Quick Start Guide ( Cloud )
- Introduction
- Online installation tool
- Pandora FMS monolith environment (server/console/database)
- Requirements for the use of the online installation tool.
- First steps
- Enterprise license activation
- Start the Enterprise server
- Detecting local network systems
- Add a remote check on an already monitored system
- Add a problem alert
- Monitoring a Windows server with a software agent
- Create a visual screen with monitoring details
- Adjust monitoring
- Advanced module properties
- Configuration of the units of a module
- Setting the interval of a module
- Configuration of the thresholds of a module
- Advanced threshold parameters
- Other advanced parameters
- Troubleshooting. Where to look, who to ask
Introduction
Presentation
The purpose of this guide is to introduce Pandora FMS, in a quick and concise way, to someone who is not familiar with the tool, but has a medium/high knowledge of networks and systems. The purpose is not to go through all the Pandora FMS functionalities, but only the most relevant ones, so that a user that goes through the whole guide can execute basic administration and operation tasks in record time.
Please note that the official Pandora FMS certification courses last 40 hours, and that the official documentation extends beyond the 120 topics. With this guide we intend to build a bridge for a smooth entry into Pandora FMS.
At present, due to the very good speed on the Internet (100 mbps or more), it is recommended to make an online installation (cloud) and, once finished, go to the monitoring starting point.
Online installation tool
If you have access to the Internet, it is recommended that you perform the installation online using this useful tool.
Pandora FMS monolith environment (server/console/database)
This installation method is especially useful when the environment is hosted by cloud providers, although it is not exclusive to such environments.
The term "Cloud provider" (or simply "Cloud") is used to describe the hosting of virtual machines, either exclusively or shared, at specialized providers with hardware, hypervisors and customer support web systems for configuration and management.
For any of them you can install Pandora FMS Community edition. Red Hat (RHEL) 8.x is recommended as the operating system, although it also has official support for Rocky Linux 8.x, AlmaLinux 8.x and Ubuntu server 22.04.
The minimum hardware requirements for this installation are: 1 core, 2 gigabytes of RAM and 20 gigabytes of free disk space, preferably Solid State Drive (SSD).
These requirements are the minimum installation requirements, to properly size the monitoring environment we recommend going to the minimum hardware requirements section.
Requirements for the use of the online installation tool.
Internet access. Specific web addresses:
- ICMP:
- firefly.pandorafms.com
- support.pandorafms.com
- HTTPS:
- https://pandorafms.com
- https://firefly.pandorafms.com/pandorafms/
- https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
- https://rpms.remirepo.net
- https://repo.percona.com
- http://mirror.ghettoforge.org
- https://download.oracle.com
- https://packages.microsoft.com
- https://github.com/pandorafms/
- For the Enterprise version (HTTPS):
- https://raw.githubusercontent.com/pandorafms/
- https://pfms.me
- In addition to these URLs it is necessary to have access to the official repositories of the distribution used (RHEL / Rocky Linux / Ubuntu).
-
Have curl installed (it comes by default in most distributions).
-
Meet the minimum hardware requirements.
-
Be a root administrator user.
-
Have a compatible OS.
-
In the case of using RHEL 8 it will be necessary to be previously activated with a license and subscribed to the standard repositories.
To use the online installation tool simply access the command line provided by your provider in the Cloud, with root administrator user, and ask for the installation command:
This tool can be requested through from this link for get a free trial (demo).
In addition, for the installation of Satellite server, there is also an online installer.
With this execution, the whole Pandora FMS stack will be installed, leaving a fully functional instance to start monitoring.
You can learn more in the video tutorial "Cloud installers (agents, server)".
First steps
Once installed, the system should boot up and, after a few seconds, display the terminal to log in. The first step should be to know the IP address that the system has assigned to be able to connect to the server from outside. To do this, type the following command in the terminal:
ifconfig
You can also use the command ip address show
.
In the case of this screenshot, the IP address of the system is 192.168.70.158
.
Once you know the IP address of the Pandora FMS system, you can access it from outside the virtual machine, which is always the most convenient. It can be done via SSH or via HTTP. Use the root password (superuser) that you established in the installation configuration (DBROOTPASS).
http://x.x.x.x/pandora_console
In the above example it would be
http://192.168.70.158/pandora_console
If everything is correct, you will access to the Pandora FMS Console welcome screen, similar to this one:
Use the default credentials: user admin
and password pandora
/Pandor4!
.
Once you have reached this point, you have a complete Pandora FMS installation ready to start using it.
Enterprise license activation
This section is for Enterprise version users only. If you would like to evaluate a demo, please contact us.
If you have licensed a Metaconsole license you can skip this step as this type of license automatically activates each associated node.
It is important not to start the daemon pandora_server
with the Enterprise version of it installed, without first enabling the Enterprise version of the Console, as errors will occur.
You can also get more information in the tutorial video «How to renew Pandora FMS License online» or «offline». Once Pandora FMS has been accessed through the browser, you will be asked to enter a valid license. Click on Request new license and proceed to the next step. In this step you must fill in the contact information and the Auth key commercial department commercial department has sent you.
Proceed to the next step by clicking on Online validation:
Once this step is done, it will automatically output the license ready to validate.
Finished all the steps, the console is ready to be used.
Start the Enterprise server
This section is for Enterprise version users only. If you want to evaluate a demo, please contact us.
After activating the license, the Enterprise server must be booted. You can connect to the Pandora FMS server through a command terminal (local or remote) or through the QuickShell functionality if you access the Agent that monitors the server itself.
sudo /etc/init.d/pandora_server start
From version NG 754 on wards you have additional options in manual startup and shutdown of High Availability (HA) Environments.
To verify its correct operation, access Pandora FMS through the browser, go to the left side menu, click on Management → Servers → Manage servers. You should see something like the following:
Detecting local network systems
To start monitoring with Pandora FMS, nothing better than detecting which devices are nearby and start detecting them. It doesn't matter if they are personal computers (PC) with MS Windows®, servers with GNU/Linux®, routers, switches, etc, since a very basic monitoring is going to be done (see if they respond to a ping). Then you can improve the monitoring once you have located them (see also "Introduction to Pandora FMS Discovery" (video): https://www.youtube.com/watch?v=oiPyFDgYvIM .
Creating a recognition task
In the side menu go to the Management → Discovery → Host&Devices section. Click on the Net Scan button, this will allow you to create a discovery task.
It will create the task as follows: You will have to modify only the network range to be scanned, in this capture it is 192.168.70.1/24
, which means that all hosts in the network 192.168.70.xx
will be scanned. The appropriate mask will be used here to define the network. Select the Applications group, which will be used to contain the devices you detect. From now on we will call generically "agents" to the devices managed and/or monitored by Pandora FMS.
Select under Module template the Basic monitoring option, which covers only latency and network availability checks. You can select other types of checks, such as SNMP or WMI, to be performed during the survey.
Once created, the entry will be displayed. Click on the magnifying glass icon to view the details of the task:
Clicking on the magnifying glass icon will show the current status of the task, which in this case is completed. In this image you can see that the progress bar has disappeared and the system has found the systems in the network to add them to the monitoring.
Checking the detected systems
Wait until the entire network has been detected.
When you are finished, access the agent detail view (left side menu Operation → Monitoring → Views → Agent detail) to view all detected systems.
You will be able to see several systems that have been correctly detected by Pandora FMS. In some cases the system name will have been resolved (if it was possible by DNS) and in others the operating system will have been detected. By clicking on the name (in this case, the second one in the previous image) you will go to the agent detail view, which will show all the information collected from that system.
Add a remote check on an already monitored system
Now that the systems are detected, add some monitoring modules. Add the following monitoring:
- Network traffic on an interface.
- Packet loss on the network.
- Monitor a TCP network service.
See also: "Live the SNMP fever. New Wizards: Network monitoring (video)": https://www.youtube.com/watch?v=yb2Ln0waCTY
Network traffic on interface
For this it is imperative that SNMP is configured on the remote device. This generally needs to be enabled and with a minimum configuration that allows data to be queried. The SNMP devices allow you to configure which IP addresses can make queries and with which community, which for all intents and purposes is a kind of password.
First you locate the agent from where you need to get the network traffic; in this case it is 192.168.70.1
. Following the same process (left side menu Operation → Monitoring → Views → Agent detail) you get to the main view of the agent to be configured and click on the last tab on the right, which will take you to the editing view of that agent.
It will switch to the main editing view of the agent. Here the Wizards configuration submenu for this agent will be displayed, where the wizard (Wizard de Interface SNMP) will be chosen.
At this point you must provide the SNMP community that the device has configured, and make sure that the device supports SNMP queries enabled on the IP address shown on the screen. You can change the IP address and the default SNMP community, which is public
. Once it is filled in, the SNMP Walk button will be given the job. If all goes well, it will display interfaces and the data that can be obtained from them.
With CTRL+Click (or CMD+Click on MacOS®) you can select several items in both boxes. Always remember to monitor the Output traffic (ifOutOctets), the Input traffic (ifInOctets) and the interface status (ifOperStatus) for each interface. Click on the Create modules button and a screen will appear that should inform that the modules have been created.
Bear in mind that the network traffic modules are of the incremental type, i.e. their value is the difference between the information sample just collected and the previous one. It displays a “rate” (in this case in bytes per second), so it needs some time (between 5 and 10 minutes) before displaying any data.
Click on the tab View to return to the agent view and wait at least 5 minutes until you already have traffic data, refreshing or clicking on the tab View.
Packet loss in the network
Remote plugins are user-defined checks that use a script or program that has been deployed on the Pandora FMS server, so that it can be used for monitoring, expanding the set of things it can do. In this section we will add a remote plugin preconfigured in Pandora FMS.
Use a plugin serial; to do so, go to the agent edit view and then to the module configuration tab:
First choose Network management and then the plugin Packet Loss using the drop-down lists, and finally put the IP address on which you want to launch the check. The rest of the fields are left as they are. The editing mode is similar, only that the Create button is replaced by the Update button.
Update the screen a couple of times, until the new module appears in the list:
This is a very interesting plugin, which used in conjunction with the basic connectivity (ping) and latency time, serves to determine the quality of the network, as it indicates the percentage of packet loss, sampling every 5 minutes by default.
Monitoring a TCP network service
In this case we are going to add a monitoring to verify that an SMTP (email) service is active on a machine. Although it can be a very complex check (simulating that user and password credentials are sent, that an email is sent, etc.) it will be simplified by only verifying that the port is open and that it responds.
To do this, repeat the same initial steps as in the previous example, but this time choose a Network module.
Then use the drop-down controls until you find the desired check (Check SMTP Server) and click to create the module.
Finally the steps will be repeated again (go to the operation view and refresh until the monitor appears), so the final result will be something similar to this:
Add a problem alert
In Pandora FMS the most basic way to make alerts is to assign an alert to a specific module.
Introduction
Of course, more advanced work can be done such as alerts on events, correlation, etc. The first alert to do is to send an email when one of the machines that are already being monitored (with the Host alive module) goes offline.
Pandora FMS alerts are composed by three elements:
- Command.
- Action.
- Template.
In this specific case we are going to use a predefined command (sending emails), we are going to modify an action that already exists (Mail to XXX
) and we are going to use a template that also exists, the Critical condition template, that will execute the alert when the module in question appears in critical condition.
See also: "Pandora FMS alert system (video)".
Server Configuration
For the correct operation of the command email
you must configure in the file pandora_server.conf
a mail server that allows to make relay.
In the example, the mail server located in our local host (localhost
) using Postfix . You must put the IP address of the local mail server, or one on the Internet (configuring authentication for it).
To modify the server configuration file, you must access to él, located in /etc/pandora/pandora_server.conf
as user root elevating its privileges by means of the command sudo su
. You are the only responsible for that key.
To edit such a configuration file in this example, the program vim is used. You can get more information in the tutorial video«File editing with VIM».
Look for the lines seen in the screenshot below and set those values. If you do not have a mail server, you can use for example a Gmail® account. You can see a quick guide on how to configure the Pandora FMS server to work with a Gmail® account in the following link: Configuration of email alerts.
Lines beginning with the #
character are comments and are not taken into account by the server.
Once the changes are made press ESC and :wq
to save the changes and exit. Once you are in the command line, restart the Pandora FMS server:
/etc/init.d/pandora_server restart
.
Alert Configuration
As indicated above, alerts in Pandora FMS are composed of 3 parts: Command, Action and Template. You can find these options in the section Alerts. In order to configure this alert you only need to modify the action so you will use the option Alert actions.
The action to use is Mail to admin, click on that name to edit the alert action.
Modify field 1 (Field 1) and put your email box, in this example it is used yourmail@example.com
. Field 2 (Field 2) is left the text that is in the screenshot. Here we are using two macros that will replace at run time the agent name and the module that has generated the alert.
Assign alert to module
Now add the module (Host Alive), the template (Critical Condition) and the action ( Mail to admin ). Click on the button Add alert.
Once added, you will be able to observe in the agent view whether it is running or not, seeing the color of its status:
When the host goes out of line the alert will be initiated:
An email with the alert should arrive in your mailbox, something like the following:
Pandora FMS alerts are extremely flexible, and therefore, sometimes complex to use. There is a chapter in the documentation specifically for them: Alerts in Pandora FMS.
Monitoring a Windows server with a software agent
In Pandora FMS there are two types of monitoring:
- Remote (the one that is done from the Pandora FMS server to the different devices).
- Local (a software agent is installed in each of the machines to be monitored and it is in charge of extracting the information and sending it to the Pandora FMS server).
See also: "How to install a Pandora FMS Windows agent (video)": https://www.youtube.com/watch?v=tVD9phgTuPI
In this point we are going to deal with the installation of a software agent in a MS Windows® machine and the basic monitoring of it.
Agent Installation
The first step is to download the MS Windows® agent from:
https://sourceforge.net/projects/pandora/files/Pandora%20FMS%207.0NG/759/Windows/
At this link you can choose between 32-bit or 64-bit agent.
Once the agent is downloaded, run it by double-clicking on él and the language selection screen will appear:
It is a standard MS Windows® installer that will prompt you to follow the steps below. Accept the license and proceed through the different windows of the installer. Select the path where the Pandora FMS agent will be installed (by default it is installed in %ProgramFiles%/pandora_agent
). You can change it by pressing Browse…, once correctly indicated press Next:
Wait for the files to be copied. Configure the IP address (or name) of the Pandora FMS server that will receive the agent data and the group to be associated with the agent.
In the next window appears the option to enable the remote configuration. It is important to have it enabled with a 1
to have a copy of the agent in the Pandora FMS server and from there you can add, edit and delete local modules directly from the agent.
To start the agent service at the end of the Pandora FMS agent installation keep selected Run Pandora FMS Agent 7.0NG; otherwise you will have to do it manually, or it will start when MS Windows® is restarted again.
Once this process is finished, the MS Windows® agent is installed, running and reporting on the computer.
Checking the information returned by the agent
Once the MS Windows agent has been started® after its installation, it is time to check what this agent is reporting. To do this, you must know the name under which this agent is going to report. By default the agent is created with the name of the host. You can see the name of the host MS Windows® with the execution of the command hostname in a window with cmd.exe.
Once you know the agent name, the next step is to see if it has been created in Pandora FMS. To do this you have several options. The first one is to search in agent details, inside the group in which the agent has been created, in this example the group Workstations.
A faster and more efficient way to find the agent is to search directly through the Pandora FMS search engine, indicating the agent's name.
By default, the MS Windows® agent comes with several pre-loaded local basic monitoring modules, such as CPU load (CPU Load), % of RAM used (Memory_Used), free space in MB of disks (DiskUsed), etc.
If we need to add new modules to this agent, we can consult the advanced documentation of monitoring with software agents.
You can see graphs generated with the module's data history and a table with the data history from this view by clicking on the marked icons in the following screenshot:
Create a visual screen with monitoring details
One of the visualization options offered by Pandora FMS are the Visual Consoles. The Visual Console allows to represent the monitoring information in real time in a completely graphical way. In this example of Visual Console we are going to create an example of a network distributed all over the world and we will see how by clicking on the node that appears over Spain, we can see another map of Spain with other elements of the Spanish installation.
See also: "Creating visual consoles in Pandora FMS (video)": https://www.youtube.com/watch?v=TIdsDbfBX5c
The power of the maps is that it allows to "summarize" the state of a child map in the visualization of the parent map; that is to say, if any of the elements visualized in the map of Spain is put in critical state, the icon that represents Spain will be red. This allows very customized hierarchies to be established when displaying information. Maps can contain status information of groups, agents, modules. In addition, graphs and data (numeric or text) can be included, as well as text labels and icons.
Creation of map 1 (Parent)
On this first map, the status of several agents distributed on a world map is added. This can be done manually, one by one, or through the Wizard. To facilitate the creation of the same we are going to use the Wizard in the example.
The first thing we have to do is to create a new map, which we will call World Map. Go to Operation → Topology maps → Visual Consoles and click Create map.
Once created we click on the Wizard of elements:
In the Wizard select the type of element, in this example Static Graph, the image to use, if you want to use one ítem per agent or per module (in this case per agent), and select the agents to add within the list that appears.
Click on the add button (Add) and all the created elements will appear on the map:
Move all the elements until you have them positioned on the map, by clicking and holding while dragging it over the map.
.
Creation of map 2 (Child map)
In the second map you will create an element indicating the status of one of the main agents, attached to it all the given modules. You will visualize in this map also a graphic of the FreeRAM module of the same agent.
The first step is to create the new map as you did in the previous step:
Once created, add the element showing the agent status in the Static Graph section:
Also create the graphic with the attached configuration by clicking on the graphics icon, adding the agent and module from which the graphic is to be mirrored.
Now that you have created the main element of the map, you must create a new element for each of the modules that exist in the agent. To do this, use the Wizard making its configuration as you see in the attached screenshot. Select Static Graph of the agent and the modules that are indicated. We place as label the name of the module and assign to this one a parent previously created in the Visual Map, in this case the previous element added.
After creating all these elements, they will appear attached to the main element and you can move them by dragging them directly with the mouse in the desired position.
.
Linking of both maps
In the previous steps we created the two maps. In this step indicate how to click on the element located on Spain on the map World Map, opens directly the map Spain Map.
To do so, open the map World Map, in edit mode, by double-clicking on the item 192.168.70.70
. The element editing will open, click on advanced options and in the option Linked Map, select Spain Map. Update the item (button Update).
Back on the map view World Map, click on the item above Spain and the map of Spain will open directly. If only one item on the map of Spain is red, the icon representing Spain on the parent map will also be red.
Adjust monitoring
In this section we will see how to configure some of the advanced options of a module (thresholds, units, others).
Advanced module properties
Select the desired module to configure.
Later open the tab a Advanced Options and proceed to configure the desired fields.
In the next two sections you will see how to configure the fields Unit and Interval and the thresholds Warning Status and Critical Status.
Configuration of the units of a module
Allows defining the units of the data obtained in a module. This unit will be included in graphs and reports, making it easier to interpret the data displayed to the user.
For example having as unit %
: Placeúese inside the Unit field and type the desired unit.
Finally, click on the Update button to save and verify that the unit is correctly displayed in the modules view.
Setting the interval of a module
Configuring or modifying the module interval defines how often the module runs. This affects remote modules (not running locally), as local modules are configured in a slightly more complex way.The more frequently a remote system is monitored, the more load it will generate on the system.
Click on the Update button and you have configured the module.
Configuration of the thresholds of a module
In this section you can configure the thresholds Warning and Critical for a module;module with the values that a module must have to be in a state CRITICAL
, WARNING
or NORMAL
.
In this example you have a CPU module to add thresholds to. This module will always be in the NORMAL
(green) state as long as it is between 0% and 100%. If you want this module to display in status Critical or Warning when the CPU reaches a certain percentage, you must configure by determining the desired Warning Status and Critical Status thresholds. In this example for when the CPU reaches 90% usage the module will switch to status Warning and if it exceeds 95%, switch to Critical.
After configuring the thresholds, just click on the Update button and the thresholds will be correctly configured. The next data received will already interpret these thresholds.
Advanced threshold parameters
The box Inverse interval is used to define non-contiguous ranges. In this example, the module will change to the critical state if the value is below 20 or above 80:
In string-type modules, the threshold is defined as a substring. Similarly, it can be inverted so that the module goes to CRITICAL
if no contains the substring passed as a par meter:
.
Other advanced parameters
The configuration of a module is very flexible, with dozens of possibilities. In the Pandora FMS documentation we can discover all of them.
Troubleshooting. Where to look, who to ask
Configuration files and diagnostic information sources
The main configuration files that we may need to modify or review are the following:
/etc/pandora/pandora_server.conf
: Main configuration file of the Pandora FMS server. If you modify something there, you will have to restart the Pandora FMS server./etc/pandora/pandora_agent.conf
: Main configuration file of the Pandora FMS software agent on Unix. If you modify something there, you will have to restart the Pandora FMS agent.%ProgramFiles%\pandora_agent\pandora_agent.conf
: Main configuration file of the Pandora FMS software agent on Windows. If you modify something there, you will have to restart the Pandora FMS agent service./etc/my.cnf
: MySQL main configuration file./var/www/html/pandora_console/include/config.php
: Pandora FMS console configuration file. During the installation it configures itself, but if you have changed any environment parameter (path, IP, MySQL user/password, MySQL host) you will have to modify it manually.
Information sources (logs) where we can search for more information, errors, etc.:
- /var/log/pandora/pandora_server.log: Server log file, contains very important clues. If you want more detail, modify the verbosity parameter of the server configuration file so that it shows more detail.
/var/log/pandora/pandora_server.error
: Log file of uncaught server errors, contains traces of errors and exceptions not handled by the server./var/log/pandora/pandora_agent.log
: Unix agent log file.%PROGRAM_FILES%\pandora_agent\pandora_agent.log
: Agent log file on Windows®./var/www/html/pandora_console/log/console.log
: Pandora FMS console log file./var/log/httpd/error_log
: Apache server error log file (httpd)./var/log/messages
: System log file.- dmesg: Command that displays kernel warnings.
/var/log/pandora/pandora_snmptrap.log
: SNMP trap log. If there is any error in booting the SNMP trap console it may show error traces there./var/log/mysqld.log
: MySQL log./var/log/pandora/web_socket.log
: WebSocket log./var/www/html/pandora_console/log/cron.log
: cron log.
Permissions of some directories:
/var/spool/pandora/data_in/
Must be from pandora:apache with permissions 755./var/log/pandora/
Must be from pandora:root with permissions 755./var/www/html/pandora_console/include/config.php
must be fromapache:apache
with permissions600
.
In versions prior to 747, the console log storage path is:/var/www/html/pandora_console/pandora_console.log
In case of updating by OUM, the corresponding achievement file must be modified.
Support
The community forum is open to anyone, you can create an account and ask:
We have a list of frequently asked questions in the knowledge base that may give you a hint or directly a solution to a specific problem:
Of course, you also have the option of training, through the official Pandora FMS courses (with certification):