Quick Start Guide ( Cloud )

• Introduction
• Presentation
• Online installation tool
• Pandora FMS monolith environment (server/console/database)
• Requirements for the use of the online installation tool.
• First steps
• Enterprise license activation
• Start the Enterprise server
• Detecting local network systems
• Creating a recognition task
• Checking the detected systems
• Add a remote check on an already monitored system
• Network traffic on interface
• Packet loss in the network
• Monitoring a TCP network service
• Add a problem alert
• Introduction
• Server Configuration
• Alert Configuration
• Assign alert to module
• Monitoring a Windows server with a software agent
• Agent Installation
• Checking the information returned by the agent
• Create a visual screen with monitoring details
• Creation of map 1 (Parent)
• Creation of map 2 (Child map)
• Linking of both maps
• Adjust monitoring
• Advanced module properties
• Configuration of the units of a module
• Setting the interval of a module
• Configuration of the thresholds of a module
• Advanced threshold parameters
• Other advanced parameters
• Troubleshooting. Where to look, who to ask
• Configuration files and diagnostic information sources
• Support

Introduction

Presentation

The purpose of this guide is to introduce Pandora FMS, in a quick and concise way, to someone who is not familiar with the tool, but has a medium/high knowledge of networks and systems. The purpose is not to go through all the Pandora FMS functionalities, but only the most relevant ones, so that a user that goes through the whole guide can execute basic administration and operation tasks in record time.

Please note that the official Pandora FMS certification courses last 40 hours, and that the official documentation extends beyond the 120 topics. With this guide we intend to build a bridge for a smooth entry into Pandora FMS.

At present, due to the very good speed on the Internet (100 mbps or more), it is recommended to make an online installation (cloud) and, once finished, go to the monitoring starting point.

Online installation tool

Pandora FMS monolith environment (server/console/database)

This installation method is especially useful when the environment is hosted by cloud providers, although it is not exclusive to such environments.

The term "Cloud provider" (or simply "Cloud") is used to describe the hosting of virtual machines, either exclusively or shared, at specialized providers with hardware, hypervisors and customer support web systems for configuration and management.

For any of them you can install Pandora FMS Community edition. Red Hat (RHEL) 8.x is recommended as the operating system, although it also has official support for Rocky Linux 8.x, AlmaLinux 8.x and Ubuntu server 22.04.

The minimum hardware requirements for this installation are: 1 core, 2 gigabytes of RAM and 20 gigabytes of free disk space, preferably Solid State Drive (SSD).

These requirements are the minimum installation requirements, to properly size the monitoring environment we recommend going to the minimum hardware requirements section.

 

Requirements for the use of the online installation tool.

Internet access. Specific web addresses:

• ICMP:
  • firefly.pandorafms.com
  • support.pandorafms.com
• HTTPS:
  • https://pandorafms.com
  • https://firefly.pandorafms.com/pandorafms/
  • https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
  • https://rpms.remirepo.net
  • https://repo.percona.com
  • http://mirror.ghettoforge.org
  • https://download.oracle.com
  • https://packages.microsoft.com
  • https://github.com/pandorafms/
• For the Enterprise version (HTTPS):
  • https://raw.githubusercontent.com/pandorafms/
  • https://pfms.me
• In addition to these URLs it is necessary to have access to the official repositories of the distribution used (RHEL / Rocky Linux / Ubuntu).

• Have curl installed (it comes by default in most distributions).

• Meet the minimum hardware requirements.

• Be a root administrator user.

• Have a compatible OS.

• In the case of using RHEL 8 it will be necessary to be previously activated with a license and subscribed to the standard repositories.

To use the online installation tool simply access the command line provided by your provider in the Cloud, with root administrator user, and ask for the installation command:

This tool can be requested through from this link for get a free trial (demo).

In addition, for the installation of Satellite server, there is also an online installer.

With this execution, the whole Pandora FMS stack will be installed, leaving a fully functional instance to start monitoring.

You can learn more in the video tutorial "Cloud installers (agents, server)".

First steps

Once installed, the system should boot up and, after a few seconds, display the terminal to log in. The first step should be to know the IP address that the system has assigned to be able to connect to the server from outside. To do this, type the following command in the terminal:

ifconfig

You can also use the command ip address show .

In the case of this screenshot, the IP address of the system is 192.168.70.158.

Once you know the IP address of the Pandora FMS system, you can access it from outside the virtual machine, which is always the most convenient. It can be done via SSH or via HTTP. Use the root password (superuser) that you established in the installation configuration (DBROOTPASS).

Open a web browser (Google Chrome® and Mozilla Firefox® are recommended) and type the following address in the address bar, consisting of the IP address (x.x.x.x) you obtained from the server:

http://x.x.x.x/pandora_console

In the above example it would be

http://192.168.70.158/pandora_console

If everything is correct, you will access to the Pandora FMS Console welcome screen, similar to this one:

Use the default credentials: user admin and password pandora/Pandor4! .

Once you have reached this point, you have a complete Pandora FMS installation ready to start using it.

Enterprise license activation

This section is for Enterprise version users only. If you would like to evaluate a demo, please contact us.

If you have licensed a Metaconsole license you can skip this step as this type of license automatically activates each associated node.

It is important not to start the daemon pandora_server with the Enterprise version of it installed, without first enabling the Enterprise version of the Console, as errors will occur.

You can also get more information in the tutorial video «How to renew Pandora FMS License online» or «offline». Once Pandora FMS has been accessed through the browser, you will be asked to enter a valid license. Click on Request new license and proceed to the next step. In this step you must fill in the contact information and the Auth key commercial department commercial department has sent you.

Proceed to the next step by clicking on Online validation:

Once this step is done, it will automatically output the license ready to validate.

Finished all the steps, the console is ready to be used.

Start the Enterprise server

This section is for Enterprise version users only. If you want to evaluate a demo, please contact us.

After activating the license, the Enterprise server must be booted. You can connect to the Pandora FMS server through a command terminal (local or remote) or through the QuickShell functionality if you access the Agent that monitors the server itself.

sudo /etc/init.d/pandora_server start 

From version NG 754 on wards you have additional options in manual startup and shutdown of High Availability (HA) Environments.

To verify its correct operation, access Pandora FMS through the browser, go to the left side menu, click on Management → Servers → Manage servers. You should see something like the following:

Detecting local network systems

Creating a recognition task

In the side menu go to the Management → Discovery → Host&Devices section. Click on the Net Scan button, this will allow you to create a discovery task.

It will create the task as follows: You will have to modify only the network range to be scanned, in this capture it is 192.168.70.1/24, which means that all hosts in the network 192.168.70.xx will be scanned. The appropriate mask will be used here to define the network. Select the Applications group, which will be used to contain the devices you detect. From now on we will call generically "agents" to the devices managed and/or monitored by Pandora FMS.

Select under Module template the Basic monitoring option, which covers only latency and network availability checks. You can select other types of checks, such as SNMP or WMI, to be performed during the survey.

Once created, the entry will be displayed. Click on the magnifying glass icon to view the details of the task:

Clicking on the magnifying glass icon will show the current status of the task, which in this case is completed. In this image you can see that the progress bar has disappeared and the system has found the systems in the network to add them to the monitoring.

Checking the detected systems

Wait until the entire network has been detected.

When you are finished, access the agent detail view (left side menu Operation → Monitoring → Views → Agent detail) to view all detected systems.

You will be able to see several systems that have been correctly detected by Pandora FMS. In some cases the system name will have been resolved (if it was possible by DNS) and in others the operating system will have been detected. By clicking on the name (in this case, the second one in the previous image) you will go to the agent detail view, which will show all the information collected from that system.

Add a remote check on an already monitored system

Network traffic on interface

For this it is imperative that SNMP is configured on the remote device. This generally needs to be enabled and with a minimum configuration that allows data to be queried. The SNMP devices allow you to configure which IP addresses can make queries and with which community, which for all intents and purposes is a kind of password.

First you locate the agent from where you need to get the network traffic; in this case it is 192.168.70.1. Following the same process (left side menu Operation → Monitoring → Views → Agent detail) you get to the main view of the agent to be configured and click on the last tab on the right, which will take you to the editing view of that agent.

It will switch to the main editing view of the agent. Here the Wizards configuration submenu for this agent will be displayed, where the wizard (Wizard de Interface SNMP) will be chosen.

At this point you must provide the SNMP community that the device has configured, and make sure that the device supports SNMP queries enabled on the IP address shown on the screen. You can change the IP address and the default SNMP community, which is public. Once it is filled in, the SNMP Walk button will be given the job. If all goes well, it will display interfaces and the data that can be obtained from them.

With CTRL+Click (or CMD+Click on MacOS®) you can select several items in both boxes. Always remember to monitor the Output traffic (ifOutOctets), the Input traffic (ifInOctets) and the interface status (ifOperStatus) for each interface. Click on the Create modules button and a screen will appear that should inform that the modules have been created.

Bear in mind that the network traffic modules are of the incremental type, i.e. their value is the difference between the information sample just collected and the previous one. It displays a “rate” (in this case in bytes per second), so it needs some time (between 5 and 10 minutes) before displaying any data.

Click on the tab View to return to the agent view and wait at least 5 minutes until you already have traffic data, refreshing or clicking on the tab View.

Packet loss in the network

Remote plugins are user-defined checks that use a script or program that has been deployed on the Pandora FMS server, so that it can be used for monitoring, expanding the set of things it can do. In this section we will add a remote plugin preconfigured in Pandora FMS.

Use a plugin serial; to do so, go to the agent edit view and then to the module configuration tab:

Click on the create module button (Create module), which will lead to the remote plugin server module configuration interface (Create a new plugin server module).

First choose Network management and then the plugin Packet Loss using the drop-down lists, and finally put the IP address on which you want to launch the check. The rest of the fields are left as they are. The editing mode is similar, only that the Create button is replaced by the Update button.

Update the screen a couple of times, until the new module appears in the list:

This is a very interesting plugin, which used in conjunction with the basic connectivity (ping) and latency time, serves to determine the quality of the network, as it indicates the percentage of packet loss, sampling every 5 minutes by default.

Monitoring a TCP network service

In this case we are going to add a monitoring to verify that an SMTP (email) service is active on a machine. Although it can be a very complex check (simulating that user and password credentials are sent, that an email is sent, etc.) it will be simplified by only verifying that the port is open and that it responds.

To do this, repeat the same initial steps as in the previous example, but this time choose a  Network module.

Then use the drop-down controls until you find the desired check (Check SMTP Server) and click to create the module.

Finally the steps will be repeated again (go to the operation view and refresh until the monitor appears), so the final result will be something similar to this:

Add a problem alert

Introduction

Of course, more advanced work can be done such as alerts on events, correlation, etc. The first alert to do is to send an email when one of the machines that are already being monitored (with the Host alive module) goes offline.

Pandora FMS alerts are composed by three elements:

• Command.
• Action.
• Template.

In this specific case we are going to use a predefined command (sending emails), we are going to modify an action that already exists (Mail to XXX) and we are going to use a template that also exists, the Critical condition template, that will execute the alert when the module in question appears in critical condition.

See also: "Pandora FMS alert system (video)".

Server Configuration

For the correct operation of the command email you must configure in the file pandora_server.conf a mail server that allows to make relay.

In the example, the mail server located in our local host (localhost) using Postfix . You must put the IP address of the local mail server, or one on the Internet (configuring authentication for it).

To modify the server configuration file, you must access to él, located in /etc/pandora/pandora_server.conf as user root elevating its privileges by means of the command sudo su. You are the  only responsible for that key.

To edit such a configuration file in this example, the program vim is used. You can get more information in the tutorial video«File editing with VIM».

Look for the lines seen in the screenshot below and set those values. If you do not have a mail server, you can use for example a Gmail® account. You can see a quick guide on how to configure the Pandora FMS server to work with a Gmail® account in the following link: Configuration of email alerts.

Lines beginning with the # character are comments and are not taken into account by the server.

Once the changes are made press ESC and :wq to save the changes and exit. Once you are in the command line, restart the Pandora FMS server:

/etc/init.d/pandora_server restart

.

Alert Configuration

As indicated above, alerts in Pandora FMS are composed of 3 parts: Command, Action and Template. You can find these options in the section Alerts. In order to configure this alert you only need to modify the action so you will use the option Alert actions.

The action to use is Mail to admin, click on that name to edit the alert action.

Modify field 1 (Field 1) and put your email box, in this example it is used yourmail@example.com. Field 2 (Field 2) is left the text that is in the screenshot. Here we are using two macros that will replace at run time the agent name and the module that has generated the alert.

Assign alert to module

Navigate to the agent edition where you have the module defined and click on the alerts tab:

Now add the module (Host Alive), the template (Critical Condition) and the action ( Mail to admin ). Click on the button Add alert.

Once added, you will be able to observe in the agent view whether it is running or not, seeing the color of its status:

When the host goes out of line the alert will be initiated:

An email with the alert should arrive in your mailbox, something like the following:

Pandora FMS alerts are extremely flexible, and therefore, sometimes complex to use. There is a chapter in the documentation specifically for them: Alerts in Pandora FMS.

Monitoring a Windows server with a software agent

Agent Installation

The first step is to download the MS Windows® agent from:

https://sourceforge.net/projects/pandora/files/Pandora%20FMS%207.0NG/759/Windows/

At this link you can choose between 32-bit or 64-bit agent.

Once the agent is downloaded, run it by double-clicking on él and the language selection screen will appear:

It is a standard MS Windows® installer that will prompt you to follow the steps below. Accept the license and proceed through the different windows of the installer. Select the path where the Pandora FMS agent will be installed (by default it is installed in %ProgramFiles%/pandora_agent). You can change it by pressing Browse…, once correctly indicated press Next:

Wait for the files to be copied. Configure the IP address (or name) of the Pandora FMS server that will receive the agent data and the group to be associated with the agent.

In the next window appears the option to enable the remote configuration. It is important to have it enabled with a 1 to have a copy of the agent in the Pandora FMS server and from there you can add, edit and delete local modules directly from the agent.

To start the agent service at the end of the Pandora FMS agent installation keep selected Run Pandora FMS Agent 7.0NG; otherwise you will have to do it manually, or it will start when MS Windows® is restarted again.

Once this process is finished, the MS Windows® agent is installed, running and reporting on the computer.

Checking the information returned by the agent

Once the MS Windows agent has been started® after its installation, it is time to check what this agent is reporting. To do this, you must know the name under which this agent is going to report. By default the agent is created with the name of the host. You can see the name of the host MS Windows® with the execution of the command hostname in a window with cmd.exe.

Once you know the agent name, the next step is to see if it has been created in Pandora FMS. To do this you have several options. The first one is to search in agent details, inside the group in which the agent has been created, in this example the group Workstations.

A faster and more efficient way to find the agent is to search directly through the Pandora FMS search engine, indicating the agent's name.

By default, the MS Windows® agent comes with several pre-loaded local basic monitoring modules, such as CPU load (CPU Load), % of RAM used (Memory_Used), free space in MB of disks (DiskUsed), etc.

If we need to add new modules to this agent, we can consult the advanced documentation of monitoring with software agents.

You can see graphs generated with the module's data history and a table with the data history from this view by clicking on the marked icons in the following screenshot:

Create a visual screen with monitoring details

Creation of map 1 (Parent)

On this first map, the status of several agents distributed on a world map is added. This can be done manually, one by one, or through the Wizard. To facilitate the creation of the same we are going to use the Wizard in the example.

The first thing we have to do is to create a new map, which we will call World Map. Go to Operation → Topology maps → Visual Consoles and click Create map.

Once created we click on the Wizard of elements:

In the Wizard select the type of element, in this example Static Graph, the image to use, if you want to use one ítem per agent or per module (in this case per agent), and select the agents to add within the list that appears.

Click on the add button (Add) and all the created elements will appear on the map:

Move all the elements until you have them positioned on the map, by clicking and holding while dragging it over the map.

.

Creation of map 2 (Child map)

In the second map you will create an element indicating the status of one of the main agents, attached to it all the given modules. You will visualize in this map also a graphic of the FreeRAM module of the same agent.

The first step is to create the new map as you did in the previous step:

Once created, add the element showing the agent status in the Static Graph section:

Also create the graphic with the attached configuration by clicking on the graphics icon, adding the agent and module from which the graphic is to be mirrored.

Now that you have created the main element of the map, you must create a new element for each of the modules that exist in the agent. To do this, use the Wizard making its configuration as you see in the attached screenshot. Select Static Graph of the agent and the modules that are indicated. We place as label the name of the module and assign to this one a parent previously created in the Visual Map, in this case the previous element added.

After creating all these elements, they will appear attached to the main element and you can move them by dragging them directly with the mouse in the desired position.

.

Linking of both maps

In the previous steps we created the two maps. In this step indicate how to click on the element located on Spain on the map World Map, opens directly the map Spain Map.

To do so, open the map World Map, in edit mode, by double-clicking on the item 192.168.70.70. The element editing will open, click on advanced options and in the option Linked Map, select Spain Map. Update the item (button Update).

Back on the map view World Map, click on the item above Spain and the map of Spain will open directly. If only one item on the map of Spain is red, the icon representing Spain on the parent map will also be red.

Adjust monitoring

Advanced module properties

Navigate to the agent's módulos view.

Select the desired module to configure.

Later open the tab a Advanced Options and proceed to configure the desired fields.

In the next two sections you will see how to configure the fields Unit and Interval and the thresholds Warning Status and Critical Status.

Configuration of the units of a module

Allows defining the units of the data obtained in a module. This unit will be included in graphs and reports, making it easier to interpret the data displayed to the user.

For example having as unit %: Placeúese inside the Unit field and type the desired unit.

Finally, click on the Update button to save and verify that the unit is correctly displayed in the modules view.

Setting the interval of a module

Configuring or modifying the module interval defines how often the module runs. This affects remote modules (not running locally), as local modules are configured in a slightly more complex way.The more frequently a remote system is monitored, the more load it will generate on the system.

Click on the Update button and you have configured the module.

Configuration of the thresholds of a module

In this section you can configure the thresholds Warning and Critical for a module;module with the values that a module must have to be in a state CRITICAL, WARNING or NORMAL.

In this example you have a CPU module to add thresholds to. This module will always be in the NORMAL(green) state as long as it is between 0% and 100%. If you want this module to display in status Critical or Warning when the CPU reaches a certain percentage, you must configure by determining the desired Warning Status and Critical Status thresholds. In this example for when the CPU reaches 90% usage the module will switch to status Warning and if it exceeds 95%, switch to Critical.

After configuring the thresholds, just click on the Update button and the thresholds will be correctly configured. The next data received will already interpret these thresholds.

Advanced threshold parameters

The box Inverse interval is used to define non-contiguous ranges. In this example, the module will change to the critical state if the value is below 20 or above 80:

In string-type modules, the threshold is defined as a substring. Similarly, it can be inverted so that the module goes to CRITICAL if no contains the substring passed as a par meter:

.

Other advanced parameters

The configuration of a module is very flexible, with dozens of possibilities. In the Pandora FMS documentation we can discover all of them.

Troubleshooting. Where to look, who to ask

Configuration files and diagnostic information sources

The main configuration files that we may need to modify or review are the following:

• /etc/pandora/pandora_server.conf: Main configuration file of the Pandora FMS server. If you modify something there, you will have to restart the Pandora FMS server.
• /etc/pandora/pandora_agent.conf: Main configuration file of the Pandora FMS software agent on Unix. If you modify something there, you will have to restart the Pandora FMS agent.
• %ProgramFiles%\pandora_agent\pandora_agent.conf: Main configuration file of the Pandora FMS software agent on Windows. If you modify something there, you will have to restart the Pandora FMS agent service.
• /etc/my.cnf: MySQL main configuration file.
• /var/www/html/pandora_console/include/config.php: Pandora FMS console configuration file. During the installation it configures itself, but if you have changed any environment parameter (path, IP, MySQL user/password, MySQL host) you will have to modify it manually.

Information sources (logs) where we can search for more information, errors, etc.:

• /var/log/pandora/pandora_server.log: Server log file, contains very important clues. If you want more detail, modify the verbosity parameter of the server configuration file so that it shows more detail.
• /var/log/pandora/pandora_server.error: Log file of uncaught server errors, contains traces of errors and exceptions not handled by the server.
• /var/log/pandora/pandora_agent.log: Unix agent log file.
• %PROGRAM_FILES%\pandora_agent\pandora_agent.log: Agent log file on Windows®.
• /var/www/html/pandora_console/log/console.log: Pandora FMS console log file.
• /var/log/httpd/error_log: Apache server error log file (httpd).
• /var/log/messages: System log file.
• dmesg: Command that displays kernel warnings.
• /var/log/pandora/pandora_snmptrap.log: SNMP trap log. If there is any error in booting the SNMP trap console it may show error traces there.
• /var/log/mysqld.log: MySQL log.
• /var/log/pandora/web_socket.log: WebSocket log.
• /var/www/html/pandora_console/log/cron.log: cron log.

Permissions of some directories:

• /var/spool/pandora/data_in/ Must be from pandora:apache with permissions 755.
• /var/log/pandora/ Must be from pandora:root with permissions 755.
• /var/www/html/pandora_console/include/config.php must be from apache:apache with permissions 600.

In versions prior to 747, the console log storage path is:
/var/www/html/pandora_console/pandora_console.log

In case of updating by OUM, the corresponding achievement file must be modified.

Support

The community forum is open to anyone, you can create an account and ask:

• https://pandorafms.com/community/

We have a list of frequently asked questions in the knowledge base that may give you a hint or directly a solution to a specific problem:

• https://pandorafms.com/community/knowledge-base/

Of course, you also have the option of training, through the official Pandora FMS courses (with certification):

• https://pandorafms.com/en/training-certifications/