ntservices default profile

[Anon Anon]

Hello, I would like to have the existing running services on a server added to the default profile (ticked) automatically (my theory is that if they are currently running on a server then those are the ones I need to monitor first) when I deploy the probe but cannot see a way of doing this.

 

I noticed on the services tab that if I right click on a service  there is an option of 'add to profiles' but this is greyed out. Is there a way to do this please?

Thank you

Kevin

[Anon Anon]

You only have to add to profiles the services that are not already listed as profiles. The default behavior of the probe is to automatically create profiles for all services on the host, whether running or not. It just does not activate any of the profiles by default.

 

In the Properties tab, you have the option of activating profiles by default and deciding whether to activate all profiles or only those for probes that are running and set to start automatically.

 

-Keith

[Daniel Blanco]

Hi Ken, how exactly do you do this? When the latest ntservices probe is deployed v3.17 nothing is added to monitoring. What I'm trying to do is configure it so that if I ever re-deploy, I want the probe to put into monitoring services that are set to automatic. 

 

Do I have to deploy base ntevl probe to clean box. 

Open the probe and then check off "Automatically add new services"

Save this probe to archive.

Modify the cfx file and remove all the Services in the services list so that when I then deploy this, does it thing the base list is the initial list and after its deployed it will think everything it sees will be considered "NEW" and if set to Automatic then add to monitoring? 

 

Is this the correct approach in getting this done this way? Thanks, Dan

[Anon Anon]

You need to configure the "Default values for added new services" section in Setup -> properties. After that if you clear the <services> section in your CFX, they will be configured accordingly.

 

-jon

[Daniel Blanco]

Thanks Jon. Let me ask then if this is the right way to do this. 

 

I want to monitor a base set of ntservices on every windows box. I deploy the probe, check off the services I want then save this profile. 

Afterwards when I deploy this profile and use it on another system, I want to have those base services beining monitored only but after the deployment, if anyone installs anything new after that point I would want to be alerted and those services be put into monitoring. 

 

Example: 

Create Profile1 by dropping ntservices probe onto Box1. Configure it so that it only monitors Services 1,2,3.

Save this as NTServices_profile1.

 

Then drop NTServices_profile1 onto Box2. Services 1,2,3 are monitored and the probe takes a snapshot of whats on the box at the time of deployment. But if anyone installs say Service 5 then add that to monitoring and alert on it

 

Do you know if this is possible or would I have to create two profiles? 

 

NTServices_profiel1 would contain JUST Services 1,2,3

 

Then a 2nd profile that would update the <Setup> section to say: Add To monitoring Newly created Services.

 

Would this be the only way to go about this type of setup?

[Anon Anon]

Hi,

 

You can put it all in the same "profile", meaning package / cfx. You can put your "base" services there, and the also the sections that defines how added services are handled.

 

-jon

[Daniel Blanco]

So I figured out how to do what I was looking for but want to know if its possible with only 1 cfx file and not having to deploy 2 templates.

So in ntservices_1 I specify to "Automatically detect new services" but in the default section I specify: Active = no and report = ignore. 

<setup> overwrite
loglevel = 3
logfile = ntservices.log
logsize = 10000
subject = alarm
report_only = no
auto_only = false
max_attempts = 5
timeout = 100
notify_type = nimbus
interval = 60
send_clear = true
auto_detect_new = yes
send_alarm_once = no
qos_interval = 1
delete_profile_section = no
pending_State_Interval = 1
reset_restarts = no
monitor_credentials = no
auto_option = 0
auto_alert_new = yes
auto_alert_startup = yes
monitor_new_services = no
<default> overwrite
active = no
action = ignore
severity = major
subsystem = 1.1.2.1
alarm_on_action = no
qos = no
</default>
</setup>

<services> overwrite

   <ServiceA> overwrite

   <ServiceB> overwrite

   <ServiceC> overwrite

</services>

 

That way I can deploy this onto any box and have my base set of services being monitored. Any new services not specified in the cfx file will get added into the Setup - Profiles list of services but not be added into monitoring. 

 

In ntservices_2 I then change the Setup's Default section to say if any new services are added then add to monitoring and alert on it via: 

<setup> overwrite
<default> overwrite
active = yes
action = report
severity = major
subsystem = 1.1.2.1
alarm_on_action = yes
qos = no
</default>
</setup>

 

Is there a way to do this with one cfx file? I tried putting the content of ntservices_2 at the end of ntservices_1 but that just added EVERY service into the profiles and all were active. 

 

Then with using the two different templates in a super pack which delivers cdm, ntservices, ntevl and processes, I tried this order:  ntservices_1, cdm, ntevl, processes, ntservices_2 but only the settings from ntservices_1 were set. The new default settings to auto-monitor and add/report were not applied. I seperated the two as to give the probe some time to start up with the _1 package to add the full list of services to monitoring then wanted to apply the _2 at the end to then say now that we have all the current services on the box if anything new is added alert and add to monitoring.

[Anon Anon]

I was thinking that adding both CFX files to a single package would do what you need, and I am surprised it did not work when you tried it.

 

I thought the default behavior of the probe was to add all of the services to the config disabled, so do you really need to do that in ntservices_1? If that is already done when the probe starts the first time and before your CFX is applied, you should be able to just layer on your specific service changes and the new default config for any services that are added later.

[Anon Anon]

If I understand correctly what you're trying to do, then no, I don't think it's possible to do in a single CFX.

 

Also it's basically not a good idea to deploy a probe's cfx twice in a package, it's really hard to get to work.

 

What you could do is create a list of basic services that you do not want to monitor and deploy that with your "monitor new services" settings. I've done that in the past, but it proved somewhat problematic (case sensitivity, order mattered etc) and was very annoying to maintain.

 

-jon

[Daniel Blanco]

Hi Jon, yeah I was hoping that by separating the delivery of the ntservices_1 and _2 with _1 going first then _2 going last after the other probes were delivered and configured it would have enough time to finish applying the cfg accordinlyg. 

 

There isnt a way to do a _WAIT in delivering these packages is there? To give it time to apply the fist package settings in the package below..

 

WindowsServerBase_Pack:

ntservices_1   -  installed ntservices then applies cfx file

cdm - installed cdm then applies cfg

ntevl - installs ntevel then applies cfg

processes - installed processes and applies cfg 

<wait 10 seconds>

ntservices_2 - checks for existence of ntservices then applies the cfg (turns on add and report any new services)

 

 

[Anon Anon]

No wait there that I know of. I've joked about transferring a large dumpfile between sections to achive that

 

Basically you could transfer the cfx to another location, have the package run a script that sleeps for x time and then copies the cfx in place and then does restart or whatever.. but it gets silly really.

 

-jon