Abstract image of a woman sitting on books and studying on a laptop

OSMC 2013 | Making monitoring simple? by Michael Medin

NETWAYS, profile picture
NETWAYS

The document discusses the features and updates related to the NSClient++ monitoring tool, focusing on its use in both Windows and Linux environments. It highlights various functionalities such as real-time monitoring, performance data collection, and syntax improvements, along with detailing error-handling and filter mechanisms for event logging. Additionally, it mentions changes and enhancements made in specific builds from versions 0.4.1 to 0.4.3.

Software
1 of 65
Download to read offline
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
http://nsclient.org Monitoring Simplified
How many use NSClient++ NS-whatdid he say? ?#@*&%! wrong room!
How many like NSClient++? ..pdh collection thread not running… ERROR: Missing argument exception PdhCollectQueryData? failed: : - 2147481643: No data to return. Failed to query performance counters: ..pdh collection thread not running… ERROR: Missing argument exception PdhCollectQueryData? failed: : - 2147481643: No data to return. Failed to query performance counters:
simple? CheckEventLog file=application file=system MaxWarn=1 MaxCrit=1 "filter=generated gt -2d AND severity NOT IN ('success', 'informational') AND source != 'SideBySide'" truncate=800 unique descriptions "syntax=%severity%: %source%: %message% (%count%)"
WTF?!?!
How many saw me last year? Boring… Get started already!
dev not ops worked in ops a long time ago work with soa not, C/C++, nagios
NSClient++
Agent (Passive, Active, Real- since 2003? ( ) windowslinux and modular by design Highly extensible <0.4.0 not open coreOpen source
0.4.1: 2012-10-xx 0.4.2: 2013-10-xx? 0.4.3: 2014-02-xx?
is stable
one-man-band no company no commercial version no paid time
Please Some times I am busy  Get your a** over here and play NOW!
sponsoring! donations! support!
Thank you!
OSMC 2013 | Making monitoring simple? by Michael Medin
Sockets: ipv6, ssl (true) New protocols: NRDP, check_mk,Graphite, syslog, smtp Real-time checks: eventlog, logfiles Simplified: Commandline syntax Modernized: NRPE, NSCA, check_nt 0.4.1
Secure monitoring
0.4.1 Build 90 (2013-02-xx) ◦ nsclient-full.ini ◦ Reload from script ◦ (re)added check_filesize (ie. Check_nt –v FILESIZE) ◦ Encoding support for NRPE ◦ New option: scan-range for CheckEventLog ◦ Various minor bug fixes Build 96 (2013-04-xx) ◦ Reverted external script quoting issues ◦ (re)added check_fileage (ie. Check_nt –v FILEAGE) ◦ Added support for binding to both ipv6 and ipv4 ◦ Various minor bug fixes Build 102 (2013-08-xx) ◦ PDH improvements ◦ Performance data: pass through ◦ Encoding support through out ◦ Various minor bug fixes and enhancements
0.4.2: The goals Modern Windows support Simplifiedmonitoring Real-time monitoring Linux checks
0.4.2: The STATUS Modern Windows support Simplified monitoring Real-time monitoring Linux checks NSCP protocol Check_xxx clients
0.4.2: Some Examples Check_os_Version Check_pagefile Check_process NO MORE PDH Check_service Nrpe_client
0.4.3: The goals LINUX PACKAGES SCRIPTS QUALITY IMPROVMENTS ADADIGIOSINTEGRATION? AUTO DETECTION
Filters
Level Source … … Error Word … … Error Excel … … Info Word … … Warning Excel … … Error App1 … … Warning App1 … … Error App3 … …
Level Source … … Error Word … … Error Excel … … Info Word … … Warning Excel … … Error App1 … … Warning App1 … … Error App3 … …
Level Source … … Error Word … … Error Excel … … Info Word … … Warning Excel … … Error App1 … … Warning App1 … … Error App3 … …
Level Source … … Error Word … … Error Excel … … Info Word … … Warning Excel … … Error App1 … … Warning App1 … … Error App3 … …
Level Source … … Error Word … … Error Excel … … Info Word … … Warning Excel … … Error App1 … … Warning App1 … … Error App3 … …
Level Source … … Error Word … … Error Excel … … Info Word … … Warning Excel … … Error App1 … … Warning App1 … … Error App3 … …
Level Source … … Error Word … … Error Excel … … Info Word … … Warning Excel … … Error App1 … … Warning App1 … … Error App3 … …
Level Source … … Error Word … … Error Excel … … Info Word … … Warning Excel … … Error App1 … … Warning App1 … … Error App3 … … ( )
Level Source … … Error Word … … Error Excel … … Info Word … … Warning Excel … … Error App1 … … Warning App1 … … Error App3 … … (source or level )
Core Load … … core1 5 … … core2 0 … … core3 0 … … core4 5 … … core5 0 … … core6 0 … … Total 2 … … load > 10
Name Size … … Foo.txt 5k … … Bar.txt 12k … … Log.txt 0 … … Test.txt 123 … … Foobar.txt 1k … … Testing.txt 2k … … Barfoo.txt 24k … … size > 10k
Name Size … … physical 8g … … commited 12g … … … … … … … … … … … … … … … … … … … … … … used > 80%
filter = (id NOT IN ('3', '4', '6', '11', '16', '23', '24', '27', '29', '36', '46', '47', '50', '56', '134', '142', '219', '267', '270', '1006', '1009', '1014', '1030', '1035', '1036', '1055', '1058', '1071', '1073', '1085', '1102', '1110', '1111', '1112', '1131', '1291', '1500', '3095', '5719', '5722', '5783', '5788', '5789', '6008', '7000', '7001', '7003', '7005', '7009', '7011', '7022', '7023', '7024', '7026', '7030', '7031', '7034', '7038', '7041', '9015', '9018', '9026', '9028', '10009', '10010', '10016', '10149', '12294', '15300', '15301', '24679', '36887', '36888', '40960', '40961', '45056') AND level IN ('error', 'warning')) OR (id IN ('3') AND source NOT IN ('FilterManager') AND level IN ('error', 'warning')) OR (id IN ('4') AND source NOT IN ('q57','L2ND') AND level IN ('error', 'warning')) OR (id IN ('6') AND source NOT IN ('Security-Kerberos') AND level IN ('error', 'warning')) OR (id IN ('11') AND source NOT IN ('Kerberos-Key-Distribution-Center') AND level IN ('error', 'warning')) OR (id IN ('16') AND source NOT IN ('WindowsUpdateClient') AND level IN ('error', 'warning')) OR (id IN ('23') AND source NOT IN ('Eventlog') AND level IN ('error', 'warning')) OR (id IN ('24') AND source NOT IN ('Time-Service') AND level IN ('error', 'warning')) OR (id IN ('27') AND source NOT IN ('Eventlog') AND level IN ('error', 'warning')) OR (id IN ('29') AND source NOT IN ('Kerberos-Key-Distribution-Center') AND level IN ('error', 'warning')) OR (id IN ('36') AND source NOT IN ('Time-Service') AND level IN ('error', 'warning')) OR (id IN ('46') AND source NOT IN ('Time-Service') AND level IN ('error', 'warning')) OR (id IN ('47') AND source NOT IN ('Time-Service') AND level IN ('error', 'warning')) OR (id IN ('50') AND source NOT IN ('TermDD','Time-Service') AND level IN ('error', 'warning')) OR (id IN ('56') AND source NOT IN ('TermDD') AND level IN ('error', 'warning')) OR (id IN ('134') AND source NOT IN ('Time-Service') AND level IN ('error', 'warning')) OR (id IN ('142') AND source NOT IN ('Time-Service') AND level IN ('error', 'warning')) OR (id IN ('219') AND source NOT IN ('Kernel-pnp') AND level IN ('error', 'warning')) OR (id IN ('267') AND source NOT IN ('Storage-agents') AND level IN ('error', 'warning')) OR (id IN ('270') AND source NOT IN ('Storage-agents') AND level IN ('error', 'warning')) OR (id IN ('1006') AND source NOT IN ('DNS Client Events','GroupPolicy') AND level IN ('error', 'warning')) OR (id IN ('1009') AND source NOT IN ('picadm') AND level IN ('error', 'warning')) OR (id IN ('1014') AND source NOT IN ('DNS Client Events') AND level IN ('error', 'warning')) OR (id IN ('1030') AND source NOT IN ('GroupPolicy') AND level IN ('error', 'warning')) OR (id IN ('1035') AND source NOT IN ('TerminalServices-RemoteConnectionManager') AND level IN ('error', 'warning')) OR (id IN ('1036') AND source NOT IN ('TerminalServices-RemoteConnectionManager') AND level IN ('error', 'warning')) OR (id IN ('1055') AND source NOT IN ('GroupPolicy') AND level IN ('error', 'warning')) OR (id IN ('1058') AND source NOT IN ('GroupPolicy') AND level IN ('error', 'warning')) OR (id IN ('1071') AND source NOT IN ('TerminalServices-RemoteConnectionManager') AND level IN ('error', 'warning')) OR (id IN ('1073') AND source NOT IN ('USER32') AND level IN ('error', 'warning')) OR (id IN ('1085') AND source NOT IN ('GroupPolicy') AND level IN ('error', 'warning')) OR (id IN ('1102') AND source NOT IN ('SNMP') AND level IN ('error', 'warning')) OR (id IN ('1110') AND source NOT IN ('GroupPolicy') AND level IN ('error', 'warning')) OR (id IN ('1111') AND source NOT IN ('Server Agents') AND level IN ('error', 'warning')) OR (id IN ('1112') AND source NOT IN ('GroupPolicy') AND level IN ('error', 'warning')) OR (id IN ('1131') AND source NOT IN ('TerminalServices- RemoteConnectionManager') AND level IN ('error', 'warning')) OR (id IN ('1291') AND source NOT IN ('NIC-agents') AND level IN ('error', 'warning')) OR (id IN ('1500') AND source NOT IN ('SNMP') AND level IN ('error', 'warning')) OR (id IN ('3095') AND source NOT IN ('Netlogon') AND level IN ('error', 'warning')) OR (id IN ('5719') AND source NOT IN ('Netlogon') AND level IN ('error', 'warning')) OR (id IN ('5722') AND source NOT IN ('Netlogon') AND level IN ('error', 'warning')) OR (id IN ('5783') AND source NOT IN ('Netlogon') AND level IN ('error', 'warning')) OR (id IN ('5788') AND source NOT IN ('Netlogon') AND level IN ('error', 'warning')) OR (id IN ('5789') AND source NOT IN ('Netlogon') AND level IN ('error', 'warning')) OR (id IN ('6008') AND source NOT IN ('Eventlog') AND level IN ('error', 'warning')) OR (id IN ('7000') AND source NOT IN ('service control manager') AND level IN ('error', 'warning')) OR (id IN ('7001') AND source NOT IN ('service control manager') AND level IN ('error', 'warning')) OR (id IN ('7003') AND source NOT IN ('service control manager') AND level IN ('error', 'warning')) OR (id IN ('7005') AND source NOT IN ('service control manager') AND level IN ('error', 'warning')) OR (id IN ('7009') AND source NOT IN ('service control manager') AND level IN ('error', 'warning')) OR (id IN ('7011') AND source NOT IN ('service control manager') AND level IN ('error', 'warning')) OR (id IN ('7022') AND source NOT IN ('service control manager') AND level IN ('error', 'warning')) OR (id IN ('7023') AND source NOT IN ('service control manager') AND level IN ('error', 'warning')) OR (id IN ('7024') AND source NOT IN ('service control manager') AND level IN ('error', 'warning')) OR (id IN ('7026') AND source NOT IN ('service control manager') AND level IN ('error', 'warning')) OR (id IN ('7030') AND source NOT IN ('service control manager') AND level IN ('error', 'warning')) OR (id IN ('7031') AND source NOT IN ('service control manager') AND strings not like 'citrix' AND level IN ('error', 'warning')) OR (id IN ('7034') AND source NOT IN ('service control manager') AND level IN ('error', 'warning')) OR (id IN ('7038') AND source NOT IN ('service control manager') AND level IN ('error', 'warning')) OR (id IN ('7041') AND source NOT IN ('service control manager') AND level IN ('error', 'warning')) OR (id IN ('9015') AND source NOT IN ('Metaframe') AND level IN ('error', 'warning')) OR (id IN ('9018') AND source NOT IN ('Metaframe') AND level IN ('error', 'warning')) OR (id IN ('9026') AND source NOT IN ('Metaframe') AND level IN ('error', 'warning')) OR (id IN ('9028') AND source NOT IN ('Metaframe') AND level IN ('error', 'warning')) OR (id IN ('10009') AND source NOT IN ('DistributedCOM') AND level IN ('error', 'warning')) OR (id IN ('10010') AND source NOT IN ('DistributedCOM') AND level IN ('error', 'warning')) OR (id IN ('10016') AND source NOT IN ('DistributedCOM') AND level IN ('error', 'warning')) OR (id IN ('10149') AND source NOT IN ('WindowsRemoteManagement') AND level IN ('error', 'warning')) OR (id IN ('12294') AND source NOT IN ('Directory-Services-SAM') AND level IN ('error', 'warning')) OR (id IN ('15300') AND source NOT IN ('HTTPEVENT') AND level IN ('error', 'warning')) OR (id IN ('15301') AND source NOT IN ('HTTPEVENT') AND level IN ('error', 'warning')) OR (id IN ('24679') AND source NOT IN ('Cissesrv') AND level IN ('error', 'warning')) OR (id IN ('36887') AND source NOT IN ('Schannel') AND level IN ('error', 'warning')) OR (id IN ('36888') AND source NOT IN ('Schannel') AND level IN ('error', 'warning')) OR (id IN ('40960') AND source NOT IN ('LSASRV') AND level IN ('error', 'warning')) OR (id IN ('40961') AND source NOT IN ('LSASRV') AND level IN ('error', 'warning')) OR (id IN ('45056') AND source NOT IN ('LSASRV') AND level IN ('error', 'warning'))
Numbers, constants etc Key Safe Key Description = eq Equals != ne Not equals > gt Greater than < lt Less than >= ge Greater or equal than <= le Less or equal than in ( <LIST OF VALUES>) In a given list not in (…) Not in a given list
Strings Key Safe Key Description = eq Equals != ne Not equals > gt Greater than < lt Less than >= ge Greater or equal than <= le Less or equal than in ( <LIST OF VALUES>) In a given list not in (…) Not in a given list like Substring matching regexp Regular expression not like Opposite of like not regexp Opposite of regexp
All good things are three! filter RETURNED warning critical
Level Source … … Error Word … … Error Excel … … Info Word … … Warning Excel … … Error App1 … … Warning App1 … … Error App3 … …
Display Custom strings Supports top- and detail-syntax
Display detail- ${source} top- ${list} Hello: s: App1, s: App1, s: App3
check_pagefile "filter=name = 'total check_uptime "warn=uptime> - "crit=uptime> - check_processprocess=explorer.exe "warn=working_set > 70m" "detail-syntax=${exe} ws:${working_set},handles: ${handles},user time:${user
Simple?
Let me guess This all seems Like a lot of typing!
Sensible defaults!
check_cpu Just works!
Real time monitoring
Active monitoring! Monitored Server (Windows) Monitoring Server (Nagios) check_cpu check_uptime check_mem check_eventlog check_updates ... ... Monitored Server (Windows) Monitoring Server (Nagios) check_cpu check_uptime check_mem check_eventlog check_updates ... ...
Monitored Server (Windows) Monitoring Server (Nagios) check_cpu check_uptime check_mem check_eventlog check_updates ... ... Monitored Server (Windows) Monitoring Server (Nagios) check_cpu check_uptime check_mem check_eventlog check_updates ... ... Passive monitoring!
Real-time monitoring! Monitored Server (Windows) Monitoring Server (Nagios) Error detected in eventlog Everything is ok Monitored Server (Windows) Monitoring Server (Nagios) Error detected in eventlog Everything is ok
Zero overhead log-file checks Stateful monitoring Adaptive thresholds? Correlation CEP Composite checks
But HOW ABOUT Graphing?
Two options: 1, store/fetch from cache 2, submit passively but not to Nagios!
OSMC 2013 | Making monitoring simple? by Michael Medin
Native Secure Simple FastLight weight A work in progress
check_service computer=192.168.0.1 check_disk drive=192.168.0.1c$ check_task_sched computer=192.168.0.1 check_wmi computer=192.168.0.1
Light weight remote deployable agent Similar to psexec check_cpu check_memory check_process External scripts!
MONITORING SIMPLIFIED?
simple? CheckEventLog file=application file=system MaxWarn=1 MaxCrit=1 "filter=generated gt -2d AND severity NOT IN ('success', 'informational') AND source != 'SideBySide'" truncate=800 unique descriptions "syntax=%severity%: %source%: %message% (%count%)"
simple? check_eventlog
THANK YOU!
Photo by Olga Berrios
Information about NSClient++ http://nsclient.org facebook.com/nsclient Slides, and examples http://nsclient.org/nscp/conferances/nwc/2013/ My Blog http://blog.medin.name Most images taken by me whilst visiting the INTREPID

More Related Content

PDF
NSClient++: Monitoring Simplified at OSMC 2013
Michael Medin
 
PDF
Ns client++ icinga camp
Michael Medin
 
PDF
Nagios Conference 2013 - Michael Medin - NSClient++ Whats New
Nagios
 
PDF
NSClient++ whats new for 0.3.9 users
Michael Medin
 
PDF
Review unknown code with static analysis php ce 2018
Damien Seguy
 
KEY
Deploying Next Gen Systems with Zero Downtime
Twilio Inc
 
PPTX
Azure Video Analyzer OpenVino Extension Module on Raspberry Pi with Movidius
Knowledge & Experience
 
PDF
BSidesSF 2016 - A year in the wild: fighting malware at the corporate level
Jakub "Kuba" Sendor
 
NSClient++: Monitoring Simplified at OSMC 2013
Michael Medin
 
Ns client++ icinga camp
Michael Medin
 
Nagios Conference 2013 - Michael Medin - NSClient++ Whats New
Nagios
 
NSClient++ whats new for 0.3.9 users
Michael Medin
 
Review unknown code with static analysis php ce 2018
Damien Seguy
 
Deploying Next Gen Systems with Zero Downtime
Twilio Inc
 
Azure Video Analyzer OpenVino Extension Module on Raspberry Pi with Movidius
Knowledge & Experience
 
BSidesSF 2016 - A year in the wild: fighting malware at the corporate level
Jakub "Kuba" Sendor
 

What's hot (17)

PPTX
Static analysis and writing C/C++ of high quality code for embedded systems
Andrey Karpov
 
PDF
Preventing Data Breaches: How to Tighten Your Security Stance
Sara Goodison
 
PDF
Penumbra: Automatically Identifying Failure-Relevant Inputs (ISSTA 2009)
James Clause
 
TXT
Cha
Cielo Rose
 
PDF
[DefCon 2016] I got 99 Problems, but 
Little Snitch ain’t one!
Synack
 
PDF
Mining Software Archives to Support Software Development
Thomas Zimmermann
 
PDF
DEF CON 24 - Patrick Wardle - 99 problems little snitch
Felipe Prado
 
PDF
Ieee 1149.1-2013-tutorial-ijtag
Venkateshwar Motamarri
 
PDF
"Quantum" performance effects
Sergey Kuksenko
 
PPTX
Codestrong 2012 breakout session hacking titanium
Axway Appcelerator
 
PPT
Android wearpp
Paul Trebilcox-Ruiz
 
PDF
Linux kernel debugging(PDF format)
yang firo
 
PDF
There's Waldo by Patrick Wardle & Colby Moore
Shakacon
 
PDF
MCE^3 - Dariusz Seweryn, Paweł Urban - Demystifying Android's Bluetooth Low ...
PROIDEA
 
PDF
Demystifying Android's Bluetooth Low Energy at MCE^3 Conf
Pawel Urban
 
PDF
ZeroNights: Automating iOS blackbox security scanning
Mikhail Sosonkin
 
PDF
Errors detected in C++Builder
PVS-Studio
 
Static analysis and writing C/C++ of high quality code for embedded systems
Andrey Karpov
 
Preventing Data Breaches: How to Tighten Your Security Stance
Sara Goodison
 
Penumbra: Automatically Identifying Failure-Relevant Inputs (ISSTA 2009)
James Clause
 
Cha
Cielo Rose
 
[DefCon 2016] I got 99 Problems, but 
Little Snitch ain’t one!
Synack
 
Mining Software Archives to Support Software Development
Thomas Zimmermann
 
DEF CON 24 - Patrick Wardle - 99 problems little snitch
Felipe Prado
 
Ieee 1149.1-2013-tutorial-ijtag
Venkateshwar Motamarri
 
"Quantum" performance effects
Sergey Kuksenko
 
Codestrong 2012 breakout session hacking titanium
Axway Appcelerator
 
Android wearpp
Paul Trebilcox-Ruiz
 
Linux kernel debugging(PDF format)
yang firo
 
There's Waldo by Patrick Wardle & Colby Moore
Shakacon
 
MCE^3 - Dariusz Seweryn, Paweł Urban - Demystifying Android's Bluetooth Low ...
PROIDEA
 
Demystifying Android's Bluetooth Low Energy at MCE^3 Conf
Pawel Urban
 
ZeroNights: Automating iOS blackbox security scanning
Mikhail Sosonkin
 
Errors detected in C++Builder
PVS-Studio
 
Ad

Similar to OSMC 2013 | Making monitoring simple? by Michael Medin (20)

PDF
Ns client++ whats new (nwc2013)
Michael Medin
 
PDF
IcingaCamp Stockholm - NSClient++
Icinga
 
PDF
NSClient++ Workshop: 05 Monitoring
Michael Medin
 
PPTX
SSL Failing, Sharing, and Scheduling
David Evans
 
PDF
Analyzing Log Data With Apache Spark
Spark Summit
 
PPTX
APIs and Synthetic Biology
Uri Laserson
 
PDF
Eventsourcing with PHP and MongoDB
Jacopo Nardiello
 
PPTX
AWS IoTで家庭内IoTをやってみた【JAWS DAYS 2016】
tsuchimon
 
PDF
10 Rules for Safer Code
Quang Ngoc
 
PDF
Security Slicing for Auditing XML, XPath, and SQL Injection Vulnerabilities
Lionel Briand
 
PDF
Implementing Server Side Data Synchronization for Mobile Apps
Michele Orselli
 
PDF
10 Rules for Safer Code [Odoo Experience 2016]
Olivier Dony
 
ODP
Exact Real Arithmetic for Tcl
ke9tv
 
PPTX
Самые вкусные баги из игрового кода: как ошибаются наши коллеги-программисты ...
DevGAMM Conference
 
PDF
To Err Is Human
Alex Liu
 
PDF
Metrics-Driven Engineering
Mike Brittain
 
KEY
Esperwhispering
Theo Schlossnagle
 
PDF
OWASP PHPIDS talk slides
guestd34230
 
ODP
Beyond php - it's not (just) about the code
Wim Godden
 
PPT
C C++ tutorial for beginners- tibacademy.in
TIB Academy
 
Ns client++ whats new (nwc2013)
Michael Medin
 
IcingaCamp Stockholm - NSClient++
Icinga
 
NSClient++ Workshop: 05 Monitoring
Michael Medin
 
SSL Failing, Sharing, and Scheduling
David Evans
 
Analyzing Log Data With Apache Spark
Spark Summit
 
APIs and Synthetic Biology
Uri Laserson
 
Eventsourcing with PHP and MongoDB
Jacopo Nardiello
 
AWS IoTで家庭内IoTをやってみた【JAWS DAYS 2016】
tsuchimon
 
10 Rules for Safer Code
Quang Ngoc
 
Security Slicing for Auditing XML, XPath, and SQL Injection Vulnerabilities
Lionel Briand
 
Implementing Server Side Data Synchronization for Mobile Apps
Michele Orselli
 
10 Rules for Safer Code [Odoo Experience 2016]
Olivier Dony
 
Exact Real Arithmetic for Tcl
ke9tv
 
Самые вкусные баги из игрового кода: как ошибаются наши коллеги-программисты ...
DevGAMM Conference
 
To Err Is Human
Alex Liu
 
Metrics-Driven Engineering
Mike Brittain
 
Esperwhispering
Theo Schlossnagle
 
OWASP PHPIDS talk slides
guestd34230
 
Beyond php - it's not (just) about the code
Wim Godden
 
C C++ tutorial for beginners- tibacademy.in
TIB Academy
 
Ad

Recently uploaded (20)

PDF
MAGIX Sound Forge Pro CrackSerial Key Keygen
captanhook047
 
PDF
Building an Inclusive Web Accessibility Made Simple with Accessibility Analyzer
Accessibility Analyzer
 
PPTX
Why 2025 Is the Best Year to Hire Software Developers in India
Milan H
 
PPTX
ESDS_SAP Application Cloud Offerings.pptx
AAlam20
 
PPTX
HackYourBrain__UtrechtJUG__11092025.pptx
SimonedeGijt
 
PPTX
Swiggy API Scraping A Comprehensive Guide on Data Sets and Applications.pptx
FoodData Scrape
 
PDF
Ragic Data Security Overview: Certifications, Compliance, and Network Safegua...
Ragic
 
PPTX
A Spider Diagram, also known as a Radial Diagram or Mind Map.
ycjb74thk6
 
PDF
Coding with GPT-5- What’s New in GPT 5 That Benefits Developers.pdf
DianApps Technologies
 
PPTX
Foundations of Marketo Engage: Nurturing
bbedford2
 
PPTX
Human-Computer Interaction for Lecture 1
ssuserca7fe9
 
DOCX
Industrial Bio-Lynx: Advanced Biometric Solution for Workforce Management
Star Link Communication Pvt Ltd
 
PDF
Bright VPN Crack Free Download (Latest 2025)
captanhook047
 
PDF
MiniTool Power Data Recovery 12.6 Crack + Portable (Latest Version 2025)
imang66g
 
PDF
Understanding the Need for Systemic Change in Open Source Through Intersectio...
Imma Valls Bernaus
 
PPTX
Chapter_05_System Modeling for software engineering
anant5150ca6
 
PPTX
Lesson-3-Operation-System-Support.pptx-I
crestibols
 
PDF
Sanket Mhaiskar Resume - Senior Software Engineer (Backend, AI)
Sanket Mhaiskar
 
PDF
Internet Download Manager IDM Crack powerful download accelerator New Version...
imang66g
 
PDF
Engineering Document Management System (EDMS)
smartprojectwrench
 
MAGIX Sound Forge Pro CrackSerial Key Keygen
captanhook047
 
Building an Inclusive Web Accessibility Made Simple with Accessibility Analyzer
Accessibility Analyzer
 
Why 2025 Is the Best Year to Hire Software Developers in India
Milan H
 
ESDS_SAP Application Cloud Offerings.pptx
AAlam20
 
HackYourBrain__UtrechtJUG__11092025.pptx
SimonedeGijt
 
Swiggy API Scraping A Comprehensive Guide on Data Sets and Applications.pptx
FoodData Scrape
 
Ragic Data Security Overview: Certifications, Compliance, and Network Safegua...
Ragic
 
A Spider Diagram, also known as a Radial Diagram or Mind Map.
ycjb74thk6
 
Coding with GPT-5- What’s New in GPT 5 That Benefits Developers.pdf
DianApps Technologies
 
Foundations of Marketo Engage: Nurturing
bbedford2
 
Human-Computer Interaction for Lecture 1
ssuserca7fe9
 
Industrial Bio-Lynx: Advanced Biometric Solution for Workforce Management
Star Link Communication Pvt Ltd
 
Bright VPN Crack Free Download (Latest 2025)
captanhook047
 
MiniTool Power Data Recovery 12.6 Crack + Portable (Latest Version 2025)
imang66g
 
Understanding the Need for Systemic Change in Open Source Through Intersectio...
Imma Valls Bernaus
 
Chapter_05_System Modeling for software engineering
anant5150ca6
 
Lesson-3-Operation-System-Support.pptx-I
crestibols
 
Sanket Mhaiskar Resume - Senior Software Engineer (Backend, AI)
Sanket Mhaiskar
 
Internet Download Manager IDM Crack powerful download accelerator New Version...
imang66g
 
Engineering Document Management System (EDMS)
smartprojectwrench
 

OSMC 2013 | Making monitoring simple? by Michael Medin

  • 2. How many use NSClient++ NS-whatdid he say? ?#@*&%! wrong room!
  • 3. How many like NSClient++? ..pdh collection thread not running… ERROR: Missing argument exception PdhCollectQueryData? failed: : - 2147481643: No data to return. Failed to query performance counters: ..pdh collection thread not running… ERROR: Missing argument exception PdhCollectQueryData? failed: : - 2147481643: No data to return. Failed to query performance counters:
  • 4. simple? CheckEventLog file=application file=system MaxWarn=1 MaxCrit=1 "filter=generated gt -2d AND severity NOT IN ('success', 'informational') AND source != 'SideBySide'" truncate=800 unique descriptions "syntax=%severity%: %source%: %message% (%count%)"
  • 6. How many saw me last year? Boring… Get started already!
  • 7. dev not ops worked in ops a long time ago work with soa not, C/C++, nagios
  • 9. Agent (Passive, Active, Real- since 2003? ( ) windowslinux and modular by design Highly extensible <0.4.0 not open coreOpen source
  • 13. Please Some times I am busy  Get your a** over here and play NOW!
  • 17. Sockets: ipv6, ssl (true) New protocols: NRDP, check_mk,Graphite, syslog, smtp Real-time checks: eventlog, logfiles Simplified: Commandline syntax Modernized: NRPE, NSCA, check_nt 0.4.1
  • 19. 0.4.1 Build 90 (2013-02-xx) ◦ nsclient-full.ini ◦ Reload from script ◦ (re)added check_filesize (ie. Check_nt –v FILESIZE) ◦ Encoding support for NRPE ◦ New option: scan-range for CheckEventLog ◦ Various minor bug fixes Build 96 (2013-04-xx) ◦ Reverted external script quoting issues ◦ (re)added check_fileage (ie. Check_nt –v FILEAGE) ◦ Added support for binding to both ipv6 and ipv4 ◦ Various minor bug fixes Build 102 (2013-08-xx) ◦ PDH improvements ◦ Performance data: pass through ◦ Encoding support through out ◦ Various minor bug fixes and enhancements
  • 20. 0.4.2: The goals Modern Windows support Simplifiedmonitoring Real-time monitoring Linux checks
  • 21. 0.4.2: The STATUS Modern Windows support Simplified monitoring Real-time monitoring Linux checks NSCP protocol Check_xxx clients
  • 23. 0.4.3: The goals LINUX PACKAGES SCRIPTS QUALITY IMPROVMENTS ADADIGIOSINTEGRATION? AUTO DETECTION
  • 25. Level Source … … Error Word … … Error Excel … … Info Word … … Warning Excel … … Error App1 … … Warning App1 … … Error App3 … …
  • 26. Level Source … … Error Word … … Error Excel … … Info Word … … Warning Excel … … Error App1 … … Warning App1 … … Error App3 … …
  • 27. Level Source … … Error Word … … Error Excel … … Info Word … … Warning Excel … … Error App1 … … Warning App1 … … Error App3 … …
  • 28. Level Source … … Error Word … … Error Excel … … Info Word … … Warning Excel … … Error App1 … … Warning App1 … … Error App3 … …
  • 29. Level Source … … Error Word … … Error Excel … … Info Word … … Warning Excel … … Error App1 … … Warning App1 … … Error App3 … …
  • 30. Level Source … … Error Word … … Error Excel … … Info Word … … Warning Excel … … Error App1 … … Warning App1 … … Error App3 … …
  • 31. Level Source … … Error Word … … Error Excel … … Info Word … … Warning Excel … … Error App1 … … Warning App1 … … Error App3 … …
  • 32. Level Source … … Error Word … … Error Excel … … Info Word … … Warning Excel … … Error App1 … … Warning App1 … … Error App3 … … ( )
  • 33. Level Source … … Error Word … … Error Excel … … Info Word … … Warning Excel … … Error App1 … … Warning App1 … … Error App3 … … (source or level )
  • 34. Core Load … … core1 5 … … core2 0 … … core3 0 … … core4 5 … … core5 0 … … core6 0 … … Total 2 … … load > 10
  • 35. Name Size … … Foo.txt 5k … … Bar.txt 12k … … Log.txt 0 … … Test.txt 123 … … Foobar.txt 1k … … Testing.txt 2k … … Barfoo.txt 24k … … size > 10k
  • 36. Name Size … … physical 8g … … commited 12g … … … … … … … … … … … … … … … … … … … … … … used > 80%
  • 37. filter = (id NOT IN ('3', '4', '6', '11', '16', '23', '24', '27', '29', '36', '46', '47', '50', '56', '134', '142', '219', '267', '270', '1006', '1009', '1014', '1030', '1035', '1036', '1055', '1058', '1071', '1073', '1085', '1102', '1110', '1111', '1112', '1131', '1291', '1500', '3095', '5719', '5722', '5783', '5788', '5789', '6008', '7000', '7001', '7003', '7005', '7009', '7011', '7022', '7023', '7024', '7026', '7030', '7031', '7034', '7038', '7041', '9015', '9018', '9026', '9028', '10009', '10010', '10016', '10149', '12294', '15300', '15301', '24679', '36887', '36888', '40960', '40961', '45056') AND level IN ('error', 'warning')) OR (id IN ('3') AND source NOT IN ('FilterManager') AND level IN ('error', 'warning')) OR (id IN ('4') AND source NOT IN ('q57','L2ND') AND level IN ('error', 'warning')) OR (id IN ('6') AND source NOT IN ('Security-Kerberos') AND level IN ('error', 'warning')) OR (id IN ('11') AND source NOT IN ('Kerberos-Key-Distribution-Center') AND level IN ('error', 'warning')) OR (id IN ('16') AND source NOT IN ('WindowsUpdateClient') AND level IN ('error', 'warning')) OR (id IN ('23') AND source NOT IN ('Eventlog') AND level IN ('error', 'warning')) OR (id IN ('24') AND source NOT IN ('Time-Service') AND level IN ('error', 'warning')) OR (id IN ('27') AND source NOT IN ('Eventlog') AND level IN ('error', 'warning')) OR (id IN ('29') AND source NOT IN ('Kerberos-Key-Distribution-Center') AND level IN ('error', 'warning')) OR (id IN ('36') AND source NOT IN ('Time-Service') AND level IN ('error', 'warning')) OR (id IN ('46') AND source NOT IN ('Time-Service') AND level IN ('error', 'warning')) OR (id IN ('47') AND source NOT IN ('Time-Service') AND level IN ('error', 'warning')) OR (id IN ('50') AND source NOT IN ('TermDD','Time-Service') AND level IN ('error', 'warning')) OR (id IN ('56') AND source NOT IN ('TermDD') AND level IN ('error', 'warning')) OR (id IN ('134') AND source NOT IN ('Time-Service') AND level IN ('error', 'warning')) OR (id IN ('142') AND source NOT IN ('Time-Service') AND level IN ('error', 'warning')) OR (id IN ('219') AND source NOT IN ('Kernel-pnp') AND level IN ('error', 'warning')) OR (id IN ('267') AND source NOT IN ('Storage-agents') AND level IN ('error', 'warning')) OR (id IN ('270') AND source NOT IN ('Storage-agents') AND level IN ('error', 'warning')) OR (id IN ('1006') AND source NOT IN ('DNS Client Events','GroupPolicy') AND level IN ('error', 'warning')) OR (id IN ('1009') AND source NOT IN ('picadm') AND level IN ('error', 'warning')) OR (id IN ('1014') AND source NOT IN ('DNS Client Events') AND level IN ('error', 'warning')) OR (id IN ('1030') AND source NOT IN ('GroupPolicy') AND level IN ('error', 'warning')) OR (id IN ('1035') AND source NOT IN ('TerminalServices-RemoteConnectionManager') AND level IN ('error', 'warning')) OR (id IN ('1036') AND source NOT IN ('TerminalServices-RemoteConnectionManager') AND level IN ('error', 'warning')) OR (id IN ('1055') AND source NOT IN ('GroupPolicy') AND level IN ('error', 'warning')) OR (id IN ('1058') AND source NOT IN ('GroupPolicy') AND level IN ('error', 'warning')) OR (id IN ('1071') AND source NOT IN ('TerminalServices-RemoteConnectionManager') AND level IN ('error', 'warning')) OR (id IN ('1073') AND source NOT IN ('USER32') AND level IN ('error', 'warning')) OR (id IN ('1085') AND source NOT IN ('GroupPolicy') AND level IN ('error', 'warning')) OR (id IN ('1102') AND source NOT IN ('SNMP') AND level IN ('error', 'warning')) OR (id IN ('1110') AND source NOT IN ('GroupPolicy') AND level IN ('error', 'warning')) OR (id IN ('1111') AND source NOT IN ('Server Agents') AND level IN ('error', 'warning')) OR (id IN ('1112') AND source NOT IN ('GroupPolicy') AND level IN ('error', 'warning')) OR (id IN ('1131') AND source NOT IN ('TerminalServices- RemoteConnectionManager') AND level IN ('error', 'warning')) OR (id IN ('1291') AND source NOT IN ('NIC-agents') AND level IN ('error', 'warning')) OR (id IN ('1500') AND source NOT IN ('SNMP') AND level IN ('error', 'warning')) OR (id IN ('3095') AND source NOT IN ('Netlogon') AND level IN ('error', 'warning')) OR (id IN ('5719') AND source NOT IN ('Netlogon') AND level IN ('error', 'warning')) OR (id IN ('5722') AND source NOT IN ('Netlogon') AND level IN ('error', 'warning')) OR (id IN ('5783') AND source NOT IN ('Netlogon') AND level IN ('error', 'warning')) OR (id IN ('5788') AND source NOT IN ('Netlogon') AND level IN ('error', 'warning')) OR (id IN ('5789') AND source NOT IN ('Netlogon') AND level IN ('error', 'warning')) OR (id IN ('6008') AND source NOT IN ('Eventlog') AND level IN ('error', 'warning')) OR (id IN ('7000') AND source NOT IN ('service control manager') AND level IN ('error', 'warning')) OR (id IN ('7001') AND source NOT IN ('service control manager') AND level IN ('error', 'warning')) OR (id IN ('7003') AND source NOT IN ('service control manager') AND level IN ('error', 'warning')) OR (id IN ('7005') AND source NOT IN ('service control manager') AND level IN ('error', 'warning')) OR (id IN ('7009') AND source NOT IN ('service control manager') AND level IN ('error', 'warning')) OR (id IN ('7011') AND source NOT IN ('service control manager') AND level IN ('error', 'warning')) OR (id IN ('7022') AND source NOT IN ('service control manager') AND level IN ('error', 'warning')) OR (id IN ('7023') AND source NOT IN ('service control manager') AND level IN ('error', 'warning')) OR (id IN ('7024') AND source NOT IN ('service control manager') AND level IN ('error', 'warning')) OR (id IN ('7026') AND source NOT IN ('service control manager') AND level IN ('error', 'warning')) OR (id IN ('7030') AND source NOT IN ('service control manager') AND level IN ('error', 'warning')) OR (id IN ('7031') AND source NOT IN ('service control manager') AND strings not like 'citrix' AND level IN ('error', 'warning')) OR (id IN ('7034') AND source NOT IN ('service control manager') AND level IN ('error', 'warning')) OR (id IN ('7038') AND source NOT IN ('service control manager') AND level IN ('error', 'warning')) OR (id IN ('7041') AND source NOT IN ('service control manager') AND level IN ('error', 'warning')) OR (id IN ('9015') AND source NOT IN ('Metaframe') AND level IN ('error', 'warning')) OR (id IN ('9018') AND source NOT IN ('Metaframe') AND level IN ('error', 'warning')) OR (id IN ('9026') AND source NOT IN ('Metaframe') AND level IN ('error', 'warning')) OR (id IN ('9028') AND source NOT IN ('Metaframe') AND level IN ('error', 'warning')) OR (id IN ('10009') AND source NOT IN ('DistributedCOM') AND level IN ('error', 'warning')) OR (id IN ('10010') AND source NOT IN ('DistributedCOM') AND level IN ('error', 'warning')) OR (id IN ('10016') AND source NOT IN ('DistributedCOM') AND level IN ('error', 'warning')) OR (id IN ('10149') AND source NOT IN ('WindowsRemoteManagement') AND level IN ('error', 'warning')) OR (id IN ('12294') AND source NOT IN ('Directory-Services-SAM') AND level IN ('error', 'warning')) OR (id IN ('15300') AND source NOT IN ('HTTPEVENT') AND level IN ('error', 'warning')) OR (id IN ('15301') AND source NOT IN ('HTTPEVENT') AND level IN ('error', 'warning')) OR (id IN ('24679') AND source NOT IN ('Cissesrv') AND level IN ('error', 'warning')) OR (id IN ('36887') AND source NOT IN ('Schannel') AND level IN ('error', 'warning')) OR (id IN ('36888') AND source NOT IN ('Schannel') AND level IN ('error', 'warning')) OR (id IN ('40960') AND source NOT IN ('LSASRV') AND level IN ('error', 'warning')) OR (id IN ('40961') AND source NOT IN ('LSASRV') AND level IN ('error', 'warning')) OR (id IN ('45056') AND source NOT IN ('LSASRV') AND level IN ('error', 'warning'))
  • 38. Numbers, constants etc Key Safe Key Description = eq Equals != ne Not equals > gt Greater than < lt Less than >= ge Greater or equal than <= le Less or equal than in ( <LIST OF VALUES>) In a given list not in (…) Not in a given list
  • 39. Strings Key Safe Key Description = eq Equals != ne Not equals > gt Greater than < lt Less than >= ge Greater or equal than <= le Less or equal than in ( <LIST OF VALUES>) In a given list not in (…) Not in a given list like Substring matching regexp Regular expression not like Opposite of like not regexp Opposite of regexp
  • 40. All good things are three! filter RETURNED warning critical
  • 41. Level Source … … Error Word … … Error Excel … … Info Word … … Warning Excel … … Error App1 … … Warning App1 … … Error App3 … …
  • 44. check_pagefile "filter=name = 'total check_uptime "warn=uptime> - "crit=uptime> - check_processprocess=explorer.exe "warn=working_set > 70m" "detail-syntax=${exe} ws:${working_set},handles: ${handles},user time:${user
  • 46. Let me guess This all seems Like a lot of typing!
  • 50. Active monitoring! Monitored Server (Windows) Monitoring Server (Nagios) check_cpu check_uptime check_mem check_eventlog check_updates ... ... Monitored Server (Windows) Monitoring Server (Nagios) check_cpu check_uptime check_mem check_eventlog check_updates ... ...
  • 51. Monitored Server (Windows) Monitoring Server (Nagios) check_cpu check_uptime check_mem check_eventlog check_updates ... ... Monitored Server (Windows) Monitoring Server (Nagios) check_cpu check_uptime check_mem check_eventlog check_updates ... ... Passive monitoring!
  • 52. Real-time monitoring! Monitored Server (Windows) Monitoring Server (Nagios) Error detected in eventlog Everything is ok Monitored Server (Windows) Monitoring Server (Nagios) Error detected in eventlog Everything is ok
  • 53. Zero overhead log-file checks Stateful monitoring Adaptive thresholds? Correlation CEP Composite checks
  • 55. Two options: 1, store/fetch from cache 2, submit passively but not to Nagios!
  • 58. check_service computer=192.168.0.1 check_disk drive=192.168.0.1c$ check_task_sched computer=192.168.0.1 check_wmi computer=192.168.0.1
  • 59. Light weight remote deployable agent Similar to psexec check_cpu check_memory check_process External scripts!
  • 61. simple? CheckEventLog file=application file=system MaxWarn=1 MaxCrit=1 "filter=generated gt -2d AND severity NOT IN ('success', 'informational') AND source != 'SideBySide'" truncate=800 unique descriptions "syntax=%severity%: %source%: %message% (%count%)"
  • 64. Photo by Olga Berrios
  • 65. Information about NSClient++ http://nsclient.org facebook.com/nsclient Slides, and examples http://nsclient.org/nscp/conferances/nwc/2013/ My Blog http://blog.medin.name Most images taken by me whilst visiting the INTREPID