Monitoring packs in NetCrunch are used for monitoring any atlas, map or even single node. A monitoring pack is a set of rules defining what event condition should be checked (alerting) and which performance data should be collected (reporting). Therefore, a monitoring pack may consist of two elements: alerting and data collection (reports). A monitoring pack may contain either one of the elements or both. NetCrunch is delivered with a set of predefined monitoring packs that include events and reports.
Available monitoring packs are listed below:
Operating Systems
Windows
Active Directory
1 or more File Replication errors 1 or more Directory Service errors Windows Service [Windows Time] is not Running Windows Service [File Replication Service] is not Running Windows Service [Intersite Messaging] is not Running Windows Service [Distributed File System] is not Running Windows Service [Kerberos Key Distribution Center] is not Running Windows Service [Net Logon] is not Running Windows Service [Security Accounts Manager] is not Running
DNS Server
1 or more DNS errors Service [DNS] is DOWN Service [DNS] is UP DNS Server has shut down DNS Server has started DNS Server could not start because it is dependent on the NTDS service which is not started Windows Service [DNS Server] is not Running
DHCP Server
Windows Service [DHCP Server] is not Running Windows Service [DHCP Server] is Running DHCP Warning DHCP Server error
Network Services Health
1 or more DHCP errors 1 or more DNS errors 1 or more Remote Access errors 1 or more TCP/IP errors 1 or more WINS errors
Security Audit
Account expired Account is disabled Account is locked out Logon time restriction violation Password is expired Unknown user name or bad password User not allowed to logon at this computer
Terminal Services
Active Sessions > 100 Inactive Sessions > 100
Windows Server
% Processor Time > 95% Available Memory 80% Average disk queue is too long Processor time spent in privileged mode is too high Processor time spent in user mode is too high Processor queue is too long Average disk read latency is too high Average disk write latency is too high Too many outbound packets which couldn't be transmitted
Reports
Basic Performance and Capacity Planning Report Windows Server Report
Basic Windows Monitoring
%Processor Utilization > 50
Memory Usage > 90%
Disk C: Free Space < 5%
#### New Pack
Node added to Map
###Linux
#### Linux (SNMP)
% CPU Load >
New Pack
Node added to Map
Linux
Linux (SNMP)
% CPU Load >=40
Load Check = 1
Minimum Swap Space 90%
Number of Running Machines Decreased
Number of Running Machines Increased
Any Hardware sensor has Error Status
Any Hardware Sensor has Warning Status
##### Reports
ESX Server Report
###NetWare
#### NetWare (SNMP)
Novell CPU Load > 95%
Cache buffers less then 50000
Volume less than 10% free space
Novell volume is not mounted
### Other
#### AIX (SNMP)
Indicates the main processor load averaged over one minute represented as a percentage > 99
Shows a snapshot of the main cpu load as a percentage > 95
Indicates the number of free blocks available to non-superuser 90
The number of process contexts currently loaded on Running on this system => 125
Indicates whether this node is congested (1=Yes, 2=No)= 1
Indicates whether session endpoint resources are depleted (1=Yes, 2=No)= 1
Indicates whether intermediated session routing resources are depleted (1=Yes, 2=No)= 1
The cpu load as a percentage > 7500
Operational state of the RWS controller description (1=Unavailable, 2=Inactive, 3=Pendactive, 4=Active, 5=Pendinac) 3
The time (in hundredths of a second) since the network management portion of the system was last re-initialized
Reports
ESX Server Report
NetWare
NetWare (SNMP)
Novell CPU Load > 95% Cache buffers less then 50000 Volume less than 10% free space Novell volume is not mounted
Other
AIX (SNMP)
Indicates the main processor load averaged over one minute represented as a percentage > 99
Shows a snapshot of the main cpu load as a percentage > 95
Indicates the number of free blocks available to non-superuser 90
The number of process contexts currently loaded on Running on this system => 125
Indicates whether this node is congested (1=Yes, 2=No)= 1
Indicates whether session endpoint resources are depleted (1=Yes, 2=No)= 1
Indicates whether intermediated session routing resources are depleted (1=Yes, 2=No)= 1
The cpu load as a percentage > 7500
Operational state of the RWS controller description (1=Unavailable, 2=Inactive, 3=Pendactive, 4=Active, 5=Pendinac) 3
The time (in hundredths of a second) since the network management portion of the system was last re-initialized < 12000
## Hardware
#### Network Devices
##### Alcatel OmniSwitch (SNMP)
Average device-level CPU utilization over the last hour (percent) >
Hardware
Network Devices
Alcatel OmniSwitch (SNMP)
Average device-level CPU utilization over the last hour (percent) >95
Average module-level input utilization over the last hour (percent) > 95
Average module-level i/o utilization over the last hour (percent) > 95
Total collision entries available in HRE CAM > 100
Total memory free (octets)< 1000000
Current temperature of switch in degrees C x 10 >500
##### Dell OpenManage (SNMP)
Global system status is not OK
Global status of memory is not OK
Status of intrusion detector is not OK
Overall sttaus of event log of the chassis is not OK
Status of power supply is not OK
Status of voltage probe is not OK
Status of cooling device is not OK
Status of temperature probe is not OK
Temperature probe reading > 450 (45 degrees C)
Global status of storage subsystem is not NORMAL
#### HP System Insight Manager (SNMP)
This value specifies the overall condition of the AR feature. (2=ok)> 2
This value specifies the overall condition of the correctable memory error log feature. (2=ok)> 2
A number that uniquely specifies this fan description > 2
This value specifies the overall condition of the fault tolerant power supply sub-system. (2=ok)>2
The overall system health condition. (2=ok)> 2
A number that uniquely specifies this temperature sensor description > 50
This value specifies the overall condition of the system's thermal condition. (2=ok)> 2
The status of the system's temperature sensors. (2=ok) > 2
NIC interface number > 2
This object represents the overall status of the network interface sub-system (2=ok) > 2
##### Cisco (SNMP)
% Memory Used > 90
% Processor Utilization > 90
###### Reports
Cisco Device Report
##### APC PowerChute (SNMP)
APC battery status not ok
APC battery capacity less than 100%
APC battery needs replacing
APC battery temperature > 50 degrees
## Applications
### APC Windows Events
Administrative Shutdown Canceled
Administrative Shutdown Pending
Battery Needs Replacing
Communication Established
Lost Communication with UPS
Shutdown In Progress
System Shutdown Starting
UPS on Battery
Utility Power Restored
### ARC Server
Backup Operation Canceled
Backup Operation Failed
Backup Operation Incomplete
Copy Operation Canceled
Copy Operation Failed
Copy Operation Incomplete
### Symantec Backup Exec
Job failed or arborted
### Apache Server
#### Reports
Apache Server Report
Detailed Report of Apache servers
## Microsoft
### Forefront TMG 2010
Windows service [Microsoft Forefront TMG Firewall] is not Running
Windows service [Microsoft Forefront TMG Job Scheduler] is not Running
Windows Service [Microsoft Forefront TMG Control] is not Running
Windows Service [Microsoft Forefront TMG Storage] is not Running
Windows service [Microsoft Forefront TMG Manage Control] is not Running
Windows service [ISASTGCTRL] is not Running
Firewall - Failed DNS Resolutions > 1
Server Cache - Disk Failure rate/sec > 1
Server Cache - Total Disk Failures > 10
Web Proxy - Failing Requests > 3
Web Proxy Service Thread Pool Failures > 1
Web Proxy Service Total Pending Connects > 2
High number of denied packets per second
### Exchange 2003
Exchange Event Error
Mailbox Send Queue Size > 500
Mailbox Receive Queue Size > 500
SMTP Server Local Queue Length > 1000
SMTP Server Remote Queue Length > 1000
Windows Service [Microsoft Exchange System Attendant] is not Running
Windows Service [Microsoft Exchange Site Replication Service] is not Running
Windows Service [Microsoft Exchange Routing Engine] is not Running
Windows Service [Microsoft Exchange POP3] is not Running
Windows Service [Microsoft Exchange MTA Stacks] is not Running
Windows Service [Microsoft Exchange Information Store] is not Running
Windows Service [Microsoft Exchange IMAP4] is not Running
Windows Service [Microsoft Exchange Event] is not Running
Service [IMAP4] is UP
SMTP is Up
POP3 is Up
Service [IMAP4] is DOWN
SMTP is DOWN
POP3 is DOWN
Service [SMTP] responds incorrectly
Service [IMAP4] responds incorrectly
Service [POP3] responds incorrectly
#### Reports
SMTP Availability Report
### Exchange 2007-2010
#### Exchange 2007-2010 Client Access Server
Average search waiting time is too long
Time to process a free/busy request is too long
OAB download tasks queue should be empty
Windows Service [Microsoft Exchange POP3] is not Running
Windows Service [Microsoft Exchange Service Host] is not Running
Windows Service [Microsoft Exchange IMAP4] is not Running
Windows Service [Microsoft Exchange Monitoring] is not Running
Windows Service [Microsoft Exchange File Distribution] is not Running
Windows Service [Microsoft Exchange Active Directory Topology] is not Running
##### Reports
IMAP4 Availability Report
POP3 Availability Report
#### Exchange 2007-2010 Mailbox Access Server
Windows Service [Microsoft Exchange Active Directory Topology] is not Running
Windows Service [Microsoft Exchange Monitoring] is not Running
Windows Service [Microsoft Exchange Service Host] is not Running
Windows Service [Microsoft Exchange Information Store] is not Running
Windows Service [Microsoft Exchange Mailbox Assistants] is not Running
Windows Service [Microsoft Exchange System Attendant] is not Running
Windows Service [Microsoft Exchange Mailbox Replication Service] is not Running
Message submission queue is too long
Average database reading time is too long
Average database writing time is too long
RPC Average Latency is too high
There are client-reported failed RPCs
#### Exchange 2007 - 2010 Transport Access Server
Windows Service [Microsoft Exchange Monitoring] is not Running
Windows Service [Microsoft Exchange Anti-spam Update] is not Running
Windows Service [Microsoft Exchange Transport] is not Running
Windows Service [Microsoft Exchange Transport Log Search] is not Running
Windows Service [Microsoft Exchange EdgeSync]is not Running
Windows Service [Microsoft Exchange ADAM] is not Running
Message delivery queue is too long (operational)
Message delivery queue is too long (nonoperational)
Largest delivery queue is too long
Active remote delivery queue is too long
Too many messages in the active mailbox queue
Too many messages in the drop directory used by a Foreign connector
Too many messages in a retry state in the remote delivery queues
Too many messages in a retry state attempting to deliver a message to a remote mailbox
Too many messages in a retry state in the non-SMTP gateway delivery queues
Too many messages in the Unreachable queue
#### Report
SMTP Availability Report
#### SharePoint
Windows Service [IIS World Wide Web Publishing Service (W3SVC)] is not Running
Windows Service [IIS Admin Service] is not Running
Windows Service [Windows SharePoint Services Timer] is not Running
Windows Service [Windows SharePoint Services Administration] is not Running
Windows Service [Windows SharePoint Services Tracing] is not Running
Windows Service [Windows SharePoint Services User Code Host] is not Running
Windows Service [Windows SharePoint Services VSS Writer] is not Running
Windows Service [Windows SharePoint Server Search] is not Running
The cache size is too small for the data being requested
The cache size is too small (nonoperational)
The cache size is too small (operational)
The amount of memory that is allocated to the ASP.NET output cache is too small
Server is too busy. Too many rejected requests (503 HTTP status code)
High number of queued requests
#### IIS
ASP Request Queue > 30
ASP Requests/sec > 180
ASP errors
SMTP errors
WWW errors
IIS Private Bytes > 32MB
##### Reports
MS HTTP Server Report
#### ISA Server
ISA error event
Firewall - Failed DNS Resolutions > 1
Server Cache - Disk Failure Rate/sec > 1
Server Cache - Total Disk Failures > 10
Web Proxy -Failing Requests > 3
ISA Server Web Proxy service Thread Pool Failures > 1
ISA Server Web Proxy service Total Pending Connects > 2
Windows Service [ISASTGCTRL] is not Running
Windows Service [Microsoft ISA Server Job Scheduler] is not Running
Windows Service [Microsoft ISA Server Control] is not Running
Windows Service [Microsoft Firewall] is not Running
Windows Service [Microsoft Data Engine] is not Running
Windows Service [Firewall engine] is not Running
Windows Service [Routing and Remote Access] is not Running
Windows Service [Network Load Balancing] is not Running
Windows Service [Microsoft ISA Server Storage] is not Running
#### MS SQL Server
MSSQL is DOWN
System Context Switches per sec > 8000
MSSQL Warning
MSSQL Error
Windows Service [SQL Server [MSSQLSERVER]]is not Running
MSSQL is Up
Buffer Cache Hit Ratio
Dell OpenManage (SNMP)
Global system status is not OK Global status of memory is not OK Status of intrusion detector is not OK Overall sttaus of event log of the chassis is not OK Status of power supply is not OK Status of voltage probe is not OK Status of cooling device is not OK Status of temperature probe is not OK Temperature probe reading > 450 (45 degrees C) Global status of storage subsystem is not NORMAL
HP System Insight Manager (SNMP)
This value specifies the overall condition of the AR feature. (2=ok)> 2 This value specifies the overall condition of the correctable memory error log feature. (2=ok)> 2 A number that uniquely specifies this fan description > 2 This value specifies the overall condition of the fault tolerant power supply sub-system. (2=ok)>2 The overall system health condition. (2=ok)> 2 A number that uniquely specifies this temperature sensor description > 50 This value specifies the overall condition of the system's thermal condition. (2=ok)> 2 The status of the system's temperature sensors. (2=ok) > 2 NIC interface number > 2 This object represents the overall status of the network interface sub-system (2=ok) > 2
Cisco (SNMP)
% Memory Used > 90 % Processor Utilization > 90
Reports
Cisco Device Report
APC PowerChute (SNMP)
APC battery status not ok APC battery capacity less than 100% APC battery needs replacing APC battery temperature > 50 degrees
Applications
APC Windows Events
Administrative Shutdown Canceled Administrative Shutdown Pending Battery Needs Replacing Communication Established Lost Communication with UPS Shutdown In Progress System Shutdown Starting UPS on Battery Utility Power Restored
ARC Server
Backup Operation Canceled Backup Operation Failed Backup Operation Incomplete Copy Operation Canceled Copy Operation Failed Copy Operation Incomplete
Symantec Backup Exec
Job failed or arborted
Apache Server
Reports
Apache Server Report Detailed Report of Apache servers
Microsoft
Forefront TMG 2010
Windows service [Microsoft Forefront TMG Firewall] is not Running Windows service [Microsoft Forefront TMG Job Scheduler] is not Running Windows Service [Microsoft Forefront TMG Control] is not Running Windows Service [Microsoft Forefront TMG Storage] is not Running Windows service [Microsoft Forefront TMG Manage Control] is not Running Windows service [ISASTGCTRL] is not Running Firewall - Failed DNS Resolutions > 1 Server Cache - Disk Failure rate/sec > 1 Server Cache - Total Disk Failures > 10 Web Proxy - Failing Requests > 3 Web Proxy Service Thread Pool Failures > 1 Web Proxy Service Total Pending Connects > 2 High number of denied packets per second
Exchange 2003
Exchange Event Error Mailbox Send Queue Size > 500 Mailbox Receive Queue Size > 500 SMTP Server Local Queue Length > 1000 SMTP Server Remote Queue Length > 1000 Windows Service [Microsoft Exchange System Attendant] is not Running Windows Service [Microsoft Exchange Site Replication Service] is not Running Windows Service [Microsoft Exchange Routing Engine] is not Running Windows Service [Microsoft Exchange POP3] is not Running Windows Service [Microsoft Exchange MTA Stacks] is not Running Windows Service [Microsoft Exchange Information Store] is not Running Windows Service [Microsoft Exchange IMAP4] is not Running Windows Service [Microsoft Exchange Event] is not Running Service [IMAP4] is UP SMTP is Up POP3 is Up Service [IMAP4] is DOWN SMTP is DOWN POP3 is DOWN Service [SMTP] responds incorrectly Service [IMAP4] responds incorrectly Service [POP3] responds incorrectly
Reports
SMTP Availability Report
Exchange 2007-2010
Exchange 2007-2010 Client Access Server
Average search waiting time is too long Time to process a free/busy request is too long OAB download tasks queue should be empty Windows Service [Microsoft Exchange POP3] is not Running Windows Service [Microsoft Exchange Service Host] is not Running Windows Service [Microsoft Exchange IMAP4] is not Running Windows Service [Microsoft Exchange Monitoring] is not Running Windows Service [Microsoft Exchange File Distribution] is not Running Windows Service [Microsoft Exchange Active Directory Topology] is not Running
Reports
IMAP4 Availability Report POP3 Availability Report
Exchange 2007-2010 Mailbox Access Server
Windows Service [Microsoft Exchange Active Directory Topology] is not Running Windows Service [Microsoft Exchange Monitoring] is not Running Windows Service [Microsoft Exchange Service Host] is not Running Windows Service [Microsoft Exchange Information Store] is not Running Windows Service [Microsoft Exchange Mailbox Assistants] is not Running Windows Service [Microsoft Exchange System Attendant] is not Running Windows Service [Microsoft Exchange Mailbox Replication Service] is not Running Message submission queue is too long Average database reading time is too long Average database writing time is too long RPC Average Latency is too high There are client-reported failed RPCs
Exchange 2007 - 2010 Transport Access Server
Windows Service [Microsoft Exchange Monitoring] is not Running Windows Service [Microsoft Exchange Anti-spam Update] is not Running Windows Service [Microsoft Exchange Transport] is not Running Windows Service [Microsoft Exchange Transport Log Search] is not Running Windows Service [Microsoft Exchange EdgeSync]is not Running Windows Service [Microsoft Exchange ADAM] is not Running Message delivery queue is too long (operational) Message delivery queue is too long (nonoperational) Largest delivery queue is too long Active remote delivery queue is too long Too many messages in the active mailbox queue Too many messages in the drop directory used by a Foreign connector Too many messages in a retry state in the remote delivery queues Too many messages in a retry state attempting to deliver a message to a remote mailbox Too many messages in a retry state in the non-SMTP gateway delivery queues Too many messages in the Unreachable queue
Report
SMTP Availability Report
SharePoint
Windows Service [IIS World Wide Web Publishing Service (W3SVC)] is not Running Windows Service [IIS Admin Service] is not Running Windows Service [Windows SharePoint Services Timer] is not Running Windows Service [Windows SharePoint Services Administration] is not Running Windows Service [Windows SharePoint Services Tracing] is not Running Windows Service [Windows SharePoint Services User Code Host] is not Running Windows Service [Windows SharePoint Services VSS Writer] is not Running Windows Service [Windows SharePoint Server Search] is not Running The cache size is too small for the data being requested The cache size is too small (nonoperational) The cache size is too small (operational) The amount of memory that is allocated to the ASP.NET output cache is too small Server is too busy. Too many rejected requests (503 HTTP status code) High number of queued requests
IIS
ASP Request Queue > 30 ASP Requests/sec > 180 ASP errors SMTP errors WWW errors IIS Private Bytes > 32MB
Reports
MS HTTP Server Report
ISA Server
ISA error event Firewall - Failed DNS Resolutions > 1 Server Cache - Disk Failure Rate/sec > 1 Server Cache - Total Disk Failures > 10 Web Proxy -Failing Requests > 3 ISA Server Web Proxy service Thread Pool Failures > 1 ISA Server Web Proxy service Total Pending Connects > 2 Windows Service [ISASTGCTRL] is not Running Windows Service [Microsoft ISA Server Job Scheduler] is not Running Windows Service [Microsoft ISA Server Control] is not Running Windows Service [Microsoft Firewall] is not Running Windows Service [Microsoft Data Engine] is not Running Windows Service [Firewall engine] is not Running Windows Service [Routing and Remote Access] is not Running Windows Service [Network Load Balancing] is not Running Windows Service [Microsoft ISA Server Storage] is not Running
MS SQL Server
MSSQL is DOWN
System Context Switches per sec > 8000
MSSQL Warning
MSSQL Error
Windows Service [SQL Server [MSSQLSERVER]]is not Running
MSSQL is Up
Buffer Cache Hit Ratio < 90%
Sqlserver Processor Time > 80%
Windows Service [SQL Server Agent [MSSQLSERVER]] is not Running
Windows Service [SQL Server Browser] is not Running
Number of page splits per second is too high
Buffer cache hit ratio is low
Too many lazy writer per second
Number of physical database page reads per seconds is high
Too many deadlocks per second
High number of batches received per second
High number of compilations per second
Windows Service [SQL Server (MSSQLSERVER)] is Running
Reports
Processor Bottleneck Analysis Disk Usage and Performance Memory Usage Analysis MS SQL Server CPU Report MS SQL Server I/O Report
Global
Service Status
Connection Reliability Degradation PING RTT> 1000ms Any service is DOWN Any service is UP
Node Status
Node is UP Node is DOWN
Open Monitor
Global NetFlow
NetCrunch
Node added to Atlas Node deleted from Atlas
