysload offline history file?

Tue, 13 Oct 2009 13:02:36 +0200

Install an OS agent on the machine ( A ).

Copy-paste the history files of the other machine ( B ) (.dat + .idx) on the machine A.

Go on the console.

Set up the communication between the agent and the console with "automatic agent declaration".
Set up the communication between the offline agent and the console manually:
- "agent declaration", "New�".
- In the "Setup" tab, enter the type of agent, agent name and IP address.
- Go to "Activities history"
- Select "Remote".
- In "host", enter the name of the agent you have installed and configured previously.
- In "path", enter the full name of the history file (include the directory but forget about the .dat). Example: if the names of the history files are "win_pulsar_off_activity.*" and "win_pulsar_off_activity-top.*", and if you pasted them in the directory called "D:\sysload\agent\history_off\", then you will need to enter "D:\sysload\agent\history_off\ win_pulsar_off_activity".

Now the group can contain both the live agent ( A ) and the offline agent ( B ).

Note that it is highly recommended, to have machines A and B of the same platform.

Solved : All Agents: how to send a mail on an event?

Tue, 13 Oct 2009 13:00:21 +0200

This must be done automatically, so Sysload Script Monitor can be used. Script Monitor can receive the events from the Sysload agents and execute a batch command as a reaction. The batch command can say "send the message of the Sysload event in a mail".

1) On Unix

Unix has a standard OS command to send a mail. This command can simply be used to forward the message of the Sysload event.

e.g. sendmail -t -o -m

2) On Windows

Any program can be used. Blat is a shareware program that can send a mail via a batch command.

e.g. blat.exe -t -server -i

Example with Blat:

Configuration file of Sysload Script Monitor (sldsmd.ini):

[RACT]
:::
cmd /c c:\program files\sysload\sldsmd\sld_mail "Sysload alert - Name = %t - Status = %s" "Message = %m"

Batch file sld_mail.cmd:

echo %2 > c:\tmp\mail.txt
c:\program files\blat\blat.exe c:\tmp\mail.txt -t recipient@company.com -server 123.123.123.123 -s "%1" -i Sysload

Solved : Management Server: Import a list of periods

Tue, 13 Oct 2009 12:28:29 +0200

INTRODUCTION
---

From version 5.00 onwards, SP Analyst console looks for the list of periods in the repository of the default Management Server.

In previous versions of Observer, the enterprise event model used to be stored in the file '\console\periodlist.per'.

PROCEDURE
---

Proceed as follows to import a list of periods from a file into the Management Server:
- Run the SP Analyst console.
- Select the menu 'Environment' > 'Management Servers'.
- Select the default Management Server, i.e. the first one in the list.
- Select the subdirectory 'Console objects'.
- Right-click, select 'Import the list of periods'.

Remark:
- SP Analyst >= 5.00 lists some standard periods in the toolbar (in the 'Change period' buton).
- These can be very easily accessed and are built-in the program.
- They are separate from the list of periods defined in the Management Server.

Solved : Console: Making a Management Server the default Management Server

Tue, 13 Oct 2009 12:23:13 +0200

INTRODUCTION
---

This FAQ is valid from Sysload version 5.00 onwards.

SP Analyst console can connect to several Management Servers.

Nevertheless only the default Management Server is the reference for some console objects:
- Enterprise Event Model.
- Enterprise Entity Model.
- List of periods.
- List of profiles.

The default Management Server is the first one displayed in the list of Management Servers.

PROCEDURE
---

Proceed as follows to make a Management Server the default one:
- Select the menu 'Environment' > 'Management Servers'.
- Select the Management Server that will be the default one.
- Right click, select 'Default Management Server'.

Solved : Agent: Set the mode token lease

Tue, 13 Oct 2009 12:17:51 +0200

INTRODUCTION
---

With Token Server and Collector both on version 5.00 onwards, Collector can start without a connection to Token Server.

This can be particularly useful for servers that are rebooted regularly.

DESCRIPTION OF THE MODE TOKEN LEASE
---

- On the very first start, Collector does need a connection to Token Server to get tokens.
- Collector keeps locally its tokens.
- Collector informs Token Server that those tokens are leased, i.e. Collector will not give them back to Token Server when it stops.
- On the next starts, Collector will use the leased tokens. That means it will not need to connect immediately to Token Server.
- Collector will be able to run without a connection to Token Server for the duration of the grace period of the license key (24 hours by default, 7 days with an extended key).

SETTING UP
---

- Run the SP Analyst console.
- Select the agent to configure in mode Token Lease.
- Select the menu 'Agents' > 'Define the' > 'Collector Analysis parameters'.
- Select the first tab ('Collector Analysis parameters').
- Select the section 'Token Server'.
- Set the parameter 'Token lease' to 'Yes'.
- Click 'Apply all'.

Solved : Management Server: Import a file 'central.ini' into Management Server

Mon, 12 Oct 2009 17:37:41 +0200

In 4.81, the central list of agents is no longer stored in the console installation directory; instead, it is held in the database of the Management Server.

It is possible to automatically import an existing list into this database.

Command:

console.exe -import "central.ini" -mgtserver sldmgts@[Management Server host]:[Management Server port]

Example:

console.exe -import "c:\sysload\console\central.ini" -mgtserver sldmgts@168.0.0.5:9900

Notes:

- The console.exe is the 4.81 one.
- Before beginning the process, the console will prompt for a Sysload login and password in order to connect to the Management Server. It is advised to connect as 'admin' to import the list.
- Depending on the number of agents in the central.ini, the process may last for several minutes.

Solved : Agent: Define Application-type entities by looking at process arguments

Mon, 12 Oct 2009 17:36:26 +0200

Sysload agents can monitor processes by looking at their arguments.

This procedure is valid on Windows and Citrix from agent version 5.00 onwards.

PROCEDURE
---

- Optionally trace what processes are seen by the agent collector. This is done by implementing a debug trace.

- On Windows and Citrix agents, setting up the debug trace is done as follows:
. Stop Sysload Collector service using Windows services control panel.
. Edit the agent ini file. '\sldrmd\sldrmd.ini'
. Locate the [PARAM] section
. Add the following lines:
. Args_MaxNumberOfChar=4096
. Dbg_newortermproc_level=1
. Save the .ini file.
. Start Sysload Collector service using Windows services control panel.
. Wait for a few agent iterations.
. With the trace each process starting or terminating is logged into the Collector log file ('\sldrmd\sldrmd.log'), with its arguments.

- On Unix and Linux agents, setting up the debut trace is done as follows:
. Stop Sysload agent collector ('/sysload.sh stop collector_unix').
. Edit the Collector configuration file ('/coll/conf/sldrmd-init').
. Locate the [PARAM] section
. Add the following lines :
. Args_MaxNumberOfChar=4096
. Dbg_newortermproc_level=1
. Save the file.
. Restart the agent collector ('/sysload.sh start collector_unix').
. Wait for a few agent iterations.
. Now each process starting or terminating will be logged into the agent log file ('coll/sldrmd.log'), along with arguments.

- Define processes with arguments to be monitored.
. Define a new application-type entity.
. Select 'Arg expression reg'.
. Copy the complete argument string found in the collector log file, including quotes.
. Caution: If the agent runs under Windows OS, be sure to replace any character '\' by '\\'.

- Test:
. Do a real time chart on the metric Application > Name of the entity > 'one process at least'.

- Remove the debug trace to avoid collector log file to grow quickly.

Solved : Agent: Activate 1-second interval metrics (Agents for Windows and Citrix, version 5.10 onwards)

Mon, 12 Oct 2009 17:33:45 +0200

INTRODUCTION
---

Agents 5.10 for Windows and for Citrix have new metrics 'Minimum' and 'Maximum' in the domain 'Processor'. In addition to 'total CPU use', those metrics show the minimum and the maximum processor activity in between two iterations of the agent Collector. The new metrics are fetched every second.

PROCEDURE
---

To activate the metrics on an agent:
- Open the SP Analyst console.
- Select an agent.
- Select the menu item 'Agents' > 'Define the' > 'Collector analysis parameters'.
- Select the tab 'Collector analysis parameters'.
- Select the section 'Min max metrics activation'.
- Set 'CPU min max activation' to 'Yes'.
- Click 'Apply all' (evenutally apply to many other agents).

REMARKS
---

When this information is activated the rules for the diagnostic metrics are modified to take it into account instead of default rules.

Solved : Management server: Convert management server repository to SQL Server

Mon, 12 Oct 2009 17:27:48 +0200

INTRODUCTION
---

Since version 5.21 of the management server, the repository can be stored on SQL Server.

Installations made with the standard repository format can be converted to support SQL Server.

PROCEDURE
---

- Stop the management server.
- Backup the current program files and repository file.
- Upgrade management server by running the standard installation program.
. Upgrade to version 5.21.2 minimum.
. The installation program will also upgrade the repository file (if necessary).
- Backup the (upgraded) repository file.
- Uninstall management server with the Windows panel 'Add or remove programs'.
- Install management server (version 5.21.2 minimum) and select SQL Server format during the installation.
- (At this stage management server is set with SQL Server as database support but the database is empty.)
- Run the conversion tool 'sldmsexp.exe' (consult the associated Readme file).
- (At this stage management server is set with SQL Server as database support and the database contains the same information as before.)

REMARKS
---

- SQL Server is supported only when management server is running on Windows.
- Consult management server Readme file for the prerequisites.
- Both Windows authentication and SQL Server authentication are supported.
- The objective of porting the repository to SQL Server may be to set management server in a fail-over cluster with a single database. It shall not be possible to query the database with SQL queries as the the database schema is not designed to be made public).

Solved : Forward agent events by e-mail with Sysload SP Analyst

Mon, 12 Oct 2009 17:25:17 +0200

INTRODUCTION
---

Events triggered by Sysload agents can be forwarded by e-mail.

Alert manager or script monitor can be used as a central module receiving every event of every agent. Filtering can be done.

Sysload SP Analyst does not provide any e-mail client or e-mail command line but the freeware 'blat.exe' can be used as a mail client to send e-mails.

(Sysload SP Monitor has an embeded e-mail client and can send e-mails without any third-party tool.)

EXAMPLE WITH ALERT MANAGER
---

Sample file 'reactions.txt':

*:*:*:*
*
1,2,3,4,5,6,7,8,9,10
begin,end

ADDITIONAL INFORMATION
---

As the double quotes (' " ') are used to delimit the parameter values of the the command 'blat.exe', avoid double quotes in Sysload event messages.

Examples above are valid with 'blat.exe' version 2.6.2.

Blat can be found at http://www.blat.net.

Solved : Forward events to a SNMP console with SP Analyst

Mon, 12 Oct 2009 17:23:20 +0200

INTRODUCTION
---

Events triggered by Sysload agents can be forwarded to a SNMP console.

Alert manager or script monitor can be used as a central module receiving every event of every agent. Filtering can be done.

Sysload command 'sldtrap.exe' can be used to send SNMP traps.

EXAMPLE WITH ALERT MANAGER
---

Sample file 'reactions.txt':

*:*:*:*
*
1,2,3,4,5,6,7,8,9,10
begin,end

Solved : Spotlight: Use and maintain the management server

Mon, 12 Oct 2009 17:20:19 +0200

INTRODUCTION
---

Since its first apparition, the Sysload management server handles more and more objects.

In version 5.21 the management server takes care of:
- Users access rights.
- List of agents.
- Groups of agents.
- Models of events.
- Models of entities.
- Workspaces.
- Dashboards.
- History periods and profiles.

Other objects will appear in future versions (management server version 5.22 will bring agent views; agent views are views on groups of agents defined as server classes, they can replace standard groups of agents and agent meta-groups).

The increasing responsabilities of the management server result in two aspects:
- It has become a critical component of the Sysload infrastructure.
- Its utilization and maintenance requirements have increased.

In order to ensure high availability of the management server, some customers have set it up in a fail-over cluster. Version 5.21 helps this as the repository can be stored on a SQL Server shared between the two nodes of the cluster.

A series of FAQs help in obtaining first level support in order to use and maintain the management server.

(see the full management server version 5.21 user manual)

USE
---

- Make a management server the default one in the SP Analyst console.
- Generate a batch ticket for running the SP Analyst console in batch mode.

MAINTAIN
---

- Upgrade management server.
- Customize the port number used by management server for receiving events from agents.
- Backup management server repository.
- Convert the repository to SQL Server.
- Move management server from one host to another.
- Quickly mount a backup management server.

Solved : Console: Generate an HTML report with the console run in batch mode

Mon, 12 Oct 2009 17:03:48 +0200

HTML reports can be generated by the console run in batch mode.

COMMAND
---

"\console\console.exe" -h -batchticket

Where:
- '' is the Sysload home directory.
- '' is a comma-separated list of workspace objects or files.
- '' is a batch ticket file created by the console.

List of workspaces:
- If using workspace filenames, it is recommended to specify the full path of the file, (including drive and sub-directories), surrounded by double quotes (' " ').
- If using workspace objects stored on a management server, then there is a special syntax.

EXAMPLES
---

# Generate 'Last week' report by using a workspace file:

"c:\program files\sysload\console\console.exe" -h "c:\program files\sysload\console\data\Last week.wks" -batchticket "c:\program files\sysload\console\data\report.tic"

# Generate 'Last month' report by using a management server object:

"c:\program files\sysload\console\console.exe" -h "//coronis/WKS/Last month" -batchticket "c:\program files\sysload\console\data\report.tic"

# Generate 2 reports using a single command:

"c:\program files\sysload\console\console.exe" -h "//coronis/WKS/Server Pluton","//coronis/WKS/Server Mars" -batchticket "c:\program files\sysload\console\data\report.tic"

REMARKS
---

When refering to a workspace object, the name of the management sever is case sensitive. It must be written as seen in the console, in the window 'Environment' > 'Management servers' (i.e. as defined in the management server configuration file ('sldmgts.ini'), section 'General', keyword 'Name').

Use double quotes (' " ') if there are spaces in the path of Sysload program files or data files.

When specifying several workspaces in the workspace list, do not use spaces before or after the commas.

RECOMMENDATIONS
---

1) Convert workspaces in format <= 4.8

Workspace files have changed after version 4.8. It is recommended to convert those to objects stored on a Management Server.
Open the old workspaces with the new console run in graphic mode to proceed to the conversion.

2) Maximize chart windows that are in the workspaces

Console version 4.81 and 5.00 do not manage well dashboards that are minimized. Maximize all windows and eventually select the menu 'Window', 'Cascade'.

3) Remove groups

If the workspaces contain only history views, it is recommended to remove any group and meta-group. This way, no unecessary communication is made with the program Collector on the agents (only communication with File Server is necessary).

4) Limit the number of threads created by the console

In order to avoid congestions on File Server, it is recommended to limit the number of threads the Observer program can create (and hence, the number of concurrent queries made to File Server).

For this, add parameters to the '\console\sld.ini':

[FLAGS]
HstLimitThreadNo=1
HstThreadMaxNo=2

Solved : Console: Generate a batch ticket

Mon, 12 Oct 2009 16:59:45 +0200

INTRODUCTION
---

Before launching the SP Analyst console in batch mode, it is necessary to define models (workspaces, dashboards�) with the SP Analyst console launched in interactive mode.

It is necessary to be logged to a management server to communicate with agents. When logged, the user accesses its working environment (agent list, console objects saved on management server...).

Therefore in batch mode, it is also necessary to connect to the console with a user profile to access console objects and agent list. This way the launched console has the same view as in interactive mode.

For that purpose, Sysload has introduced 'batch tickets'.

A batch ticket is an encrypted file containing the user/password information for each management server, for a given user.

PROCEDURE TO GENERATE A BATCH TICKET
---

To generate a batch ticket:
- Launch the SP Analyst console in interactive mode (graphic interface).
- Log onto each Management Server you need so that your models can be opened
- Select the menu 'Environment' > 'Generate a batch ticket'.
- Give a name to the file that will store the connection information (extension .tic) and save it.

USE A BATCH TICKET IN A COMMAND LINE
---

Once the ticket is generated, it can be used to connect to the management servers in batch mode.

Example:

console.exe -batchticket "c:\sysload\ticket.tic" -h "c:\sysload\foo.wks"

Solved : Agent: Define an event on an application

Mon, 12 Oct 2009 16:04:34 +0200

INTRODUCTION
---

Sysload SP Analyst agents can trigger events regarding an application. The event threshold can be set to a simple availability status (up/down) or set to the amount of the resources used by the application (processor, memory or storage).

This makes the agent very strong in terms of granularity of the information monitored on the production server, whether the server is physical or virtual.

Events can be displayed in the Sysload SP Analyst console or to Sysload SP Monitor.

Before defining the events, it is necessary to define an application-type entity.

PROCEDURE
---

Define entities with the SP Analyst console:
- Select the enterprise entity model where to save the entity.
- Edit the enterprise entity model:
. Define an Application-type entity.
. Attach the entity:
. To one or more agents.
. To one or more agent groups.
- Apply the enterprise model to the agent(s).

Test the entities:
- Make a new real time chart on the entity:
. Select the menu item 'File' > 'New' > 'Chart' > 'Real time chart'.
. Select the agent.
. Select the domain 'Application' and the entity name.
. Select a metric, for example 'number of known processes'.
. Click OK.
- If possible, restart the application to see the value decreasing and increasing.

Define an event:
- Select the enterprise event model where to save the entity.
- Edit the enterprise event model:
. Define an event. Note that the field 'instance' refers to the entity name (not to the process name(s)).
. Attach the event to agents.
. To one or more agents.
. To one or more agent groups.
- Apply the enterprise model to the agent(s).

REMARKS ON ENTITIES
---

- An entity may combine several processes.
- Processes may be defined by a standard comma separated list or by a regular expression.
- Regular expressions consume more resources than standard comma separated list but are more flexible.
- It is possible tracking processes by looking at their arguments (even on Windows).
- After an entity is defined, Sysload will no longer refer to the process(es) name(s) but to the entity name.

BONUS HISTORY DATA
---

After the agent collects additional data on entities, history information will also be available.

This history data may be useful to generate application based reports that help capacity managers allocate resources to applications with the help of Sysload SP Portal.

Solved : Agent: Mount an agent history file offline

Mon, 12 Oct 2009 15:58:00 +0200

INTRODUCTION
---

It is possible to move history files of an agent from the live server to a backup server and still be able to access the data with the SP Analyst console.

Note that the live server and the backup server must be of the same type:
- Same kernel bit (e.g. 32 bits - 32 bits).
- Same order for Most Significant and Least Significant bytes (MSB/LSB).

PROCEDURE
---

- Install an OS agent on the backup machine.
- Start the Sysload File Server on that machine (Collector can remain stopped).
- Copy the history files from the live machine to the backup machine.
- Set up the communication between the SP Analyst console and the agent on the backup machine.
. Go to the menu 'Environment' > 'Management Servers'.
. Select the local Management server and 'Agents'.
. Click on the right-mouse button and select 'New'.
. In the tab 'Setup':
. Go to the field 'Type'.
. Select the type of agent (same as the live agent)
. Go to the field 'Agent'.
. Enter the agent name (same as the live agent).
. In the tab 'Activities history':
. In the frame 'Activities history', select 'Remote'.
. Go to the field 'Host'.
. Enter the host ID (name or IP address) of the backup server.
. Go to the field 'Path'.
. Enter the full name of the history file.
. Include the directory but forget about the file extention '.dat'.
. Example: If the names of the history files are 'pulsar.*' and 'pulsar-top.*', and if they were pasted to the directory called 'D:\sysload\history_off\', then it will be necessary to enter 'D:\sysload\history_off\pulsar'.
. Proceed in the same way in the tab 'Alerts history' to also interrogate the history files of events.

Solved : Management Server: Force the port number used by management server to receive events

Mon, 12 Oct 2009 15:53:12 +0200

INTRODUCTION
---

It may happen that events sent by an agent Collector are not received by a SP Analyst console or in SP Monitor. This may be due to a firewall blocking the network communications between the agent and the management server.

Indeed, by default the management server uses a dynamically allocated port number to listen to events sent by agent Collector programs. This is not suitable with firewalls. The port number can be forced to a fixed value (e.g. 9505).

PROCEDURE
---

- Go to the management server machine.
- Edit the file '/sldmgts/sldmgts.ini'.
- Set the following:

[Listener]
AlertListener=:9505

- (Replace '' above by the host ID to be used - hostname or IP address.)
- (By default there are '#' (hash) caracters in front of the section and keyword above, remove the '#'.)
- Restart the management server.
- Check that the file '/sldmgts/sldmgts.log' contains something like the following:

sldmgts - AlertListener: :9505

- Discuss with the security team in order to open firewalls: open port 9505 in the direction agent (initiator) -> Management Server (receiver).
- Open the SP Analyst console and open a group of servers.
- Check the Collector log file contains something like the following:

Evt - Subscribe 'Console' Pid=2276 from '' (:9505

Solved : Management Server: Import former Sysload console data files

Mon, 12 Oct 2009 15:51:20 +0200

Observer console 4.81 introduces a new format for the data files (.wks, .dhb, .etc.).

When a file in the previous format is opened by the Observer Console 4.81, the user has the choice to either convert the file into 4.81, or to leave it as it is.

If it is decided to keep the old format, the console will be able to use the file, but then it will not be optimized for version 4.81.

After the file is converted, it will no longer be compatible with previous versions of the Observer console.

Solved : Management Server: Quickly mount a backup management server

Mon, 12 Oct 2009 15:50:24 +0200

INTRODUCTION
---

Due to its central position, the management server is a single point of failure.

By default there is no backup management server online, nevertheless a new one can be quickly setup in case of failure.

PROCEDURE
---

- Install a new management server acting as a backup.
- Make sure the parameter 'name' in the configuration file 'sldmgts.ini' is exactly the same on both the primary management server and on the backup.
- Duplicate the original management server repository file.
- Start the backup communication server and management server programs.
- Make the client applications point to the backup management server (section 'SLDMSCOM' of the '\console\sld.ini' for the SP Analyst consoles).

GET READY IN ADVANCE
---

A backup management server may be installed in advance.
- Not running by default.
- But with a repository file kept up to date via an automatic procedure.

Sysload agents and client applications will need to be already aware of this backup management server in their configuration file, e.g. 'console\sld.ini':

[SLDMSCOM]

# Site 1: Online management server
MgtServer_00=sldmgts@168.0.0.1:9900

# Site 1: Backup management server
# MgtServer_01=sldmgts@168.0.0.2:9900

Example: In case the file 'authority.txt' is used, '\sldrmd\sldrmd.ini':

authority=c:\program files\sysload\sldrmd\authority.txt

Sample 'authority.ini':

# Live management server
Ip=168.0.0.5 Auth=rw

# Backup management server
Ip=168.0.0.6 Auth=rw

REMARKS
---

- Do not forget Sysload batch applications, these also need to point to the backup management server.
- Instead of having 2 different IP addresses for the primary and the backup, one may point to management server via an alias in the DNS. Then do a DNS entry change when swaping from the primary to the backup management server.
- Management server may also be set on a fail-over cluster. In this case porting the database on SQL Server will help the management of the cluster (on Windows only, from version 5.21.2 onwards).

Solved : Agent: Define an event with a threshold on a Windows service or process

Mon, 12 Oct 2009 15:43:50 +0200

The Sysload agent for Windows can trigger an event based on a threshold on a metric regarding a Windows service or a process.

Before defining an event on a service or on a process, it is necessary to define a Service-type entity or an Application-type entity.

PROCEDURE
---

The definition of entities is done with the SP Analyst console, menu Environment > Enterprise Entity Model. Define entities, attach entitities to agents and then apply the definition to the agents.

It is then recommended to validate that the entity is correctly defined for example by making a real time chart on a metric of the entity and, if possible, stopping and starting the service or application.

Then an alert can be defined on the Service-type or Application-type entity. This is done as usual with the definition of events but specifing the entity name in the instance field of the definition of the event (the name as seen in Sysload, not the name of the service or process as seen on the server).

Solved : Console: Access workspaces saved on Management Server

Mon, 12 Oct 2009 15:33:57 +0200

From SP Analyst console version 5.00 onwards, workspaces can be stored on Management Server, in the repository file. This way it can be accessed remotely and shared between colleagues easily.

In version 5.00, workspaces can still be saved into a file. Nevetheless, storage on Management Server shall be prefered.

In the recently used files in Observer GUI, workspaces stored on a Management Server are displayed like this:

\\\WKS\

Example:

Workspace "Production" stored on the Management Server 'Coronis':

\\Coronis\\WKS\\Production

Solved : Console: Import an old workspace file into a Management Server repository (Sysload 5.00 onwards)

Mon, 12 Oct 2009 15:32:22 +0200

Workspaces created in a previous version of Observer can be imported into the repository file of a Management Server.

This can be done this way:
- Open the workspace file as in previous versions of Observer (.wks file).
- Select the menu 'Environment' > 'Management Servers'.
- Select the default Management Server, i.e. the first one in the list.
- Select the subdirectory 'Console objects'.
- Right-click, select 'Save the current workspace'.

Alternatively:
- Select the menu 'Environment' > 'Management Servers'.
- Select the default Management Server, i.e. the first one in the list.
- Select the subdirectory 'Console objects'.
- Right-click, select 'Import a workspace' and select a .wks file.

Solved : Management Server: Import a list of profiles into Management Server

Mon, 12 Oct 2009 15:23:13 +0200

From version 5.00 onwards, SP Analyst console looks for the list of profiles in the repository of the default Management Server.

In previous versions of SP Analyst, the list of profiles used to be stored in the file '\console\profilelist.prf'.

PROCEDURE
---

Proceed as follows to import a list of profiles from a file into Management Server:
- Run the SP Analyst console.
- Select the menu 'Environment' > 'Management Servers'.
- Select the default Management Server, i.e. the first one in the list.
- Select the subdirectory 'Console objects'.
- Right-click, select 'Import the list of profiles'.

Solved : Management Server: Import an Enterprise Event Model (Sysload 5.00 onwards)

Mon, 12 Oct 2009 15:21:55 +0200

From Sysload version 5.00 onwards, the SP Analyst console looks for the enterprise event model in the repository of the default Management Server.

In previous versions of the console, the enterprise event model used to be stored in the file 'sysload\console\entevtmodel.eem'.

Proceed as follows to import an enterprise event model defined with a previous version of Observer:
- Select the menu 'Environment' > 'Management Servers'.
- Select the default Management Server, i.e. the first one in the list.
- Select the subdirectory 'Console objects'.
- Right-click, select 'Import the enterprise event model'.

Solved : Management Server: Import an enterprise entity model

Mon, 12 Oct 2009 15:20:48 +0200

From Sysload version 5.00 onwards, the SP Analyst console can manage a central definition of entities.

This way, an entity can be defined once only. It can then be dispatched to different agents. This mechanism is very flexible because it allows to do a fine setup of entities with minimum efforts.

The enterprise entity model is actually stored in the Management Server repository file.

Proceed as follows to create an enterprise entity model:
- Run the SP Analyst console.
- In case the the console is connected to several Management Server modules, make sure the default Management Server is the desired one (the default Management Server is the first one in the list of Management Servers).
- Select the menu 'Environment' > 'Enterprise entity model'.
- Create new entities in the model via the menu 'Entities' > 'Add'.
- Eventually import entities defined in agents via the menu 'Entities' > 'Import from'.

Solved : Console: Match color of events upon severity of event

Mon, 12 Oct 2009 15:19:25 +0200

Since version 5.00 the console can change the way it displays events.

In previous versions of the console, the color of events was dependant upon the state of the event:
- Blue: Event is starting.
- Red: Event is persistent.
- Yellow: Event is ending.

The color can now be dependant on the severity, or priority, of the event:
- Red: 1 <= Severity <= [High Limit].
- Yellow: [High limit] < Severity <= [Medium limit]
- Blue: [Medium limit] < Severity.

[High limit] and [Medium limit] are defined in the configuration file of the console ('sysload\console\sld.ini'):

[EVNT]
HighPriorThreshold = 20
MediumPriorThreshold=50

# [EVNT].HighPriorThreshold: [High Limit]
# [EVNT].MediumPriorThreshold: [Medium limit]

In order to switch the display mode, select the menu 'Environment' > 'Display alerts by priority'.

Solved : Forward events triggered in SP Analyst by email

Mon, 12 Oct 2009 10:46:06 +0200

Forward by email the events triggered in SP Analyst, with Sysload Alert Manager

The sending of emails with Alert Manager requires to modify the reaction definition file.
This means working on the file "reactions.txt" located in "C:\Program Files\Sysload\sldald"

Adding reaction
There is a default reaction already defined in the file.
The idea is is to add a reaction in the file so the file will look like this:

Default reaction

Reaction for sending emails

Reaction details
In the details the email sending reaction could look like this:

*:*:*:*

begin,persist,end

Command line to send emails

Command details
The command line could be the following one:

This example is based on the use of blat.exe, a small program used to send emails in command line.

As the double quotes (") are used to delimit the parameter values of the the command 'blat.exe', avoid double quotes in Sysload event messages.

Examples above are valid with 'blat.exe' version 2.6.2.
Blat can be found at http://www.blat.net.

More variables
The following variables can be used in the definition of the commands:

%ms
Management Server name. Name as defined by the parameter �name� in the configuration file of Management Server, which is not necessarily the host name of the machine, case sensitive

%c
Agent type. The types known by Alert Manager are those set in the file �agenttypes.txt� in the installation directory of Alert Manager

%n
Agent server hostname. Name as defined in Management Server, case sensitive

%ai
Agent instance name. Empty string in case the agent has no instance

%nai
Agent server hostname followed by the agent instance name in brackets if the instance exists. Example: galactica(base1)

%a
IP Address of the agent server

%t
Alert name

%x
Alert instance name

%tx
Alert name followed by the alert instance name if the last one exists

%p
Alert priority

%s
Alert status

%d
Date at which the alert was triggered

%Vn
Value of the condition n of the Sysload alert

%vn
Value of the condition n of the Sysload alert followed by the context in brackets if the context exists.

%vcn
Context of the condition n of the Sysload alert

%ln
Threshold of the condition n of the Sysload alert

%i
Duration of the alerts in number of iterations of the Sysload Collector

%m
Alert message

%Y
Year (yyyy) at which the Sysload alert was triggered

%M
Month (mm) at which the Sysload alert was triggered

%D
Day (dd) at which the Sysload alert was triggered

%H
Hour (hh) at which the Sysload alert was triggered

%I
Minute (mm) at which the Sysload alert was triggered minute

%S
Second (ss) at which the Sysload alert was triggered