If the spreadsheet was the essential application for accounting and massification of personal computers, MS Windows® operating system was the graphical interface that turned work into something more pleasant and paved the way for web browsers for the Internet as we know it today.
Today, in Pandora FMS blog, we discuss:
Windows Event Monitoring and Pandora FMS
Decades ae gone by but there is always a joke, among us computer scientists, that prevails in time:
“This is the year of Linux on our desktops”.
I actually think that, in the end, it is a statement that comes with a flaw from the very beginning:
The kernel (Linux in this case) has little to do with the graphical interface, the actual thing is that the applications that go along with Linux, such as GNU/Linux, are the combinations that should take their place in hundreds of millions of computers in our homes and jobs.
The MS Windows® operating system (OS), despite losing ground with Android/Linux on our mobile phones, still has it still going on on desktop computers and in the field of video games it keeps its position, faring pretty well.
Many say that desktop personal computers will disappear. I personally think that we will connect the monitor, keyboard and mouse to our cell phones at home and at the office.
But today MS Windows has a stronghold in its market position and for Pandora FMS it has implied a series of very special considerations for its monitoring.
The overview
Monitoring with Pandora FMS can be done both remotely and locally and the MS Windows® OS is no exception. Remote monitoring can be performed through SNMP and through WMI.
*If you are new to monitoring, I recommend you to take a few minutes to learn about Pandora FMS Basics.
For local monitoring install a small program, which is called Pandora FMS Software Agent.
Once installed in MS Windows®, the modules to collect the most relevant information (disk usage, RAM consumption, etc.) will already be installed by default.
If what you need to monitor is the basics of MS Windows® the Open version of Pandora FMS is more than enough for the task.
Windows® event monitoring
The amount of applications for MS Windows® is humongous but in a way it is easy to monitor applications and even processes, since we have a special instruction for the Software Agent called module_Proc.
This instruction is able to tell us, either immediately or every certain period of time whether a program or process is running.
*If you want to find out more about this Pandora FMS feature, visit our video tutorial Monitor processes or applications in Windows.
So far all this is the basics for monitoring MS Windows®.
And in the case of Pandora FMS Enterprise version you can “transfer” normal events to events in Pandora FMS, which can generate alerts and warnings for us to take the necessary actions, or let Pandora FMS restart the software vital to our work or business.
* The latter is known as Watchdog: if an application for any reason stops in MS Windows®, it is re-launched and executed.
Analyzing the causes
Simplifying as much as possible:
So far we can say that we are working on true and false, on ones and zeros.
But often it is called on to us to analyze under what conditions an application collapses or find out why it does not start.
If all that related information had to be seen on your screen you simply would not be able to work with so many interruptions. For that reason there are event registries and working with them implies more specialization on Pandora FMS behalf.
MS Windows® presents an advantage as a privative software for its monitoring and it is that its events and corresponding logs are centralized after a certain routine or standard way.
Monitoring an individual event
Pandora FMS offers the instruction module_logevent that uses Windows® API and offers better performance than data collection by means of WMI.
You will obtain data from the event logs from Windows itself.
Along with additional instructions, it offers the ability to monitor very specific events identified by the fields Log Name, Source, Event ID and Level.
Remember I told you they’re standardized?
Well, in Log name they are well defined by:
- Application.
- Security.
- Installation.
- System.
- Forwarded events.
And you must use one of them for the instruction module_source, which is mandatory in the module to be created in Pandora FMS Software Agent.
Up to this point we have only discussed simple modules of Pandora FMS agents but, depending on your needs all the above can also be done as a complement or Pandora FMS plugin.
The difference is to place module_type async_string when it is a data module and module_type log when it is a plugin.
Plugins offer flexibility as they can return multiple data at the same time, unlike Pandora FMS modules that only return a specific, normalized data type in Pandora FMS.
This is important for what we will see below:
The instruction module_regexp which has as a parameter an event log file (.log) on which you will search for keywords with the instruction module_pattern.
This is necessary because there are old applications that keep their own separate event log, although in other regards they do not escape the Windows log.
*We explained this in detail in our tutorial video « Windows modules logevent and regexp ».
Monitoring an event channel
En MS Windows® algunos log que no están en el registro de eventos del propio Windows, pueden ser recogidos mediante los canales de registros de eventos (Windows Event Log channel o simplemente log channels) con una instrucción especial lla
In MS Windows®, some logs that are not in Windows event log can be collected using the Windows event log channels with a special instruction called module_logchannel that does not carry any parameters but then uses module_source<channel_name> together with module_eventtype (event type), module_eventcode (event code) and even module_pattern to search by keyword.
*For more details, our video tutorial «Windows modules: Logchannel |Pandora FMS|» quickly explains this feature.
However, I said that we are looking for or investigating the cause of some problem or inconvenience in an application that runs on MS Windows®, but the examples I have given are specific and go directly to monitor a particular point.
Alright so…
How do we do it if we don’t know exactly what we’re looking for?
Elasticsearch and log mass collection
What I needed to explain is that if you use a plugin to collect logs you must install, together with Pandora FMS, a powerful tool called Elasticsearch.
Which uses a non-relational database capable of storing and classifying all this large amount of information.
*It is well explained, again, in another tutorial video called “ Log Collector in Pandora FMS “)
But don’t think Pandora FMS just delegates the work, no:
From Elasticsearch you may go back to Pandora FMS to generate alerts and reports that you scheme and then create in Pandora FMS to finally understand what the conditions and precise values are when an application fails (or has peak workload values, or is “doing nothing”, etc.).
Conclusions
He resI have summed it up as much as possible and I recommend that you watch the tutorials over and over again until you fully understand and are able to put it into practice installing both Pandora FMS and Elasticsearch. If you have any problems, check the official documentation, which is extensive on the topic “Log monitoring and collection.”
Resources
Programmer since 1993 at KS7000.net.ve (since 2014 free software solutions for commercial pharmacies in Venezuela). He writes regularly for Pandora FMS and offers advice on the forum . He is also an enthusiastic contributor to Wikipedia and Wikidata. He crushes iron in gyms and when he can, he also exercises cycling. Science fiction fan. Programmer since 1993 in KS7000.net.ve (since 2014 free software solutions for commercial pharmacies in Venezuela). He writes regularly for Pandora FMS and offers advice in the forum. Also an enthusiastic contributor to Wikipedia and Wikidata. He crusher of irons in gyms and when he can he exercises in cycling as well. Science fiction fan.
