Pandora FMS Glossary of Terms

Basic Concepts Pandora FMS (video)

When starting to work with Pandora FMS, it is important to fully understand some of the terms that are used. Because the different monitoring systems use their own terms to refer to similar concepts, it is important that each of them are throughly explained to avoid misleading.

The purpose of this glossary is to unify and define in a detailed way all the definitions of the terms commonly used in Pandora FMS.

*nix environments

Abbreviation for both Unix® and GNU/Linux® environments.


ACL stands for Access Control List, that in Pandora FMS are defined by assigning a profile on a group to a user. They determine user permissions.


Execution carried out when an alert is triggered. They are parameterizable through a series of fields, including specific information on the circumstances in which the alert was triggered. It is possible to execute several actions for a single alert.


An agent in Pandora FMS is an organizational entity, which is usually a machine, system or host (a computer), that contains information of different checks called modules, and belongs to a single group. It can be related to other agents through a kinship relationship (parent-child). See also Software agent.


An automatic request based on circumstances. It can have different associated actions and has two possible status: “Triggered” or “not triggered”. The alert, in Pandora FMS, is in charge of sending a warning email or an SMS to a person, displaying what happened. An alert consists of a template + action + command.

Alert Template

It is one of three components of alerts. It specifies the triggering conditions of the alert, which may depend on the value or status of a module, and other details such as the maximum number of times it will be triggered in a given interval or time range of operation.

Alert Threshold

The time interval in which the defined restrictions are applied when configuring the alert template. For example: An alert template which defines a '10 minute' threshold and a maximum alert number of '5', ensures that the alert will not be triggered more than 5 times within a 10 minute interval. Besides, the alert will remain triggered until this time interval ends, except if the recovery is already configured.

Asynchronous Monitoring

A module is considered asynchronous if it returns data depending on its availability, e.g. it searches for a string in a log file. If it does not find the string, this module does not return data. Another -very common- example is the one of SNMP traps which are only generated if an error takes place (e.g. a power-supply failure).

Broker mode

The broker mode allows a software agent to be executed in several “copies” and with different identities in order to perform remote checks and collect metrics for a PFMS server. See “Broker Mode”.


System-level execution carried out by the server when an alert is triggered. External commands or custom scripts can be used to expand existing possibilities.

Commenting out or uncommenting a parameter

Generally a file is used to save the execution parameters of any application (another option is to save them in a database).

It is common to use a line describing the utility of the parameter, which is placed in the next line immediately following.

This first line is a comment that is recognized as such by a special character at the beginning of that line (for example # or ;):

# This line is a comment.
parameter1 value1

# The following parameter is “commented” and will not be read or taken into account:
# parameter2 value2

Commenting out is the process of placing the parameter itself as a comment by adding the special character at the beginning of its line (or uncommenting, thus activating the parameter by removing the special character).

After saving the file, the application must be restarted to read and load the new configuration (few applications have the ability to detect if a file has changed through the Linux kernel).


Pandora FMS console or web console is the interface that allows Pandora FMS to be managed through the browser.


NORMAL, and CRITICAL are a module's three possible status. CRITICAL and WARNING status usually show error conditions of different severity. Pandora FMS allows different thresholds to be defined for the CRITICAL and WARNING status of each module independently.


A DAEMon, in computing, is a program without a graphical interface that runs at operating system level with little or no user interaction. It is an abbreviation for “Disk And Execution Monitor”.

Data Files /Data XML

Data files generated by Pandora FMS software agents. Besides containing the agent module's information, they contain information about the agent itself (the version, the operating system, etc.).


A collection of data belonging to the same context and stored systematically for later use. Pandora FMS uses relational databases, within which the place and the way data is stored has no particular importance. You can access them through a structured language of standard requests (SQL).

Database Schema

The Database Schema describes the database structure in a formal language. In a relational database, the sketch defines the tables, the fields of each table, and the connections between fields and tables.

Debugging Mode

Debug mode provides detailed, step-by-step process and parameter information when running an application or operating system to facilitate the correction of code exceptions (“bugs”).


See library.


Generally, an update or upgrade contains improved components compared to the one it replaces, but sometimes there is an inconvenience. For example, two different third party dependencies could have incompatibilities if one is updated and the other is not, or in the worst case one of those dependencies lacks update and stops working in harmony. This is also closely related to the operating system and/or distribution used.

For these unique cases, we speak of a downgrade to return a PFMS server to the previous version installed.


An event is everything that takes place in a monitored system. The information displayed ranges from any module status change, alerts triggered or retrieved, to system restarts or custom events.

False Positive / Negative

When a check returns an error and the error has not taken place, it is a false positive. When no error is returned and the error has occurred, it is a false negative. For example, a module that returns 1 when the server is available. It would be a false negative when the server is not available and the module returns 1; and it would be a false positive when the server is available and the module returns 0.

Flip-Flop Protection

The flip flop protection of a module indicates the number of times that the condition of change of status must be given in order for the change of status to happen. This feature allows a module to be protected from false positives or negatives. For example, if a module returns a false positive, but never more than twice in a row, the flip-flop protection can be modified to prevent false positives from causing status changes.


A set containing agents, used to filter and control visibility and permissions. Groups work closely with user profiles, and combine to create rules that establish which elements of the console a user can or cannot see. Groups may contain other groups.

Hibernate or hibernation

Although this term refers to the biological field, hibernate is also used in computing to describe the process of completely saving what is in RAM (data and/or running programs) on a fixed storage device by an operating system. This is valid for both real machines and virtual machines. In the field of energy saving, this state is different from standby mode as saving is higher even in the case of virtual machines.

Inverse interval

The Inverse interval is used to define non-contiguous ranges in the thresholds. For example, the module will switch to warning status if the value is above 80 or below 20:

In string type modules, the threshold is defined as a substring. In this example the module will go to critical state if it doesn't contain the substring passed as parameter:


It is the software that communicates the hardware with the rest of the software installed on a computer and thus constitutes the heart, the basis and essence of an operating system.


A library, in computer science, is a set of files, generally compiled to machine code, with functions that can be used by one or several applications in an operative system. For example, Pandora FMS uses PHP language for its Web Console, as well as other libraries written in PHP to connect to the MysQL database.

Log rotation

Log rotation is an automated process used in system administration where log files are compressed, moved (archived), renamed or deleted once they are too old or too large (there may be other parameters that can be applied here, even two or more at a time). New incoming log data is directed to a new file (in the same location) usually with a mnemonic name.

Logical agent

See Agent .

Merging (code)

The verb “to merge” is often used to refer to the fusing of source code, such as a new feature. It can also be applied to other similar processes such as merging two databases from different servers into a third server.

Go back to Pandora FMS documentation index


A Web portal where you can view, synchronize and manage different Pandora FMS monitoring systems in a unified and transparent way. That way, the data from different monitoring environments will be handled centrally from this hierarchically superior point.


A module is an atomic information entity that stores numerical or alphanumeric/text values. Each module only stores data from an individual check (CPU, RAM, traffic…). The modules are contained within the agents, and stay always associated with a single agent. An agent can contain multiple modules.


A module with an associated status.


Pandora FMS makes use of this method or way of working in the GIS Console (Geographic Information System). A mosaic is, according to the sixth meaning of the Merriam-Webster dictionary: “a composite map made of photographs taken by an aircraft or spacecraft”.

Native Software

Native software or native data formats are those that were designed to run and/or process on a particular operating system.


OpenSSH (Open Secure Shell) is a set of applications that enable encrypted communications over a network, using the SSH protocol. One of its functions is to allow opening a shell or command line from a remote computer to a local computer, as long as its sshd service is running.


A package contains a program or group of programs packaged in a specific format, ready to be installed in a specific operating system and version, e.g. an RPM package for OpenSUSE Linux.

Pandora Web Robot Daemon

Pandora Web Robot Daemon (PWRD) provides the necessary tools to automate web browsing sessions for later monitoring with WUX. It is available in the Enterprise module library.

Polling SNMP

It is the consultation process, in a regular way, by Pandora FMS to the monitored devices, through SNMP.


It defines the permissions on different possible operations under Pandora FMS: see an agent, modify an agent, assign alerts, define reports, manage the database, etc. They are associated with users for specific groups.

Proxy mode

The proxy mode allows a software agent to receive metrics from other software agents which are forwarded to a PFMS server, together with the metrics collected by the software agent itself. See “Proxy Mode”.

Remote Server

Server that is on a network that is not the local server.

Rotation mechanism

SeeLog rotation”.

Root user

In *nix environments, this is the user dedicated to the administration of an operating system, with special privileges to install, configure and maintain the software, among other tasks. Other users can inherit these privileges if they belong to the same root user group.


The Pandora FMS server is the one that processes the collected information in different ways, it also executes alerts, applies policies and sends the information to the database. Pandora FMS server also contains different components that perform their own functions, some of them are the network server, the SNMP server, the data server… All of them are components that are part of Pandora FMS server and can be enabled or disabled depending on the needs.

Service Level Agreement (SLA)

A Service level agreement or SLA, is an agreement negotiated between two parties where one of them is the client and the other one a service provider.

In Pandora FMS, SLA non-compliance is detected when a component goes into critical status , being careful of activating FlipFlop protecton in module advance options ("FF threshold"). In the case of Service monitoring, in its initial configuration, if SLA thresholds are not set, Pandora FMS will take into account FF thresholds literally.

Informes SLA en Pandora FMS (vídeo)

In reporting, their reliability must be fine tuned to avoid issues and also se the priozation mode (OK or unknown priorization).

All SLA takes as valid unknown periods, since Pandora FMS cannot guarantee the status of a module if it does not have any information on it. Also, all perios in scheduled downtime are considered valide (since by being in a scheduled downtime it is assumed it is under contril and the module's situation is accepted) and periods in warning status (the service is still provided even in non-optimal status).

Shell or Command Line

An interface which allows commands to be entered manually, via keyboard.

SNMP Checks

These are essentially TCP checks that strictly use an established and specific protocol, the SNMP protocol. See also Remote Monitoring .

Software Agent

This refers to the service that is installed on computers to collect local information, and it can be installed on all types of systems: MS Windows®, UNIX®, etc. It runs on the system where it is installed to collect and send information from time to time, called interval. The software agent generates a data file in XML format that is sent to Pandora FMS server through the network, generally using Tentacle protocol.


It is normally used to refer to the status of one module. It gives information about the module at the present moment. The status of an agent is determined by considering the worst of the status of all its modules as a group (if it has 5 modules and one is in CRITICAL, two in WARNING and two in NORMAL), the module's status will be CRITICAL. Same goes for the status of one group.


Just as in GNU/Linux there is a superuser called root, in Pandora FMS there is also the figure of superadmin:

  • When installing a full PFMS server, by default, two users are included: admin and internal_API.
  • This user admin is the first superadmin but not the only one, you may add as many as needed and justified.
  • To do so, a new superadmin must be assigned to it:
    • Set Global Profile to Administrator level.
    • Besides the superadmin, in Pandora FMS it is possible to create administrator users, through the PM access bit, assigned through profiles/groups to a user. The users with PM bit are almost the same as a superadministrator, except that for example, they cannot create alert commands, and some other limitations, such as not being able to define other users as superadmin.

Versión EnterpriseIn the case of using the ACL Enterprise System, superadmins are exempt from such control, the other users are bound by ACL, even if they have the Pandora Administrator profile assigned to them.

  • For security reasons there are functions that can only be accessed by a PFMS superadmin.


See superadmin.

SVN / Subversion / Code Repository

SVN / Subversion / Code Repository is a version control system that stores one repository along with the different versions of the files assigned to one project as long at it exists. The group of files within a specific time is called 'Revision', so two people that have the same project's revision will have two identical copies of the same files.

Synchronous Monitoring

A module is considered synchronous if it returns data in regular intervals, e.g. a temperature measurement every 5 minutes.


Like packages, they contain a program or group of programs packed in TAR format, but do not contain information on how to install them, and are not specific to a specific operating system.

TCP Checks

The Transmission Control Protocol (TCP) allows queries, with acknowledgement of receipt, to be made to devices and computers through ports opened for this purpose. A TCP check seeks specific responses which are compared to the thresholds for each module. See also Remote Monitoring.


Tentacle is the data transfer protocol the software agents and the Satellite Server use to send data to Pandora FMS Server. Tentacle is multi platform and it is designed to be an easy-to-use and secure protocol. It uses port 41121 (assigned by IANA) by default.


Minimum or maximum value of a module at which a change of state occurs.

UKNOWN status

We say that a module is in unknown status or UNKNOWN if it does not receive data for more than twice its interval. In other words, a module that sends data every 5 minutes is marked as UNKNOWN after 10 minutes without receiving data.


A watchdog timer is an electronic device that checks from time to time that processes are running, otherwise it restarts them. The term (sometimes called computer operating properly or COP timer) was extended from hardware to software simply as (processes) watchdog.


The defining characteristic of a graphical widget (or simply widget) is to provide a single interaction point for the direct manipulation of a given kind of data. Any widget displays an information arrangement changeable by the user, such as a window or a text box. In other words, widgets are basic visual building blocks which, combined in an application, hold all the data processed by the application and the available interactions on this data.

Go back to Pandora FMS documentation index