Table of Contents

Report Types

Graphs

Simple graph

Shows the simple graph of a Module.

Simple baseline graph

This type of graphs can excessively overload Pandora FMS if a lot of data is used to make future estimates.

You can see future values with estimates of the selected Module. For example, if you select a period of one week and today is Tuesday, you will see the actual data for Monday and Tuesday and the estimates for the other days.

Custom graph

User-defined combo chart. A field is added by means of the Custom graph to select the custom graphic:

The fields of this form are:

SQL query

This kind of graphs defined from SQL have to be used with care because they can overload the Pandora FMS server in excess.

This type of report element allows custom charts to be defined for use in reports.

For security reasons the following words are reserved and therefore excluded from queries:

*, DELETE, DROP, ALTER, MODIFY, password, pass, INSERT y UPDATE.

Simple SQL used to create graphs of this type: 

SELECT a.nombre as `label`, count(st.id_agente_modulo) as `value`
FROM tagente_estado st, tagente a;

In SQL query, to delimit the report in start and end date and time, you can use the macros _start_date_ and _end_date_ respectively. In Serialised header for each requested field and separated with | the column headers can be set. For this case the use of label and value are omitted so no graph will be drawn.

To save SQL queries with macro variables you must use the Custom SQL option in the Operation → Reporting menu.

Then when requesting the report you expand Filters, in Date you choose Choose start/end date period then select the start date and time in From: and select the end date and time in to:, then click Update:

SQL pie graph

Example based on SQL query report:

SQL Vertical bar graph

Example of a vertical bar graph for reports based on SQL query:

SQL horizontal bar graph

Example report based on SQL query:

Availability Chart

Availability report (Availability graph), shows a detailed report of the states reached by a module in a given time interval.

It will indicate all the relevant information about the time that this module has been available.

We can choose the time range for which we want the report (for example, the last month) and the working time if, for example, we need to indicate that we are only interested in the status of our module at a certain time (for example, 8×5, 8:00 a.m. to 4:00 p.m. Monday through Friday).

As of version 749 of Pandora FMS, this type of report also includes the possibility of checking the 24×7 box, which is located under working time. In this way, the information will be collected without taking into account the working time configuration and being able to compare both cases, since it will show us 2 independent graphs.

It is also possible to determine a prioritization mode. When choosing the OK prioritization mode, if data in the SLA compliance range and some other status (such as a planned shutdown) are flashed over time, it will color that section in green. If the unknown prioritization mode option is chosen, the color corresponding to the other state will always be displayed.

After saving the data of the report element, we will add the modules that we want at the bottom:

Note: You can use the SLA min. and max. (value) to indicate that the calculation is done in relation to the values reached by the module in that range. SLA limit % will indicate the minimum acceptable (within that range).

By defaultto, if you do not specify a minimum or maximum for the value, the threshold values defined in the module (dynamic limits) will be used.

Viewing the report we will see the availability graph of the chosen module in the selected time range:

Failover mode

This utility is used to assign 'failover or backup' modules to the main module on which you want to perform the availability calculation. In other words, if a module is assigned one or more failover modules, the availability calculation for a given period will be done taking these modules into account.

When the main measured module falls, if there are one or more operational backup modules, these will be taken into account for the calculation of the SLA. In this way, only the real service failure is shown where primary and backups do not work.

Add failover or backup modules

We will do this in the edition of the module on which we want to perform the availability calculation, in the module relations section ('Module relations'):

We select the module that we want to act as failover and select the type of relationship, which in this case is of the failover type.

Once the modules have been assigned in the report, we activate the 'failover mode' option:

We will have two types of visual representation:

In the simple type 'availability graph' reports, the possibility of adding a failover module directly in the report as a simulation is added, this will work exactly the same as the previous ones.

This is not applicable in the wizard or template reports.

Module Histogram graph

It will display a graph with the state histogram of the chosen module.

IPAM

IPAM networks

You should choose one of the networks created in the Operation view. Two important options are to show the IP addresses that are active and/or the IP addresses that are not assigned to any agent. Other common fields exist.

SLA Items

All the reports of Service Level Agreement (SLA) show information about the compliance of a metric, that is, they indicate the percentage of time that the module has had a known valid value.

Planned shutdowns can be created in the past as long as the console administrator has enabled it in the general configuration.

Some of the SLA reports present data grouped by time periods and the overall status of these periods is calculated. As these are long periods, the module from which the report is being made may have gone through many states: going to unknown, going through a planned stop… In these reports, there is a configuration parameter called prioritization mode that determines which states take precedence when summarizing. You have two options:

Of course, if at any time the SLA compliance value is not reached, it will be painted red in either mode.

S.L.A.

It allows to measure the level of compliance of a service or any Pandora FMS monitor. Most important fields:

In the case of combined SLA, compliance with the SLA will depend on compliance with all SLA that have been configured.

The SLA value will take into account only critical states of the selected module and will be marked as valid:

Monthly SLA

This is a variant of S.L.A., which instead of measuring service level over a period, measures it for each day of the months in that period.

Unknown days will be taken into account as valid data for the percentage of SLA-compliant days.

Weekly SLA

Shows the S.L.A. of the modules chosen by weeks throughout the selected period (by default current month, although it can be deactivated in Current Month).

Hourly SLA

Shows the S.L.A. of the chosen modules per hour throughout the selected period (by default current month, although it can be deactivated in Current month).

SLA services

Allows to measure the SLA of any service created in Pandora FMS.

Since the services in Pandora FMS incorporate their own SLA readings, the calculation for the report is different from the standard operation. The SLA validity limit values will be automatically retrieved from the definition of the service itself.

In order to add one or more services, you must first create the report item and then edit and add these elements in the footer.

Prediction Items

Prediction date

Using a projection of a module's data into the future, it returns the date on which the module is likely to take a value in a given range.

The least squares method is used for the calculation.

Projection graph

It allows to estimate the values that a module will take in the future.

This estimate is based on the least squares method.

The area marked Period represents the evolution of the module data during the selected time interval and Projection period shows the probable evolution of the module in the requested time.

Module Items

Avg. Value

Allows you to display the average value of a module (with the option of displaying a graph) in the defined period. This value is calculated at the moment of viewing the report.

Max. value

Displays the maximum value of a module in the defined period, this period is calculated at the time of viewing the report.

Min. value

Displays the maximum value of a module in the defined period, this period is calculated at the time of viewing the report.

Monitor report

Shows the percentage of time that a module has been in normal state or another of its states, such as warning or critical (values OK and Not OK, respectively), in the defined period of time.

Serialise data

Shows an item in the report in table format from the data stored in the tagente_datos_string table in the Pandora FMS database. For this, the agent must serialize the data separating them with a line separator character and another field separator, and all the lines must contain all the fields.

This type of item, for example, is used for the agent that extracts management data from the SAP platform.

The module that generates the following report returns lines with the following content: 

Some text sample|some value#this is a new row|and another value

Summation

Shows the sum of the values of a module in a given period.

Historical data

It is used to receive a dump of the old stored data from the module that is indicated in the report configuration. The historical_database|historical database] must be enabled.

Increase

Use this type of report element (Increment) to display a brief analysis indicating the change in value for the indicated modulus.

Report display example:

Last Value

Last value (Last Value) of a module in the defined period. This period is calculated at the time of viewing the report.

In the HTML version of the report, an item of this type is generated, for example:

Items grouped

Overall

Shows values from different modules sorted (ascending, descending or by agent name) or/and grouped by agent.

Reports in period 0 cannot show past information. The information contained in this type of report will always show the most recent information.

Report display example:

Report Group

Displays a table with the following information for a given group:

Report display example:

Exception

Shows the values of various modules that fulfill logical operations (Condition):

We can configure the following fields:

Report display example:

Agents/Modules

Agents/Modules displays an array of agents and modules from a given group of selected modules with their associated status. You can get the agents by groups (includes recursion option for subgroups) and filter by common modules between them. Furthermore, the modules can also be filtered by groups (application, database, network, etc.).

Example:

If you edit the report again, you will need to reselect the modules again.

Agents/Module Status

Agents/Modules status shows in table mode the status of themodules as well as their data and the last time to record said data. Request example:

Generates the following example output:

Apart from the general options, it also allows you to filter by:

The report can be exported to PDF and CSV (in the image a CSV opened in a spreadsheet):

In the Command Center (Metaconsole), the report contains the server to which the agent belongs:

Templates are in both node and Command Center (Metaconsole): This allows you to search using regular expressions. Example:

SQL Queries

This feature also works in Command Center (Metaconsole).

This item shows a table to have personalized data extracted directly from the Pandora FMS database.

This type of items must be used carefully as they can excessively overload the Pandora FMS server.

When selecting the SQL Query report type:

Due to security restrictions, there are some reserved words that cannot be used:

  • *.
  • DELETE.
  • DROP.
  • ALTER.
  • MODIFY.
  • password.
  • pass.
  • INSERT.
  • UPDATE.

Custom SQL

You can define your own templates in the Operation → Reporting → Custom SQL menu.

In the query list view, you can create a new stored query by clicking the Create custom SQL button. Define your query and put a name to identify it and press Save to make it appear in the list.

To edit the SQL query, in the list of queries click on the name and you will get a screen similar to the next figure:

Make the necessary changes and to save press the Update button.

First example

Example query using the Custom SQL template dropdown (predefined “SQL Monitoring Report Modules” query, note the use of the corresponding headers in the Serialized header):

Report display from the previous example:

Second example

In an SQL query, to delimit the report on both the start and end date and time, you can use the _start_date_ and _end_date_ macros respectively. Example:

Third example

Get all modules called Host Alive that are in a critical state. For this example go to the Reporting menu → Custom SQL and add a query with the following code: 

SELECT ta.alias AS AGENT, tm.name AS MODULE, te.data AS DATA
FROM tagente ta
INNER JOIN tagente_modulo tm
ON ta.id_agent = tm.id_agent
INNER JOIN tagent_state te
ON tm.id_agent_module = te.id_agent_module
WHERE tm.name LIKE 'Host%Alive' AND te.status = '1';

Save the query with a suitable name.

Now go to the Reporting menu → Customs reports and add a report with the Create report button. Again use a suitable name and fill in the requested fields, save the report with the Save button.

Now go to the item editor by clicking on the Item editor icon and select the SQL query option in Type from the drop-down list (it is in the Grouped subsection). Leave the Serialised field blank and fill in the rest of the fields appropriately. Save the changes.

Go to the display button, you will get something like this:

Fourth example

Modify the template that comes by default with Pandora FMS called Agent safe mode not enabled:

Add the id_agent field to the query, click Update to save the changes. In a custom report add a SQL Query item and select the modified query.

In the Serialized header field, add ID|Alias and save by clicking Update item.

Top N

Shows the first values, specified in the Quantity(n) field, discriminated by: maximum, minimum or average over the total number of modules added. They can be sorted ascending, descending or by agent name.

Example:

Network interfaces

This type of report element generates the network interface graphs of all those devices that belong to the selected group.

An agent will be considered to have interface traffic data when it has modules with the following format:

Note: Input/Output octet counters can also be collected from HC counters (hcOctets).

Example:

Custom Graphic Representation

Advanced knowledge about Pandora FMS is necessary to carry out this type of report since it is capable of combining several different elementsis from PFMS, some more complex than others.

Custom render allows you to generate direct and concise reports both on screen and in PDF (with certain limitations in the latter format). It consists of two components, the definition of macros (Macros definition) and the graphic definition in HTML (Render definition) where the results of the macros will be inserted.

Macro definition

Rendering definition

Some CSS instructions are not supported for PDF report generation.

Example 1 (Simple graph)

Example 2 (Graph SQL)

This example is completely devoid of practical use in real life and is for teaching purposes only. Querying the database is extremely simple: 

SELECT taggent_module. name as 'label', tagente_modulo.id_agent_modulo as ' value' FROM tagente_modulo WHERE tagente_modulo.id_agent=43;

Note the use of the aliases label and value in the query (see “Charts defined from SQL” and “Pandora FMS Engineering”).

Availability

This item (Availability) shows a table with the availability data of a selected list of agents and modules. The data represented in it is an exact reflection of the situation of the modules throughout the selected period.

It also offers the possibility of showing a summary in which the modules with the highest and lowest availability will be shown, as well as an analysis of the average.

Example:

Displays the following information:

Example with Show 24×7 item and Show summary selected:

Text/ HTML Items

Text

This item shows in the reports a text formatted with HTML, useful to include additional information of each company.

Example screenshot of the window to add link:

Example screenshot of the window to add image:

You can add any HTML content to this element. Report display example:

Import text from a URL

This item (Import text from URL) shows the text extracted from an external server to which Pandora FMS Console has access. You should always keep in mind that in the HTML type report format it will show it as it is, but in the PDF report version it will only show the text in plain format.

You must indicate the protocol in the URL ( http: , https:, …)

Example:

Alert Items

Module Alert Report

Shows a list with the alerts launched by the module selected in the report, in the defined period (Alert report module).

Example:

Agent Alert Report

Shows a list (Alert report agent) with the alerts launched by the agents of the report group in the defined period.

The fields of this form are:

Example:

Action Alert Report

Shows a list (Actions alert report) with the alerts launched by the modules of the report group in the defined period.

For this report to be displayed in the Command Center (Metaconsole) you must have event replication enabled, otherwise the report will always indicate that it has no data to display.

Command Center (Metaconsole) will not be able to group or filter by templates.

In Command Center (Metaconsole) it will not be possible to group or filter by templates.

Examples:

Showing only the modules with triggered alert and its total.

Showing all modules with or without alert triggered and their total.

Showing 6 hour intervals:

Group Alert Report

Shows a list (Group alert report) with the alerts launched on any element of the group defined in the report, in the defined period.

Example:

Event Items

Module Event Report

Shows a list (Module event report ) with the events that have occurred in the module of a selected agent, in the defined period.

Example:

Agent Event Report

(Agent event report) Shows a list with the events that occurred in the selected agent, in the defined period.

Example:

Group Event Report

Shows a list with the events that occurred in the agents of the selected group, in the defined period (Group event report).

Example:

Inventory Items

Agent Inventory

Agents inventory lists the registered agents and has several filters to select in a very detailed way, even at module level.

Example:

Module Inventory

Version 765 or later.

Modules inventory lists the registered modules and has filters to select in detail, even at the module group level, showing name, description, module group, labels, agent group and secondary agent group.

Example:

Inventory

This item (Inventory) shows the selected inventory of one or several machines corresponding to a specific moment or the last known one.

The fields of this form are:

Example with the parameters selected in the list above (the list is longer than the one shown here):

Example showing CPU and RAM:

Change Inventory

This item (Inventory changes) shows the inventory changes registered in one or several machines within a selected period.

The data for this item is collected from inventory change events. If the item is too big, you can remove some of those events manually to reduce it.

Example:

Configuration Items

Agent Configuration

This type of report (Agent configuration) allows you to display a snapshot of the selected agent's status:

Example:

Group Settings

This type of report (Group settings) will display a snapshot of the status of the agents that belong to the selected group:

Even though whoever is creating the group options item does not explicitly belong to the EVERYONE group (ALL), they will still be able to assign the group ALL as the source of Group Agents.

Example:

NetFlow Items

NetFlow Area Chart

This report element (NetFlow Area Chart) will display a graph with traffic analysis using filters already created in the NetFlow view.

Example:

NetFlow Data Table

This element (NetFlow Data Chart) shows the data obtained by applying the NetFlow filter indicated by the user in a table ordered by date and origin.

Example with the parameters selected in the list above (the list is longer than the one shown here):

Example showing CPU and RAM:

NetFlow Summary Table

This report element (NetFlow Summary Chart) will show a table with summary information of the traffic that matches the NetFlow filter indicated in the Filter parameter .

Example

First N NetFlow Connections

Top-N connections (First N connections) is a table showing the TOP-N connections between Source IP - Destination IP pairs, based on the traffic between these IP addresses (the sum of the percentages of the N elements in the table is not going to be a hundred because there are many other pairs of src/dst connections that are not in the table).

Top-N connections is a table that shows the connections between pairs of Source IP - Destination IP addresses, based on the traffic between these IP addresses.

A filter, time period and type are chosen. The filters required for that report element are those of the Live view.

By default it is selected grouped by port destination, Show aggregate by destination port (values fmt:%sap,%dap,%ibyt,%ipkt,%bps) and you can also choose by source and destination traffic Show InBound/Outbound traffic per SrcIP/DestIP (values fmt:%sap,%dap,%ibyt,%obyt,%ipkt,%opkt,%bps)

The sum of the percentages of the N elements of the table not necessarily will be one hundred because there may be other pairs of connections src/dst.

Log Items

Log report

This type of report (Log report) will show the log entries in the selected period.

Example:

Log report by period

This type of report (Log report by period) is based on Log report with the difference that a period of time can be set for the data ( Period range).

A unique index must be generated daily for each instance of Pandora FMS in Elasticsearch, otherwise no data will be displayed. See the topic “Monitoring and collecting logs”.

Permission Report Items

User Permissions Report

Allows you to select users or user groups and list their names, groups and permissions.

Example:

NCM Reports

Security hardening

Security hardening reports are only available with the plugin bearing the same name installed and running.

Top-N agents with the worst score

This report shows the last scores of the top ten agents (10 by default) and is sorted from the worst score to the best score and can be filtered by group (with or without Recursion subgroups).

Top-N most frequent failed checks

In this report, the last data of all agents are grouped (by default or you may select a group) and by type of check and the checks with the highest number of failures among all the agents are shown. It works in the Command Center (Metaconsole) in an analogous way, only that the agents of all the nodes are grouped. The number of checks to be shown, by default, is 10.

Top-N checks failed by category

In this report, the latest data of all agents (or only the selected group) are grouped by categories and the categories with the highest number of failures among all agents are listed.

For the Command Center (Metaconsole) it is the same but node agents are grouped. The configurable parameters are: by group (All by default) and number of total categories to list (10 by default).

Vulnerabilities by category

In this report, a category is chosen and the failed and passed checks (optionally the skipped ones with the token Skipped) of all the agents in the selected group (All selected by default) will be grouped.

The result is displayed in a pie chart where the vulnerabilities are unique, i.e. if a check with the identifier “N” has failed in two different agents they are not added together, the result is 1.

Available categories:

List of checks (agent)

This report lists the last checks of a selected agent filtered by category and their status: failed, approved, skipped or all (default selected option, All).

Available categories:

Scoring by date

This report shows the last scores of the agents of the selected group (or All) within the selected time range.

It always takes the last score of each agent within the time range, i.e. if a range of one month is set, the last score of the agents within that month will be searched.

Displaying items with extended history data can have an impact on system performance. We do not recommend that you use intervals longer than 30 days, especially if you combine several of them in a report, dashboard or visual console.

Evolution

This report shows a global evolution of Security hardening by averaging the tests passed and those that failed, grouped by day, of all the agents or those within the selected group with the last 11 dates to avoid overflowing the graph.

The minimum recommended period is every 7 days when the plugin is activated, so if you run it 4 times a month, you will get better results than doing a monthly grouping.

In the Command Center (Metaconsole), the average of all the agents of al nodes is made, they are not separated.

Vulnerabilities

Severity graph bar

It displays a report of features grouped into Confidentiality, Integrity, Availability of the selected group(s) and their severity score (none, low or high).

Once displayed on the screen (HTML option) you may click on any of the features to show or hide these bars.

Attack complexity doughnut chart

It displays an attack complexity report grouped into low, medium and high complexity (Low, Medium and High) of the selected group(s) and their respective score.

Once displayed by screen (HTML option), you may click on any of the complexities to show or hide said bars.

By packages in pie chart

It displays a report of vulnerabilities in a pie chart and grouped by software packages installed on the monitored devices of the selected group(s) and their score.

Once displayed on the screen (HTML option), you may click on any of the packages to show or hide these bars.

Detailed security report

This report allows you to see each agent with its key information: Operating system and version installed, group, security monitoring status, vulnerability, among other relevant data.

Vulnerabilities of agent

The report allows to choose only one agent to show the detected vulnerabilities. In the following options, when creating a report item, (All) is selected by default in all the options of each list.

The most important information of the report is described below:

Top-N agents with more risk

The report allows to show the most risky 10 agents.

Top-N common vulnerabilities

This report shows the top 10 vulnerabilities (CVE identifier) most frequently present in agents (sorted from highest to lowest number of agents).

Back to Pandora FMS documentation index