WhatsUp Monitor

The WhatsUp Monitor watches for reports on availability of hosts and services that are issued by WhatsUp Gold, a discovery and monitoring tool for TCP/IP, IPX, and NetBIOS networks.

Usage Guidelines

Use the WhatsUp Gold Monitor to monitor the current condition of hosts and services in a given network. it allows the user to define the network topology by creating network maps and then specify their physical and logical connections. With SiteScope doing this for you at set intervals, you can eliminate the need to scan the logs manually. In addition, you can be notified of warning conditions that you might have otherwise been unaware of until something more serious happened.

The SiteScope WhatsUp Gold Monitor receives alerts from the WhatsUp logs. Thus it must have network access to the machine where the WhatsUp Gold logs are stored. The logs can be accessed using the Log File Pathname if WhatsUp Gold is running on the same machine as SiteScope (not recommended), or through a UNC path if WhatsUp Gold is running on a remote NT/2000 machine. When using a UNC path, the root directory on the remote machine in that path must be shared. To monitor on a remote UNIX machine, define a UNIX remote to the WhatsUp machine and then select that machine using the Server selection link.

Completing the WhatsUp Monitor Form

To display the WhatsUp Monitor Form, either click the Edit link for an existing WhatsUp Monitor in a monitor table, or click the add a Monitor link on a group's detail page and click the Add WhatsUp Monitor link.

Complete the items on the WhatsUp Monitor Form as follows. When the required items are complete, click the Add Monitor button.

Server

Select the server where the WhatsUp log files you want to monitor are located. Use the choose server link to access a list of remote UNIX servers that have been specified to SiteScope.

Log File Pathname

Enter the pathname to the log file you want to monitor. The WhatsUp log files generally have the filename format of EV-yyyy-mm-dd.tab. For reading log files on remote UNIX machines, the path must be relative to the to the home directory of UNIX user account being used to login to the remote machine. See the Preferences - Remote UNIX page for information on which UNIX user account is being used. For monitoring log files on a remote NT machine, you can access log files on remote Windows NT/2000 servers by including the UNC name as part of the Log File Pathname. For example, \\NTmachinename\sharename\EV-yyyy-mm-dd.tab.

Note: If you are using SSH as a connection method to remote NT servers, you will need to select the remote server using the Choose Server link above. It is not necessary to select a remote NT server if you are using NetBIOS to connect to remote NT servers.

Optionally, you can use a regular expression to insert date and time variables
For example, you can use a syntax of s/EV-$Year$-$0month$-$0day$.tab/ to match the date-coded WhatsUp log file names.

Run Alert

Choose the method for running alerts for this monitor. If the for each log entry matched option is chosen, then the monitor triggers alerts for every matching entry found and the monitor will remain "good". If the once, after all log entry have been checked option is chosen, then the monitor counts up the number of matches and then triggers alerts based on the Error If and Warning If thresholds defined for the monitor.

Note: When the WhatsUp Monitor is run in the for each event matched alert method, the monitor will never report a status of error or warning, regardless of the results of the content match or even if the target log file is not found.

Content Match

Enter the text to look for in the log entries. Regular expressions may also be used in this box to match text patterns. Unlike the content match feature of other SiteScope monitors, the WhatsUp Monitor content match is run repeatedly against the most recent content of target log file until all matches are found. This means the monitor not only reports if the match was found but also how many times the matched pattern was found.

The default content matching monitors the log file for four types of alerts:

service is down (default severity warning)
service is up (default severity normal)
host is down (default severity critical)
host is up (default severity normal)

Update every

Select how often the monitor should read the WhatsUp log file. The default interval is to run or update the monitor once every 10 minutes. Use the drop-down list to the right of the text box to specify another update interval in increments of seconds, minutes, hours, or days. The update interval must be 15 seconds or longer.

Title

Enter a title text for this monitor. This text is displayed in the group detail page, in report titles, and other places in the SiteScope interface. If you do not enter a title text, SiteScope will create a title based on the host, server, or URL being monitored.

Advanced Options

The Advanced Options section presents a number of ways to customize monitor behavior and display. Use this section to customize error and warning thresholds, disable the monitor, set monitor-to-monitor dependencies, customize display options, and enter other monitor specific settings required for special infrastructure environments. The options for this monitor type are described below. Complete the entries as needed and click the Add or Update button to save the settings.

Disable

Check this box to temporarily disable this monitor and any associated alerts. To enable the monitor again, clear the box.

Enable EMS Integration

Check this option to have all detected WhatsUp events forwarded to Topaz.

EMS configuration file path

Enter the path to the EMS integration configuration file. The default location is: SiteScope\ems\NetCool\main.config.
For more information about format of the file see EMS Generic Alert Probe Configuration.

Rules File Pathname

Optional: In rare cases, it may be necessary to create a custom rules file to specify the log entries to match and the alerts to send. An example rules file is located in <SiteScope install path>/SiteScope/Classes/CustomMonitor/test.rules. Make a copy of this file and rename it. There is no required naming convention. Open the file with the editor of your choice, and using the comments as a guideline, edit the file to meet your needs. When you are finished, type the full path name to your rules file in this box.

No Error on File Not Found

Check this box if you want this monitor to remain in GOOD status, if the file is not found.

Verify Error

Check this box if you want SiteScope to automatically run this monitor again if it detects an error. When an error is detected, the monitor will immediately be scheduled to run again once.

Note: In order to change the run frequency of this monitor when an error is detected, use the Update every (on errors) option below.

Note: The status returned by the Verify Error run of the monitor will replace the status of the originally scheduled run that detected an error. This may cause the loss of important performance data if the data from the verify run is different than the initial error status.

Warning: Use of this option across many monitor instances may result in significant monitoring delays in the case that multiple monitors are rescheduled to verify errors at the same time.

Update Every (on error)

You use this option to set a new monitoring interval for monitors that have registered an error condition. For example, you may want SiteScope to monitor this item every 10 minutes normally, but as often as every 2 minutes if an error has been detected. Note that this increased scheduling will also affect the number of alerts generated by this monitor.

Schedule

By default, SiteScope monitors are enabled every day of the week. You may, however, schedule your monitors to run only on certain days or on a fixed schedule. Click the Edit schedule link to create or edit a monitor schedule. For more information about working with monitor schedules, see the section on Schedule Preferences for Monitoring.

Monitor Description

Enter additional information about this monitor. The Monitor Description can include HTML tags such as the <BR> <HR>, and <B> tags to control display format and style. The description will appear on the Monitor Detail page.

Report Description

Enter an optional description for this monitor that will make it easier to understand what the monitor does. For example, network traffic or main server response time. This description will be displayed on with each bar chart and graph in Management Reports and appended to the tool-tip displayed when you pass the mouse cursor over the status icon for this monitor on the monitor detail page.

Depends On

To make the running of this monitor dependent on the status of another monitor or monitor group, use the drop-down list to select the monitor on which this monitor is dependent. Select None to remove any dependency.

Depends Condition

If you choose to make the running of this monitor dependent on the status of another monitor, select the status condition that the other monitor or monitor group should have in order for the current monitor to run normally. The current monitor will be run normally as long as the monitor on which it depends reports the condition selected in this option.

List Order

By default, new monitors are listed last on the Monitor Detail page. You may use this drop-down list to choose a different placement for this monitor.

Error if

Set an error threshold for this monitor. The thresholds are used when the "Run Alerts: once, ..." option is chosen. By default, an error is signaled whenever there is one or more matching events. Select a comparison value from the list, and use the comparison operator list to specify an error threshold such as: >= (greater than or equal to), != (not equal to), or < (less than).

The possible comparison values are:

matches - the number of matches found.
lines - the number of lines processed.
lines/min - the number of lines per minute processed during this monitoring period.
matches/min - the number of matches per minute that occurred during this monitoring period.

Warning if

Set the Warning threshold for this monitor. The default is to generate a warning if SiteScope is unable to read the log file. The symbols in the comparison value drop-down list are the same as those for Error if.

Good if

The default is to mark the monitor as good if the log file can be read and there are no matches.