FAQ and Videos - Free ITOM Training

Frequently Asked Questions (FAQ)

OPMOpManager
NFANetFlow Analyzer
NCMNetwork Configuration Manager
APMApplications Manager
FWAFirewall Analyzer

Part 1
Part 2
Part 3
Part 4
Archives

OpManager

Why can't I add performance monitors via Rule Engine?Performance monitors can be added only via device templates. It is the current design. We have plans to enhance it as "monitoring profile" in future so it can be applied via Rule Engine.
Make it sense to use layer2 discover without CDP?We can do it by LLDP based discovery but for Cisco CDP is recommended.
What is the role of this seed router?OpManager will query the seed device(mostly core switch with SNMP) and get all the neighbor devices to plot the layer 2 map.
Does REST API work with FreshService?REST API is for OpManager. Since the APIs are open, any third party tool can integrate with it, provided that third party tool has an option to call OpManager APIs. http://help.opmanager.com/rest_api
If you have a notification profile associated with say the category Servers, and a new server is added after the profile was associated. Will the new server automatically be added to the notification profile that was previously associated with the category Servers, or will it need to be added manually?We can do it by Rule Engine. Please refer this link for more info about rule engine. http://help.opmanager.com/rule_engine_api-v12
What will happen if we have virtual devices in a cluster. How we can be sure that we will monitor the devices even in the case that it moves to different physical computers of the cluster?If the IP/DNS of the VM is the same while moving , OpManager will continue to monitor it.
Imagine I want to skip all the windows pc when I discover network devices, my list shows unknown category?Use discovery filter to exclude all windows devices by choosing ignore filter -> device type contains as 'Windows' and choose one more ignore filter for Unknown.
How I can discover and monitor only critical interface of switch like uplink or ten gigabit interface?We have an option to filter based on interface type like 'Ethernet' now and we will provide more filter like 10G interfaces soon.
How to rediscover IP address in network devices?Choose existing devices option in Network discovery and choose the devices based on category.
Can I modify DomainController category?Yes, You can change the category in device snapshot page.
How shall i discover cisco l2 switch?Yes, if any device that responds to SNMP we can add this in OpManager by giving proper SNMP credentials. If there is no exact device template for this then please refer this link to create custom device template for the same. http://help.opmanager.com/device_templates_api
Is there any site, where i can see the custom made templates publically?Yes, check it here. https://resources.manageengine.com/resources/forum/opmanager/device-templates
What happens if I accidentally delete VMwareVirtualMachine template or some monitor of it, then how do I re-add the monitor or the entire template?You can import this template using import option. Please click export this option under device template. It's present before delete button in demo.opmanager.com. http://demo.opmanager.com/apiclient/ember/index.jsp#/Settings/Configurations/DeviceTemplate
Can a device be added, just for the ability to ping test, without SNMP or WMI. I have vendor devices on my network, that I do not have SNMP or WMI on. I just need to to Ping these devices?Yes. It is possible. Please discover the device & OpManager will do an ICMP ping periodically and update the device status.

OpManager

Will it monitor an exchange/Office 365 hybrid environment?OpManager can to Exchange servers. For Office 365 monitoring, we recommend APM plugin. https://www.manageengine.com/products/applications_manager/office-365-monitoring.html
Is file monitoring only available for Windows?Yes. Since it is limited to WMI, it is available only for Windows.
Nutanix runs in a CentOS environment, would it be able to monitor that?We can monitor if it responds to SNMP OID. As per the Nutanix Portal, we can configure SNMP and add few metrics. Please refer this video and contact support for further assistance.
What is exactly total traffic for an interface ? Is it the total traffic from the specific point in time until another point in time?It is based on the polling interval. If Interface polling interval is 15 mins, then the last polled value is the traffic in between the two consecutive polls.
How can I know the total amount of traffic through an interface from time 1 to time 2 ? Is there a report?You can choose the time period in reports and pull the data based on this.
Is it possible to make a script run from a specific device instead of the monitoring server and I'm talking here about Microsoft windows devices?For Windows devices, script has to be executed locally but there is are workarounds like psexec(third party) or an option in Powershell where a block of code can be executed on a remote server. This psexec or Powershell script might run locally on windows server but it can call the remote script or run the block of code on a remote server. https://pitstop.manageengine.com/portal/kb/articles/how-to-run-commands-on-remote-machines-using-pstools
What should I do when I discover a vCenter and in "virtual details" it shows the esxi host, but it doesn't start monitoring automatically? DNS records are correct. How can I force start monitoring it? Rediscovering vCenter, deleting and readding vCenter also doesn't help.Yes it won't help, as DNS name is not updated so deleting and rediscovery will again do the same thing. But if do update the dnsname then in the next scheduled discovery of vCenter, it will automatically start monitoring the corrected ESXServer.

If you correct the DNS Records it would be great, but in case its not correct you can force start monitoring by going to vCenter snapshot page -> Host List Widget and in the end there is Monitoring Column, from there on you can give IP and start monitoring it. Also, in our next releases we are going to do away with DNS Name dependency we are going to rely on the Entity Name only.
I have 6 ESX host, however one doesn't show up under Virtualization / VMware-Host. How do I add it to that section?That section only shows the monitored ESX Server's. You can go to vCenter snapshot page and see the complete list of ESXServers mapped to that vCenter.
Why does SNMP write have to be enabled for IPSLA?OpManager need to push the IPSLA settings on the network device using SNMP write.
What permissions are required by the vmware vcenter credentials?HTTPs credential for VMware vCenter with ReadOnly Permission are enough to monitor vCenter.
What is the quickest/easiest way to identify against which IP or interface the DOS attack is against from my main router, I am also using your product netflow?In NetFlow, you can see the source IPs in 'Offender' tab under attacks event drill down. You can see about the interface details under 'Field Details' tab (Unique IN interfaces and Unique OUT interfaces) under attacks event drill down.
What happens if the OpManager Server Hard Disk goes full, how can we free Space on Server?NFA specific hard disk space usage reduction can be done by setting proper data retention period under Settings->NetFlow->Storage Settings.

Data retention period for Raw data , Aggregated data and One Min data can be set there.
If someone DOS attacks me, how can i see the network utilization in for example last 3 minutes to solve the problem quickly, not in last 1 hour. If I view it in last 1 hour then its very hard to notice the massive peak in my network.- Note down the Offender IP and Interface name from attacks drill down.
- Go to Reports -> Custom Search Reports
- Select that interface and give the offender IP value for 'Source Address' criteria and select the desired time frame.
- Click 'Generate report'.
- If Raw data is enabled , then more detailed report can be seen under Reports -> Forensics Reports
What constitutes a license for a monitored device? i.e. = Physical Server / Virtual Host (HYPER-V)? –> Virtual Machines?The license for a monitored Virtual Host or Virtual Machines are same as Physical Server. There is no difference in it. One Device - One License.
How can we monitor VPN connections in a Cisco ASA and create a view of this?You can create your own monitors for SNMP-enabled devices, detailed steps are available in this link: http://help.opmanager.com/add_custom_monitors_api-v12

OpManager

When using consecutive times, does it use the interval to check, or does it check more often if it is violated. Like CPU goes to 90 percent and threshold is 85 and the interval is 5 minutes. If I set consecutive times to 2, would that mean it would have to be above 85 for 10 minutes?It is based on monitoring interval. Yes, that is correct. If you set consecutive times to 2, it would have to be above 85 for 10 mins.
How much traffic does this generate if we are looking at a more frequent time, like every minute so you could see if the spike lasts like 2 minutes instead of 10.If it is within LAN, this traffic is negligible.
Can you make the failure component entry anything you want, or does it need to match something?Anything. But, to have meaningful name, we recommend to combine both the trap processor name. $_Source_trapname1_Trapname2.
In setting up snmp traps on my netscaler, it is asking for a community string entry. Do I need something in there, or leave it blank or?OpManager doesn't need SNMP string (authentication) for processing traps. You can leave it blank.
Where do I find unsolicited traps?Alarms page --> Events --> Funnel filter --> Unsolicited traps
I have found that when the notification profile is created, missed poll set to 1, and criticial check it will not send a notification. As 1 missed poll is not critical. Is this not right?Yes. It is configured to send for attention severity. 1 poll missed: attention, 3 poll missed: trouble, 5 poll missed= critical.
I would like to know if a server produces an 'unusually' high amount of any sort of error within a short period of time, say ten minutes. Is there a way to monitor if an event log records a set number of errors in a given time?
Example: Notify me if a OPManager records 500 errors within a 20 minute time period.If it is eventlog or traps, then you can use 'Event Flood Notification' feature.
Does devices have to be configured in a certain way, for Event logs to go to OpManager?No. There is no need to configure anything on the end device for event log monitoring.
My event log widgets show No data for all or specific device, is this okay?Hope the event log is configured on the devices successfully. Please let me know if you wish to spare sometime with our technical team in a remote session. We will check this on a screen sharing session and help you fix this.
On the Netscaler it has public in there, when I clear it and save it, it still has public, will this block opmanager from getting the traps?No. OpManager will process this trap.

Part 1
Part 2
Archives

NetFlow Analyzer

If unknown interface/vlan/IP in my router gets under DOS attack, then how do I identify the attacked IP fastest?We do have an add on feature called ASAM which will provide you the information based on security events happening on an interface this will be covered in our next session in detail.
We add devices only if we have to configure export on them?Yes you are correct. We auto discover the device once the device exports the flows.
Why is there so much traffic as Others classified?The default widget shows only top 10 for detailed view you can expand the widget to full view. We will discuss this in detail in the next session.
Will this CBQoS policy fetch directly from the device where QoS policy has been written or need to specify policy separately?We fetch the CBQOS information using SNMP from the device.
I see there are no CISCO SB Routers (RV series) natively supported. Are there plans to support them in the future?NetFlow Analyzer can support any device which can export Netflow or any other flow formats.
What will show in flow analysis standard graphs? Both, in and out traffic or just in or out traffic?Both in and out traffic, and you have option to filter it.
There is an alternative to configure the netflow packages in the broadband links or where the upgrading time is applied in the packages. It is the equipment or it can be malipular in the software (OpManager netflow)?We get the NetFlow information form the Network device. NetFlow Analyzer is an software based solution.
No site-site traffic between certain applications viewable in NetFlow?Yes, you can create site to site IP group with IP address/range.
How accurate I can analyse the traffic flow. Is it possible to drill down to one selected minute?Yes you can drill down to 1 min.
How can I view the traffic for last 3 minutes for all interfaces?You can Generate Compare Reports by selecting all the interfaces and get traffic reports for all in a single report.
What is the timeout in NetFlow monitor if the link is down?Max 15 mins.
So I can configure 1 min?No, if there is no flows received for some time, Netflow analyzer will SNMP poll the device for link down, and this may happen between 3 min to 15 min.
Which MSSQL version does NetFlow analyzer support?NetFlow Analyzer support any MSSQL database version above 2008.
Is it possible to configure AVC via Network Configuration Manager?Yes, it is possible using configlets.
If we monitor a port channel trunk is that one license or 10 licenses for the 10 clans?NetFlow Analyzer license is based on the number of interfaces. If you monitor a port channel it will come under one license.
If NAT is enabled, in that case to view internal IP I must configure to monitor outcome traffic on all interfaces?Yes, if you wish to monitor the traffic before nat, you can monitor the interface before that.
Does it possible to apply ACL for any resources in case of threshold violation?Yes, using NCM add-on.
Is it possible to view traffic based on users?Yes, you can create IP groups based on users IP address and monitor the same.

Part 1
Part 2
Archives

Network Configuration Manager

Does NCM support NextGen syslog?We use Syslog logout messages to detect the changes in real-time. The syslog format used is RFC 5424.
How can I compare the current configuration setting with an older version (used 10 days ago)?You can see the timestamp in 'Changes' page and identify the version number for that particular change. You can compare that with the current configuration.
Is AD authentication supported in NCM?Yes. We do support AD authentication.
Why are my backups showed as unauthorised? What can I do to prevent it?All the changes that are made from out side of NCM will be treated as unauthorized. You need to make it authorized from "Inventory >> Changes" page.
Or else, you can provide the user names whose changes are always set as authorised. You can do that in 'Settings >> System Properties'.
From where are the configuration files accessible after a backup has been run in NCM?All the configuration files are encrypted and stored in NCM's database. You can click on a particular device to view its config file in a readable format.

Network Configuration Manager

Can we manage the ports of the network devices via NCM?We have another product OpUtils which can be used to manage ports. You can have both the products in one installation as well.
Does NCM auto-detect the network devices that are active on the network, or should the devices be added manually?We have device discovery schedules. You can create a discovery schedule, and if any change is detected during the schedule time, it will be automatically added it in NCM.
Is it possible to do IOS upgrade of network devices?Yes, we can upgrade IOS image using Configlets feature.
If I have Hub and Spoke topology, is it possible to push configuration changes to all the spoke routers or switches at a single go, without any downtime?Yes, it is possible.
Can SSH credential be provided using AD authentication?Yes, you can provide AD credentials in Credential Profile.
Does backup need write permission for SNMP protocol?Yes, it is required.
What is the unmanage option use for?If you unmanage a device, you cannot perform any operation in the device. Also, it will not be included in the license.
Do you have a link that has the license package details for NCM?es, please check this: https://store.manageengine.com/network-configuration-manager/

Also you can ask for personalised quotes from our sales team. Please contact them at eval-itom@manageengine.com
Do you provide POC for NCM?Yes. Please contact eval-itom@manageengine.com. Our Pre-sales team will get back to you as soon as possible.
Is it possible to add EOL and EOS information for custom or other vendors? I have only seen this option for Cisco devices, but would like to know how you get the data for other vendors also, so I can use it to notify my customer that we are EOL'ing a device.Yes, we are working on other vendors as well. We will add it in the near future in our upcoming releases. Also, we will periodically update the EOL/EOS for all the other vendors as well.
How do I remove a device from NCM?You can go to 'Inventory' and select 'Devices'. Click on the device that you want to delete, and you will have the Delete icon inside that device's Snapshot page in the top-right corner.
How can I get config backup, but without the password for 'switch enable' being displayed?You can configure the 'enable secret' in the device so that the configuration will not contain a password as plain text. We cannot filter the passwords automatically.

Webinar 1
Webinar 2
Webinar 3
Webinar 4

Applications Manager

Is it possible to display all the jobs in AS400? What is the limit? By default you can view 100 jobs. If you want to increase the number of jobs, you need to update the same in AppManagerHome\conf\AS400Server.properties file. For example, you want to display say 500 jobs, then you need to change am.as400.jobs.limit=100 to am.as400.jobs.limit=500 and restart Applications Manager.
Is it necessary to install an agent to monitor AS400 in Applications Manager?No, one need not install an agent to monitor AS400 in Applications Manager. AS400 monitoring in Applications Manager is agent less.
What are the prerequisites required to monitor AS400? Following are the prerequisites required to monitor AS400:
To connect to AS400/iSeries server from Applications Manager ensure that the ports mentioned under "Port Non-SSL" column in the link are not blocked in firewall. Also check out:
http://www-304.ibm.com/support/docview.wss?uid=nas1acc12fda96496e4b8625668f007ab75f
It is recommended to use an account having a *QSECOFR permission on the server. If using the *QSECOFR user profile is not possible, then use an account of user class *USER with additional permissions as follows:
The user should be permitted to access QMPGDATA/QPFRDATA(used to collect disk details) and QGPL(used to collect problem details) libraries and permitted to execute the command CRTPFRDTA and DSPPRB.

Consider the following special authorities when you use an account of user class *USER such as *ALLOBJ, *SAVSYS , *JOBCTL, *SPLCTL to retrieve all data and perform AS400 admin actions from Applications Manager.
How do forecast reports work? Do you have any built-in intelligence system that helps in the process?We have in-built Machine Learning algorithms in the product to do the forecast reporting.
Is it possible to monitor external storage in AS400? It is possible to monitor external storage in AS400 using ManageEngine OpManager. Applications Manager provides integration with Opmanager which will help you to gain deep insights into the availability and health of networks, servers, and applications in your IT environment.

Part 1
Part 2
Archives

Firewall Analyzer

Does Firewall Analyzer support Cisco FirePower? Yes, refer the link:https://www.manageengine.com/products/firewall/compatible-firewalls.html#supported_firewalls
Does Firewall Analyzer support PCI standards report for the Vyatta 5600 device? Yes, the Vyatta 5600 device is added recently. Upgrade the product with the latest service pack.service pack.
Does Firewall Analyzer support FortiWeb - WAF?Firewall Analyzer supports many versions/models of FortiGate device. Please contact the fwanalyzer-support@manageengine.com with Firewall model and its version.
Is there any report like category wise UTM report? Like what category is using more bandwidth?Yes, Firewall Analyzer provides the Allowed/Blocked categories in URL Report under 'Reports' section.
Can we have 'Peek hours' report?Yes, there are slew of bandwidth reports, Firewall Analyzer provides the report based on 'Working hours' and 'Non-Working hours' in 'Trend' reports.
I want to see VPN Report as per the user's time not bandwidth useage. Yes, you can generate. Please contact fwanalyzer-support@manageengine.com for further details. We will explain in detail.
Does Firewall Analyzer support MikroTik?Yes, check the link:https://www.manageengine.com/products/firewall/compatible-firewalls.html#supported_firewalls
Can I export the firewall rules to CSV format?Yes, Firewall Analyzer provides the export option for PDF and CSV formats.
Does Firewall Analyzer support Huawei firewalls?Yes, the Huawei device is added recently. Upgrade the product with the latest service pack..
Does Firewall Analyzer support ZTE firewalls?t is in the product roadmap.
Can I make firewall rule spolicy change through this tool?It is in the product roadmap.
Is this tool generates reports on firewall policies?Yes, exhaustive policy reports are available.
Can I delete a firewall policy through this tool?No, we can not delete a policy using FIrewall Analyzer. It's purely a reporting application. However, you can use another tool called Network Configuration Manager (NCM) to take action on the device. The feature which is add/edit/delete the policies from the Firewall Analyzer is in the product roadmap.
Is Network Configuration Manager (NCM) your product?Yes, it is part of ITOM suite.
Is Network Configuration Manager (NCM) combined with Firewall Anaylzer?No, It's a separate tool. But, when you install ManageEngine OpManager, all these tools come bundled as Add-ons.
Can Network Configuration Manager (NCM) be controlled using Firewall Analyzer? Can I integrate Network Configuration Manager (NCM) with Firewall Analyzer?Firewall Analyzer and Network Configuration Manager (NCM) are integrated with OpManager, but just Firewall Analyzer and Network Configuration Manager (NCM) are not integrated as of now.
How much is the Standalone Firewall Analyzer product?Pricing is based on number firewall devices to be monitored. For complete pricing details, contact our sales team.
We have 10 SonicWALL devices connected with the Site-to-Site VPN. Is it recommended to use a single Firewall Analyzer for all devices or install on each location?Yes, you can use Standalone Firewall Analyzer for the all 10 SonicWALL devices. But, if the total log rate is more than 2000, or the devices are geographically apart, we would suggest 'Distributed' edition.
How is the OpManager different from Firewall Analyzer?OpManager is a network monitoring tool and Firewall Analyzer is a firewall policy and log analytics tool.
There is Firewall Analyzer option in OpManager, does this version has all the features of Firewall Analyzer?Yes, Firewall Analyzer is available along with OpManager as IT Operations & Management (ITOM) suite of products. The Firewall Analyzer can be activated by simply applying license. You can also get a standalone Firewall Analyzer product.
How to add pfSense firewall to the Firewall Analyzer?How to add pfSense firewall to the Firewall Analyzer? https://www.manageengine.com/products/firewall/help/configure-pfsense-firewalls.html
Can we have AD credentials as Firewall Analyzer authentication?Yes, you can use AD for external authentication for Firewall Analyzer user credentials.
Can I use the Firewall Analyzer demo or test set up through the Internet?Yes, please visit our demo page:http://demo.fwanalyzer.com
Does Firewall Analyzer check the policy ID of multiple firewalls to generate reports? Because we need to maintain the IDs of multiple firewalls.Yes, we generate the rule management reports based on the Policy ID for single/multiple firewall(s).

Firewall Analyzer

Can we use Firewall Analyzer to audit cloud firewalls?As of now, Firewall Analyzer does not support cloud firewalls. Please send the sample logs with details of cloud firewall. Please contact firewall analyzer support for further details.fwanalyzer-support@manageengine.com
What is meant by 'Trend report'?Trend Reports analyze traffic over a period and present graphs that make analysis and forecasting easy.
Why do i need this tool when I have a Cyberoam that can provide me this kind of reports and user activity monitoring? Often our customers ask us this question. Firewall Analyzer supports multiple vendor firewalls. If your customer switches to some other vendor firewall, he need not change the analyzer product. He can continue using Firewall Analyzer. User activity monitoring is only a part of the Firewall Analyzer functionality. It has much more capability which can be used to protect your network.
Only the syslogs. Please configure your firewall to forward syslogs to Firewall Analyzer server. Refer below link for configuration. Yes. You can create a custom report with specific user filter and get the reports.
Firewall Analyzer suggests to change rule oder, when any attack alert is generated, will the Firewall Analyzer suggest what action to be taken on that alert?Configure 'Anomaly' alert. Firewall Analyzer provides the analysis of when the attack happened and its details. Depending on that analysis you can modify the firewall configuration. (In this case, there will not be any rule reorder suggestion. Firewall Analyzer suggests to change rule order for better performance)
I am using MikroTik router, whether all the logs are supported by FIrewall Analyzer? As of now, Firewall Analyzer supports bandwidth logs for MikroTik firewall devices. Please provide the sample logs to the Firewall Analyzer support: fwanalyzer-support@manageengine.com
What is meant by 'Trend report'?Create an alert profile with the following criteria: URL is 'Required URL' and the User is specific user for whom you want an alert. Please contact support for further queries.fwanalyzer-support@manageengine.com

Videos

OPMOpManager
NFANetFlow Analyzer
NCMNetwork Configuration Manager
APMApplications Manager
FWAFirewall Analyzer

Part 1
Part 2
Part 3
Part 4
Archives

OpManager

Discovery and Classification

Archives

OPMOpManager
NFANetFlow Analyzer
NCMNetwork Configuration Manager
APMApplications Manager
FWAFirewall Analyzer

OpManager

Why can't I add performance monitors via Rule Engine?

Performance monitors can be added only via device templates. It is the current design. We have plans to enhance it as "monitoring profile" in future so it can be applied via Rule Engine.

Make it sense to use layer2 discover without CDP?

We can do it by LLDP based discovery but for Cisco CDP is recommended.

What is the role of this seed router?

OpManager will query the seed device(mostly core switch with SNMP) and get all the neighbor devices to plot the layer 2 map.

Does REST API work with FreshService?

REST API is for OpManager. Since the APIs are open, any third party tool can integrate with it, provided that third party tool has an option to call OpManager APIs. http://help.opmanager.com/rest_api

If you have a notification profile associated with say the category Servers, and a new server is added after the profile was associated. Will the new server automatically be added to the notification profile that was previously associated with the category Servers, or will it need to be added manually?

We can do it by Rule Engine. Please refer this link for more info about rule engine. http://help.opmanager.com/rule_engine_api-v12

What will happen if we have virtual devices in a cluster. How we can be sure that we will monitor the devices even in the case that it moves to different physical computers of the cluster?

If the IP/DNS of the VM is the same while moving , OpManager will continue to monitor it.

Imagine I want to skip all the windows pc when I discover network devices, my list shows unknown category?

Use discovery filter to exclude all windows devices by choosing ignore filter -> device type contains as 'Windows' and choose one more ignore filter for Unknown.

How I can discover and monitor only critical interface of switch like uplink or ten gigabit interface?

We have an option to filter based on interface type like 'Ethernet' now and we will provide more filter like 10G interfaces soon.

How to rediscover IP address in network devices?

Choose existing devices option in Network discovery and choose the devices based on category.

Can I modify DomainController category?

Yes, You can change the category in device snapshot page.

How shall i discover cisco l2 switch?

Yes, if any device that responds to SNMP we can add this in OpManager by giving proper SNMP credentials. If there is no exact device template for this then please refer this link to create custom device template for the same. http://help.opmanager.com/device_templates_api

Is there any site, where i can see the custom made templates publically?

Yes, check it here. https://resources.manageengine.com/resources/forum/opmanager/device-templates

What happens if I accidentally delete VMwareVirtualMachine template or some monitor of it, then how do I re-add the monitor or the entire template?

You can import this template using import option. Please click export this option under device template. It's present before delete button in demo.opmanager.com. http://demo.opmanager.com/apiclient/ember/index.jsp#/Settings/Configurations/DeviceTemplate

Can a device be added, just for the ability to ping test, without SNMP or WMI. I have vendor devices on my network, that I do not have SNMP or WMI on. I just need to to Ping these devices?

Yes. It is possible. Please discover the device & OpManager will do an ICMP ping periodically and update the device status.

Will it monitor an exchange/Office 365 hybrid environment?

OpManager can to Exchange servers. For Office 365 monitoring, we recommend APM plugin. https://www.manageengine.com/products/applications_manager/office-365-monitoring.html

Is file monitoring only available for Windows?

Yes. Since it is limited to WMI, it is available only for Windows.

Nutanix runs in a CentOS environment, would it be able to monitor that?

We can monitor if it responds to SNMP OID. As per the Nutanix Portal, we can configure SNMP and add few metrics. Please refer this video and contact support for further assistance.

What is exactly total traffic for an interface ? Is it the total traffic from the specific point in time until another point in time?

It is based on the polling interval. If Interface polling interval is 15 mins, then the last polled value is the traffic in between the two consecutive polls.

How can I know the total amount of traffic through an interface from time 1 to time 2 ? Is there a report?

You can choose the time period in reports and pull the data based on this.

Is it possible to make a script run from a specific device instead of the monitoring server and I'm talking here about Microsoft windows devices?

For Windows devices, script has to be executed locally but there is are workarounds like psexec(third party) or an option in Powershell where a block of code can be executed on a remote server. This psexec or Powershell script might run locally on windows server but it can call the remote script or run the block of code on a remote server. https://pitstop.manageengine.com/portal/kb/articles/how-to-run-commands-on-remote-machines-using-pstools

What should I do when I discover a vCenter and in "virtual details" it shows the esxi host, but it doesn't start monitoring automatically? DNS records are correct. How can I force start monitoring it? Rediscovering vCenter, deleting and readding vCenter also doesn't help.

Yes it won't help, as DNS name is not updated so deleting and rediscovery will again do the same thing. But if do update the dnsname then in the next scheduled discovery of vCenter, it will automatically start monitoring the corrected ESXServer.

If you correct the DNS Records it would be great, but in case its not correct you can force start monitoring by going to vCenter snapshot page -> Host List Widget and in the end there is Monitoring Column, from there on you can give IP and start monitoring it. Also, in our next releases we are going to do away with DNS Name dependency we are going to rely on the Entity Name only.

I have 6 ESX host, however one doesn't show up under Virtualization / VMware-Host. How do I add it to that section?

That section only shows the monitored ESX Server's. You can go to vCenter snapshot page and see the complete list of ESXServers mapped to that vCenter.

Why does SNMP write have to be enabled for IPSLA?

OpManager need to push the IPSLA settings on the network device using SNMP write.

What permissions are required by the vmware vcenter credentials?

HTTPs credential for VMware vCenter with ReadOnly Permission are enough to monitor vCenter.

What is the quickest/easiest way to identify against which IP or interface the DOS attack is against from my main router, I am also using your product netflow?

In NetFlow, you can see the source IPs in 'Offender' tab under attacks event drill down. You can see about the interface details under 'Field Details' tab (Unique IN interfaces and Unique OUT interfaces) under attacks event drill down.

What happens if the OpManager Server Hard Disk goes full, how can we free Space on Server?

NFA specific hard disk space usage reduction can be done by setting proper data retention period under Settings->NetFlow->Storage Settings.

Data retention period for Raw data , Aggregated data and One Min data can be set there.

If someone DOS attacks me, how can i see the network utilization in for example last 3 minutes to solve the problem quickly, not in last 1 hour. If I view it in last 1 hour then its very hard to notice the massive peak in my network.

- Note down the Offender IP and Interface name from attacks drill down.
- Go to Reports -> Custom Search Reports
- Select that interface and give the offender IP value for 'Source Address' criteria and select the desired time frame.
- Click 'Generate report'.
- If Raw data is enabled , then more detailed report can be seen under Reports -> Forensics Reports

What constitutes a license for a monitored device? i.e. = Physical Server / Virtual Host (HYPER-V)? –> Virtual Machines?

The license for a monitored Virtual Host or Virtual Machines are same as Physical Server. There is no difference in it. One Device - One License.

How can we monitor VPN connections in a Cisco ASA and create a view of this?

You can create your own monitors for SNMP-enabled devices, detailed steps are available in this link: http://help.opmanager.com/add_custom_monitors_api-v12

When using consecutive times, does it use the interval to check, or does it check more often if it is violated. Like CPU goes to 90 percent and threshold is 85 and the interval is 5 minutes. If I set consecutive times to 2, would that mean it would have to be above 85 for 10 minutes?

It is based on monitoring interval. Yes, that is correct. If you set consecutive times to 2, it would have to be above 85 for 10 mins.

How much traffic does this generate if we are looking at a more frequent time, like every minute so you could see if the spike lasts like 2 minutes instead of 10.

If it is within LAN, this traffic is negligible.

Can you make the failure component entry anything you want, or does it need to match something?

Anything. But, to have meaningful name, we recommend to combine both the trap processor name. $_Source_trapname1_Trapname2.

In setting up snmp traps on my netscaler, it is asking for a community string entry. Do I need something in there, or leave it blank or?

OpManager doesn't need SNMP string (authentication) for processing traps. You can leave it blank.

Where do I find unsolicited traps?

Alarms page --> Events --> Funnel filter --> Unsolicited traps

I have found that when the notification profile is created, missed poll set to 1, and criticial check it will not send a notification. As 1 missed poll is not critical. Is this not right?

Yes. It is configured to send for attention severity. 1 poll missed: attention, 3 poll missed: trouble, 5 poll missed= critical.

I would like to know if a server produces an 'unusually' high amount of any sort of error within a short period of time, say ten minutes. Is there a way to monitor if an event log records a set number of errors in a given time?
Example: Notify me if a OPManager records 500 errors within a 20 minute time period.

If it is eventlog or traps, then you can use 'Event Flood Notification' feature.

Does devices have to be configured in a certain way, for Event logs to go to OpManager?

No. There is no need to configure anything on the end device for event log monitoring.

My event log widgets show No data for all or specific device, is this okay?

Hope the event log is configured on the devices successfully. Please let me know if you wish to spare sometime with our technical team in a remote session. We will check this on a screen sharing session and help you fix this.

On the Netscaler it has public in there, when I clear it and save it, it still has public, will this block opmanager from getting the traps?

No. OpManager will process this trap.

How do I get opmanager to send notification if xenserver storage goes below a limit? For example, 100GB?

We need to configure the threshold in the template. If needed, we will send you the steps in email.

I cannot find VMware-Datastore template in my opmanager --> settings --> configuration --> device templates. Or do I need to configure each datastore separate?

VMware-HostSystem template will have the datastore related monitors. You can configure the threshold values and apply it to the required host machines.

Can you explain Seed Router?

Seed device is the Core switch or a Router which is SNMP enabled. Opmanager will query the seed device to know its neighbours.

What function is behind setting the business view for a report?

Business view is for grouping. It helps the user to get the report only for the devices in that group (business view).

Is it possible to present a report (result) on a dashboard or map? Or a Link to the report?

We can create a report and show it under widgets (inside dashboard).

Is it possible to create own reports to netflow data analysing?

Yes.

Is the traffic generated by this process significant on a LAN?

No. We will send you the exact traffic generated via mail.

Does OpManager automatically backup?

OpManager has a .bat/.sh file to take database backup. You can use Windows Scheduler or Linux cronjob to automate it. The backup will be stored under the OpManager installation folder.

NetFlow Analyzer

If unknown interface/vlan/IP in my router gets under DOS attack, then how do I identify the attacked IP fastest?

We do have an add on feature called ASAM which will provide you the information based on security events happening on an interface this will be covered in our next session in detail.

We add devices only if we have to configure export on them?

Yes you are correct. We auto discover the device once the device exports the flows.

Why is there so much traffic as Others classified?

The default widget shows only top 10 for detailed view you can expand the widget to full view. We will discuss this in detail in the next session.

Will this CBQoS policy fetch directly from the device where QoS policy has been written or need to specify policy separately?

We fetch the CBQOS information using SNMP from the device.

I see there are no CISCO SB Routers (RV series) natively supported. Are there plans to support them in the future?

NetFlow Analyzer can support any device which can export Netflow or any other flow formats.

What will show in flow analysis standard graphs? Both, in and out traffic or just in or out traffic?

Both in and out traffic, and you have option to filter it.

There is an alternative to configure the netflow packages in the broadband links or where the upgrading time is applied in the packages. It is the equipment or it can be malipular in the software (OpManager netflow)?

We get the NetFlow information form the Network device. NetFlow Analyzer is an software based solution.

No site-site traffic between certain applications viewable in NetFlow?

Yes, you can create site to site IP group with IP address/range.

How accurate I can analyse the traffic flow. Is it possible to drill down to one selected minute?

Yes you can drill down to 1 min.

How can I view the traffic for last 3 minutes for all interfaces?

You can Generate Compare Reports by selecting all the interfaces and get traffic reports for all in a single report.

What is the timeout in NetFlow monitor if the link is down?

Max 15 mins.

So I can configure 1 min?

No, if there is no flows received for some time, Netflow analyzer will SNMP poll the device for link down, and this may happen between 3 min to 15 min.

Which MSSQL version does NetFlow analyzer support?

NetFlow Analyzer support any MSSQL database version above 2008.

Is it possible to configure AVC via Network Configuration Manager?

Yes, it is possible using configlets.

If we monitor a port channel trunk is that one license or 10 licenses for the 10 clans?

NetFlow Analyzer license is based on the number of interfaces. If you monitor a port channel it will come under one license.

If NAT is enabled, in that case to view internal IP I must configure to monitor outcome traffic on all interfaces?

Yes, if you wish to monitor the traffic before nat, you can monitor the interface before that.

Does it possible to apply ACL for any resources in case of threshold violation?

Yes, using NCM add-on.

Is it possible to view traffic based on users?

Yes, you can create IP groups based on users IP address and monitor the same.

Is there a feature where I can share the Dashboard with a specific department for monitoring their own application and visibility?

Yes. You can create a user group based on department and create the dashboard for the users.

Can I convert the alert into a ticket?

Yes, with a trap processing application, we can send SNMP traps.

In custom search, can reports be pulled for server IP or only for router Interface IP that is being used?

Server IP.

I am missing the capacity planning report. How do I add it?

It is an add-on for NetFlow analyzer. You will be able to access it once you upgrade your license.

If an interface is not used, will we receive any flows?

No.

What is cost of NetFlow Analyzer?

Please refer the exact price details: https://store.manageengine.com/netflow/

Which communication port do I have to set in the device to send flows from the device to NFA?

The device will select it randomly by itself. In netflow server we use 9996 , custom ports can be added to a maximum number of 5 ports.

Can NetFlow also send email to subscriber when alarm is set?

Yes.

Will the offsite NetFlow Analyzer demo be able to monitor my network?

Yes.

Can NetFlow monitor my MAC address?

MAC addresses can be monitored only for WLC (wireless).

Is it possible to set an alert for the top bandwidth consumers?

Yes. You can use Alert profile feature in NetFlow Analyzer.

Is it possible to monitor network devices and their interface availability with NetFlow?

We have OpManager with NetFlow to achieve the same.

Network Configuration Manager

What is the format of the SNMPv3 password credentials?

You need to create the V3 user and view with Auth and Priv password. We support AES 256 and DES.

How can I see all the users on my Network with their device name, IP Address, Bandwidth consumption and blocking opportunity in ManageEngine?

You can achieve this with the combination of NetFlow Analyzer and NCM. Please refer the below link for NetFlow Analyzer. https://www.manageengine.com/products/netflow/

Is CISCO NXOS one of the templates?

Yes, CISCO NXOS is one of the templates.

Is there a possibility to export the device configuration manually from db and upload via CLI commands?

Yes, you can export the device configuration manually from db and upload via CLI commands.

What is exactly SysOID?

SysOID is the identifier for a device using SNMP.

Does NCM support Fortigate firewalls?

Yes, We do support all types of Fortigate.

How to import Domain Controller server on NCM?

You can navigate to Settings -> User Management -> Windows Domain and then add the controller.

Is Aruba fully supported?

Yes, We support any device that are managed through CLI.

Can we add CISCO L3 and L2 switch?

Yes, You can add L3 and L2 switch without any problem.

Is there a way to exclude items from being detected in change management?

Yes, we have the option of Exclude Criteria. Once you create the criteria, NCM will not check those for changes.

Do you have any approval process for taking backup & restore?

Yes, we do have this feature available in the product for all Operator users.

What do you mean by device template?

Device Templates are the template based on which we associate device type and with the Commands to backup the device.

Is there a necessity to automate the backups manually, before doing it automatically?

Yes, You have to backup the device once manually and then configure the Syslog automation.

What is config conflict?

It is the difference in Startup and Running or Running and Baseline configuration.

What happens if the "changed by" tab says it is "not available"?

There is a possibility that the Syslog message does not have the User name detail. Also for the backup done manually we will not have this field updated.

Which is your current NCM version?

The latest version for NCM in 123053.

Where is the Exclude Criteria?

You will find it under Settings -> NCM -> Exclude Criteria

Can snmpv1 be disabled due to vulns?

We have option to use V2, v2c and V3. You can choose any based on your requirement.

Do you have any other feature apart from backup/restore like running some script?

We do have the Configlets feature in the product that will allow you to push changes to the devices using script.

What is Line feed and are timers configured in ms?

Line feed means a "new line char" and timers are configured in milliseconds.

Whose IP address is seen in the server field of server settings?

It will be by default, the NCM installed server IP address.

Where can I find logs related in order to find the reason for backup failures?

When you drill down to the Device Snapshot page, you will get the Reason of the failure.

If I edit a configuration and not save it, then how does it create a problem?

There will be no change in the startup config and we will backup the running config alone. It will show the Startup-Running config Conflict in the UI

What do you mean by unauthorized change?

If you make any changes outside NCM tool, then it is marked as unauthorized changes.

So I have to make all changes via NCM and not by taking local access to device?

All Changes will be mentioned as Authorized.

Is there a command list for the Advanced Execution configlets?

Yes. We have the document: http://help.networkconfigurationmanager.com/automation_using_configlets-new-ui_v12/

Are the compliance policies only for checking the device against the policy, or can we make the corrections using NCM?

Yes, you can do the changes using NCM with the help of configlets.

Can the compliance reports be run on any device that has CLI or is it limited to Cisco only? I'm asking because I have a device that has just the running config.

If the configuration file is present in NCM, then you can run the compliance check on the devices.

So as long as I can backup configuration, NCM can compare/check configuration compliance?

Yes, that's correct.

Is a separate RADIUS server needed for this or NCM has RADIUS functionality in-built?

You can integrate your RADIUS server and authenticate your already existing users. You can refer the below link for the configuration: http://help.netflowanalyzer.com/user-management$Radius%20Server%20Settings

Can we see the comparison of the last config with current config?

Yes, we can see this in NCM under 'Device Snapshot' page.

Is NCM compatible with MikroTik devices?

Yes. We do support MikroTik devices.

Is the search term highlighted when I perform a global search? For example, if I search for 'public', are the search results displayed with the keyword 'public' highlighted?

Yes, the searched string will be highlighted in the search results.

Can you show us how to upload a configuration change to a switch?

You can use Configlets or Configuration upload feature, which you can see here.http://help.networkconfigurationmanager.com/automation_using_configlets-new-ui_v12. For more details, please contact support.

Is there a way to exclude items from being detected in change management?

Yes, we have the option of Exclude Criteria. Once you create the criteria, NCM will not check those for changes.

Is it a stand-alone software or it is cloud-based?

It is a stand-alone software.

What is the advisable number of configuration rules one should add? Or can we add it according to our purpose?

There is no limitation, you can specify any number of policies based on your requirement.

How to clear old config backup of devices in the NCM database?

It is not possible to delete the config files directly. But, you can provide DB clean-up actions like deleting the older versions other than the last 10 versions, or deleting config files older than 10 days, etc.

Can someone hack my NCM database and have access to all of my configuration?

No, we store the configuration in encrypted format in our database and it cannot be accessed from outside.

Can you create a configlet to remove all of the NAT entries for a router using wildcards?

Yes, this is possible with Configlets.

Applications Manager

If we add users through AD, what is the limit of licenses in context of users?

It is limited by the number of users you have purchased in your product license.

In a multi-user environment, can we see which user has created or modified or deleted monitor settings? Where can we see logs to view user activities?

We can check the Tomcat access logs in the product but detailed audit option is not available in at the moment. But we could take it up for development in future based on demand by multiple users.

Can the business view/ dependency map be customised according to our requirement?

Yes, you can use the settings option in the business views to customize it.

How to configure background map on the dashboard View with groups from different locations?

You can use the 'Topology map view' widget in dashboards to configure background map with monitors from different locations. We will be covering dashboards in detail in next session on Jan 31st 2018.

Is the credential manager intended to use on the Admin server only in a distributed deployment?

No, it can be used in both the Admin and Manged servers.

Does the application discovery using the VMware option require VMware administrative credentials? One of my environments is hosted on a 'managed' VMware environment.

No, guest privileges are sufficient except for certain administrative activities like start/stop/restart virtual machines.

For domain users will it affect the number of license users?

Yes, the number of users you can import from your AD is limited by your purchased licensed user count.

We use Applications Manager Plugin in OpManager. Do we have limitations on monitoring things?

There are no limitations in monitoring features. The user management will have to done through the OpManager console.

Why do we have user group/ as we already selecting the role while creating user account?

Creating a User group simplifies managing permissions and associations for multiple users at the same time. It will be useful for importing user groups through Active directory.

Does the credential manager have to be configured on both Admin and Managed server or can it be trickled down?

If you have an enterprise edition, doing it in Admin server is recommended.

What is the best practice when it comes to using credential manager on both Admin as well as Managed servers?

Doing it in Admin is the recommended method. The credentials created in admin server will be synched to the managed servers automatically.

Is that an option under the managed server tab?

Admin server will do all the synchronisation automatically.

how can we do root cause analysis to ascertain the problems?

It will point you to the device and the attribute level information starting from the parent group to the lowest level. You can identify based on the Root cause analysis message given to you.

Is Applications Manager agentless only for discovery?

Applications Manager is agentless for both discovery as well as monitoring.

What browser is the best supported for accessing Application Manager?

All modern browsers are very well supported.Google Chrome is recommended.

How can you be contacted to have the solution deployed in an establishment?

You can contact eval-apm@manageengine.com to receive assistance regarding Applications Manager deployment in your establishment and for any other queries.

How can someone configure alerts to come every 30 minutes?

There are various alarm configuration options to configure. There are features like Alarm escalations that you can use. You can refer the user guide, http://help.appmanager.com/admin-alarm-escalation .

Is the discovery only based on network ports or other API are used for discovering applications like application specific APIs, wmi etc.

We discover based on network ports.

How do we know the port details of all the servers?

We have already provided standard ports in port configuration. Hence, if there are any custom ports to be entered, you can provide it as well.

What is the difference between monitor groups and business service?

None. They are the same.

Why do you need credentials just to scan for network port ? Do you use those ports to talk to the application APIs to monitor?

Once we identify an application through the port we'll need the credential to connect and monitor it as an application from the Applications Manager. Most of the performance metrics might be protected by the application administrators. That is the reason we need credential to access the metrics.

Can operator change the monitor group he has rights to?

Limited access is granted, provided the Admin enables those privileges. Please refer the 'Permissions' tab within 'User Management' for more details.

So the dependency mapping is done manually which means you have to know the relations to create a business view, right? There is no learning to query the application components to know the relations?

We learn connections that we can capture using network commands. These connections will be mapped automatically by Applications Manager. The connections that are protected will have to be done manually by the user using Monitor Groups or selecting the necessary monitors in the select monitors option while using ADDM.

Related to the dependency mapping, can I have an example of the relations of applications that are automatically created?

Applications Manger uses a Tomcat server and PostgreSQL database. They will be identified using a netstat command comparison and will be automatically connected while doing the dependency mapping.

This mean admin right for the server instance is needed, right?

Yes, admin right is needed during discovery.

When an application is discovered and all relations are created, will this automatically transform to a monitor group or do I have to create the group manually?

Yes, once you save it as a business service it will get created as a Monitor group in Applications Manager.

What if I would like to monitor Active Directory with APM? Will the ActiveDrectory be mapped with all the known components of ActiveDirectory infrastructure?

Active Directory management is not available in Applications Manager. Only certain performance metrics of the AD Server are monitored. For detailed AD Management we have another product called ADManager Plus.

As we use APM plugin with OpManager it seems there is a limitation in user management. It seems that we are limited to OpManager roles. Is it right? Will this be changed in next version of APM plugin?

Both Applications Manager and OpManager have more or less similar roles. There shouldn't be anything to lose when you are using Applications Manager plugin. We will try to examine how to improve. However, immediate changes are unlikely.

How can we monitor a SAN (EMC, NetApp, HP, IBM, etc, storage)

We recommend you to try ManageEngine OpManager for storage devices monitoring.

Dependencies with URLs (for example, the principal URL "www.google.com", with the children "www.google.com/hello"), if the children's down, how to configure the dependence for that so that the parent shows down too? Only with monitor groups or with Configure Alarm-Dependences?

Suggest you to configure http url sequence monitor where you can record such a group of urls in the single transaction monitor. Once one of the child url monitor is down , the whole parent transaction monitor will be reported as down.

If I modify performance polling parameter would it have an impact on the database space, say for example needs to be <= on frequency of polling on Oracle DB?

That depends on the parameter you are trying to change. If you choose to collect the Oracle performance metrics data in every poll, DB size could grow. It depends on the amount of data being returned from the Oracle, for example the number of tablespaces or numbers of scheduled jobs etc. Ideally it should not increase to more than 10 GB (unless in case of very large result set).

In this case, will the previous data be purged automatically?

Data collection frequency can be customized for certain attributes in Oracle monitor and some other monitors. They can be changed under Admin -> Performance Polling -> Optimize Data collection option. The polled data collected for Oracle monitor will be removed after 30 days. If you change the frequency, future data will be affected but existing data will not be purged (it will be done after 30 days).

How can I change the frequency for Data collection?

You can go into Admin -> Server Settings and update the key "Conf data cleanup Interval (days)". The value updated here is not applicable for the following monitor types. They are Apache, DB2, Java Runtime, JMX Applications, Microsoft .NET, MSSQL, MySQL, SNMP, Sybase, Weblogic and all Server Monitors.

Can we monitor MariaDB?

Yes you can monitor it as a MySQL database monitor.

Can we search the application by entering their IP address?

Yes. In Search box (on the top) you can search based on IP Address. Additionally you can also search using Monitor Display Name, Monitor Type, Custom Fields or All.

Is there an easy way to get a report of the items that would cause a critical alert? For example I want to see all attributes that would cause a critical alert, how do I do that?

Yes, you can do it from Reports tab by selecting the monitor group and selecting groups' availability history report. Also from Alarm tab under Critical /Warning/Clear alarms filter you can export it as excel file. You can export the thresholds too as a CSV file and review it.

Can a URL monitor have an identifier to distinguish it in Apache logs?

Yes. In URL Monitor you can edit the same and add details in User Agent column using which you can distinguish access from Applications Manager in your application's access log.

Can you monitor a JAS instance in Weblogic?

Out of the box support is not available. You can however use Java Runtime or JMX monitor or HTTP URL monitor to achieve the same.

Is SNMP the only way to monitor a Windows server?

No. It can be monitored using WMI as well.,You can refer http://help.appmanager.com/windows for details about adding Windows monitor via WMI.

What is the intended use of the File /directory monitor?

To monitor applications errors in logs. Another use case is to get notified when/ if someone modifies an important folder or file.

On my ESXI server I have VMs that are no longer active and disabled/ removed on host. How can I remove these from appearing on the Applications Manager list of VMs?

You will have an option to select the VMs in the ESX monitor page and choose the Delete option in the VM actions drop down.

For downtime scheduler, can we import server names from CSV file ?

Not available presently. However you can create downtime using Rest API - http://help.appmanager.com/create-downtime-scheduler-tasks.

Can we monitor datastores at VM host?

Yes. You can monitor the datastores in the ESX servers. They will be discovered automatically. You will find a tab called Datastore.

Can we get the alarms report say, for alerts from last month alerts?

For monitors, alarm history will be saved for the last 30 days. You can export the same as PDF from Alarms tab. If you have associated that monitor to a group, you can get History report for that group even for last month from Reports -> Monitor Group -> History Report.

Can we create a JDBC connection to a database and get the queries output represented on APM dashboard?

Yes, we have a Database Query Monitor using which you can do this. The output of the query monitor can be projected in a widget in your dashboard.

Can I query an external DB and show that on the APM dashboard?

No. You cannot do that. You will have to create a Query monitor in APM and then use it for the dashboard.

Can we create a dashboard for multiple monitors?

Yes. There are widgets in Applications Manager dashboard that you can use for this purpose.

Do we have the option to monitor website containing captcha based login in URL Sequence monitor ?

Unfortunately, this can't be done. The purpose of adding a captcha is to avoid automated play backs. In these scenarios, we recommend people to have a special user account which does not require captcha.

If applications manager is agentless, why is there a need for EUM agent installation? How is this said agent different from managed server of applications manager?

Imagine if you were to monitor the performance of your applications and services from various locations say, different branch offices. In such cases, rather than installing an entire Managed Server each time, you can choose the EUM alternative which is more lightweight and stateless. Since all these agents send the monitored data back to the same APM monitor instance, we can view the consolidated information across locations in one report. This is currently not possible with a managed server. The agent supports monitoring capabilities like RBM that are not present in the APM instance.

What about installing the EUM/RBM outside of a secure domain, for e.g. a home banking website?

You can install EUM / RBM agents anywhere as long as bidirectional connectivity between APM and these agent is available.

Does RBM run in the background or will it run as a visual on the machine?

This depends on the OS. For Windows, the EUM agent (which is where the RBM playback occurs) is installed as service by default. In such cases, the playback occurs as a background process and will not been shown in the GUI. To view the browser-based playback, we have to disable the service and launch the agent in the non-service mode. For Linux, it will shown in the GUI by default. If the EUM agent is present in a Linux machine or run in the non-service mode, we recommend running the agent in a machine or environment that doesn't require any user interaction since any changes to the Firefox browser that is launched during playback will affect the playback.

How can we see the file size affecting the slow response time of a web server?

Real Browser Monitoring includes a waterfall graph which gives information regarding the time taken to retrieve the various files, such as images, scripts, HTML docs, etc, that form a webpage. If a particular file is large and affects the performance, this will be shown in the waterfall graph. For more details, refer http://help.appmanager.com/real-browser-monitor-rbm.

How do we know the top SQL script that is using a DB instance?

From APM insight you can find the SQL script times. Refer http://help.appmanager.com/web-transaction-monitoringFor this you need to deploy agent in your application.

In a server where several applications have been hosted, when we realize that the server utilization is growing drastically larger, how do we detect the application that is over utilizing the server resource?

Monitor each application individually (either using Java runtime or dot net application monitor or APM Insight monitor) and place them in a dashboard to get a consolidated view of the resource consumption of the respective apps.

Which is the best method/recorder to monitor a sequence of pages that begins with a user login to their account on our website and ability to click links that include their personal account information? P.S. Those pages are not available without authentication to their account.

The HTTP(s) URL Sequence monitoring and Real Browser Monitoring should meet this requirement. Record a transaction where you login, perform the required operations and log out of the application and create a monitor for the same. The playback will happen periodically upon monitor creation.

Can we monitor SSL Certificate Expiry as well?

Yes, we can monitor SSL certificate expiry. Please refer http://help.appmanager.com/web-server-/-services$sslcertificatemonitoring for details.

Is it possible to monitor Citrix Storefront / Netscaler license expiry?

If it is accessible over 'https://' like a website, you should be able to monitor it.

Can content check in defacement monitor contain multiple value?

Yes. Content Check can contain multiple comma separated values.

If you are using RBM, it can record ajax calls but applets wont work.

How does the licensing goes for this EUM monitoring?

EUM is an Add-on. Once the add-on is purchased, you can have as many EUM Agents as you want. Each monitor added to a particular EUM Agent, will be counted as a monitor in APM. So, you will only be limited by your total monitor count.

How do you trace a URL monitor in your application logs? For e.g. if I want to identify the URL monitor polls in my application (apache) logs, how do I achieve that?

For the given URL monitor, you can set the User-Agent String in the configuration page. If the website does not restrict access based on the browser type, you can provide a unique value for this UA String and using the unique value and the IP Address of the machine where APM is installed, the you can trace the URLs, accessed by Applications Manager, in your Application's access log.

Do you point the APM insight agent to the Admin server or managed server? If managed server, then will you be able to see APM insight details (transactions) on the Admin Server?

We should point the Insight agent to the managed Server. However, you can view the monitor and transactions in the admin server as well.

What overhead does APM Insight cause?

The overhead depends on the number of transactions happening. Max Response time overhead is 4% and max Memory consumption is 300 MB (on 1000 transactions/min).

What is the latest version of the java-agent? Does it provide a similar interface as .NET agent?

Java Agent configuration are still text based and not UI based. The latest version of APM insight java agent is 2.2.1 and APM Insight .NET agent is 2.5.1. You can download the latest agents from https://www.manageengine.com/products/applications_manager/apm-insight-agent-installation.html

Is there any way to collect JMX metrics from the APM Insight agent?

No. For gathering JMX metrics, you will have to create a JMX Application monitor. Refer http://help.appmanager.com/services$jmx

Where can I see other http services called from the Java Application/JVM? Is this possible? For instance, say the app calls several other web services via REST or SOAP as an HTTP client.

If there are any traces for those particular transactions where this http calls are made, you should be able to see them.

Is it ideal to use APM Insight in production all the time?

Yes, If you want to have real time performance information you can deploy it in production as the overhead will be less. Additionally, you can also use it in development and QA environments.

Can we configure the same for a linux based apache/tomcat application?

Yes. Refer http://help.appmanager.com/installing-transaction-agent$tomcat

Firewall Analyzer

Can reports on internet usage be generated if a proxy is being used?

Yes, report can be generated even if the proxy is used.

How long should it take to configure my Checkpoint firewall to be accessed by Firewall Analyzer?

Refer our help doc to configure the firewall: https://www.manageengine.com/products/firewall/help/configure-check-point-firewalls-lea.html

Why do i need this tool when I have a Cyberoam that can provide me this kind of reports and user activity monitoring? Often our customers ask us this question.

Firewall Analyzer supports multiple vendor firewalls. If your customer switches to some other vendor firewall, he need not change the analyzer product. He can continue using Firewall Analyzer. User activity monitoring is only a part of the Firewall Analyzer functionality. It has much more capability which can be used to protect your network.

How are you importing firewall logs? Which firewalls are supported?

Go to Settings > Firewall > System > Import logs and click add choose option and upload files. Refer the same in below
link.http://help.fwanalyzer.com/import-log-files-v12 Refer supported device list in below
link.https://www.manageengine.com/products/firewall/help/firewall-analyzer-supported-firewalls.html

How do you support list of website/black listed Internet IPs? I wanted to know if a user or machine is connected to blacklisted IP addresses over the internet?

By creating a custom report with black list IP filter, you can get the report. Please refer below links. By creating a custom report with black list IP filter, you can get the report. Please refer below links. http://help.fwanalyzer.com/log-filters-v12

I want to see VPN Report as per the user's time not bandwidth useage.

You can create new report type for VPN by selecting user and duration column alone.

How much HDD is required to manage number of firewalls?

Hard disc requirement is purely based on the Syslog flow rate and the data retention time period.
Example:If there are 100 logs/sec flow rate and we want to retain the data for 1 month, then we need approximately 150 GB of HDD.
For more information on System Requirement, please refer the below link,
http://help.fwanalyzer.com/firewall-system-requirements-v12

Is the drill down option available for the dashboard widgets?

Yes, we can perform drill down analysis in the dashboard Widgets.

Can I get an alert from the application if there are no syslogs received from devices?

Yes, we can create an Availability Alert profile under Settings-->Firewall-->Firewall Server-->Availability Alert. This will notify via e-mail when Firewall Analyzer does not receive Syslogs from the firewall for a certain period of time.

Syslog forwarding port in the application says failed. What should I do?

If the given Syslog listening port(s) are occupied by any other application/process, then Firewall Analyzer will not be able to use the same port and it will show the status as "Failed". We need to ensure that the same port is not occupied by another application/process.

Can we create a report for raw data and schedule it?

Yes. Using the Raw Search option we can perform search for any given criteria and save those search results in the form of a Report.
Additionally, this report can be scheduled.

Unable to start the application automatically once the Firewall Analyzer server is restarted. What could be the problem?

The "Startup Type" of Firewall Analyzer Service should be set to "Automatic", so that the service will restart automatically when there is a Server reboot. Also, if the Firewall Analyzer is running as an "Application" (i.e. using the run.bat from CMD), then upon a reboot of Server, Firewall Analyzer won't start automatically. Hence, it's recommended to run the Firewall Analyzer as a service.

Device is forwarding the syslogs to the Firewall Analyzer server but device not added?

i) Log in to Firewall Analyzer Web Client and click on "Settings" tab-->Firewall--> "Syslog server" and check if, the corresponding port(s) (configured in firewall for forwarding logs) is "UP".
ii) Check if any firewall ( like Windows Firewall or any other ) is blocking the packets.
iii) Check if there is any unsupported logs under Settings-->Firewall-->Firewall Server-->Device Details. If yes, then delete them and check.

Unable to see the Application/Virus reports for Cisco devices in the product(Firewall Analyzer) Web-UI. What is the issue?Usually syslogs from Cisco ASA does not contain "Application" and "Virus" attribute.
Hence, the Application Report and Virus Report in Firewall Analyzer will be empty for Cisco ASA firewalls.

Can we add devices manually in the Firewall Analyzer?

We do not need to add firewalls manually in Firewall Analyzer. Once you configure the Firewall, you have to forward Syslogs to Firewall Analyzer Server, the firewalls be added automatically in application.
Exception:In case of Check Point Firewalls, we need to add the device in Firewall Analyzer.

Is there any other protocol used in Firewall Analyzer other than syslog?

We can use SNMP to generate Live Traffic and update Link speed for devices and interfaces.

Does your application support configuration analysis for Check Point devices?

We can not add Check Point Firewall in Firewall Analyzer with CLI credentials. By importing the configuration files (objects.C, objects.C_41, objects_5_0.C, rules.C, rulebases.fws, rulebases_5_0.fws) as a zipped format, Firewall Analyzer can generate the "Security Audit Report".

Standard, Change Management & Rule Management reports can not be generated for Check Point firewalls using Firewall Analyzer.

Can I get any specific version of Start-up (or) Running configuration from the application?

Yes, we can fetch the specific version of Start-up/Running configuration from the Change Management reports. This also helps us to compare different versions of Start-up/Running configuration and to find the difference between them.

While adding device rule, test credential got failed. What should I do?

Connect to the device using a standard TELNET/SSH tool (Putty) from the Firewall Analyzer server and then ensure that credentials given in Firewall Analyzer are in the same sequence similar to TELNET/SSH tool. Additionally, we need to ensure the login credentials are proper.

I have a Firewall with VDOMs. Will Firewall Analyzer fetch and analyze their configurations?

Yes, Firewall Analyzer can fetch the configuration from VDOMs.

Is it possible to ignore a line/configuration, so that it won't appear as a configuration change in Change Management Report?

Yes, we can use the "Exclude Criteria" feature (available under Settings-->Firewall-->Firewall Server) to ignore a line/configuration in Change Management Report.
Please refer the below link to know more about Exclude Criteria :
http://help.fwanalyzer.com/configuration-exclude-criteria-v12

How to get immediate notification for configuration change if anyone performed those changes anonymously?

While adding the firewall under Device Rule, under "Reports" section select "Generate Change Management Report". This will give an option to add the e-mail address to notify whenever there is any configuration change occurred in the firewall.

Can I roll-back any specific configuration using Firewall Analyzer?

No, we can not roll back the configuration in the Firewall using Firewall Analyzer.

Is there a report to verify who changed the configuration?

Yes, "Changed by" section of Change Management Report shows the User name, who performed the configuration change.
Can we update the Rule re-order position change automatically in Firewall? Firewall Analyzer helps to analyze the usage of each rule and suggests the position of the rule for optimum performance. Using Rule Re-order, Firewall Analyzer can not change the position of the rule in the firewall. Based on the Rule re-order suggestion Network Admin can change the position in the firewall.

I have to know what kind of command executed in the device over a period of time. Will Firewall Analyzer helps in getting such information?

Firewall Analyzer provides a pre-defined "Admin Report" with Successful User Logon, Successful User Logff, Denied User Logon & Commands Executed information. We can select a period of time in the calendar to view the commands executed for the same time.

For adding device in Firewall Anlayzer , we can use SNMP, is there any other method to do it?

Just configure the device to export syslogs into our server, device will be automatically added.

How to import data to change management i.e. currently under change management I have no data

Change Management will populate the data automatically. Consequently, Firewall Analyzer can detect rule/policy changes happened in the device, provided if you already configured device-rule for that particular device in the application.

Does Firewall Analyzer supports Fortigate? And how does it help with Fortigate logs?

Log reporting and configuration analysis is fully supported for Fortigate firewalls. You can export Syslog and Device-Rule, which will show you complete reports as explained in training-1.

I want to download configuration based on whatever I did in application. Will the Firewall Analyzer show me the information? If yes then how?

Yes, whenever a user logs in to the CLI, and make any changes and logs out. We receive a syslog and based on the received logs we can trigger a configuration fetch.

What is the format of the SNMPv3 password credentials?

You need to create the V3 user and view with Auth and Priv password. We support AES 256 and DES.

How can I see all the users on my Network with their device name, IP Address, Bandwidth consumption and blocking opportunity in ManageEngine?

You can achieve this with the combination of NetFlow Analyzer and NCM. Please refer the below link for NetFlow Analyzer. https://www.manageengine.com/products/netflow/

Is CISCO NXOS one of the templates?

Yes, CISCO NXOS is one of the templates.

Is there a possibility to export the device configuration manually from db and upload via CLI commands?

Yes, you can export the device configuration manually from db and upload via CLI commands.

What is exactly SysOID?

SysOID is the identifier for a device using SNMP.

Does NCM support Fortigate firewalls?

Yes, We do support all types of Fortigate.

How to import Domain Controller server on NCM?

You can navigate to Settings -> User Management -> Windows Domain and then add the controller.

Is Aruba fully supported?

Yes, We support any device that are managed through CLI.

Can we add CISCO L3 and L2 switch?

Yes, You can add L3 and L2 switch without any problem.

Is there a way to exclude items from being detected in change management?

Yes, we have the option of Exclude Criteria. Once you create the criteria, NCM will not check those for changes.

Do you have any approval process for taking backup & restore?

Yes, we do have this feature available in the product for all Operator users.

What do you mean by device template?

Device Templates are the template based on which we associate device type and with the Commands to backup the device.

Is there a necessity to automate the backups manually, before doing it automatically?

Yes, You have to backup the device once manually and then configure the Syslog automation.

What is config conflict?

It is the difference in Startup and Running or Running and Baseline configuration.

What happens if the "changed by" tab says it is "not available"?

There is a possibility that the Syslog message does not have the User name detail. Also for the backup done manually we will not have this field updated.

Which is your current NCM version?

The latest version for NCM in 123053.

Where is the Exclude Criteria?

You will find it under Settings -> NCM -> Exclude Criteria

Can snmpv1 be disabled due to vulns?

We have option to use V2, v2c and V3. You can choose any based on your requirement.

Do you have any other feature apart from backup/restore like running some script?

We do have the Configlets feature in the product that will allow you to push changes to the devices using script.

What is Line feed and are timers configured in ms?

Line feed means a "new line char" and timers are configured in milliseconds.

Whose IP address is seen in the server field of server settings?

It will be by default, the NCM installed server IP address.

Where can I find logs related in order to find the reason for backup failures?

When you drill down to the Device Snapshot page, you will get the Reason of the failure.

If I edit a configuration and not save it, then how does it create a problem?

There will be no change in the startup config and we will backup the running config alone. It will show the Startup-Running config Conflict in the UI

What do you mean by unauthorized change?

If you make any changes outside NCM tool, then it is marked as unauthorized changes.

So I have to make all changes via NCM and not by taking local access to device?

All Changes will be mentioned as Authorized.

Is there a command list for the Advanced Execution configlets?

Yes. We have the document: http://help.networkconfigurationmanager.com/automation_using_configlets-new-ui_v12/

Are the compliance policies only for checking the device against the policy, or can we make the corrections using NCM?

Yes, you can do the changes using NCM with the help of configlets.

Can the compliance reports be run on any device that has CLI or is it limited to Cisco only? I'm asking because I have a device that has just the running config.

If the configuration file is present in NCM, then you can run the compliance check on the devices.

So as long as I can backup configuration, NCM can compare/check configuration compliance?

Yes, that's correct.

Is a separate RADIUS server needed for this or NCM has RADIUS functionality in-built?

You can integrate your RADIUS server and authenticate your already existing users. You can refer the below link for the configuration: http://help.netflowanalyzer.com/user-management$Radius%20Server%20Settings

Can we see the comparison of the last config with current config?

Yes, we can see this in NCM under 'Device Snapshot' page.

Is NCM compatible with MikroTik devices?

Yes. We do support MikroTik devices.

Is the search term highlighted when I perform a global search? For example, if I search for 'public', are the search results displayed with the keyword 'public' highlighted?

Yes, the searched string will be highlighted in the search results.

Can you show us how to upload a configuration change to a switch?

You can use Configlets or Configuration upload feature, which you can see here.http://help.networkconfigurationmanager.com/automation_using_configlets-new-ui_v12. For more details, please contact support.

Is there a way to exclude items from being detected in change management?

Yes, we have the option of Exclude Criteria. Once you create the criteria, NCM will not check those for changes.

Is it a stand-alone software or it is cloud-based?

It is a stand-alone software.

What is the advisable number of configuration rules one should add? Or can we add it according to our purpose?

There is no limitation, you can specify any number of policies based on your requirement.

How to clear old config backup of devices in the NCM database?

It is not possible to delete the config files directly. But, you can provide DB clean-up actions like deleting the older versions other than the last 10 versions, or deleting config files older than 10 days, etc.

Can someone hack my NCM database and have access to all of my configuration?

No, we store the configuration in encrypted format in our database and it cannot be accessed from outside.

Can you create a configlet to remove all of the NAT entries for a router using wildcards?

Yes, this is possible with Configlets.

How much bandwidth it will consume to send the syslogs over the internet link?

It depends on the number of logs forwarded from the firewall to Firewall Analyzer.

Whether it is using NetFlow Analyzer to check the user bandwidth? or how the user bandwidth details are calculated?

Firewall Analyzer uses the Syslogs to calculate the user bandwidth details. NetFlow or NetFlow Analyzer is not used to calculate bandwidth details in Firewall Analyzer.

Whether Firewall Analyzer supports Cisco FirePower IPS device?

Yes, Firewall Analyzer supports Cisco FirePower IPS device.

What is the type license I require to procure it?

Firewall Analyzer license is based on number of Firewalls that needs to be monitored.

Traffic management, Security Management, and Device management required any separate license?

Firewall Analyzer licensing is based on number of firewalls. No separate license is required for the reports.

How about HA failover firewall device license and remote location device license

For HA failover, if you are using one VRRP IP address, you need only 1 license.

Does the license depends on the logs/day and storage

No, licence depends on the number of firewalls that you want to monitor

How does the user data integrate into the Firewall Analyzer?

Once the AD is configured in User Name-IP Mapping Setting of Firewall Analyzer, the AD user Login events will be captured to get the AD User Name. When there is any traffic transaction done by the same user, the IP and the User name will be mapped.

How does the analyzer pull the data for the LDAP user in non-windows servers?

As of now LDAP integration is not available in Firewall Analyzer.

Is it possible to create a custom report , like Fortigate have a FortiAnalyzer which you can create your own report?

It is possible to create custom reports in Firewall Analyzer UI itself.

Can the user traffic be monitored in the NGFW firewalls which are using URL filtering?

Yes, we can monitor the traffic from NGFW firewalls using Firewall Analyzer.

I have seen the Firewall Analyzer can do the traffic analysis, does the NetFlow should be integrated for the same from all the devices?

NetFlow is not required for Firewall Analyzer. Only syslogs are used for both the Traffic & Security Analysis.

Does the Firewall Analyzer generate the report for Layer 7 (application layer) DDOS attacks?

Firewall Analyzer will be able to generate the reports based on the information available in the Syslogs. i.e. if the Syslog contains the Attribute as "Attack = DDOS" then Firewall Analyzer will be able to detect it

Can the IPS logs be integrated into Firewall analyzer?

Yes, IPS logs can be monitored using Firewall Analyzer.

I have fortianalyzer. Is it the same or deffrent?

Firewall Analyzer provide mutli-vendor support with advanced analytics and reporting. Analyzing the firewall rules/policies and making the network 100% compliant becomes hassle free using the Firewall Analyzer.

Is Netflow Analyzer the same?

In Firewall Analyzer we show information only with the Syslogs exported by the Fortigate Devices and not on NetFlow. We have different product for NetFlow based reporting.

Do you support Barracuda devices? Or where I can find list of supported devices?

Yes, we support Barracuda devices in Firewall Analyzer. Please refer the below link for supported devices: http://help.fwanalyzer.com/supported-firewalls-v12

Frequently Asked Questions (FAQ)

OpManager

OpManager

OpManager

OpManager

OpManager

NetFlow Analyzer

NetFlow Analyzer

NetFlow Analyzer

Network Configuration Manager

Network Configuration Manager

Network Configuration Manager

Applications Manager

Applications Manager

Applications Manager

Applications Manager

Firewall Analyzer

Firewall Analyzer

Firewall Analyzer

Videos

OpManager

Discovery and Classification

OpManager

Network/Server Performance Monitoring

OpManager

Effective Fault Management and IT Automation

OpManager

Dashboards and Widgets, Business Views, 3D Data-center and Reports

OpManager

NetFlow Analyzer

NetFlow Analyzer: Getting the initial settings right

NetFlow Analyzer

Diagnosing and troubleshooting traffic issues faster

NetFlow Analyzer

Network Configuration Manager

Network Configuration Manager

Network Configuration Manager

Applications Manager

IBM Db2 and system i monitoring

Applications Manager

Cloud monitoring

Applications Manager

End-to-end ERP performance monitoring

Applications Manager

Why you should monitor your Middleware

Firewall Analyzer

Firewall Analyzer training Part 1

Firewall Analyzer

Firewall Analyzer training Part 2

Firewall Analyzer

Archives

OpManager

Why can't I add performance monitors via Rule Engine?

Make it sense to use layer2 discover without CDP?

What is the role of this seed router?

Does REST API work with FreshService?

What will happen if we have virtual devices in a cluster. How we can be sure that we will monitor the devices even in the case that it moves to different physical computers of the cluster?

Imagine I want to skip all the windows pc when I discover network devices, my list shows unknown category?

How I can discover and monitor only critical interface of switch like uplink or ten gigabit interface?

How to rediscover IP address in network devices?

Can I modify DomainController category?

How shall i discover cisco l2 switch?

Is there any site, where i can see the custom made templates publically?

What happens if I accidentally delete VMwareVirtualMachine template or some monitor of it, then how do I re-add the monitor or the entire template?

Can a device be added, just for the ability to ping test, without SNMP or WMI. I have vendor devices on my network, that I do not have SNMP or WMI on. I just need to to Ping these devices?

Will it monitor an exchange/Office 365 hybrid environment?

Is file monitoring only available for Windows?

Nutanix runs in a CentOS environment, would it be able to monitor that?

What is exactly total traffic for an interface ? Is it the total traffic from the specific point in time until another point in time?

How can I know the total amount of traffic through an interface from time 1 to time 2 ? Is there a report?

Is it possible to make a script run from a specific device instead of the monitoring server and I'm talking here about Microsoft windows devices?

What should I do when I discover a vCenter and in "virtual details" it shows the esxi host, but it doesn't start monitoring automatically? DNS records are correct. How can I force start monitoring it? Rediscovering vCenter, deleting and readding vCenter also doesn't help.

I have 6 ESX host, however one doesn't show up under Virtualization / VMware-Host. How do I add it to that section?

Why does SNMP write have to be enabled for IPSLA?

What permissions are required by the vmware vcenter credentials?

What is the quickest/easiest way to identify against which IP or interface the DOS attack is against from my main router, I am also using your product netflow?

What happens if the OpManager Server Hard Disk goes full, how can we free Space on Server?

If someone DOS attacks me, how can i see the network utilization in for example last 3 minutes to solve the problem quickly, not in last 1 hour. If I view it in last 1 hour then its very hard to notice the massive peak in my network.

What constitutes a license for a monitored device? i.e. = Physical Server / Virtual Host (HYPER-V)? –> Virtual Machines?

How can we monitor VPN connections in a Cisco ASA and create a view of this?