Cluster Manager

Add Peer

Allows you to queue the new peer for integration, then click Add Peer to add the new peer to the cluster. This works in conjunction with the Integration tab found at the appliance level on the Cluster Manager. When you want to add a new appliance to your cluster as a new peer, you start the integration process on the new appliance and finish the integration process on an appliance that is already in the cluster.

See the Integration section later in this chapter for instructions on how to add a new peer to your cluster.

Remove Peer

Caution should be used when considering the use of this feature.

This feature should only be considered when the peer is acting in a way that is adverse to the overall cluster functionality or performance. In a Hot Standby Appliance peer pair, if you click this button you remove both appliances in the peer.

The following statements assume that the peer is still functional enough to continue to appropriately run the SevOne NMS software.

• All devices polled by the peer are not removed from the peer and are not distributed to other peers. These devices are inaccessible from the peers that remain in the cluster.

• Data is not removed from the peer you remove from the cluster.

• After you agree to the confirmation prompts, there is no way to cancel the peer remove process.

• The removed peer no longer appears in the hierarchy on the Cluster Manager.

• The peer removal is bi-directional which means the removed peer is excised from the net.peers table and the removed peer attempts to change its cluster master to itself. If the removed peer is partially or totally unresponsive, this function restricts MySQL access to remove the affected peer from the cluster master.

Clear Failed

Allows you to remove peer add failure messages from the list.

View Cluster Logs

Allows you to view the logs of the integration messages.

Alerts

The Alerts subtab enables you to define alert settings that affect Alerts page and related pages workflows.

1. In the Alert Duration field, enter the number of days' worth of alert information to store (between 0 and 365). The default is 90.

2. Select the Acknowledge Alerts for Disabled Objects check box to clear alerts for objects that you disable.

3. Select the One Trap per Alert check box to send only one trap per alert. Leave clear to send a trap every time a threshold triggers, even if an alert already exists.

4. Select the Show Alerts in Title check box to display the number of alerting devices and the highest alert severity level in the web browser tab.

5. Click the Alerts Refresh Time drop-down and select the frequency at which to refresh the Alerts page display. For large clusters that trigger many alerts, you should consider setting this higher than the 30 second default setting. The Alert engine runs every three minutes to trigger alerts and you cannot configure the alerts engine via the UI.

6. Click the SevOne NMS Trap Revision drop-down and select 1 for revision one traps or select 3 for revision three traps or select 4 for revision four traps. This defines what trap data SevOne NMS sends to your fault management system. If you change this you will need to update how your fault management system receives traps from SevOne NMS. See the Trap Revisions chapter for details.

7. Select the Use Cached Tables For Alert Reporting check box to use a cached version of the table to reduce read contention.

8. Select the Do not trigger alerts for disabled devices check box to prevent alerts from being generated for devices that polling has been disabled for (on the Device Manager page).

9. Click Save to save the Alerts settings.

Baseline

The Baseline subtab enables you to define how to create baselines. Baselines are used in report workflows and policy/threshold workflows.

Exponential Smoothing: SevOne NMS uses a rolling average formula known as Exponential Smoothing for baseline calculation. This uses the scalar value of the previous average and the newly collected value to compute the new average. There is no reliance on the actual data points collected during the previous <n> weeks.

The value of (old weight / (old weight + new weight)) is the smoothing factor. The smoothing factor affects the resistance to change that new data has on a baseline. This value ranges between 0 and 1 and a higher smoothing factor causes a greater resistance to change.

As the smoothing factor approaches 1, the impact of each new value on the existing baseline approaches zero. This approach calculates the average and the standard deviation. No trending (slopes) is considered in the calculation as each baseline data point is computed individually.

1. In the Granularity field, enter the granularity of a baseline in seconds. The default is 900 seconds (15 minutes) which takes all data during a 15 minute time span, averages the 15 minutes' worth of data, and stores that average data point for every 15 minutes of the week for a total of 672 data points in order to create baselines. The minimum value is 240 seconds (4 minutes) and maximum value is 3600 seconds (60 minutes or 1 hour).

2. In the Baseline Weight field, enter the weight to apply to existing baselines (between 1 and 52). The default is 10. A larger number here reduces the impact of new data on the baseline.

3. In the New Data Weight field, enter the weight to apply to new data (between 1 and 52). The default is 1. A larger weight here causes new data to change the baseline faster.

4. Click Save to save the Baseline settings.

Devices

The Devices subtab enables you to define device definition settings for the Device Manager and related workflows.

1. Select the Prevent Duplicate IP Addresses check box to prevent the addition of a device with an IP address that is already in SevOne NMS.

2. Select the Discover Trap Destinations check box to discover trap destinations on devices.

3. Click the Propagate child rules up to the parent drop-down and select one of the following options. The default is Prompt.

   • Don't allow. Do not allow child rules to propagate up to the parent.

   • Prompt. Will prompt you whether to allow child rules to propagate up to the parent.

   • Automatically. Automatically propagate child rules up to the parent.

4. In the Device Names section:

   1. Select the Resolve Device Names check box to update the device IP address to the resolved address. If you do not enter the correct IP address when you add a device (or an IP address changes) and DNS can resolve the device's name, the device IP address in SevOne NMS updates upon discovery.

   2. Select the Lookup Hostnames check box to rename devices whose names are IP addresses to their hostname. If you enter an IP address as a device name and DNS can resolve the IP address, the device name in SevOne NMS changes from the IP address to the device's hostname upon discovery.

   3. Select the Lookup SysNames check box to rename devices whose names are IP addresses to their sysName. If you enter an IP address as a device name and DNS cannot resolve the device name or you do not select the Lookup Hostnames check box, the device name in SevOne NMS changes to the SNMP sysName upon discovery, if possible. The device name updates during discovery only if the current name is an IP Address. This check box does not cause the device name to change in SevOne NMS if you change the sysName on the device, in which case you must manually change the device name in SevOne NMS.

   4. Select the Force Hostnames check box to use DNS to change all device names to their host names if DNS can resolve the device name.

5. In the Device Name Masks section, view the device name masks you define to mask (hide) device names.

   1. Click Add to add a row to the list.

   2. In the text field, enter a valid Perl regular expression.

   3. Click Update.

   4. Repeat to define the list of expressions.

   5. Click the arrows to move the expression up or down in the list to arrange the sequence of expressions. The mask process stops when a match is found.

6. In the Device Deletion Queue Information section:

   About Device Deletion Queue

   The Device Deletion Queue is a tool to safeguard device data from accidental deletion. By hiding & disabling devices that are added to the queue, devices are effectively removed from service without their historical data being deleted. When devices are deleted accidentally or unexpectedly, the absence of these devices from reports and alerts is often enough for users who rely on them to contact an administrator to communicate that there is a problem. An administrator may remove devices from the deletion queue to return them into service. While historical data, alerts and Device & Object group references to these devices in reports are maintained, there will be a data gap between the time the device was put into the queue and the time it was removed. Administrators may expedite deletion of devices from the queue on a per-device basis or by reducing the number of days devices are maintained in the queue before their permanent deletion.

   This has been introduced in SevOne NMS 5.7.2.24.

   1. Click the Days to delay drop-down to select the timespan to delay the deletion of the devices in the queue by the number of days entered in this field. The default value is 0 days. The minimum value is 0 days and maximum value is 31 days.

      If Days to delay field is set to 0 days, then the device(s) in the deletion queue are marked for immediate deletion. This is to preserve the pre-existing behavior and allow the feature to be turned off.

   2. Select the Disable Devices check box to disable objects, polling, and alerting for the devices in the deletion queue.

      This setting applies only for the new devices added to the device deletion queue.

   3. Select the Hide Devices check box to hide devices queued for deletion from various reports such as, Device, Metadata, Topology, Performance Metrics, TopN, etc., in the user interface. These devices are not visible from Report Manager or Instant Graphs but their device summary is visible.

7. In the Time Information section:

   1. Click the Default Date Format drop-down and select the date format to use by default. Each user can override this setting from the Preferences page.

   2. Click the Default Time Zone drop-down and select the time zone to appear by default in all device specific Time Zone fields.

   3. In the Time Zone Filter field, select the check box next to each country for which you want time zones to appear available for selection from the Time Zone drop-down lists. You must select at least one country time zone.

8. Click Save to save the Device settings.

Discovery

The Discovery subtab enables you to define the way device discovery works to find the objects to poll.

1. Click the Device Note Severity Level drop-down and select the severity level at which to create device notes during discovery.

2. In the Thread Pool section:

   1. In the Low Priority Size field, enter the number of low priority devices to simultaneously discover (between 1 and 100). Automatic discovery is low priority. The default is 3, which is usually ideal for most implementations. There is a maximum thread pool of 100 devices that can be simultaneously discovered. More threads use more CPU and RAM, so you should reduce this number and/or the High Priority Size number if you notice system slow down.

   2. In the High Priority Size field, enter the number of high priority devices to simultaneously discover (between 1 and 100). The default is 3. User initiated discovery is high priority.

3. In the Missing Objects section:

   When an indicator is discovered and you disable that Indicator Type from Administration > Monitoring Configuration > Object Types, the setting that determines when it will be removed from the report creation selection (for example, choosing indicators for an object in the Performance Metric Graph) is the Days until Deleted field.

   Although the setting is for missing objects, the same applies for its indicators. If you add a new device and you have already disabled the Indicator Type from Administration > Monitoring Configuration > Object Types, the new device will not discover this indicator and it will not be available in the Instant Graph selection under your object.

   1. In the Days Until Disable field, enter the number of days to wait before an object that is not found during a successful plugin-specific discovery is marked disabled (between 0 and 9999). The default is 2. Enter 0 (zero) to disable missing objects as soon as SevOne NMS determines an object is missing.

   2. In the Days Until Deleted field, enter the number of days to wait before an object that is not found during a successful plugin-specific discovery is deleted (between 0 and 9999). The default is 31. Enter 0 (zero) to delete missing objects (and all associated data) as soon as the object is determined to be missing. The value you enter in the Time Until Delete field must be greater than the value you enter in the Time Until Disable field.

      Individual xStats indicators that have stopped transmitting data are subject to be disabled and deleted pending the Days Until Disable and Days Until Deleted field settings. Previously, all indicators would remain regardless of their individual status as long as their object had any activity.

4. In the Administrative Status section:

   1. In the Enable Up Objects field, enter the number of days to wait before an object that is administratively up is enabled (between 0 and 9999). The default is 0. Enter 0 (zero) to not use this feature.

   2. In the Disable Down Objects field, enter the number of days to wait before an object that is administratively down is disabled (between 0 and 9999). The default is 0. Enter 0 (zero) to not use this feature.

5. In the Operational Status section:

   1. In the Enable Up Objects field, enter the number of days to wait before an object that is operationally up is enabled (between 0 and 9999). The default is 0. Enter 0 (zero) to not use this feature.

   2. In the Disable Down Objects field, enter the number of days to wait before an object that is operationally down is disabled (between 0 and 9999). The default is 3. Enter 0 (zero) to not use this feature.

   3. Select the Preserve Max Values check box to prevent SevOne NMS from using the settings it discovers from objects that are operationally down.

6. In the Universal Collector section:

   1. In the Days Without New Data Until Objects/Indicators Are Treated As Missing field, enter the number of days that need to pass after the last data for an Object/Indicator before SevOne NMS starts treating it as missing during the routine Discovery. The minimum value that SevOne NMS allows is 1.

7. Click Save to save the Discovery settings.

Duration

The Duration subtab enables you to define how long to store data. You should consult with a SevOne Support Engineer before you change these settings to discuss the potential consequences of these changes.

1. In the Device History Duration field, enter the number of days to store Debug severity level device history. Info severity level history is stored for twice as long, Notice severity level history twice that, and so forth. The minimum value is 1 day and maximum value is 99 days. The default value is 7 days.

   Example

   Each log entry has an associated level (or severity) that follows the syslog standard. The higher the severity of the log, the longer it is kept. It follows the exponential model; low-level entries are trimmed.

   Log Level	Duration
   DEBUG	1 x <time> = 7 days
   INFO	2 x <time> = 14 days
   NOTICE	4 x <time> = 28 days
   WARNING	8 x <time> = 56 days
   ERROR	16 x <time> = 112 days
   CRITICAL	32 x <time> = 224 days
   ALERT	64 x <time> = 448 days
   EMERGENCY	128 x <time> = 896 days

   where, <time> is 7 days.

   Optionally, device history duration can be set using the command line interface script.

   Command Line Interface command

   $ /usr/local/scripts/SevOne-act trim device [ARGUMENTS]

    

    

   Arguments

   --wait-duration (Optional) This is how long to wait between cleaning up device logs

   Default: 0

   --server-id (Optional) This is the peer id to run the script on

   Default: 1

   --short-term-logs-duration(Optional) This is how long to hold on to the short term logs, in seconds

   Default: 604800

   --emergency-purge (Optional) Emergency purge. Force removing of old data with base 1 day for debug logs.

   In case of emergency, you may run the script with argument --emergency-purge which automatically sets device history duration to 1 day. This results in 7x reduction for all device notes.

   Command Line Interface command with --emergency-purge argument

   $ /usr/local/scripts/SevOne-act trim device --emergency-purge

   Log Level	Duration
   DEBUG	1 x <time> = 1 days
   INFO	2 x <time> = 2 days
   NOTICE	4 x <time> = 4 days
   WARNING	8 x <time> = 8 days
   ERROR	16 x <time> = 16 days
   CRITICAL	32 x <time> = 32 days
   ALERT	64 x <time> = 64 days
   EMERGENCY	128 x <time> = 128 days

   where <time> is 1 day.

   In comparison to Plugin Longterm data, Device Notes data is with low priority. The cron job is scheduled to run every day at 00:05 (GMT), an hour before Plugin Longterm Trim process execution.

   5 0 * * * root /usr/local/scripts/SevOne-act trim device --log-timestamp --log-start-stop 2>&1 | logger -t SevOne-act-trim-device

   If Plugin Longterm Trim is invoked manually with --emergency-purge argument, Device Notes Trim will first be called internally with the same arguments. In this case, more disk space will be reserved for the Plugin Longterm data. Only one instance of the process runs at a time.

2. In the Logged Trap Duration enter the number of days to store logged traps for display on the Logged Traps page. The minimum value is 1 day and maximum value is 365 days. The default value is 7 days.

3. In the Unknown Trap Duration field, enter the number of days to store unknown traps for display on the Unknown Traps page. The minimum value is 1 day and maximum value is 365 days. The default value is 1 day.

4. Click Save to save the Duration settings.

Email

The Email subtab enables you to define the email server that SevOne NMS uses to email reports and alerts.

1. In the Email Server field, enter the host name or IP address of the SMTP email server for SevOne NMS to use to send emails.

2. In the Username field, enter the user name SevOne NMS needs to authenticate onto the email server.

3. In the Password field, enter the password SevOne NMS needs to authenticate onto the email server.

4. In the Email Sender field, enter the email address to appear as the sender of the emails. This must have a valid email address format.

5. In the Email Sender Name field, enter the name to appear as the sender of the emails.

6. In the Alerts Email Subject field, enter the text to appear in the Subject line of alert emails. When you leave the Multiple Alerts Per Email check box clear, this field supports the variables listed below.

7. In the Reports Email Subject field, enter the text to appear in the Subject line of report emails. Supports the following variables: $name - Report name, $id - Report ID

8. Select the Multiple Alerts Per Email check box to place multiple alerts in the same email. Leave clear to receive each alert in a separate email. If you select this check box, the Alerts Email Subject does not include variables.

9. Select the Email Cleared Alerts check box to send an email when an alert clears.

10. Click the Connection Security drop-down and select a connection security protocol.

11. In the Port field, enter the port number on the email server for SevOne NMS to use.

12. Select the Compress Emailed Reports check box to compress the size of email attachments. Perform the following steps if you select this check box.

    1. In the Compress Reports Larger Than field, enter the minimum report size to compress. All smaller reports are not compressed. Enter 0 (zero) to compress all emailed reports.

    2. In the Image Quality field, enter how much to compress images (between 1 and 10). 10 = no compression, and the best quality and 1 = more compression and less quality. The default is 10.

13. Click Send Test Email to send a test email to the email address you associate to your user profile from the email sender through the email server.

14. Click Save to save the Email settings.

Alerts Email Subject Supported Variables

• $severity - Alert severity in text form

• $severityNum - Alert severity in numeric form

• $deviceId - ID of the alerting device

• $deviceIp - IP of the alerting device

• $deviceName - Name of the alerting device

• $deviceAltName - Alternate name of the alerting device

• $alertId - Alert identifier in numeric form

• $occurrences - Number of alert occurrences in numeric form

• $objectName - Name of the object that triggered the alert

• $objectAltName - Alternate name of the object that triggered the alert

• $thresholdId - Threshold identifier in numeric form

• $alertType - Type of the alert

• $threshold - Name of the threshold

• $policyId - Policy identifier in numeric format

• $policyName - Name of the policy

• $groupName - Device/Object Group name of the policy

• $message - Threshold trigger message

• $firstSeen - Time of the first alert.

• $lastSeen - Time of the last alert

• $assignedTo - Name of the user to which the alert is assigned

• $singleAlertMsg - Combination of severity and device name with format " - $severity: $deviceName"

Firewall

The Firewall subtab enables you to select the firewall service for the cluster. Click the check box to confirm and enable the firewall settings for the cluster. By default, it is disabled.

Click on Open Port to add a firewall port and click on Remove Port to remove user-added ports only.

FlowFalcon

The FlowFalcon subtab enables you to define how to collect and process raw flow data and aggregated flow data. An example at the end of this section sums up many of the following settings.

1. * Select the Store Raw Flow check box to collect and store raw flow data. Most FlowFalcon views use raw data which provides more specificity in the result set at the tradeoff of longer report execution times and less historical data availability.

2. * Select the Store Aggregated Flow check box to collect and store the most relevant flow data in an aggregated format that aggregated FlowFalcon views use for faster report execution times.

3. * In the Raw Flow Duration field, enter the number of days' worth of raw flow data to keep. Gigabytes of raw flow data can accumulate quickly. You define aggregated flow duration on the Cluster Manager at the peer level as described later in this topic. The minimum value is 0 days.

4. * In the Raw Flow Data Size field, enter the maximum amount of disk space to allocate for raw flow data. The minimum value is 0 GB.

5. * In the Write Interval field, enter the number of seconds to collect flow data before creating a flat file and writing the data to the disk (between 60 and 300). The default is 60, which is recommnded. A longer write interval results in fewer (but larger) flat files for raw data and smaller tables for aggregated data. See example below.

6. Select the Drop Long Flows check box and enter the maximum number of seconds to consider flow data "long" in the Max Flow Duration field (between 60 and 600). The default is 120. This drops flows when the flow's duration exceeds the write interval. Long flows are usually due to improper router configuration. This setting triggers an administrative message that appears upon log on to inform you to review the router configuration. Suggested Max Flow Duration is ~2x the Write Interval from the previous step.

7. Select the Enable MPLS Attribute Mapping check box and enter the number of seconds for how frequently to read the map files and to refresh the mapping in the MPLS Attribute Mapping Refresh Interval field. This enables you to map v9 NetFlow template data from core "P" routers for reports that use the following fields in FlowFalcon views: 45050: Customer Client IP, 45051: Customer Client Subnet, 45052: Customer VRF Name, 45053: Customer Application IP, 45054: Customer Application Subnet, 45055: PE Ingress IP, and 45056: PE Egress IP.

   Map files are customer-specific. The MPLS Flow Mapping page enables you to upload the two required map files into SevOne NMS.

8. * In the Aggregation TopN field, enter the number of results (between 50 and 1000) to store for each aggregation per each write interval. This consumes disk space and is the maximum number of individual results that an aggregated FlowFalcon view can display. The default value is 100.

   Warning: Setting a value greater than the default may result in data loss.

9. In the Hide Inactive field, enter the number of days (minimum 1) to display data for an inactive device or interface before the device or interface is considered inactive and its information is hidden. The default is 14. A device or interface is considered inactive if it does not send data to SevOne NMS.

10. In the Purge Inactive field, enter the number of days (minimum 0) to store data for an inactive device or interface. The default is 0. Enter 0 (zero) to never purge data.

11. In the Incoming Port field, enter the port number on the SevOne appliance to listen for flow traffic.

12. Click the Raw Data Compression drop-down and select a method for compressing raw data files. Greater compression requires less storage but results in higher CPU usage.

13. Select the Display Flow Sample Rates check box to display the sampled flow rate on FlowFalcon reports that contain split interfaces and to display an additional column on the Flow Interface Manager for sampled data. FlowFalcon reports with sampled data display a message. Interfaces that are not sampled use a sample rate of 1X.

14. Select the Create Egress Records When Not Available check box to automatically create egress records for ingress interfaces that do not receive egress records. Leave clear if your devices support both ingress and egress interface flow export. This does not affect how SevOne NMS handles NetFlow v5.

15. Select the Create Ingress Records When Not Available check box to automatically create ingress records for egress interfaces that do not receive ingress records. Leave clear if your devices support both ingress and egress interface flow export. This does not affect how SevOne NMS handles NetFlow v5.

16. Select the NAT Support check box to enable support for routers behind network address translation (NAT).

17. Click Save to save the FlowFalcon settings.

General

The General subtab enables you to define general system settings.

1. Click the Log Entry Severity Level drop-down and select the severity level at which to write to the log file. Select a lower severity level to generate more log data. This setting is primarily for use by SevOne Support Engineers.

2. Click the Search Behavior drop-down and select one of the following options:

   • Default. Searches with special characters are exact searches. Searches without special characters are wildcard searches.

   • Never Exact. All searches are wildcard searches.

   • Always Exact. All searches are exact searches.

3. Select the Override Precisioncheck box to specify the level of precision. Data typically rounds to two decimal places. Select this check box and enter the number of decimal places to which to round data (between 0 and 6). The default is 0. Most report workflows enable you to define the precision for each report.

4. In the Peer Status Cache field, specify the number of seconds between updates to the peer availability cache. SevOne advises against entering 0 or high values (anything over 60 seconds) without first contacting SevOne. (A cache invalidation setting of 0 will not rebuild the cache.) The minimum value is 0 seconds and the maximum value is 999999 seconds .

5. Select the API Weekend Work Hours check box if you use the SevOne NMS API and your work hours include weekends.

6. Select the Measure System Uptime check box to populate the Deferred Data plugin for each device with a system object and a SysUpTime indicator that contains the normalized data. The deferred data SysUpTime is the true representation of the devices uptime as SevOne NMS derives from polls every 15 minutes. Each poll collects data for the past 7 days. System uptime is the length of time a device has been up without any downtime (loss of connection to the device can appear as downtime).

7. Select the Reports Restricted By Default check box to restrict access to new reports. You can override this setting for each report on the Report Properties.

8. Select the Use WebKit to PDF check box to use WebKit to render .pdf reports. WebKit integration is a beta feature but has proven to generate more presentable .pdf's. NOTE: If a Performance Metrics Report is added with more than 25 indicators (which are in single-row table) along with the graph, the report will shrink-to-fit on the page.

9. Select the Fit PM Graph in One Page check box to shrink the Performance Metrics graph to fit on a single page while using Webkit to render .pdf reports.

10. Select the Enable Localization check box to enable the display of SevOne NMS in a language other than English. When you select this check box, click the Default Language drop-down and select the language to appear by default in user definition workflows and to display on the Login page. Localization is a beta feature and can be set for each user on the Preferences page.

11. Click the Week starts on drop-down and select the start day of the week. Options are Saturday, Sunday, or Monday. This can also be set on the Preferences page.

    The value set in Week starts on field here overwrites any user specified setting when reports are mailed. For example,
    Cluster Manager > Cluster Settings > General > Week starts on is set to Sunday .
    Administration > My Preferences > Week starts on is set to Monday .
    When reports are mailed, it will choose the day set in Cluster Manager (Sunday as shown in this example) as the week's start day .

12. In the Peer Takeover Threshold field, specify the number of minutes for the self-monitoring notification to be pushed when the peer takeover exceeds <n> minutes to complete. The default value is 10 minutes. The minimum value is 1 minute and maximum value is 999 minutes.

13. Click Save to save the General settings.

Graphs

The Graphs subtab enables you to define the settings for the graphs that appear in reports.

1. Select the Abbreviate Graph Text check box to abbreviate long names on the graph with ellipses.

2. Select the Display Poll Frequency check box to have the Display Frequency check box selected by default in report creation workflows.

3. Select the Display Minimum Value check box to have the Display Minimum check box selected by default in report creation workflows.

4. Select the Draw Horizontal Grid Lines check box to display horizontal lines on the graph then enter how close the horizontal lines should be to one another in the Horizontal Grid Density field.

5. Select the Draw Vertical Grid Lines check box to display vertical lines on the graph enter how close the vertical lines should be to one another in the Vertical Grid Density field.

6. Select the Display Last Poll Value check box to display the value of the last successful poll in the graph legend.

7. Select the Display Units in TopN CSV check box to append the units as an additional column in the TopN CSV exports.

8. Click the Default Aggregation Alignment drop-down and select Aligned to Interval or Aligned to Start Time to allow you to align all the aggregation points by Interval or by Start Time.

9. Select the De-normalizing GAUGE Totals check box to perform a total aggregation instead of using a simple sum for the Total column in graph summaries.

10. Click Save to save the Graphs settings.

ICMP

The ICMP subtab enables you to define ICMP settings for devices on which you enable the ICMP plugin.

1. Select the Always 100% Availability check box to report 100% availability in ICMP even if a single packet makes it through. Leave clear to set availability to the percentage of the packets that make it through.

2. Click Save to save the ICMP settings.

IP SLA

The IP SLA subtab enables you to define IP SLA settings for the devices on which you enable the IP SLA plugin. You can override this setting for individual devices from the Edit Device page.

1. Click the Default Responder Action drop-down.

   • Select Ignore to have SevOne NMS not change the IP SLA responder setting on devices.

   • Select Yes to turn on the IP SLA responder on devices upon discovery, when possible.

   • Select No to turn off the IP SLA responder on devices upon discovery, when possible.

2. Click Save to save the IP SLA settings.

Logging

The Logging subtab enables you to manage which user actions are to create log entries. You can view log entries on the Cluster Manager at the appliance level on the System Logs tab. See the Processes and Logs topic for a list of the system logs to where log entries are made.

• - User actions are logged.

• - User actions are not logged.

You can override cluster level Logging settings at the peer level from the Peer Settings tab described later in this topic. Some user action log functionality is dependent upon your software kernel version being higher than 2.6.36. On the About page, click the PHP Statistics link to find your kernel version.

• applianceSettingManaged - Cluster Manager Appliance Settings creates log entries when a user changes a setting on the Cluster Manager Appliance Settings tab.

• clusterManaged - Cluster Manager Appliance Management creates log entries when a user performs actions such as database synchronization, fail over, etc. from the gear menu at the appliance level on the Cluster Manager.

• commandExecuted - Console Command Execution creates log entries when a user executes a command in the Linux terminal.

• configFileModified - System Configuration Files creates log entries when various system configuration files are modified.

• devicePluginEntityManaged - Device Editor Plugin Object Managers creates log entries when a device plugin object manager (e.g. "DNS Objects", "ICMP Objects" or "HTTP Objects") is modified.

• devicePluginManaged - Device Editor Plugin Settings creates log entries when a user modifies the plugin settings for a device on the Add/Edit Device page.

• discoveryManaged - Discovery Management creates log entries when a user queues a device discovery, changes discovery priority or cancels discovery.

• entityManaged - General Management triggers when a user creates, updates, deletes, enables or disables devices, alerts, thresholds, policies, users, trap destinations, and others.

• entityMappingManaged - Association Management creates log entries when a user modifies associations of device/object groups, nested device/object groups, user roles, trap destinations or metadata mapping.

• fileUploaded - File Upload Management creates log entries when a file has been uploaded to cluster manager upload update file, status maps or device types.

• importTriggered - Data Import creates log entries when a user imports data via an .spk file.

• processManaged - Cluster Manager Processes creates log entries when a user starts, stops, or restarts a process from the Process Overview tab on the Cluster Manager.

• ruleApplied - Membership Rules triggers when a user applies object group and device group membership rules.

• settingModified - Cluster Manager Settings creates log entries when a user modifies the settings on the Cluster Settings tab or the Peer Settings tab on the Cluster Manager.

• soapMethodInvoked - SOAP API Call creates log entries when a user invokes a SOAP API call.

• userAuth - User Authentication creates log entries when a user logs in, logs out or is affected by other authentication events such as inactivity time out or failed login attempts.

• userPasswordChanged - User Password creates log entries when a user changes their password or an account is created with a new password.

Click Save to save the Logging settings.

Login

The Login subtab enables you to add a custom message to the Login page and to display the Alert Summary, Instant Status, and Alerts on the Welcome Dashboard.

1. In the Login Page Message field, enter the message to appear on the Login page. Limit is 1500 characters and you cannot use HTML formatting.

2. Select the Use a Fixed Width Font check box to use a font whose letters and characters each occupy the same amount of horizontal space. The font you define for your browser is the default font for the message. To change your font in Internet Explorer; click the Tools menu and select Internet Options then Fonts. To change your font in Firefox: click the Tools menu, select Options, and then select Content.

3. In the Welcome Dashboard section:

   1. Select the Display Alert Summary check box to display an Alert Summary report on the Welcome Dashboard.

   2. Select the Display Instant Status check box to display an Instant Status report on the Welcome Dashboard.

   3. Select the Display Alerts check box to display an Alerts section on the Welcome Dashboard.

4. In the User Sessions section, select the Allow Concurrent User Sessions check box to allow a user to login in more than once, concurrently, using the same login credentials.

5. In the Single Sign-On section,

   1. Select the Enable Single Sign-On check box to allow a user to use the configured Single Sign-On integrations instead of the default authentication.

   2. Select the Enable Peer Certificate Verification check box to verify the peer's certificate when logging in with Single Sign-On.

   3. In the OpenID-Connect Issuer URL field, enter the issuer URL to use for Single Sign-On integrations.

      The OpenID-Connect Issuer URL must match the Nginx Server Certificate Common Name. For example, if the server certificate common name is sso.example.com, the OpenID-Connect Issuer URL must be https://sso.example.com/sso.

   4. In the OpenID-Connect Client ID field, enter the string to identify SevOne NMS for Single Sign-On integrations.

   5. In the OpenID-Connect Client Secret field, enter the secret to identify SevOne NMS for Single Sign-On integrations.

      Root certificate (and chain) must be added to the operating system trust store

      Example

      $ SevOne-act add-certificates --file /path/to/cert.crt

6. Click Save to save the Login settings.

PLA

The PLA subtab enables you to establish a secure connection to PLA.

1. Select the SSL check box to have the SSL check box selected by default to establish a secure connection to PLA.

   Warning: If you disable SSL then the connection to PLA will not be secure.

Poller

The Poller subtab enables you to define poller settings.

1. In the Poller Threads field, enter the number of poller threads to use concurrently (between 1 and 1000). The default is 60.

   SevOne NMS Appliance Model	Recommended Poller Thread Max
   PAS2k	60
   PAS5k	60
   PAS10k	100
   PAS20k	200
   PAS60k	300
   PAS100k	600
   PAS200k	1000

   Poller Thread Max should be set to the smallest size of the SevOne NMS appliance model in the cluster. By not doing so, it may result in resource issues.

2. In the Update Interval field, enter the number of seconds to collect poll data before writing data to the disk (between 1 and 300). The default is 60.

3. Select the Display Poller Downtime check box to display a gap in a graph when a poller is down. In the Poller Downtime Threshold field, enter the number of seconds for polling to be down before a gap appears in a graph. Leave clear to display a continuous line in graphs between actual poll points. The minimum value for Poller Downtime Threshold field is 1 second.

4. In the Oracle Plugin Timeout field, enter the number of minutes to keep each Oracle poller thread polling before time out and start over. This prevents threads from being consumed by infinite Oracle poll times. The minimum value is 1 second and the maximum value is 32767 seconds.

5. Select the Enable Custom Calculation Poller Cutoff Period check box to enable custom calculation poller cutoff period for all devices in the cluster. In the Calculation Poller Custom Cutoff Period, enter the number of minutes that calculation poller will treat data buckets as valid. Calculation Poller Custom Cutoff Period field can range between 5 minutes to 120 minutes (2 hours). The default value is 5 minutes.
   
   This field allows an administrator to define a duration between this range. The Calculation Poller looks for data for the indicators if the current values are not available. By updating this field, it affects all Calculation Poller devices on the next poll. For example, if a calculation object is comprised of two SNMP indicators that are normally polled every 5 minutes and, one of those indicators is no longer available, then the Calculation Poller uses the last available value for that indicator. This will prevent calculation objects from returning null values but may result in calculated values that do not accurately reflect the raw data.
   
   When a customized cutoff period is not used for Calculation poller, SevOne-polld dynamically assigns an availability cutoff period of x2 the device's polling frequency.

   Since the default polling period is 5 minutes, devices that derive data from non-polled sources such as, xStats, may require the use of a custom cutoff period to avoid null calculation values when current data is not available.

6. Click Save to save the Poller settings.

Ports

The Ports subtab enables you to define the port settings for communication between peers in the cluster.

1. The Primary/Secondary Port field displays the TCP port for communication between the Primary appliance and the Secondary appliance in a Hot Standby Appliance peer pair. Do not change. This port is for internal use.

2. The Alert Server Port field displays the port for alerts. Do not change. This port is for internal use.

3. The Peer Communication Port field displays the port for communication among peers. Do not change. This port is for internal use.

4. In the Trap Receiver Port field, enter the UDP port number on the SevOne appliance to listen for incoming SNMP traps.

5. The SevOne-gui-installer Port field displays the TCP port number required for SevOne-gui-installer. The default value is 9443. You may change the port number to any other valid value. The port will get opened automatically if firewall is enabled on the system. After changing the port, you must go to Cluster Manager > Cluster Upgrade and click on Run Installer to generate the new URL.

6. Click Save to save the Ports settings.

Requestd

The Requestd subtab allows you to configure SevOne-requestd runtime parameters for the cluster.

1. The Responder Queue Size field allows you to set the number of responder tasks to queue up. Maximum number of queries from remote peers queue up for the local peers to reply to, as the responder threads become available. The default value is 400. The queue size can range between 400 and 1200.

2. The Local Threads field allows you to set the maximum number of worker threads used for internal requestd requests made to the local appliance. The default value is 200. The threads can range between 200 and 600.

3. The Originator Threads field allows you to set the maximum number of worker threads from the originator. These threads are used for executing the requests from the local appliance (the originator) to the remote appliances. The originator threads are requests that distribute tasks to other peers. The default value is 200. The threads can range between 200 and 600.

4. The Responder Threads field allows you to set the maximum number of threads used for responding to remote requests from other appliances. The default value is 200. The threads can range between 200 and 600.

5. The Requestd Module Originator ZMQ Timeout field allows you to set the timeout for the originator ZMQ process that handles the requestd queries. 0 minutes indicates no timeout. Timed out queries are discarded, resulting in query failure. Lowering the timeout may help requestd from exhausting threads due to excessively long queries or network conditions that may cause ZMQ to wait indefinitely. Setting the value too low may cause reports that are expected to take a long time to run, to timeout or display impartial results. The valid values are 0 minutes (for no timeout) or 15 - 1440 minutes. The default value is 0 minutes.

6. Click Save to save the Requestd settings.

   IMPORTANT

   These settings are provided to support advanced NMS troubleshooting. NMS administrators are strongly discouraged from making changes to these settings without first contacting SevOne Support. Improper changes to these settings may cause service degradation or disruption.

   When you save the requestd settings, you will get the following warning message.

   
   

   Click OK to save the settings or Cancel to exit.

Security

The Security subtab enables you to define security settings.

1. In the Inactivity Timeout field, enter the number of minutes a user can remain inactive before SevOne NMS automatically logs the user out of the application (between 5 and 86400). The default is 30. You can override this setting for each individual user from the User Manager.

2. Select the Enable Hard Timeout check box to enable hard timeout for all users in the cluster with the exception of the admin user. Enable the check box to allow you to enter the number of minutes in Hard Timeout field the user can remain alive before SevOne NMS automatically logs them out of the application. The default value is 30 minutes. Hard Timeout field can range between 5 minute to 86400 minutes (60 days).

3. In the Minimum Password Length field, enter the number of characters users must have in their password (between 0 and 99). The default is 0. Enter 0 (zero) to disable this feature.

4. In the Enforce Password History field, enter the number of password changes a user must make before they can repeat a password (between 0 and 999). The default is 0.

5. In the Minimum Password Age field enter the number of days a user must wait between password changes (between 0 and 999). The default is 0. This feature prevents users from circumventing Password History enforcement. Enter 0 (zero) to disable this feature.

6. In the Password Change Notification field, enter the number of days to wait after a password change before a user receives a password change notification (between 0 and 999). The default is 0. Enter 0 (zero) to disable this feature.

7. In the Maximum Password Age field, enter the number of days a user account can remain enabled before the user must change their password (between 0 and 999). The default is 0. Enter 0 (zero) to disable this feature.

8. Select the Mask Read Community String check box to mask Read Community Strings on user interfaces. Write Community Strings are masked by default.

9. Select the Require Strong Passwords check box to enforce the complexity of user passwords. If you select this check box, passwords must contain at least one special character !@#$%^&*=+_?<>/~()-[{]}|\;:", and at least two of the following three types of characters: lowercase letters, UPPERCASE letters, and numbers. In addition, passwords cannot contain more than two of a given type of character in succession (upper and lowercase letters count as the same type). An example of a valid password: 8s0h43o@7!o&p3. If your current password does not meet this requirement, you will be forced to change the password at the next log on.

10. Select the Require Strong Passwords for mysql users check box to enforce the complexity of MySQL user passwords. If you select this check box, minimum length of the MySQL password must be at least 14 symbols long, contain at least one special character +-_@[]:,.%, at least one number, at least one UPPERCASE letter, and at least one lowercase letter. The valid characters are a-z, A-Z, 0-9, +-_@[]:,.%. The invalid characters are *$!#^;&. An example of a valid password: 8s0H43o@7]o%p3. Current MySQL passwords that do not meet this requirement will be changed to a random, compliant password.

    By selecting the check box, the following warning message will appear. Please read the warning message and proceed with caution.
    

    Select No to make no changes.

    Select Yes will require a restart of the MySQL database and services of each peer. Click on Save button to apply the changes. This action may result in you intermittently losing access to SevOne NMS User Interface as the MySQL services are being restarted. Depending on the cluster and load per appliance, times will vary.

    Log in to the SevOne NMS via the Command Line Interface (CLI) as user root to check the progress of the restart of mysqld services. Execute the command below.

    Check mysqld services restart progress

    $ SevOne-peer-do "supervisorctl status mysqld mysqld2"

    Example: View status of MySQL services

    $ SevOne-peer-do "supervisorctl status mysqld mysqld2"
    --- Gathering peer list...
    --- Running command on 10.168.116.40...
    Authorized uses only. All activity may be monitored and reported.
    mysqld RUNNING pid 14358, uptime 0:00:12
    mysqld2 STARTING
    Connection to 10.168.116.40 closed.
    [ OKAY ]
    --- Running command on 10.168.117.67...
    Authorized uses only. All activity may be monitored and reported.
    mysqld RUNNING pid 5043, uptime 1:21:47
    mysqld2 RUNNING pid 5085, uptime 1:21:36
    Connection to 10.168.117.67 closed.
    [ OKAY ]
    --- Running command on 10.168.118.17...
    Authorized uses only. All activity may be monitored and reported.
    mysqld RUNNING pid 17089, uptime 1:20:49
    mysqld2 RUNNING pid 17206, uptime 1:20:35
    Connection to 10.168.118.17 closed.
    [ OKAY ]
    --- Running command on 10.168.117.30...
    Authorized uses only. All activity may be monitored and reported.
    mysqld RUNNING pid 16234, uptime 1:19:51
    mysqld2 RUNNING pid 16355, uptime 1:19:36
    Connection to 10.168.117.30 closed.
    [ OKAY ]

    The processes are seen in transition between RUNNING and STARTING but you have to wait until all the peers have the mysqld and mysqld2 services in RUNNING state and the uptime is seen as close to the current time. The ones highlighted in red have still not restarted and are yet to be processed - the process is performed one peer at a time.

    Example: Completion of MySQL services after restart on all appliances

    $ SevOne-peer-do "supervisorctl status mysqld mysqld2"
    --- Gathering peer list...
    --- Running command on 10.168.116.40...
    Authorized uses only. All activity may be monitored and reported.
    mysqld RUNNING pid 14731, uptime 0:04:35
    mysqld2 RUNNING pid 14873, uptime 0:04:13
    Connection to 10.168.116.40 closed.
    [ OKAY ]
    --- Running command on 10.168.117.67...
    Authorized uses only. All activity may be monitored and reported.
    mysqld RUNNING pid 22565, uptime 0:02:58
    mysqld2 RUNNING pid 22800, uptime 0:02:43
    Connection to 10.168.117.67 closed.
    [ OKAY ]
    --- Running command on 10.168.118.17...
    Authorized uses only. All activity may be monitored and reported.
    mysqld RUNNING pid 9207, uptime 0:01:54
    mysqld2 RUNNING pid 9267, uptime 0:01:33
    Connection to 10.168.118.17 closed.
    [ OKAY ]
    --- Running command on 10.168.117.30...
    Authorized uses only. All activity may be monitored and reported.
    mysqld RUNNING pid 7949, uptime 0:00:38
    mysqld2 RUNNING pid 7996, uptime 0:00:23
    Connection to 10.168.117.30 closed.
    [ OKAY ]

    This indicates that the setting for Require Strong Passwords for mysql users is now enabled.

    If the password was not already set for the MySQL user, or if the existing password did not meet the secure complexity requirements, then SevOne NMS will automatically set a password that meets these requirements, but the actual password may not be known to the user. In such cases, you can optionally change the password and meet the complexity requirements. Please refer to SevOne NMS Appliance Security Guide, section Change MySQL User Credentials for details on how to change the MySQL user credentials.

11. Select the Allow Forcelogin check box to enable SevOne NMS integration with other software applications via the Forcelogin script.

12. Select the Force Same Origin Policy check box to prevent SevOne NMS from being loaded outside of the current domain. This includes portals and the use of the force login script to load SevOne NMS into an iframe from where a malicious user could log a user's activity. Note: If you clear this check box, the application security is lowered in a way that can prevent SevOne NMS from passing specific security scans.

13. Select the Rest API Validate Certificates check box to enforce REST API to validate the certificates of the other appliances when calling their REST API services.

14. Select the Require HTTPS check box to require a secure connection for all dynamic content. You must log on via HTTPS to enable this check box.

15. Select the Allow insecure code in Simple attachment check box for SevOne NMS administrators to allow/disallow usage of custom code in the Simple attachments.

16. Select the Enable render graph security check box to prevent all users to generate graphs with all pooled data, without any restrictions, due to user permissions. It is highly recommended to always keep this option enabled.

17. In the Account Lockout section:

    1. In the Disable Inactive Users field, enter the number of days a user can go without logging on before their account is disabled (between 0 and 999). The default is 0. Enter 0 (zero) to disable this feature, so that inactive users will never be disabled.

       Note: This setting does not affect the Guest users you define on the Authentication Settings page for LDAP, TACACS, and RADIUS; nor does it affect the “admin” user.

    2. In the Threshold field, enter the number of incorrect log on attempts a user can make (within the Counter Reset time span) before the account is locked. Enter 0 (zero) to disable this feature. Note: When you set this to anything other than 0 (zero), log on becomes dependent upon validation from the cluster master peer. If the cluster master peer is not accessible from a peer on which a user attempts to log on, access to the application will not be available. The minimum value is 0 attempts and the maximum value is 99999 attempts.

    3. If you enter a number in the Threshold field, in the Counter Reset field, enter the number of minutes during which the user enters an incorrect user name and password combination before the account is locked. Set this to 0 (zero) to disable this feature. Example: Enter 3 as the Threshold and 2 as the Counter Reset. If the user incorrectly enters their user name and password combination three times in a two minute time span, the account is locked for the number of minutes you enter in the Duration field. The minimum value is 0 minutes and the maximum value is 99999 minutes.

    4. If you enter a number in the Threshold field, in the Duration field, enter the number of minutes for the account to be locked after the Threshold/Counter Reset combination is exceeded (between 0 - minimum value and 99999 - maximum value). The default is 0.

18. Click Save to save the Security settings.

SFTP

The SFTP subtab enables you to define the SFTP destination settings for SevOne NMS to use when you send a report via SFTP.

1. In the Server field, enter the IP address or host name of the SFTP server where SevOne NMS is to send reports.

2. In the Port field, enter the port to which SevOne NMS is to send reports.

3. In the Username field, enter the user name SevOne NMS needs to authenticate onto the SFTP server.

4. In the Password field, enter the password SevOne NMS needs to authenticate onto the SFTP server.

5. In the Path field, enter the path to the location on the SFTP server where you want the report to be sent.

6. Click Test SFTP Settings to verify that your SFTP settings work correctly.

7. Click Save to save the SFTP settings.

SNMP

The SNMP subtab enables you to define the SNMP settings for devices on which you enable the SNMP Plugin. You can override these settings for individual devices from the Edit Device page.

1. Select the Strictly Support RFC 2233 check box to have interfaces under 20Mbps not support 64 bit counters when 32 bit counters are available and to have interfaces over 20Mbps not support 32 bit counters when 64 bit counters are available. Certain combinations of Strictly Support RFC 2233 and Prefer 64 bit can result in data loss.

2. Select the SNMP Version Lock check box to use the version of SNMP you select. This prevents the SNMP plugin from trying to determine the proper version if the version you select fails.

3. Select the Discover Max PDUs for Devices to attempt to discover the maximum data packet size that devices allow. PDU (Protocol Data Unit) data types are complex SNMP data types. The PDU field contains the body of an SNMP message. There are two PDU data types, GetRequest and SetRequest, which hold all the necessary data to get and set parameters.

4. Click the Counter Preference drop-down. This setting controls how the SNMP plugin determines what counter type (32 bit or 64 bit) to choose. If you select the Strictly Support RFC 2233 check box, this setting does not apply to in and out utilization for interfaces. Certain combinations of Strictly Support RFC 2233 and Prefer 64 bit can result in data loss.

   • Select Allow Both to use both 64 bit and 32 bit counters for an object.

   • Select Prefer 64bit to have interfaces under 20Mbps not support 64 bit counters when 32 bit counters are available and to have interfaces over 20Mbps not support 32 bit counters when 64 bit counters are available.

   • Select Prefer 32bit to use 32 bit counters.

5. In the Synchronize Objects section:

   1. Select the Administrative State check box to hide and not poll objects that are administratively down. Leave clear to poll administratively down objects normally. The Object Manager enables you to override this setting on a per object basis.

   2. Select the Operational State check box to hide and not poll objects that are operationally down. Leave clear to poll operationally down objects normally. The Object Manager enables you to override this setting on a per object basis.

6. The Default Community Strings section displays the SNMP community strings to use during discovery. The field on the left displays the list of read community string in the sequence of precedence and the field on the right displays the write strings in the sequence of precedence. When SevOne NMS discovers a device and attempts to poll SNMP data, the first string in the list is tested. If that string fails, the subsequent strings are tested, in sequence, until a string is successful. The successful community string appears on the Edit Device page for the device.

   1. In the Read Community Strings field and the Write Community Strings field, click Add to add a new row in the list.

   2. Enter the community string and click Update.

   3. Repeat the previous steps to add additional strings.

   4. Click the arrows to move the string up or down in the list. The discovery process goes through the list sequentially.

7. Click Save to save the SNMP settings.

Storage

The Storage subtab enables you to define the size of items in the system.

1. In the Data Retention field, enter the number of days' worth of data to store. The default/recommended value is 365 days. Increasing this value means that the physical storage requirements will be much greater. The minimum value is 1 day and the maximum value of 100000 days. Enter 100000 to use the Maximum Disk Utilization percentage you enter in the next step as the storage limit.

2. In the Maximum Disk Utilization field, enter the percentage of disk space to allocate for the storage of poll data (between 80 and 100 percent). The default is 80 percent, which is recommended. Leave some disk space for logs and flow data. The FlowFalcon subtab (described above) enables you to define FlowFalcon raw data retention.

3. Click Save to save the Storage settings.

Syslog

The Syslog subtab enables you to define where SevOne NMS is to send Syslog data. You can override the cluster level Syslog destination at the peer level from the Peer Settings tab described later in this topic.

1. Click Add Syslog Destination or click to add or edit a Syslog destination.

2. In the Destination Name field, enter the name of the host/destination device to which to send the Syslog data.

3. In the IP Address field, enter the IP address of the host/destination device.

4. Click the Protocol drop-down and select TCP or select UDP for the port type to which to send Syslog data.

5. In the Port field, enter the port number to which to send Syslog data.

6. Click Update to save the destination.

7. Repeat to add additional destinations to the list.

8. Click Save to save the Syslog settings.

Topology

The Topology subtab enables you to manage which topology sources are discovered for each device type.

• - Topology source discovered for the selected device type.

• - Topology source not discovered for the selected device type.

You can discover topology sources independently at each level of the device type hierarchy.

1. Select a device type in the Device Types hierarchy in the field on the left.

2. Slide the toggle to enable or disable discovery of each topology source for the device type you select.

3. Repeat for each device type in the hierarchy.

4. Click Save to save the Topology settings.

Tracing

Trap Collector

The Trap Collector subtab enables you to define the trap collector settings for devices.

1. In the Threads field, enter the number of trap-handling threads to use. Each thread handles one trap at a time. The minimum value is 1 thread and the maximum value is 99 threads. The default value is 10 threads.

2. In the Update Interval field, enter the number of seconds for how often the trap collector updates the event information and caches data. The default value is 300 seconds. The minimum value is 1 second and the maximum value is 300 seconds.

3. Click Save to save the Trap Collector settings.

WMI Proxies

The WMI Proxies subtab enables you to define the WMI proxy servers for the WMI plugin use to poll WMI data and provides links to the WMI Proxy service and the .NET 3.5 Framework software you need to install on the proxy server. See the Enable WMI chapter for details.

1. In the WMI Proxies section, click Add WMI Proxy or click to add or edit a WMI proxy server.

2. In the Name field, enter the name of the proxy server.

3. In the IP Address field, enter the proxy server IP address.

4. In the Port field, enter the port for the proxy server to use to communicate with SevOne NMS (default – 3000).

5. Select the Encryption Support check box to allow support for encrypting the password. Enable the check box to allow you to enter the password in Encryption Password field.

6. On the pop-up, click Save.

7. Repeat the previous steps to define additional WMI proxy servers.

8. Click Save to save the WMI Proxy settings.

Downloads

The Downloads section includes the SevOne NMS WMI Proxy service file and the .NET 3.5 Framework installation file. On the WMI proxy server, run the .NET 3.5 Framework setup.exe if needed, then run the SevOne WMI Proxy Setup.msi to install the SevOne NMS WMI Proxy service.

• The SevOne NMS WMI Proxy file installs a Windows service on the Windows device you designate to act as the proxy to perform WMI queries. Click the WMIProxy Download Installation Package link and save the file to the proxy device.

• If the proxy device is not running the Microsoft .NET 3.5 framework, click the .NET 3.5 Framework Download Installation Package link to download the .NET installation package setup.exe file.

  Starting SevOne NMS 5.7.2.7, you have the capability to use encryption for WMI traffic. Follow the steps below:

  • Download the file from SevOne NMS > Administration > Cluster Manager > Cluster Settings > WMI Proxies > click on Download Installation Package.

  • Send the downloaded file to the same server/computer where you have it previously running.

  • Uninstall the WMI Proxy (if one exists).

  • Install the new version of the WMI Proxy.

  • Enable the Encryption Support field.

  • Enter the Encryption Password.

  SevOne provides a Windows native proxy to ensure speed and integrity of Windows native metrics.

  Prior to SevOne NMS 5.7.2.7, the functionality was:

  SevOne ↔ WMI Proxy ↔ Polled Windows device (without encryption)

  Starting SevOne NMS 5.7.2.7, the functionality with encryption is:

  SevOne(encryption/decryption) ↔ Encrypted Traffic ↔ WMI Proxy(encryption/decryption) ↔ Polled Windows device (when encryption is enabled/supported)

Get Upgrade Artifact via SFTP Server

Enter the values in the following fields for the SevOne NMS being upgraded.

• Server IP - The IP Address or hostname of the SFTP server for SevOne NMS to use.

• Port - The port number on which the SFTP server is running on the remote server. The default value is port 22. SevOne NMS will send the reports to this port.

• Username - The username for copying the artifact from the remote server.

• Password - The password SevOne NMS needs to authenticate onto the SFTP server.

• FilePath to upgrade artifact - The path to the artifact on the remote SFTP server from where you wish to download the tar file. The user must have read permissions to the artifact.

• Click on Get Upgrade Artifact button to get the artifact to be used by SevOne NMS for the upgrade.

  If you have already configured the SFTP server on Cluster Manager > Cluster Settings tab > SFTP subtab, the same will be fetched except for the path. You may use the same server or configure a different one here.

  Depending on the size of the artifact, this step may take some time.

Run Installer

After the upgrade artifact is downloaded, you can upgrade the installer with the latest version available in the artifact. Click on the Run Installer button and the following will be processed in the background.

• The latest installer from the artifact is extracted.

• The installer is upgraded to the latest version.

• A URL for the installer is generated.

You may proceed to the generated URL to initiate the upgrade via the Graphical User Interface.

By default, the installer runs on port 9443. However, you may change the port and reconfigure the installer to run on any port. To change the port on which the Graphical User Interface installer runs, go to Cluster Manager > Cluster Settings tab > Ports subtab. You may change the SevOne-gui-installer Port to any value desired. If cluster-wide firewall setting is enabled, this will automatically add the new port to the allowed ports list.

Cluster Upgrade History

This section shows the cluster upgrade history for all the previous upgrades done using the Graphical User Interface installer. The following details are available.

• Starting Version - The SevOne NMS version of the cluster prior to the upgrade.

• Forward Version - The SevOne NMS version of the cluster that it is upgraded to.

• Status - The status of the upgrade. i.e., it indicates whether the upgrade is in progress, successful, or has failed.

• Upgrade completion time - This field shows the time it took to complete the upgrade.

Firewall

The Firewall subtab enables you to select the firewall service for the selected peer.

Select the Override Cluster Settings check box. Click OK in Inherit Cluster Settings pop-up to override firewall settings for the selected peer and save the settings. When Override Cluster Settings field is enabled, Enable Firewall field is available. Click the check box to enable the firewall service for the selected peer. It is disabled by default.

Also, Open Port becomes available. Click on Open Port to add the firewall port for the selected peer and Remove Port removes user-added ports only.

FlowFalcon

The FlowFalcon subtab enables you to define the retention of aggregated flow data on the peer for use in FlowFalcon reports. You define raw flow duration on the Cluster Manager at the cluster level as described earlier in this topic.

1. In the Write Interval field, enter the number of days' worth of <write interval> aggregated flow data to store for calculations (between 60 and 300). The default is 60 days. You define the write interval on the Cluster Settings tab > FlowFalcon subtab. See above for details.

2. In the Fifteen Minutes field, enter the number of days' worth of fifteen minute aggregation data to store for calculations. Every hour, SevOne NMS takes the flow data and creates one 1 hour aggregation data points for each of the top flows for each interface and each view. The default value is 7 days. The minimum value is 0 days.

3. In the One Hour field, enter the number of days' worth of one hour aggregation data to store for calculations. Every hour, SevOne NMS takes the flow data and creates four 15 minute aggregation data point for each of the top flows for each interface and each view. The default value is 90 days. The minimum value is 0 days.

4. In the One Day field, enter the number of days' worth of one day aggregation data to store for calculations. Every hour, SevOne NMS takes the flow data and creates one 1 day aggregation data point for each of the top flows for each interface and each view. The default value is 365 days. The minimum value is 0 days.

5. Click Save to save the FlowFalcon peer settings.

General

The General subtab enables you to add a tunneling proxy server for each peer to use for HTTP poll requests and proxy information for VMware requests. This subtab also enables you to schedule when the peer is to perform the automatic discovery function.

1. In the HTTP Proxy section, in the HTTP Proxy Server field, enter the full URL of the HTTP server you want the peer to poll for data from devices on which you enable the HTTP plugin. This field is applicable when your implementation includes a HTTP proxy server and the URL must have a valid format with a port number.
   

   Example: http://www.yourproxyserver.com:portnumber/

2. In the VMware Proxy section, the following fields enable you to define how peers communicate with each other to collect VMware data from the VMware plugin.

   1. In the Port field, enter the port on the proxy for the peer to use to collect the VMware data from other peers.

   2. In the Username field, enter the user name the peer needs to authenticate onto the proxy.

   3. In the Password field, enter the password the peer needs to authenticate onto the proxy.

3. In the Automatic Discovery section: the following fields enable you to schedule when to run the Automatic Discovery process.

   1. In the Days field, click the day tab for each day to run the automatic discovery. Automatic discovery runs on the days that appear dark blue. You must schedule automatic discovery to occur at least once every week. You should run automatic discovery daily at a time when the application is least utilized.

   2. Click the Time drop-downs to enter the automatic discovery start time.

   3. Click the Time Zone drop-down and select a time zone.

   4. Click Discover Now to run automatic discovery now.

4. Click Save to save the General peer settings.

Logging

The Logging subtab enables you to manage which user actions are to create log entries. You can view log entries on the Cluster Manager at the appliance level on the System Logs tab. See the Processes and Logs topic for a list of the system logs to where log entries are made.

This subtab enables you to override the cluster level Logging settings for an individual peer. Select the Override Cluster Setting check box to enable the following fields.

• - User actions are logged.

• - User actions are not logged.

Some user action log functionality is dependent upon your software kernel version being higher than 2.6.36. On the About page, click the PHP Statistics link to find your kernel version.

• applianceSettingManaged - Cluster Manager Appliance Settings creates log entries when a user changes a setting on the Cluster Manager Appliance Settings tab.

• clusterManaged - Cluster Manager Appliance Management creates log entries when a user performs actions such as database synchronization, fail over, etc. from the gear menu at the appliance level on the Cluster Manager.

• commandExecuted - Console Command Execution creates log entries when a user executes a command in the Linux terminal.

• configFileModified - System Configuration Files creates log entries when various system configuration files are modified.

• devicePluginEntityManaged - Device Editor Plugin Object Managers creates log entries when a device plugin object manager (e.g. "DNS Objects", "ICMP Objects" or "HTTP Objects") is modified.

• devicePluginManaged - Device Editor Plugin Settings creates log entries when a user modifies the plugin settings for a device on the Add/Edit Device page.

• discoveryManaged - Discovery Management creates log entries when a user queues a device discovery, changes discovery priority or cancels discovery.

• entityManaged - General Management triggers when a user creates, updates, deletes, enables or disables devices, alerts, thresholds, policies, users, trap destinations, and others.

• entityMappingManaged - Association Management creates log entries when a user modifies associations of device/object groups, nested device/object groups, user roles, trap destinations or metadata mapping.

• fileUploaded - File Upload Management creates log entries when a file has been uploaded to cluster manager upload update file, status maps or device types.

• importTriggered - Data Import creates log entries when a user imports data via an .spk file.

• processManaged - Cluster Manager Processes creates log entries when a user starts, stops, or restarts a process from the Process Overview tab on the Cluster Manager.

• ruleApplied - Membership Rules triggers when a user applies object group and device group membership rules.

• settingModified - Cluster Manager Settings creates log entries when a user modifies the settings on the Cluster Settings tab or the Peer Settings tab on the Cluster Manager.

• soapMethodInvoked - SOAP API Call creates log entries when a user invokes a SOAP API call.

• userAuth - User Authentication creates log entries when a user logs in, logs out or is affected by other authentication events such as inactivity time out or failed login attempts.

• userPasswordChanged - User Password creates log entries when a user changes their password or an account is created with a new password.

Click Save to save the Logging settings.

Primary/Secondary

The Primary/Secondary subtab enables you to view the IP addresses for the two appliances that act as one SevOne NMS peer in a Hot Standby Appliance (HSA) peer pair implementation. In a Hot Standby Appliance relationship, the active appliance does the normal network polling and the passive appliance pulls the config database data from the active appliance and pulls the data database data from the active appliance to provide redundancy. The passive appliance takes the active role if the active appliance fails. The primary appliance is initially set up to be the active appliance. If the primary appliance fails, it is still the primary appliance but its role changes to the passive appliance. The secondary appliance is initially set up to be the passive appliance. If the primary appliance fails, the secondary appliance is still the secondary appliance but it becomes the active appliance. You define the appliance IP address upon initial installation. See the SevOne NMS Installation Guide for details.

1. In the Primary Appliance IP Address field, view the IP address of the primary appliance.

2. In the Secondary Appliance IP Address field, view the IP address of the secondary appliance.

3. The Virtual IP Address field appears empty unless you implement the primary appliance and the secondary appliance to share a virtual IP address. A virtual IP address is useful when you configure the devices SevOne NMS polls to communicate with a specific appliance IP address because if that appliance fails, the virtual IP address becomes the IP address of what was the passive appliance and the communication from the poller is not blocked because of a different poller IP address.

4. In the Failover Time field, enter the number of seconds for the passive appliance to wait for the active appliance to respond before the passive appliance takes over. SevOne NMS pings every 2 seconds and the timeout for a ping is 5 seconds. If you change this setting, you must restart the SevOne Master/Slave Monitor process for both the active peer and the passive peer on the Cluster Manager at the peer level on the Process Overview tab. The default value is 600 seconds. The minimum value is 1 second.

   If you change this setting, you must restart the SevOne Master/Slave Monitor process for both the active appliance and the passive appliance on the Cluster Manager at the appliance level on the Process Overview tab.

5. Click Save to save the Primary/Secondary peer settings.

Requestd

The Requestd subtab allows you to configure SevOne-requestd runtime parameters for a peer.

1. Select the Override Cluster Settings check box to enable the following fields. It provides local overrides of the requestd settings for the selected peer.

   The following settings are provided to support advanced NMS troubleshooting. NMS administrators are strongly discouraged from making changes to these settings without first contacting SevOne Support. Improper changes to these settings may cause service degradation or disruption.

2. In the Responder Queue Size field , enter the number of responder tasks to queue up. Maximum number of queries from remote peers queue up for the local peers to reply to, as the responder threads become available. The default value is 400. The queue size can range between 400 and 1200.

3. In the Local Threads field, enter the maximum number of worker threads used for internal requestd requests made to the local appliance. The default value is 200. The threads can range between 200 and 600.

4. In the Originator Threads field, enter the maximum number of worker threads from the originator. These threads are used for executing the requests from the local appliance (the originator) to the remote appliances. The originator threads are requests that distribute tasks to other peers. The default value is 200. The threads can range between 200 and 600.

5. In the Responder Threads field, enter the maximum number of threads used for responding to remote requests from other appliances. The default value is 200. The threads can range between 200 and 600.

6. In the Requestd Module Originator ZMQ Timeout field, enter the timeout for the originator ZMQ process that handles the requestd queries. 0 minutes indicates no timeout. Timed out queries are discarded, resulting in query failure. Lowering the timeout may help requestd from exhausting threads due to excessively long queries or network conditions that may cause ZMQ to wait indefinitely. Setting the value too low may cause reports that are expected to take a long time to run, to timeout or display impartial results. The valid values are 0 minutes (for no timeout) or 15 - 1440 minutes. The default value is 0 minutes.

7. Click Save to save the Requestd settings.

   When you save the requestd settings, you will get the following warning message.

   
   

   Click OK to save the settings or Cancel to exit.

Storage

The Storage subtab enables you to configure storage data retention on an individual peer.

1. Select the Override Cluster Settings check box to enable the following field. This subtab enables you to override Data Retention settings for an individual peer.

2. In the Data Retention field, enter the number of days' worth of data to store (between 1 and 100000).

3. Click Save to save the Storage settings.

Syslog

The Syslog subtab enables you to define where this peer is to send Syslog data. This subtab enables you to override the cluster level Syslog destination for an individual peer.

1. Select the Override Cluster Settings check box to enable the following fields.

2. Click Add Syslog Destination or click to add or edit a Syslog destination.

3. In the Destination Name field, enter the name of the host/destination device to which to send the Syslog data.

4. In the IP Address field, enter the IP address of the host/destination device.

5. Click the Protocol drop-down and select TCP or select UDP for the port type to which to send Syslog data.

6. In the Port field, enter the port number to which to send Syslog data.

7. Click Update to save the destination.

8. Repeat to add additional destinations to the list.

9. Click Save to save the Syslog settings.

Common Criteria

Prerequisites:

• The peer cannot be a part of a cluster.

• The peer cannot have a Hot Standby Appliance.

• You must log on to the appliance via HTTPS.

• xStats adapter configuration is not available.

• Group aggregated indicator features are not available.

Perform the following steps to enable the appliance to meet Common Criteria security standards.

1. Select the Enable Common Criteria check box.

2. Click Save to display a confirmation message pop-up.

3. Click OK on the pop-up to display another confirmation pop-up that informs you that a restart is required to enable Common Criteria mode.

4. Click OK on the second confirmation pop-up to start the Common Criteria enable process and to restart the appliance. If you click Cancel, the common Criteria enable process starts but remains incomplete until after the appliance is restarted.

5. Watch the status messages as the system checks and adjusts settings to meet Common Criteria standards. The page displays nine green check marks to display the success of the Common Criteria mode success.

   If you did not click OK to restart the appliance, you must restart the appliance before the Common Criteria mode is enabled.

6. Click Save. A Date and Time subtab appears to enable you to define the appliance system date and time for Common Criteria.

Date and Time

The Appliance Settings tab displays a Date and Time subtab when you implement the Common Criteria mode to enable you to define the system time for the appliance.

1. In the Date and Time field, enter the system time for the appliance.

2. Click Save to save the Date and Time settings.