Foglight Evolve 6.1.0 - Administration and Configuration Guide

View Audit Information

Use the View Audit Information dashboard to explore log entries. Log entries show the users that are logged in, changes made to user security settings, or any changes made to rules, schedules, or registry variables. Select a time period for which you want to view the logs, and optionally, print the desired set of entries to a file.

IMPORTANT: The appearance of the dialog box may be different, depending on the type and version of your web browser.

IMPORTANT: If you show or hide one or more columns in the audit log table, this layout is reflected in the export file. For example, if you display only the time range and the operation name, only those columns appear in the export file.

The following table lists the operations that are audited by Foglight. In addition to the operations listed below, Foglight audits the following operations:

Table 8. Operations audited by Foglight and the originating service.

Service	Operation
AgentPropertyServiceImpl	cloneConfigModel(PropertyPath, String)
	cloneConfigModel(String, String, String, String)
	deleteClonedConfigModel(PropertyPath)
	deleteClonedConfigModel(String, String, String)
	removePrivateProperty(PropertyPath)
	removePrivateProperty(String, String, String)
	saveConfigModel(PersistableConfigModel, Boolean)
AgentServiceImpl	activate(String)
	deactivate(String)
	delete(String)
	markObsolete(String)
	startDataCollection(String)
	stopDataCollection(String)
AlarmService	acknowledgeAlarm(String)
	autoAcknowledgeAlarm(String)
	clearAlarm(String)
CartridgeServiceImpl	activateCartridges(Collection<String>, boolean)
	installCar(String)
CartridgeServiceSL	activateCartridge(String)
	deactivateCartridge(String)
	uninstallCartridge(String)
com.quest.nitro.admin.ui.xwork.support.SessionAuditor	com.quest.nitro.admin.ui.xwork.action.navigation.LandingPageActionsessionDestroyed(HttpSessionEvent)
	sessionCreated(HttpSessionEvent)
	sessionDestroyed(HttpSessionEvent)
DerivationServiceBean	deleteDerivations(Set<String>)
	saveDerivation(DerivationInterface)
DynamicModelServiceBean	deleteModelAssociation(ModelAssociation)
	deleteModelAssociation(String)
	saveModelAssociation(ModelAssociation)
Foglight4MigrationServiceSL	cancelScheduledTasks(String, String)
	migrateAgent(String, String, String, Map<String, Object>)
	migrateData(String, String, String, Map<String, Object>)
	migrateDcm(String, String, String, Map<String, Object>)
	refreshFgl4Server(String, boolean)
	registerFgl4Server(String, String, String, Integer, String, String, String, File, boolean)
	registerHostNameMapping(String, String, String)
	unregisterFgl4Server(String)
	unregisterHostNameMapping(String, String)
LicensingBean	importLicenseFromFile(String)
	removeLicense(String)
NitroExtendedLdapLoginModule	abort()
	commit()
	logout()
MonitoringPoliciesDeployerBean	exportToFile(String)
	importFromFile(String)
PersistenceConfigServiceBean	deleteGroupingPolicy(GroupingPolicy)
	deleteGroupingPolicy(String)
	deleteLifecycle(Lifecycle)
	deleteLifecycle(String)
	deleteRetentionPolicy(RetentionPolicy)
	deleteRetentionPolicy(String)
	deleteSchema(Schema)
	deleteSchema(String)
	saveGroupingPolicy(GroupingPolicy)
	saveLifecycle(Lifecycle)
	saveObservationLifecycle(ObservationLifecycle)
	saveRetentionPolicy(RetentionPolicy)
	saveSchema(Schema)
	setDefaultLifecycle(ObservationLifecycle)
RegistryServiceBean	deleteRegistryVariables(Collection<RegistryVariableInfo>)
	saveRegistryVariable(RegistryVariableInterface)
RemoteAgentManagementServiceImpl	downloadClientFile(String, String, File)
	initializeAgent(String, String, String)
	initializeAgentAsync(String, String, String)
	installAgentPackage(String, String)
ReportingServiceBean	deleteGeneratedReports(List<DataObject>)
	deleteReportResults(List<String>)
	deleteReportResults(String)
	deleteScheduledReport(ScheduledReport)
	executeReport(ReportContext)
	generateReport(ReportContext, String)
	saveScheduledReport(ScheduledReport)
RuleServiceBean	deleteRule(String)
	deleteRules(Set<String>)
	saveRule(Rule)
	suspendRuleActions(String, Date)
	suspendRuleAlarms(String, Date)
	unsuspendRuleActions(String)
	unsuspendRuleAlarms(String)
ScheduleServiceBean	deleteSchedules(Set<String>)
	saveSchedule(NamedScheduleInterface)
ScriptingBean	invoke(ScriptInvocation)
	runNamedScript(String, ScriptExecutionParams)
	runScript(String, ScriptExecutionParams)
	runScript(String, String, Object[])
	runScript(String, String, TopologyObject)
	runScript(String, String)
	verify(ScriptVerification)
	verifyScriptText(String)
SecurityServiceBean	addGroupToUser(SecUser, SecGroup)
	addRoleToGroup(SecGroup, SecRole)
	addRoleToUser(SecUser, SecRole)
	changeOwnPassword(String, String, String)
	changeUserPassword(String, String, String)
	createGroup(String, String, String, boolean)
	createGroupNesting(SecGroup, SecGroup)
	createRole(String, String, String, boolean)
	createUser(String, String, String, String, boolean, boolean, boolean)
	deleteGroup(SecGroup)
	deleteGroupNesting(SecGroupNesting)
	deleteObjPermission(SecObjectPermission)
	deleteRole(SecRole)
	deleteUser(SecUser)
	deleteUserObjPermission(SecUserObjPermission)
	setObjAceByIds(String, String, int, boolean, String)
	setObjAceByNames(String, String, int, boolean, String)
	setUserObjAceByIds(String, String, int, boolean, String)
	setUserObjAceByNames(String, String, int, boolean, String)
	storeGroup(SecGroup)
	storeGroupNesting(SecGroupNesting)
	storeLdapConfig(SecJaasLdapConfig)
	storeObjPermission(SecObjectPermission)
	storeRole(SecRole)
	storeUser(SecUser)
	storeUserObjPermission(SecUserObjPermission)
SupportBundleServiceImpl	createSupportBundle()
	createSupportBundle(SupportBundle)
	deleteBundle(SupportBundle)
ThresholdServiceBean	deleteThreshold(String)
	deleteThreshold(Threshold)
	saveThreshold(Threshold)

 

Online-Only Topics

Learn more about:

Cartridge Inventory and Components for Download

The Cartridge Inventory dashboard lists the cartridge that exist in your system and contains controls for installing, enabling, disabling, and uninstalling cartridges.

Installation is the first step in adding a cartridge to the Foglight Management Server. A cartridge file has the extension.car. Installing the CAR file causes the Management Server to be aware of all cartridges in the CAR file.

Use the Cartridge Inventory dashboard to install a cartridge. Alternatively, use the cartridge:install command. This fglcmd command allows you to install one or more cartridges at a time. For more information, see the Command-Line Reference Guide.

Some Foglight cartridges are license-protected, while others do not require a license. You can install any cartridges, regardless of their license requirements. However, installing a license-protected cartridge without adding its license results in that cartridge being disabled by default. For more information, see Managing Licenses.

NOTE: In some cases, there are dependencies between two or more cartridges. Enabling or disabling a cartridge may prompt you to provide further input, such as to disable or enable additional cartridges, or can inform you that the cartridge cannot be enabled due to cartridge dependency.

A cartridge must also be enabled before it is added to the Management Server. You can enable a cartridge before or after its installation.

TIP: To view only cartridges which are enabled, click the Only display enabled cartridges check box at the bottom of the screen. In addition, you can sort by the Version and Creation Date columns.

TIP: Enabling a cartridge completes the installation process by making the cartridge components available for use by the Management Server. Alternatively, you can enable the cartridge at a later time. For details, see Enable or disable Foglight cartridges.

Enabling a cartridge completes the process of adding it to Foglight by making the cartridge’s components available for use by the Foglight Management Server.

Disabling a cartridge causes its components to no longer be available for use by the Foglight Management Server. A disabled cartridge remains installed on the Management Server. For example, Foglight automatically disables older versions of cartridges when newer versions are installed.

NOTE: It is strongly recommended that you do not disable a cartridge unless your intention is to remove it indefinitely. Although data is retained in the database, user configurations can be lost, and expired topology types are removed when cartridges are disabled and re-enabled.

A cartridge can be in one of the following states:

You can install any cartridge, regardless of the contents of your Foglight license. Installing a license-protected cartridge without adding its license results in that cartridge being disabled by default. Before enabling a license-protected cartridge, ensure that its license is installed and current. For more information, see Managing Licenses.

When you install a newer version of an existing cartridge, Foglight detects that, and automatically disables the older version.

NOTE: In some cases, there are dependencies between two or more cartridges. Enabling a cartridge may prompt you to provide further input, such as to enable additional cartridges, or can inform you that the cartridge cannot be enabled due to cartridge dependency.

TIP: The Status column contains icons that indicate if a cartridge is enabled , enabled pending dependency , partially enabled , or disabled .

NOTE: It is strongly recommended that you do not disable a cartridge unless your intention is to remove it indefinitely. Although data is retained in the database, user configurations can be lost, and expired topology types are removed when cartridges are disabled and re-enabled.

TIP: The Status column contains icons that indicate if a cartridge is enabled , enabled pending dependency , partially enabled , or disabled . To view only cartridges which are enabled, click the View only Activated Cartridges check box at the bottom of the screen.

Uninstalling a cartridge removes the cartridge files from the Foglight Management Server installation.

A .car file can contain multiple cartridges. When you remove all of the cartridges that come in a .car file, the .car file is deleted.

Before removing a cartridge, make sure that the cartridge is disabled, and that any agent instances that come with the cartridge do not collect data. Uninstalling a cartridge while its agents are still collecting data prevents the Foglight Management Server from recognizing the data that the agents collect. For more information about disabling a cartridge, see Enable or disable Foglight cartridges.

TIP: The Status column contains icons that indicate if a cartridge is enabled , enabled pending dependency , partially enabled , or disabled .

The Components for Download dashboard lists the agent components that are included with the Foglight Management Server or any of the installed cartridges, and are available for download. It also provides access to any files that you may need to download following a cartridge installation. If you have access to the browser interface, use this dashboard to view information about the available components, and to download them.

TIP: The Component for Download URL contains a direct link to the component file that is accessible without needing to login. This can be used to download components in headless environments when browser access is not possible.

NOTE: The appearance of the dialog box varies, depending on the type and version of your web browser.

If you do not have access to the browser interface and want to use a direct URL to download agent components, you can do that either by typing the URL into the web browser address field, or use it in combination with a command-line utility such as wget.

NOTE: The appearance of the interface varies, depending on the type and version of your web browser.

IMPORTANT: The wget utility illustrated above is a command-line tool that can be used to retrieve a file from a URL using standard Internet protocols. This command does not come with Foglight. For more information about this command, visit http://www.gnu.org/software/wget/.

Some Foglight dashboards have reports associated with them. This allows you to run a report based on the current dashboard. You can generate the report using the Reports menu in the top-right corner.

The Cartridge Inventory dashboard is associated with the Cartridge Inventory Report. Run this report by choosing Cartridge Inventory Report from the Reports menu.

The report wizard provides more information about the Cartridge Inventory Report. For more information about reports in Foglight, see the Foglight User Help.

This dashboard is a starting point for viewing and managing Foglight Agent Managers. It displays a list of all Agent Managers that exist in your environment, and allows you to manage them. To access the Agent Managers dashboard, from the navigation panel, click Dashboards > Administration > Agents > Agent Managers.

TIP: You can navigate to the Agent Adapters dashboard from this page. To do that, in the upper-right corner, click Agent Adapters.

You can select one or more hosts and click a button just above the table to perform a desired operation on the selected host. For example, to create an agent instance and manage it by a specific Agent Manager, select an Agent Manager, and click Create Agent. The following commands are available:

The upper part of this dashboard lists the connected Agent Manager hosts. Some columns are hidden by default You can control the appearance of columns using the Customizer .

This area provides information about any running tasks initiated from this dashboard. For example, when you deploy an agent package, the status of that task appears in this area.

The lower part of the Agent Managers dashboard provides information about any completed or running tasks that are initiated on this dashboard. By default, the following columns are displayed:

Two additional columns are not hidden by default. You can display them in the Customizer :

This dashboard is a starting point for viewing and managing Foglight Agents. It displays a list of all monitoring agent instances that exist in your environment, and allows you to manage them. To access the Agent Status dashboard, from the navigation panel, click Dashboards > Administration > Agents > Agent Status.

You can select one or more hosts and click a button just above the table to perform a desired operation on the selected host. For example, to activate an agent instance, select it in the table, and click Activate. The following commands are available:

The upper part of this dashboard lists the available agent instances. Some columns are hidden by default. You can display the hidden columns using the Customizer .

This area provides information about any running tasks initiated from this dashboard. For example, when you deploy an agent package, the status of that task appears in this area.

The lower part of the Agent Managers dashboard provides information about any completed or running tasks that are initiated on this dashboard. By default, the following columns are displayed:

Two additional columns are hidden by default. You can display them using the Customizer :

An administrator uses services to help organize the monitoring environment. The Agent Status dashboard allows you to filter and display the agents that capture data about the monitored objects in the selected service(s). This option helps you better monitor the agent, like checking the agent status, stopping data collection and so on.

To filter agents by services:

Agent Status and Agent Managers

Foglight cartridges use agents to collect information from monitored hosts. Agents communicate with the Foglight Management Server using the Foglight Agent Manager. When you install a cartridge on the Foglight Management Server, the cartridge installation process makes its agent packages available for deployment. You can only deploy those agent packages whose cartridges are already installed on the Foglight Management Server and on which the Foglight Agent Manager is installed and running.

IMPORTANT: Any agent packages that you deploy must be compatible with the host’s platform. Failing to do so can cause existing agents to be deleted, if they were previously deployed to the host, and as such can lead to unpredictable results.

Use the Agent Managers dashboard to deploy one agent package at a time, or to deploy the agent package to multiple hosts. You can also deploy agent packages to a single host from the Agent Status page.

Alternatively, use the agent:deploy command to deploy agent packages from the command line. For complete information about this and other fglcmd commands, see the Command-Line Reference Guide.

NOTE: In order to select the host, the Foglight Agent Manager must be up and running on the monitored host.

NOTE: You can only deploy those agent packages whose cartridges have already been installed on the Foglight Management Server.

IMPORTANT: Do not deploy any agent packages that are not compatible with the host’s platform. Deploying incompatible agent packages on top of existing compatible agent packages deletes the existing agents which can cause unpredictable results.

NOTE: In order to select the host, the Foglight Agent Manager must be up and running on the monitored host.

NOTE: You can only deploy those agent packages whose cartridges have already been installed on the Foglight Management Server.

IMPORTANT: Do not deploy any agent packages that are not compatible with the host’s platform. Deploying incompatible agent packages on top of existing compatible agent packages deletes the existing agents which can cause unpredictable results.

 

IMPORTANT: Do not deploy any agent packages that are not compatible with the host’s platform. Deploying incompatible agent packages on top of existing compatible agent packages deletes the existing agents which can cause unpredictable results.

NOTE: You can only deploy those agent packages whose cartridges have already been installed on the Foglight Management Server.

After a successful agent package deployment, you can proceed to create agent instances using the agent types included in the newly-deployed agent package. For more information, see Create agent instances on monitored hosts.

You can remove (undeploy) an agent package from a monitored host using the Undeploy agent package option on the Agent Managers dashboard.

The Foglight Agent Manager collects information from the agents monitoring hosts and relays it to the Management Server. In some instances, such as making a change to the Agent Manager configuration, you may need to restart the Agent Manager. You can do so from the Agent Managers dashboard.

Remote updates of the Agent Manager are deployed from the Management Server. Local access to Agent Manager clients is typically not required to perform an upgrade. You cannot use the Agent Manager installer to upgrade. You must upgrade the Agent Manager through the Agent Managers dashboard.

Foglight cartridges use agents to collect information from monitored hosts. To start collecting data from the monitored system, it is necessary to create first and subsequent instances of the desired agent type. You can create an agent instance when the agent package that contains that agent type has been deployed to the monitored host. Creating an agent instance creates an agent process on the monitored host.

Use the Agent Status dashboard to create an agent instance for one host at a time. To create agent instances on multiple hosts, use the Agent Managers dashboard instead.

Alternatively, use the agent:create command to create agent instances from the command line. For complete information about this and other fglcmd commands, see the Command-Line Reference Guide.

NOTE: In order to select the host, the Foglight Agent Manager must be installed and running on the monitored host.

NOTE: You can only create instances of those agent types that have already been deployed to the monitored host.

TIP: Deleting an agent instance created with the Generic Name option, followed by creating an instance of the same agent type, also with the Generic Name option, results in copying the properties of the deleted agent instance to the instance that is about to be created. If the deleted agent instance had custom properties set, those custom properties are automatically assigned to the new agent instance, which is reflected by the Property State column . This behavior is intended, and it allows you to quickly retrieve the previous settings, and start from there, without having to re-create them again.

NOTE: You can only create instances of those agents whose agent packages have already been deployed.

TIP: Refresh the page to see the complete list.

After creating an agent instance, you need to its properties. For more information, see Edit instance-specific agent properties.

Agent tagging allows you to form logical groupings of agents for sorting and selection. With tags, you can edit properties for a group of agents. For information on how to use tags to select a group of agents in order to edit their properties, see Edit instance-specific agent properties .

Agent instances can have multiple tags. You can modify the tags for each individual agent instance.

NOTE: To remove an existing tag association, in the row containing the selected tag, click the Apply To column and select None.

Foglight Management Server allows you to set the debug level of FglAM logs from the Agent Managers dashboard. The amount of debug messages depends on the specified debug level.

NOTE: If the debug level is set to “Extremely verbose debug logging”, many logs are written to the log file and the log file size becomes huge. Therefore it is strongly recommended that you do not select this debug level and print logs over than 20 minutes.

When an agent connects to the Foglight Management Server, it is provided with sets of properties that it uses to configure the agent’s running state. Foglight stores agent properties on the Foglight Management Server.

Default versions of these properties are installed with the cartridge in which the agents are included. You can edit the default properties, create sets of properties that apply only to a specific agent instance, or create edited clones of property sets that are used by a subset of the agents of a certain type.

You have the following options:

The Agent Status dashboard allows you to choose the scope of the edit operation and edit the properties of an agent instance, or of all properties of that type. Its Property State column allows you to quickly identify the agent instances that have custom properties assigned to them.

Another way to edit type-specific properties is using the Agent Properties dashboard. For more information, see Edit primary type-specific properties.

TIP: This option is available for selection only if the agent instance does not have custom property values.

NOTE: All text boxes have a limit of 64 characters.

IMPORTANT: Default list properties, associated with the agent type are type-specific, and as such global in nature, which means that any changes to them affect all instances of that agent type. To override this behavior, you can create an instance-specific list by cloning a global list and assigning the cloned list to the agent instances. Any changes to this list affect only those agent instances to which the list is assigned. Examples of situations in which you may want to clone a list include the following scenarios: You want a set of default agent properties to use different lists at different times. For example, you may want to create a clone of a list and configure it to have different settings during testing. You want to use lists with different settings in different agent instances.

Activating an agent instance starts the agent process and data collection on the machine on which the agent is installed. Deactivating an agent stops the agent process and data collection.

The Activated icon () on the Agent Status dashboard indicates if the agent is active, while the Deactivated icon () indicates the agent is inactive.

Alternatively, use the agent:activate or agent:deactivate commands to activate or deactivate agents. These commands come with the fglcmd interface. For complete information, see the Command-Line Reference Guide.

If an agent instance fails to activate, you can use the agent’s log file to determine the cause of the problem. For more information, see Retrieve agent logs.

TIP: Some Foglight agents require root-level privileges to run on Unix. This can be accomplished by making sure that the user account used to install the Foglight Agent Manager on the monitored host does not appear in the sudo configuration file. However, if the Foglight Agent Manager does not have root-level privileges, the agents that require those privileges fall back to normal, non-root launch. Starting those agents without root privileges does not prevent them from activating and collecting data. For more information about installing the Foglight Agent Manager with root privileges, see the Installation and Configuration Guide.

NOTE: It may take some time for the Activated () and Collecting Data () icons to appear even if activation of the agent was successful. The Activated icon appears when the Management Server has confirmed that the agent has started and is running. If the activation command was executed successfully but the agent fails after starting, the Activated icon will not appear.

By default, the Foglight Management Server accepts only the data that is collected within one hour from the moment it is received. The one-hour window allows the server to accept the data that Foglight agents collect during such short-term disruptions. When the connection with the server is lost, Foglight agents continue to collect and store data from monitored hosts, and forward that data to the server when the connection is restored without any additional configuration of the agents or agent manager components.

This feature is useful in situations when an agent temporarily loses a connection with the server. However, in some situations, such as a longer-term network outage, you may need to increase the one-hour time window to prevent the Foglight Management Server to discard the data with timestamps that are older than one hour.

The length of that time window can be controlled with a virtual machine (VM) option, foglight.data_service.max_past_timestamp_delta. Add this option to the configuration file <Foglight_home>/config/server.config to change the length of the store-and-forward period in milliseconds.

Any data with older timestamps that is received and accepted by the Foglight Management Server triggers data-driven rules and derived metrics. Time-driven rules do not re-evaluate data with older timestamps, even if that data meets their conditions and would cause them to fire if collected in real-time.

CAUTION: Changes made to the data-collection status of an agent by following the instructions below will not be persisted if: • The server is restarted. • The agent exits a blackout period. See Suspending Alarms and Data Collection for information about agent blackouts.

IMPORTANT: In order for the changes to take effect, you need to restart the Foglight Management Server.

When you delete an agent, that agent instance is removed from the monitored host. You can only delete those agent instances that you create after the installation. This excludes agent adapters that also appear in the Agent Status dashboard, such as the SPI Network adapter. Selecting the row containing the SPI Network adapter entry disables the Delete button.

Alternatively, use the agent:delete command to delete an agent instance. The command comes with the fglcmd interface. For complete information about this command, see the Command-Line Reference Guide.

TIP: To select multiple agent instances, press the CTRL or SHIFT key while selecting the rows containing the instances for which you want to start data collection.

Agent log files contain entries that describe the operations an agent process performs while it is running on the monitored host. Use agent logs to solve problems related to an agent’s state or behavior. For example, if an agent instance fails to activate, you can use an agent log file to determine the cause of the problem.

Foglight stores agent logs on the monitored host, with their path and file names using the following syntax:

<foglight_client_home>/state/default/logs/<cartridge_name>/<cartridge_version>/logs/<agent_type>/<agent_name>_<date>_<time>_<file_ID>.log

Where:

For example:

C:\Quest\Foglight_Agent_Manager\state\default\logs\HostAgents\6.1.0\WindowsAgent\WindowsAgent_on_Host1_2011-11-21_124119_001.log

An agent instance can generate one or more log files, one for each period of time the agent is running. Use the Agent Status dashboard retrieve the latest log file generated for an agent instance.

Alternatively, use the agent:getlog command to obtain an agent’s log file. The command line offers more flexibility in that it allows you to obtain older log files.The command comes with the fglcmd interface. For complete information, see the Command-Line Reference Guide.

NOTE: The appearance of the dialog box varies, depending on the type and version of your web browser.

NOTE: Copying agent logs into the <Foglight_home>/logs directory enables them to be added to the server support bundle. For more information about server support bundles, see Managing Support Bundles.

Some Foglight dashboards have reports associated with them. This allows you to run a report based on the current dashboard. You can generate the report using the Reports menu in the top-right corner.

The Agent Managers and Agent Status dashboards are associated with the Hosts Report. Run this report by choosing Hosts Report from the Reports menu, and specifying the input parameters in the report wizard.

The report wizard provides more information about the Hosts Report and instructions on how to set the input values. For more information about reports in Foglight, see the Foglight User Help.