First steps with Pandora FMS Official start-up guide to get the most out of Pandora FMS, from installation to report generation. If you don't want to mess with the manual, this is your guide. 1. Introduction The purpose of this guide is to briefly introduce Pandora FMS to someone who is not familiar with the tool. The purpose is not to make a tour through all Pandora FMS features, but to talk about the most relevant ones in order to start working and managing in record time.  Pandora FMS architecture is made up of different services:  Database server (Percona/MySQL) Web console. Pandora FMS server (which runs different types of services). A small optional application (software agent) that runs on the servers you want to collect information from (both windows and linux) and send it to the central server. We call agent to any network device that can be monitored. That is to say, everything you can obtain data from and that has an associated IP, such as servers, routers or switches. The number of these agents is what is used to license a Pandora FMS Enterprise installation, for example, a 100 agent license. The information collected in each agent is not relevant, it does not matter if it is a router with just a few simple metrics or a 48-port switch full of information. These metrics in Pandora FMS are known as modules. A software agent is the piece of software that collects information, an agent, simply, is how this information is displayed and managed. They only share the name. Minimum hardware requirements The requirements set out in this table are the minimum recommended for the different installations. These recommendations are calculated assuming that 80% of the modules have historical data, that each agent has an average of about 10 modules and that the average sampling is five minutes. These recommendations are specified for an environment where they are installed in the same database server, server and console. Hardware SMALL MEDIUM BIG CPU 2 cores at 2 GHz 2 cores at 2,5 GHz 4 cores at 3 GHz RAM 4 GB 8 GB 16 GB HD 7200 rpm 15K RPM o SSD SSD Storage ~20GB ~60GB ~120 GB Capacity Up to 500 agents Up to 2000 agents  5000 agents In addition to the above recommendations, it is recommended that you install MySQL on a separate server and install Percona XTraDB instead of the standard MySQL. If you already have a Pandora FMS installation, go straight to device discovery here Everything discovered and configured? Go to metric alerting here You need to start seeing you data, start with reports here 2. Basic Architecture Pandora FMS servers The Servers are integrated into a single application, generically called Pandora Server, which is a multithreaded application that concurrently executes different instances or specialized Pandora FMS servers. These are the elements in charge of performing the existing checks, as they verify and change their status according to the results obtained. They are also in charge of triggering the alerts that are established to control the data status. Pandora FMS automatically manages the status of each server, its load level and other parameters. The user can monitor the status of each server through the server status section of the Web Console. The basic servers are the following ones: Open Data server: It is in charge of processing the information sent by the software agents (in XML format), the server processes it and stores the result in the database. It is also in charge of generating alerts and events according to this data. To enable the server it is necessary to configure the dataserver 1 line in the /etc/pandora/pandora_server.conf file. Network server: This server executes remote monitoring tasks through the network, it could be ICMP checks, TCP requests and SNMP requests. The server and the remote machines must have communication to execute these checks. To enable the server it is necessary to configure the networkserver 1 line in the /etc/pandora/pandora_server.conf file. Discovery server: It allows to explore networks to detect equipments and apply monitoring templates to them quickly. It also allows the rapid deployment of specific monitoring of databases, cloud systems and virtual environments. It includes the necessary tools to discover or import devices and equipment in the network. To enable the server it is necessary to configure the discoveryserver 1 line in the /etc/pandora/pandora_server.conf file. Plugin server: It allows complex remote monitoring, since it executes complex checks from Pandora FMS server by means of customized scripts. It is a centralized process, integrated into Pandora FMS interface. This server allows advanced users to define their own checks, developed by themselves, and integrate them into the application so that they can be used easily from Pandora FMS. To enable the server it is necessary to configure the pluginserver 1 line in the file /etc/pandora/pandora_server.conf. Prediction server: This server predicts numerical values using statistics and modules with real data as source, allows to detect anomalies out of the usual trends and creates new values from prediction statistics, which can be used as baselines. It also allows to create new values by arithmetic operations with the values of existing modules (synthetic modules). To enable the server it is necessary to configure the predictionserver 1 line in the /etc/pandora/pandora_server.conf file. WMI server: This server allows remote monitoring of Windows systems using the WMI protocol. This is done through the execution of WMI sentences, remote sentences compatible with any Windows system with WMI enabled that allow to obtain Hardware and Software information. To enable the server it is necessary to configure the wmiserver 1 line in the file /etc/pandora/pandora_server.conf.   Inventory server: The inventory server obtains and displays inventory information of the systems: installed software, model of hardware elements, hard disks, services running on the system, etc. This information can be obtained both remotely (from the Pandora server) and locally (through the software agents). It does it by using the same monitoring agents or remotely, with extensions developed by the user, both for Windows and Unix. To enable the server it is necessary to configure the inventoryserver 1 line in the /etc/pandora/pandora_server.conf file. Web server: It is used to perform complete web checks, from the user identification process, to parameter transfer through a form, content checking, menu navigation, etc. It allows performing availability checks (working or not working) and obtaining latency times (in seconds) of the complete browsing experience, including resources associated to the page (images, full texts, etc). It is based on Goliath (Web audit server), which is OpenSource. To enable the server it is necessary to configure the webserver 1 line in the /etc/pandora/pandora_server.conf file. SNMP Traps Console: This server uses the standard trap collection system daemon, snmptrapd. This daemon receives SNMP traps and Pandora FMS SNMP console processes and stores them in the database. It is also in charge of launching the alerts associated to SNMP traps were defined. To enable the server configure the snmpconsole 1 line in the /etc/pandora/pandora_server.conf file. Enterprise Enterprise ICMP server:  This server multiplies the efficiency of ICMP checks. It uses the nmap binary installed with Pandora FMS Enterprise version. It uses nmap version 5.5. or higher. To enable the server it is necessary to configure the inventoryserver 1 line in the /etc/pandora/pandora_server.conf file.   Enterprise SNMP server: This server increases the efficiency of SNMP checks. It uses the braa binary that is installed with the Enterprise version of Pandora FMS. The braa binary, used by the enterprise SNMP server is located at /usr/bin/braa by default. It is compatible with SNMP V1 and v2. SNMP v3 checks will be done by the network server. It requires for the network server to operate simultaneously, to translate the OIDs. To enable the server it is necessary to configure the snmpserver 1 line in the /etc/pandora/pandora_server.conf file. Syslog server: This component allows Pandora FMS to analyze the syslog of the machine where it is located, analyzing its content and storing the references in the corresponding ElasticSearch server. The main advantage of the syslog server is to complement log merging. With the support of the exporting features of the syslog server of Linux® and Unix® environments, it allows log consultation regardless of the source, searching in a single common point (Pandora FMS console log viewer). To enable the server it is necessary to configure the syslogserver 1 line in the /etc/pandora/pandora_server.conf file. You may establish for each server the number of threads that the processes will use in the instance where Pandora FMS is installed. Pandora FMS web console It is the user interface of Pandora FMS, it allows to control the status of the Agents, see statistical information, generate graphs and data tables. It is also able to generate reports and centrally define new agents, modules, alerts and create other users and profiles. Pandora FMS database Pandora FMS uses a MySQL database in which all the information received in real time is stored, normalizing all the data from the different sources (server, agents...). Currently Pandora FMS only supports MySQL, MariaDB and Percona. Agents In Pandora FMS there are two types of agents and they can execute remote and local modules : Remote Agent: This type of agent is an organizational element created in Pandora FMS Web Console, it usually contains remote type modules that are executed by those servers that obtain information remotely, such as the network server. Software Agent: It is a software installed on the equipment to be monitored locally, retrieving information from the computer itself, it allows monitoring machine resources (CPU, RAM, disks...) and the installed applications (MySQL, Apache, JBoss). All the information collected by software agents is sent to the server in XML format through the Tentacle protocol (SSH or FTP is allowed) at a predetermined interval of 5 minutes (300 seconds). Generally, server and computer monitoring will be carried out with Software Agents while network equipment monitoring will be done remotely without installing any software. Topologies, overviews and monitoring modules The ideal is for all monitored computers to have communication with Pandora FMS server, but sometimes you will find cases in which you do not have total communication between the different elements we want to monitor, we are going to mention different situations we can face and how to solve them. Accessible networks Accessible network for centralized remote monitoring: Pandora FMS server has communication with all network machines. Accessible network for Agent-based monitoring: It is the software agents that have communication with Pandora FMS server. Hard-to-access networks Remote network not reachable by Pandora FMS remote checks: It uses the broker agent mode. Software Agents that do not have access to Pandora FMS server: In this case it uses the proxy feature of the Software Agents or a Satellite server as a proxy of software agents. Different networks to monitor remotely with the server: You may use the Satellite Server or several different Pandora FMS servers connected to the same database. Are you not achieving the expected results? Go to  help or  support sections . 3. Installation Online installation The term "Cloud provider" (or simply "Cloud") is used to describe the hosting of virtual machines, either exclusively or shared, in specialized providers with hardware, hypervisors and customer support web systems for configuration and administration. For any of them you can install Pandora FMS Community edition. CentOS 7.x is recommended as operating system, 4 gigabytes in RAM memory and 20 gigabytes in free disk space, preferably Solid State Drive (SSD) type. For the case of CentOS 7.x : curl -sSL https://pfms.me/deploy-pandora | bash In the case of using RHEL 8.x or Rocky Linux 8.x : curl -sSL https://pfms.me/deploy-pandora-el8 | bash If you are using Ubuntu Server 22.04 to install the version : curl -SsL https://pfms.me/deploy-pandora-ubuntu | bash When you finish executing the script it will leave you installed and ready to use Pandora FMS in its latest version. Offline installation (ISO Image) Pandora FMS ISO Appliance will be used, since it is the fastest and easiest method. For more information on alternative installation methods, check Pandora FMS Installation from our official documentation.  Pandora FMS uses Linux as a base, but Pandora FMS is designed so that. As an administrator user, you do not have to know about Linux or interact with it. 99% of the configuration and operation is done from Pandora FMS graphic console and it is not necessary to access the shell (the command black screen) of Linux system. The installation image is based on Linux CentOS 7, and contains all the components and dependencies needed for Pandora FMS to work pre-installed. You must have a machine with minimum hardware requirements, a minimum of 4 GB of RAM and 20 GB of disk.  If you are pondering over Pandora FMS Enterprise version, the license comes pre-installed, and once it is activated and running, you will have 30 days to try the product. After this time, your Pandora FMS will automatically become the Community version and you will be able to continue using it indefinitely. No data is lost and the system will continue working, but without Enterprise version features. Installation from ISO Appliance The ISO image must be downloaded from the   download section and burned to a DVD, or you can also boot the system from this ISO file if you are using a virtualization system (VMWare, VirtualBox, etc).  The graphical installer will guide you step by step through the whole installation process. This installer is available in several languages and follows a standard installation process. The two sections where you should pay special attention are when asking for the root password and when asking about partitioning. Once installed, you will not have to access the Linux base system again. You can also do a manual network configuration at this point . Otherwise, the system will try to activate the network interface and assign an IP through DHCP. The requested options, "Date and Time", "Keyboard" and "Installation Destination" must be selected and configured. The network device must be activated.  The network interface is activated and the host name can optionally be changed. If you are going to set a fixed IP, this is the time to configure it , otherwise you will get it by DHCP. Clicking on the installation destination will start disk partitioning. Select the disk where you are going to install and the partitioning is chosen. The "Click to create them automatically" option will be used. The created partitions will be checked and click Done. Click Accept changes. Click on Start installation, at the bottom and the process will start installing. Do not forget the root password or you will have to reinstall everything again. Now wait until the installation is complete and the system is rebooted. If you are using virtualization, make sure the system boots from the disk first, or unmount the CD drive with Pandora FMS installation image. If you install from USB or CD, when the system will restart. First steps Once installed, the system should boot from the hard disk and after a few seconds, display a terminal screen: In this same screen you should find the IP that the system has assigned to be able to connect to Pandora FMS console.  Once you know the IP of Pandora FMS system, you can access it from a browser. Write in it the following address, composed by the IP obtained: http://x.x.x.x/pandora_console In the example above it would be http://192.168.126.129/pandora_console , but you have to get the system IP address correctly in order to continue. If everything is correct, you will access Pandora FMS console welcome screen, similar to this one: Are you not achieving the expected results? Go to  help or  support sections . 4. Detecting and monitoring new systems with Discovery Pandora FMS Discovery tool provides a set of tools to simplify monitoring through wizards, including Discovery's Network Scan feature. To use it, follow these steps. In the side menu go to Discovery → Host&Devices → Network Scan  section. Create the task as follows: modify only the network range to be scanned, in this screenshot it is 192.168.70.0/24, which means that all hosts on network 192.168.70.xx will be scanned. Select the "Unknown" group, which will be used to contain the devices you detect in that group. From now on the devices managed and/or monitored by Pandora FMS will be called "agents". You may select different aspects of the initial monitoring that will be applied to the discovered devices. You may define different pre-configured templates, as you can see in the image. Choose the option "BASIC MONITORING" and leave the option "Review results" unchecked. Once the recognition task is created, as it has been created with manual interval, start it manually. For that, force its execution in the discovery task list: Its progress will be updated: At any time, you may click on the magnifying glass icon to see the task details:   At this point, it is better to wait until the entire network is scanned. When it is finished, go to the agent detail view to see all the detected systems. Menu "Monitoring" > "Views" > " "Agent detail", as seen in the image:   You will see several systems that were detected. In some cases, the name of the system will have been solved (if it was possible by DNS) and in others, the type of Operating System will have been detected, according to the options selected in the network scan carried out with Discovery. Clicking on the name will lead you to the agent detail view, which will show all the system information. In this case, the agent has only one module, the " Host alive " module, a check that verifies whether the machine is "alive" and responds from the network, and the " Host Latency " module, which calculates the time it takes for the server to communicate with the machine: If you do not need more monitoring or configuration, go to the metric alert here Are you not achieving the expected results? Go to  help or  support sections . 5. Detecting and monitoring network and Windows devices with Discovery Let us now look at a more complex discovery task by configuring SNMP and WMI, two protocols used to remotely monitor devices, both network (SNMP) and Windows (WMI). The configuration process is similar to the previous one, but here got to the discovery task configuration options and look at the bottom.     To enable monitoring with SNMP and WMI, activate the corresponding token and provide the data required by each protocol. SNMP has "communities" that are like access passwords. If you do not know your SNMP community, try "public". You can enter as many as you want, so that it will be tested with all of them. The credentials for the WMI service (and others) can be defined in Profiles -> Manage agent groups -> Credential Store . Credential stores are secure user/password stores that are used later in remote checks, device configurations, remote access, etc. So they can be reused at different points in Pandora FMS. Also enable the "Review results" token, which will allow you to see the components found by Pandora FMS in the discovery task once it is finished, showing what it has found and allowing to add it to the remote monitoring of the agent with just one click. If you don't need more monitoring or configuration, go to metric alerting here Are you not achieving the expected results? Go to  help or  support sections . 6. Network device monitoring through SNMP Interface Wizard In order to perform this type of monitoring, it is essential for the SNMP to be configured in the remote device. This usually needs to be activated as well as a minimum configuration that allows us to check data. SNMP devices allow you to configure which IPs can make queries and with which ''community'', which for all intents and purposes is a kind of password. Most network devices (routers, switches) have the community " public " by default. First locate the agent from where you want to get the network traffic; in this case we are going to use a CISCO Catalyst switch, but it could be any device with SNMP enabled. Following the same process ''Monitoring" > "Views" > "Agent detail'' you will reach the main view of the agent you want to configure and click on the last tab on the right, which will take you to the editing view of that agent.     Go to the main view of the agent editing. Here you will see the agent configuration "Wizards" submenu, where to choose the SNMP Interface Wizard , as you can see in the following screenshot:   The SNMP wizard will allow to track the agent's interfaces. Provide "SNMP community" and "version" data. If everything works, it will show the interfaces and the data that can be obtained from them. With a simple click you will be able to select the metrics you are interested in from all the switch interfaces and even define thresholds with warning and critical values that will later be useful to work with the alerts. Click on "Create modules" and a screen should inform that the modules have been created.    The network traffic modules are ''incremental'', that means that its value is the difference between the information sample that has just been collected and the previous one. It shows a ''rate'' (in this case in bytes/sec), so it needs time (about 1 or 2 agent intervals) before showing anything. Click on the "View" tab to return to the agent view and wait for a minimum of 1 agent interval until you already have data, updating or clicking on the "View" tab. If you do not want to wait any more or you want to "force" the execution of all the remote agent modules, use the "force remote check" icon. Depending on the server load, it can take between 2 and 15 seconds to execute the test:   Module information will be seen this way and the graphs for each metric will show a window with the graph of that monitor and when clicking on the data icon, a table with the data: Let us see a graph of one of the individual metrics (Gi0/1_ifHCInOctets): You may also use the "Interfaces" view to easily see the information of the input/output traffic of each interface. To do this, open the "Interface information (SNMP)" box under the agent overview: By clicking on the graphical icon of an interface ( ): Are you not achieving the expected results? Go to  help or  support sections . 7. Network device remote monitoring Monitoring through network modules. TCP Service. In this case, monitoring to verify that an SMTP (mail) service is active on a machine will be added. Although this could be a very complex check (simulating that user credentials and passwords are sent, that an email is sent, etc.) it will be simplified by only checking that the port is open and responsive. To do that, repeat the same steps from the previous chapter, but this time choose a "Network module". Then use the drop-down controls until you find the desired check (Check SMTP Server) and click on it to create the module: Finally, repeat the steps (go to the operation view and refresh until the monitor appears). Until a module has no data, it will be BLUE, which indicates that it is not yet initialized: After a few seconds it should start and take a value, GREEN if the SMTP server responds, or RED if it does not: Monitoring through server plugins. Network packet loss. We are going to monitor the network packet loss using a remote check that comes pre-configured in Pandora FMS. For that go to the configuration view of any agent connected to your network, because we are going to measure the packet loss from Pandora FMS to the IP of that agent. The configuration view can be accessed through the cogwheel icon: From there go to the module view: And create a "Plugin" module: Choose the group of components "Network management" and look for "Packet loss": So the new module should look like this: We have chosen a "library" module that uploads some values automatically. Click on "Create" and return to the operation view (eye icon): The screen is updated a couple of times, until the new module appears in the list: The round icon is to "force" the check again (it only works with remote checks): The graph and data table icon respectively help show an interactive graph or a table with the data collected by that module. All the modules with active history have the possibility to see graphs or data: This is a very interesting plugin, which used together with basic connectivity (ping) and latency time determines your network quality, as it indicates packet loss percentage. Are you not achieving the expected results? Go to  help or  support sections . 8. Web Monitoring For this last example we will use the Pandora FMS web server component that performs HTTP and HTTPS basic monitoring.  This element allows to make simple or more complex web checks (in several cases), using low level calls. It is useful to see whether your pages are still alive, verify that you can take a series of steps (for example, filling in forms) and/or that they contain a certain word. Besides verifying that they work , you can measure the total time they take . To create this type of module, choose a webserver type module for module creation.   Once you click Create , you will see a form where to fill in the necessary fields to be able to monitor a website. The most important thing will be to choose the type of check. Here we are going to create a module that will allow to check the loading time of a web that must contain the word To do this, select the Remote HTTP module to check latency , which will allow to see the number of seconds it takes for the server to respond.   The code that you have to add to the web checks' box is intuitive, in this case we will make only one request and we will check that the response returns a sentence: task_begin get https://pandorafms.com/prices/ check_string License based on devices task_end  The checkup will be as follows: As always, after a few seconds, you will have already received some data from this module, in this case, the seconds it takes for the request to be completed: Pandora FMS also offers the possibility of monitoring complex web transactions thanks to the User Web Experience which is a more advanced feature than this one . Are you not achieving the expected results? Go to  help or  support sections . 9. Remote Server Monitoring Pandora FMS also offers the possibility of monitoring Linux and Windows servers remotely without installing a software agent.  To achieve this, create remote execution modules that allow you to ask the device from your Pandora FMS installation by executing a command (Windows or Linux) remotely and obtaining the result. Create a network module: Then choose a "Remote execution" module. Choose between the following ones depending on the type of data that the check returns (numeric, true/false, alphanumeric or incremental): To be able to use successfully these modules you need to have remote connection data to the system you wish to monitor. Therefore, register in the safe credential store the connection data against the target. The credential store stores user/password sets so that they can be reused in different checks and whose data are not shown in check configuration. To create an entry in the credential store go to section " Configuration -> Credential store " and click "Add Key" : Create a "Custom"  credential and set the password and login credentials for your Windows server: Go back to the remote check and configure this: You will need to fill in three key fields: Optionally the IP of the target (if not, the agent's IP will be used). The command that you will launch to monitor. The  set of credentials that you are going to use to connect (that you defined in the previous step). In Windows environments choose "Windows remote" connection: The example above will indicate the number of processes running on the remote machine. To perform the same on Linux servers, just choose the remote SSH connection method, choose port 22 and use a command that returns a number in Linux. The previous example in Linux would be: If you want to monitor something that returns a true/false status, such as the status of a process, just make sure your command returns 0 for the wrong value and 1 or more for the right value. You should use a BOOLEAN data type (e.g.: "Remote execution, boolean data") so that Pandora FMS interprets it as such. Are you not achieving the expected results? Go to  help or  support sections . 10. Server Monitoring through Software Agents MS Windows® First, download the MS Windows®. software agent installer: https://pandorafms.com/community/get-started/ In this link, you may choose either the 32-bit or 64-bit agent, according to your OS. Once the agent is downloaded, execute it by double-clicking on it (you must have admin permissions) and the usual installation screen will appear, where you must accept all the steps:   Accept the license and go through the different installer steps. Configure in this screen the IP address (or name) of the Pandora FMS server that will receive the agent's data and the group you wish for the agent to be associated with. This group must exist in Pandora FMS .   In the next window there is the option to enable remote configuration . It is important to activate it by clicking on the checkbox if you wish to remotely manage the agent's setup and not have to edit files manually. The remote configuration management feature is exclusive to Pandora FMS Enterprise version     Decide if you wish to start the agent service at the end of the installation of Pandora FMS agent, otherwise it will run when MS Windows® is restarted again.   Once this process is finished, the Windows agent stays installed and running on the computer. In a few seconds you should be able to see the agent reporting in your Pandora FMS console. If you do not see the agent in the console, check that there is a connection between the agent and the IP of the server you have configured in the agent. The communication from agent to server uses port 41121/TCP. Once the MS Windows® software agent is started after its installation, it is time to check what the agent is reporting. To that end you have to know the name this agent will report with. By default, the agent is created with the name of the computer , as you can see in "System information" (in this case DESKTOP-JU0S2L5). Once you know the name of the agent, the next step is to see if it was created in Pandora FMS. For that there are several options. The first one is to search in agent details, inside the group where the agent was created, in the example the group "Servers" (in this screenshot the name of the computer is DESKTOP-2GGIE80 ). A faster and more efficient way to find the agent is by searching directly through Pandora FMS search engine, a the top bar, where you may enter the name of your machine or part of it. Here the agent will appear and by clicking on the name go to the information it reports. The MS Windows® agent comes with several preloaded local modules for basic monitoring by default, such as CPU Load , % of free RAM memory ( FreeMemory ), used space disk in MB ( DiskUsed_C: ), DHCP status ( DHCP Enabled ) and process number ( Number processes ). If you need to add new modules to this agent, check the advanced documentation on monitoring through software agents . You may see graphs generated with the module data history and a table with the module history from this view by clicking on the icons highlighted in the following screenshot: It is important to note that on the same agent, remote monitoring and agent-based monitoring can be performed, combining them both, resulting in a much more comprehensive monitoring. GNU/Linux® Monitoring a GNU/Linux server is just as simple, but it must be done from the console. If you are interested, you may download the package corresponding to your linux distribution (or the self-installable tarball). There is also the option to install using an online installer: https://pandorafms.com/manual/!current/en/documentation/02_installation/01_installing#online_installation_of_pandora_fms_software_agent The configuration needed to set up the Linux agent, can be found in the file: /etc/pandora/pandora_agent.conf Once configured, start the service, e.g: /etc/init.d/pandora_agent_daemon start For MS Windows®, there is a file with the same name in the directory where Pandora FMS agent was installed, and you may edit it with a standard text editor. The configuration tokens are exactly the same both for the GNU/Linux agent and for MS Windows® agent, except for some specific MS Windows® agent tokens. These are the default modules that report data in a Linux software agent: Are you not achieving the expected results? Go to  help or  support sections . 11. Module Advanced Settings In this section we will see how to configure some module advanced options, as well as to define the measurement thresholds that make a module go into WARNING or CRITICAL state. In a module's editing, it is possible to define, additionally, many other configurations that allow to customized each metric monitored by Pandora FMS. Go to the agent modules view, in the agent configuration mode view: From the normal agent view: Click on the cogwheel icon to go to the agent's "configuration" mode, and from there, click on the cube icon: Choose the module you wish to configure by clicking on its name: In this view, you will find the fields needed to adjust warning and critical thresholds . In this example, we edit the "CPU Load" module, a module that returns a numeric value (as you can see in the module type information, it is a "generic numeric"). Other interesting fields could be the checkbox to disable the module , or the module group definition combo it is attached to, that is used to "organize" the modules of an agent so they are grouped. Finally the " Historical data " checkbox allows to define that this module keeps all the information it receives (to show history graphs) or only the last value collected. You will also see some other interesting fields at the bottom of the Advanced Options drop-down tab: Thresholds In this section, configure the "Warning" and "Critical" thresholds for a module, that define which values a module must have to be in CRITICAL, WARNING or NORMAL status. Let's see an example: In our example there is a "CPU %" module to add thresholds to. This module, by default, will always be in NORMAL state (green) as long as it is between 0% and 100%. If you want that module to go into "Critical" or "Warning" status when the CPU reaches a certain %, you should configure it setting the desired "Warning Status" and "Critical Status" thresholds. In this example, we will configure them so that when the CPU reaches a 60% usage, the module will go into "Warning" status and if it exceeds 80%, it will go into "Critical". After configuring the thresholds, click "Update" and the thresholds will be properly configured. The next data received will already interpret those thresholds. Units This field within advanced options allows to define the units of the data obtained in a module. This unit will be included in graphs and reports, so it is easier to interpret the data displayed to the user. In this example, we want it to have "entries" as unit. Go inside the "Unit" field and choose the desired option from the drop-down menu. Finally, click "Update" and check that the unit is correctly displayed in the module view. If the unit does not appear among the available ones, define one by clicking on the pencil icon. Are you not achieving the expected results? Go to  help or  support sections . 12. How to use Pandora FMS plugins Plugins allow Pandora FMS to obtain information that requires complex processing or that requires the use of complex systems or APIs. Examples of plugins could be: MySQL database monitoring. In this quick guide we are going to show examples of plugins that are included by default in Pandora FMS, but there is the possibility of being able to create our own server and agent plugins. Server Plugins Pandora FMS includes by default a few plugins ready to be used, to visualize the server plugins registered in Pandora FMS go to  Management -> Servers -> Plugins. This kind of plugin only returns a single value. These plugins are stored in the directory /usr/share/pandora_server/util/plugin/ and they are executed by the server. To make use of this type of plugin, the plugin server must be enabled in file /etc/pandora/pandora_server.conf. To create a plugin remote module, access agent editing, at the Modules tab: Create a plugin server module . Generally speaking, it is configured as any other type of remote module. In this type of module there is the Plugin drop-down, which allows you to choose the plugin to be used. In this example, the Packet Loss plugin is used to check the amount of packets lost in a time span between the server and the target. Fill in the fields with the necessary information, in the case of the Packet Loss plugin, define the test time and the target IP. This is what the configured module looks like: Depending on the plugin, you will have to fill in different specific fields, for example, for MySQL plugin define the IP of MySQL server, the user name and password, and the data you want to retrieve. A few seconds after creating the module, the module and its obtained value will appear in the agent's view: Agent Plugins Linux This type of plugins are stored and executed from a software agent and can return more than one value. These plugins are stored in the /usr/share/pandora_agent/plugins/ directory of the local agent and are defined in the configuration file /etc/pandora/pandora_agent.conf. In the configuration file, some agent plugins are defined by default, in this example a plugin called top.sh is used, which shows the processes that are being executed in the agent. To see the created module and its value (or values, depending on the plugin) go to the software agent view in the console. You see that an icon with the shape of a sheet of paper is shown as obtained data, click on this icon to see the list of processes retrieved from the computer through the agent plugin. Windows The plugins are stored in the directory C:\Program Files "pandora_agent" and are defined in the configuration file C:\Program Files "pandora_agent" "pandora_agent.conf". As in Linux, there are some examples of plugins defined in the configuration file. Are you not achieving the expected results? Go to  help or  support sections . 13. Email Alert In Pandora FMS, alerts are assigned to specific agent modules. There are more advanced tasks (alerts on events, correlation, etc.) but those are not included in this guide. The first alert is just sending an email when one of the machines that are already being monitored (from the previous step) is down. Pandora FMS alerts are made up by three elements: Command (send an email), Action (send an email to a specific user, using the previous command) and Template (execute a specific action when a certain term is met). In this specific case, we are going to use a predefined command (send emails), we are going to modify an existing action (Mail to XXX) to send it to an specific email and we are going to use an already existing template, the template ''Critical condition'', which will execute the alert when the module goes into critical. With the alerts you may do many more things, such as creating a scaling, creating your own commands (to make more complex integrations or notifications), sending recovery warnings, setting correlations and mass assigning alerts, but that is for another type of guide. Configuring email alerts Pandora FMS already contains in its installation a server to send emails whose default sender is pandora@pandorafms.org . Although generally these are classified as SPAM by any receiver. In case you want to change the email address in charge of sending notifications, and the server that processes them, go to the console, to the section Setup > Setup > General Setup. At the bottom of the configuration page you will find the Mail configuration section. If you use the local server (127.0.0.1) you may not be able to send emails correctly, as the configuration of your environment will depend on it. If you need more information, click here . To prevent emails from being classified as spam, we recommend that you use a corporate email (exchange, gmail, etc). To be able to configure the recipient of an alert, modify the action. The action is "Mail to XXX" in Alerts > Actions. Click on the name of the action to add the configuration. Follow the menu "Alerts -> Actions". Edit "Mail to" action and use this example as a reference: Field 1 (Destination address) will be modified and the destination email address must be added. In field 2 enter the text from the screenshot. Here two macros are used (_agent_ and _module_) and they will replace at run time the agent name and the module generated by the alert. There are about forty macros that you can use to obtain values at the time of executing alerts. Read the documentation. Field 3 could be used to shape the email, in HTML or plain text: Although Pandora FMS includes an HTML viewer, we recommend that if you are going to write emails in HTML, copy and paste the code here: If you have not changed the default action, the HTML template of the mail will be similar to this one. You can modify it later, now let us see how alerts are assigned. Assigning an alert to a module Go to the agent edition view where you wish to assign an alert to an already defined module and click on the alert tab: Now add the module (for example, Host Alive), the template (Critical Condition) and the action that you configured in the previous step (Mail to XXX). Add the alert: Once added, you may see it in the agent view, checking whether it is executed or not, seeing the color of its state: You may wait (or force) the host to fail to see if the alert works, or you may "force the alert" to see if the mail is actually sent. Click on the force icon (see image): An email with the alert should be sent to the mailbox. As it is a "forced" alert, in the data field it says N/A. In real fife it would show the real module value, like this one: Are you not achieving the expected results? Go to  help or  support sections . 14. Create a Custom Report Pandora FMS offers the possibility of custom display for the monitored data through reports that can be programmed to be sent, exported to PDF or displayed in real time. To create a custom report, go to the menu "Reporting" -> "Custom reports", where you may find the button "Create report" for creating reports. First define a name, group, write access or whether the report will be interactive or not. Non-interactive reports are reports that due to their large size are preferable to only be programmed since it takes some time to generate them. Once you have filled in these data with the desired requirements, the upper right menu will offer new options, thanks to which we can start adding different monitoring items. You may see that, in addition to the element editor, there are three wizards that will help you with report creation. The general wizard allows you, for example, to add graphs of different agents/modules to the report:   The wizard allows to easily create other elements within the report, such as showing maximum, minimum or average module values in a time interval, a list of triggered alerts or generated events. SLA Wizard : This wizard allows to create SLA report items automatically. You will be able to choose the value validity ranges of the modules to be selected. This feature will allow you to check the time percentage that a module has kept values within specific ranges. If no thresholds are defined, they will be dynamically adjusted to the each module's criticality thresholds. You will be able to know, in short, what time percentage it behaved as expected . Grouped reports are also available: Global : In this report section, you may create Exception, General or Top N elements easily through a wizard. Exception : This shows module values that meet a logical operation (e.g.: show the occupation percentage of those links that have an activity higher than 100KB/Sec). General : It shows values of several modules ordered (ascending, descending, by agent name) and/or grouped by name. Top N : It shows N values classified by maximum, minimum or average over the total of added modules, in ascending or descending order or by agent name. That way you may add different modules from different agents, being also possible to choose the operation to perform on each module: sum, average, minimum, maximum. In the tab "Item Editor" you may find more specific elements, such as the possibility of creating inventory elements for your reports. That will allow you to see the hardware and software data of the agents you select, if they have inventory values collected. Once the reports have been configured, you may see them thanks to the "View report" icon at the upper left corner. In the case of this report, these are the results.   Are you not achieving the expected results? Go to  help or  support sections . 15. Visual Console Creation Parent visual console creation In this first map, we will add the status of several agents distributed in a world map. It can be done manually, one by one or through the Wizard. To make its creation easier, we are going to use the Wizard in the example. The first step is creating a new map, in this example called World Map. Once created, click on the Elements Wizard: In the Wizard select the element type (in this example Static Graph) the image you want to use, whether you want to use an item by agent or by module, and select the agents you are going to add inside the list that appears. Click add, go to the "View" tab and all the elements created will appear on the map, as seen in the following screenshot. Move all the elements to their appropriate map positions, by clicking and dragging them over it. To move or add elements, enable the "Edit" token. Child visual console creation In the second map, an element that indicates the state of one of the main agents will be created, together with all the given modules. You will also see in this map a graph of the DiskUsed_/ module from the same agent. The first step is to create the new map like before: Once created, add the element that shows the state of the agent by selecting the Static Graph item, as in the attached image: Create the graph clicking on the Basic chart item with the attached configuration, adding the agent and module that you will see represented in the graph. The main element of the map is created. Now create a new element for each of the agent modules. For that, use the Wizard configuring it as seen in the attached screenshot. Select the agent Static Graph and the modules you indicate. Set as label the module name and assign to this item a parent previously created in the Visual Map, in this case the previous element that you added. After creating all these elements, they will appear together with the main element and you may move them dragging them directly with the mouse to the position you wish. Map linking In the previous steps we created the two maps. In this step we will indicate how to click on the element located on Spain in the "World Map", opening directly the map "Spain Map". To do that, open the World Map in edit mode by double-clicking on the element 192.168.70.45. This will allow to edit the element, click on advanced options and in the option Linked visual console, select Spain Map. Update the element by clicking on the OK button. When you return to the World Map view, click on the item above Spain and the map of Spain will open directly. If there is only one element in red on the map of Spain, the icon representing Spain on the parent map will also be displayed in red. Are you not achieving the expected results? Go to  help or  support sections . 16. Dashboard creation A Dashboard is a Pandora FMS feature that allows each user to build his own monitoring page. You can add more than one page, and there you can add monitoring maps, graphs and status summaries, short event lists (with filters) and many other widgets.   To create your own dashboards go to "Reporting" -> "Dashboards", where you can select the "New dashboard" button to create the ones you need. Pandora FMS will show you a new window where you may give name to your new dashboard and define if it will be a private dashboard, the monitoring group it belongs to or if you want to define it as a favorite so that it shows up in the lateral drop-down menu in the dashboards section. Once these steps are defined configure your first widget.   You may choose between different aspects of your environment's monitoring to display them on screen. You may choose, for example, the list of the last events generated. This will get your widget ready, which you have to configure to define the desired parameters, such as the type of events you want it to display, the list size, severity or the group they belong to. Once selected, your widget will start showing the data and you may start adding as many as you want by clicking " Add cell (+) " in the edit view.   Following this process, you can build a dashboard like this with a few clicks: Are you not achieving the expected results? Go to  help or  support sections . 17. Inventory Pandora FMS allows you to keep an inventory of the devices monitored by Pandora FMS. It is possible to keep a list of the processor model, storage, running services, software installed on the equipment, among other information. The inventory is independent of monitoring and can be obtained:      - Remotely , using Inventory Modules.     - Locally , with Pandora FMS Software Agent, through agent plugins. We can create our own Remote and Local inventory modules, but we do not go into detail in this quick guide. Remote inventory To assign this type of inventory to a remote agent, access the agent edition, particularly the Inventory tab. Fill in the fields with the following information: The type of inventory you wish to obtain, in this example the CPU model. The target IP , which in this case is 192.168.1.77. The username and password of an existing user on the remote machine. Optionally you may set a custom interval for the  module execution and make use of custom fields. Click on the Add button. The inventory module will have been applied and you will be able to perform actions such as deleting, editing and forcing the execution of the module by clicking on its corresponding icons. You may see the data collected by the remote inventory module from Operation -> Monitoring -> Inventory. Local Inventory Inventory data is obtained through a software agent, the configuration is a little different depending on whether it is a Windows or Linux agent. Windows By default, there are some inventory templates in the agent configuration file pandora_agent.conf. To enable the local inventory modules, un-comment the corresponding code block, in this case we will collect the inventory from the available storage disks: Define the execution interval through cron. See the value returned by the software agent (DESKTOP-2GGIE80): Linux In Linux, inventory modules are also defined in pandora_agent.conf file, but unlike Windows, here it is established by uncommenting a single line, specifying the inventory you want to obtain. The line means that an inventory plugin will be used, 1 means that inventory data will be collected every 1 day (set to 0 if you want it to be collected in every agent execution), and the objects from which you want to collect inventory data: See the values returned by the software agent (Rocky-AS): Are you not achieving the expected results? Go to  help or  support sections . 18. Events An event is everything that happens within the system. It may be module creation or even user login in the console. The event itself is a descriptive text of the problem, its source, an agent, and its creation date. Pandora FMS allows displaying in real time all the events of your monitored systems. With this information, you may carry out the necessary actions according to the created event. Information is shown about any module status changes, launched or recovered alerts, system restarts or custom events. Depending on the information he event has, it will appear in one color or another. For example, if an information event says a module has gone into a critical status, this event will appear in red. Thanks to this default view you may see the active "problems" in real time. Going into critical or warning events are automatically validated when the situation returns to normal. This is what is known in Pandora FMS as event auto-validation and it is an essential feature, since it allows to hide the information that is no longer relevant in the event console. There is the possibility in Pandora FMS of setting alerts on events, so instead of acting on each module, it could be done on a specific group of modules, generalizing monitoring and making alert deployment much easier. Correlation and event alerts are an Enterprise feature. Besides, correlation rules can be created on the events, creating true logical heuristics when dealing with events. Obviously, these are advanced and complex features that are not seen in this quick guide. Are you not achieving the expected results? Go to  help or  support sections . 19. Working with Policies in Pandora FMS Pandora FMS offers the possibility of working with previously seen alert and module creation and management tools in more efficient ways. One of them is the mass operations tool. However, the most powerful of these tools are monitoring policies. Policies are groups of settings where you add elements that you may later mass load in the agents or agent groups. Those elements can be monitoring modules (remote or local), alerts and script collections for local monitoring. Policies are an advanced Enterprise version feature. Policies are  designed to make monitoring's initial deployment easier and also to homogenize monitoring management , since you may unify checks by different criteria such as Operating System, applications, network... that is, by any common factor of the software and remote agents previously installed or included. If you go to Configuration → Manage policies , you will see some already created by default, and others created especially for the monitoring you implemented specifically according to the applications to be used. If you take a look at the policies located at the top, you find those for operating systems such as MS Windows®, GNU/Linux® or Solaris®. It is important to mention that the local type modules will be applied if the software agent has the remote configuration enabled , in any case we can force the creation of local modules from the policy configuration, enabling the token  "Force Apply" : Policy modules For example, with the basic Linux policy, if you go to module section, you see some already pre-loaded to obtain the corresponding checks on CPU usage, available memory and other metrics. These modules can be both local and remote: Right next to it there is another menu with options like a Wizard to create both interface and WMI modules. You will be able to create inventory modules, link policies and modules, use agent plugins to monitor applications, use collections to upload files between Pandora FMS server and the software agent or create both internal and external alerts. External alerts In the policies we can establish external alerts, which are alerts for modules defined in the agents to which the policy has been assigned, that is to say, modules belonging to the agents and not to the policy itself. To do this we go to the External Alerts  tab and click on  Add . The following window will be shown in which we must choose the modules that will be added to the alert, in which condition it will be triggered (in this case when the status of the modules is critical) and the action that will be launched. Click on Add external alert and observe the alerts created: Alerts This type of alerts are set only to the modules defined in the policy, go to the Alerts tab and click on Add . A window similar to the previous one will be shown in which we select the modules assigned to the alert, the condition in which the alert will be triggered and the action to perform when the alert is launched. Click on Add alert and observe the alerts created. Collections The collections are sets of files that we can deploy in a massive way in our software agents by means of policies, for this we go to the "Collections" tab. We observe the collections that are applied to the policy, to add another collection we click on the Add(+)  button. Agent plugins We can also deploy agent plugins massively through the policies, we observe the existing ones and add the new ones from the Agent plugins tab. Linking The policy modules that are not linked to the agent appear here, so the changes we make in those modules will not take effect in the agents unless we link them again by marking the modules and clicking on the Link button. Inventory modules We can also add inventory modules massively with the policies from the Inventory modules tab, although the inventory is obtained remotely, so all the agents to which we assign the policy must have the same access credentials. Assign agents to the policy Once a policy has been defined we will assign it to new agents: And we will apply the policy to the agents assigned to this policy. In this way we will "synchronize" the configuration of all the agents and we will make sure that their monitoring configuration is the same for all the agents of that policy. Once this last operation has been carried out, all the selected agents will have in their configuration the modules included in the policy, alerts, plugins, collections and inventory in a massive, simple and fast way. If this icon appears when displaying all existing policies, it means that the policy has undergone changes and is pending application in all the agents involved. Delete policy To delete a policy we must delete all the applied agents from it, this can be done by clicking on the broom icon, then the trash can button will be enabled to delete the policy.   Are you not achieving the expected results? Go to help or  support sections . 20. Next Steps This guide does not cover them but you may be interested: Network Maps . Monitoring with SNMP Traps . Log Collection and Monitoring WEB User Experience (WUX) Monitoring . Managed system remote access (Quick Shell) IT Automation (Omnishell) 21. Where to Look if Problems Arise? In the face of any problem, Pandora FMS offers different tools to take measures: Diagnostic tool: in Admin tools -> Diagnostic info , it will provide you with a list of essential system information. Event viewer: In Events -> View events , it displays all the events generated in your environment and allows working with them in a simple way. Audit viewer: In Admin Tools -> System audit log , it shows monitoring environment detailed information. Advanced information sources Information sources (logs) where you may look for more information, errors, etc: "/var/log/pandora/pandora_server.log''. Server log file that contains very important clues. If you want more details, modify the ''verbosity'' parameter of the server configuration file to show more details. ''/var/log/pandora/pandora_server.error''. Log file of not captured server errors. It contains traces of errors not handled by the server, they are usually bad stuff. "/var/log/pandora/pandora_agent.log''. Unix agent log file. ''%PROGRAM_FILES%\pandora_agent\pandora_agent.log''. Windows agent log file. ''/var/www/html/pandora_console/log/console.log'', Pandora FMS console log file. "/var/log/httpd/error_log'', Apache server error log file (httpd). "/var/log/messages'', system log file. 22. Support Pandora FMS Forum The forum is open 24x7 to anyone, you may create an account and ask questions. It is totally for free and there are communities in English and Spanish. It has more than 15,000 messages that can be used to find the solution to a problem like yours or to ask our community. Pandora FMS FAQ We have a list of frequently asked questions ( FAQ ) that can give you a hint or directly a solution to a particular problem. Pandora FMS official training Of course, you also have the option of training, through Pandora FMS official courses (certified). More information in our web site .