Pandora: Documentation en: Massive Operations

From Pandora FMS Wiki
Jump to: navigation, search

Go back to Pandora FMS documentation index


1 Massive Operations

1.1 Introduction

The massive operation feature allows you to carry out actions related to agents, modules, users, alerts, policies, SNMP, satellite or plugins in a massive way. In recent years, the importance of massive operations have grown in large-volume environments. This feature has been designed to make administrators' work easier in situations in which they have to deal with systems that contain a large amount of components.

You may access massive operations by clicking on Configuration > Bulk Operations as shown below.

Massive operations1.png


Info.png

Nota: To carry out bulk operations, PHP language requires for the timeout parameters to be properly configured. In order to do it, open the PHP configuration file (php.ini).

 


To configure the timeout, open the 'php.ini' file and fix its timeout parameters to a correct value:

sudo vi /etc/php5/apache2/php.ini;


max_execution_time = 0 
max_input_time = -1

1.2 Massive Operations - Agents

1.2.1 Massive agent edition

Within the 'massive agent edition' subsection, it is possible to filter by group and status and check those to be changed.

Agentes 1.PNG

Once you have checked some, you could modify some parameters:

Agentes 2.PNG


  • Cascade protection: Parameter with which alert overload can be avoided. It is possible to choose an agent or an agent module. In the first case, when the chosen agent is in critical state, the agent will not generate alerts. In the second case, only when the specified module is critical state, the agent will not generate alerts.
  • Module definition: Three work modes can be selected.
    • Learning mode: If an XML arrives with new modules, they will be created automatically (by default).
    • Normal mode: If an XML arrives with new modules, they will not be created unless they are already declared in the console.
    • Auto-disable mode: Same as learning mode, but if all modules go into unknown, the agent will be disabled until new information arrives again.

1.2.2 Agent massive delete

Within the 'massive agent deletion' subsection, it is possible to filter by group and state.

Agentes 3 eliminar.PNG



1.3 Massive operations: modules

1.3.1 Module massive delete

When deleting modules, it is possible to select the modules to be edited in two ways:


  • Module selection: If you choose search by module, you may filter by module type, tags, module status and, in the last section, select the agents whose filtered modules you wish to delete.


Masivas, eliminar módulos.PNG



  • Agent selection: If you choose search by agent, you may filter by agent group, agent status, module status, and tag. Once filtered, select the agents whose modules you wish to delete.


Masivas, eliminar módulos SelecAgente.PNG



1.3.2 Module massive edition

When editing modules, it is possible to select the modules to be edited in two ways:

  • Agent selection: If you choose search by agent, you will be able to filter by group, module state, agent state, using tags and the agent or agents that contain modules that you want to modify. Finally, select the module or modules.



Operaciones masivas, editar modulos por age.PNG



  • Module selection: If you choose search by module, you may filter by module type, status, tag and the module or modules you wish to modify. Finally, select the agent or agents whose modules you wish to modify.



Operaciones masivas, editar modulos por mod.PNG



Once done, a menu will be displayed where you may adjust some parameters for these modules.



Operaciones masivas, editar modulos parametros.PNG





Operaciones masivas, editar modulos parametros2.PNG





Operaciones masivas, editar modulos parametros3.PNG



  • FF threshold: FlipFlop (FF) is known as a common phenomenon in monitoring: when a value fluctuates frequently between alternative values (RIGHT/WRONG), which makes it difficult to interpret. When this happens, a "threshold" is usually used so that in order to consider something as having changed status, it has to "stay" more than X intervals in a state without changing. In Pandora FMS terminology this is called: "FF Threshold".
  • Post process: Parameter by which the data received by the module can be converted. It is disabled with the value 0 by default.
  • FF interval: If the flip-flop threshold is enabled and there is a state change, the module interval will be changed for the next execution.
  • TCP send: The field to configure the parameters intended to be sent to the TCP port. It accepts the '^M' string as a replacement for sending a CR. To send several strings in a row in a send/response manner, separate them by the character":"
  • TCP receive: The field to configure the text strings expected to be received on the TCP connection. If they send/receive in several steps, each step should be separated by the '|' (pipe) character.
  • WMI Query: WMI query. It is very similar to a sentence in SQL.
  • Plugin: Once selected the plugin, you may use the following macros:
    • _agent_: Name of the agent the module belongs to.
    • _agentdescription_: Description of the agent the module belongs to.
    • _agentstatus_: Current agent status.
    • _address_: Address of the agent the module belongs to.
    • _module_: Module name.
    • _modulegroup_: Module group name.
    • _moduledescription_: Module description.
    • _modulestatus_: Module status.
    • _moduletags_: Tags associated to the module.
    • _id_agent_: Agent ID. It is quite useful to generate a direct URL or to redirect to a Pandora FMS console webpage.
    • _id_module_: Module ID.
    • _policy_: The name of the policy the module belongs to (if that applies).
    • _interval_: Module execution interval.
    • _target_ip_: Module target IP address.
    • _target_port_: Module target port.
    • _plugin_parameters_: Module plugin parameters.
    • _email_tag_: Emails associated to module tags.
  • Web Checks: This essential field defines the WEB check to be performed. This is defined in one or more steps, or simple requests. These simple requests must be written in a special format in the Web checks field. Checks start with the tag task_begin and end with the tag task_end.

1.3.3 Modules massive copy

Module copying allows you to select one or more modules and copy them to the agent of your choosing. Start by filtering them by group, status and agent, which will deploy a tag filter through which the module or modules contained within can be selected, having the possibility to copy their alerts too.


Masivas cop mod.PNG



In the lower sections, select the destination agent or agents for which to copy the modules and alerts. Filter by group and status.


Masivas cop mod destino.PNG



1.4 Massive Operations: Plugins

Plugins will be able to be edited in a massive way. So, a plugin, the agents that contain it and the data that you wish to modify must be chosen.


Masivas, editar plugins.PNG



1.5 Massive Operations: Users

1.5.1 Add profiles massively

In order to add new profiles, choose the profile and groups you will grant the permissions to and last but not least the user you will assign them to.


Masivas, añadir usuarios.PNG



1.5.2 Delete profiles massively

In order to delete profiles, filter them by profile and group and you will be shown the users that meet that criteria. You may delete them by checking the ones you wish.


Masivas, eliminar usuarios.PNG



1.6 Massive Operations: Alerts

1.6.1 Add alerts massively

In order to add new alerts, it is possible to filter them by group. To do so, select the agent, module and template to add.


Masivas, añadir alertas.PNG



1.6.2 Delete alerts massively

In order to delete alerts, select the template, group, agent and modules you want to delete them from.

Masivas, remover alertas.PNG

1.6.3 Add alert actions massively

In order to add actions to alerts, filter them by group, agent contained in the alert template, alert template and module. Finally, add the desired action to the checked modules.


Masivas, añadir acciones.PNG



1.6.4 Delete alert actions massively

In order to delete alert actions, filter by group, select agents, alert templates, modules and the actions you intend to delete.


Masivas, remover acciones.PNG



1.6.5 Enable/Disable alerts massively

In order to enable or disable alerts, filter by group, select agents, alert template and you will be shown the alerts within the enabled or disabled alert board. You may move those alerts to the desired board.


Masivas, activar desactivar alertas.PNG



1.6.6 Change standby alerts massively

In order to assign a stand-by state to an alert, filter by group, select the agents, alert templates and you will be shown the existing alerts. Move them from one board to another if you wish to set them on stand-by.


Masivas, alertas standby.PNG



1.7 Massive operations: Policies

1.7.1 Add policy alerts massively

In order to add alerts to modules of a certain policy, indicate on which policy you wish to make changes, the alert template you wish to add and the modules on which alerts must be applied.


Politicas, add alerts.PNG



1.7.2 Delete policy alerts massively

In order to delete policy alerts set the policy whose alert you wish to delete, the alert template you want to delete from the policy and the modules whose alerts you wish to delete.


Politicas, delete alerts.PNG



1.7.3 Add tags to policy modules massively

To add tags to the policy modules, indicate the target policy, the module itself and eventually select from the tag list those you wish to add.



Politicas, tags selectmodulos.PNG



1.7.4 Add policy modules to tags massively

To add modules to the tags set the target policy, the tag itself, and then select from the list of modules those that you want to add.



Politicas, tags modulos.PNG



1.7.5 Add modules to policies from existing agents massively

To add modules of a certain agent to the desired policy or policies, first select the source agent, using filters to make the search more direct. Then choose from your module list those you want to back up and then from the policy list those you wish as backup destination.


Politicas, añadirmodulos.PNG



1.7.6 Edit policy modules massively

To edit the desired modules of a certain policy, first select the source policy. After choose from the module list thos you want want to edit and then fill in the fields you wish to edit.


Politicas, editarmodulos1.PNG



Politicas, editarmodulos2.PNG



Politicas, editarmodulos3.PNG



  • FF threshold: FlipFlop (FF) is known as a common phenomenon in monitoring: when a value fluctuates frequently between alternative values (RIGHT/WRONG), which makes it difficult to interpret. When this happens, a "threshold" is usually used so that in order to consider something as having changed status, it has to "stay" more than X intervals in a state without changing. In Pandora FMS terminology, this is called "FF Threshold".
  • Post process: Parameter by which the data received by the module can be converted. It is disabled by default with the value 0.
  • FF interval: If the flip-flop threshold is enabled and there is a state change, the module interval will be changed for the next execution.
  • TCP send: The field to configure the parameters intended to be sent to the TCP port. It accepts the '^M' to replace it by sending of a CR. To send several strings in a row in a send/response manner, they must be separated by the character":"
  • TCP receive: The field to configure the text strings expected to be received on the TCP connection. If they are sent/received in several steps, each step should be separated by the '|' (pipe) character.
  • WMI Query: WMI query. It is very similar to an SQL sentence.
  • Plugin: Once selected the plugin, you may use the following macros:
    • _agent_: Agent name the module belongs to.
    • _agentdescription_: Agent description the module belongs to.
    • _agentstatus_: Current agent status.
    • _address_: Address of the agent the module belongs to.
    • _module_: Module name.
    • _modulegroup_: Module group name.
    • _moduledescription_: Module description.
    • _modulestatus_: Module status.
    • _moduletags_: Module associated tags.
    • _id_agent_: Agent ID. It is quite useful to generate a direct URL or redirect to a Pandora FMS console.
    • _id_module_: Module ID.
    • _policy_: Name of the policy the module belongs to (if that applies).
    • _interval_: Module execution interval.
    • _target_ip_: Module target IP address.
    • _target_port_: Module target port.
    • _plugin_parameters_: Module plug-in parameters.
    • _email_tag_: Emails associated to module tags.
  • Web Checks: This essential field defines the WEB check to be performed. This is defined in one or more steps, or simple requests. These simple requests must be written in a special format in the Web checks field. Checks start with the tag task_begin and end with the tag task_end.

1.8 Massive operations: SNMP alerts

1.8.1 Edit SNMP alerts massively

Firstly, alerts must be filtered by text, type and priority.


SNMP, editaralertasSNMP1.PNG


Once the alerts have been selected, you may change certain parameters.



SNMP, editaralertasSNMP2.PNG


1.8.2 Delete SNMP alerts massively

First, alerts must be filtered according to text, type and priority, and then the selected alerts may be deleted.


SNMP, borraralertasSNMP1.PNG


1.9 Massive operations: Satellite

1.9.1 Edit modules massively

Critical and warning fields of modules generated in agents that have been created through satellite can be edited.


Salite, edicionmodulos.PNG


Go back to Pandora FMS Documentation Index