Network Equipment Performance Monitor by Nova Software
Local Edition
Help for the Courier Management Console
General
The NEPM:LE Courier telnets in sequence to the monitored systems. Syslogs, event logs, web and mail server logs, switch and router logs, etc. are captured from these target systems and mailed to the NEPM:LE Builder. The Builder archives them and builds web page reports from the logs that may be viewed remotely for monitoring and managing downtime, critical events and performance of network nodes. This split architecture monitors isolated networks, such as test labs or networks behind multiple firewalls, from one remote location, without compromising network isolation.

Courier can be configured and controlled from the command line with a text control file and standard scheduling programs (cron on Unix's, 'at' on WinNT's.) For those who prefer the convenience of a graphical user interface this program, Courier Management Console (CMC) configures and controls Courier thru a web browser. It also adds the ability to manage Courier remotely from anywhere on the network. The CMC installs automatically with NEPM:LE and runs on the same host as the Courier itself. It simplifies configuration, automates scheduling, and will run Courier manually, eliminating direct use of the command line. Command line control of Courier is not affected by the use of CMC: the two methods can coexist.

For further information consult the NEPM User Guide here.

CMC Configuration
CMC itself has only one configurable parameter: TCP port number. It defaults to 50000 and should normally never need to be changed by the user. If this value must be changed for your Courier host system, add the new value as the first command line parameter to the line that starts CMC, e.g. cmc.bat 12345 on the WinNT shortcut or cmc 12345 on Unix/Linux command line. Port numbers lie between 1 and 65535. Many port numbers are already assigned to other standard services such as telnet, ftp, and email, and many others. Type 'netstat -a' at a command prompt to list all the TCP ports in use (either system type.) Do not use any of these that are already running on the CMC/Courier host machine. On WinNT consult the file WinNT\system32\drivers\etc\services and on Unix's /etc/services for the list of well-known and registered TCP port names vs. numbers.
Starting and stopping CMC
WinNT's: Double-click on the cmc.bat icon in the NEPM\LE home directory. A command window will open and then a brower window for opening an existing Courier control file or for creating a new one. Leave the command window open to keep the CMC server running. Close the browser window alone to leave the CMC server running and the command window open. Use this mode when accessing the CMC server remotely from several different machines. Click the 'Close CMC' button to stop the CMC server itself and close the command window automatically, eliminating all access. Access CMC from browsers on remote systems on the network by entering the URL that is shown in the command window when CMC starts up into the browser's address bar, typically 'http://courierhostpcname:50000/opencmc'. On some networks the hostname may not work from remote systems -- use the IP address of the CMC host machine in those cases. Type 'ipconfig /all' at a command prompt to find the IP address on the CMC host machine.

Unix/Linux: cd to the NEPM/LE home directory and type cmc at a command prompt to start the CMC server. Enter the URL shown in a browser's address bar to begin the session. Stop the server with the 'Close CMC' button in the browser window or the 'kill' command. Access the CMC server locally or remotely, as on WinNT systems, observing the cautions about overlapping access and the difference between stoping the server and simply closing the browser window.

Limitations
Help for General Settings and Controls
Open a new or existing control file
Enter a file pathname of a Courier control file to be opened or use the browse button to select one. If no filename is entered or the named file is not found Courier opens a new file for you from a default set of settings. Give this file a name in the 'save as...' box below before saving it.

When working remotely this entry points to a file on the CMC host machine not on the remote client. Do not use the "browse" button in this case, but rather enter the relative or absolute file pathname of the desired control file on the CMC host into the input box. In other words this entry always selects a control file from the CMC host machine, whether the browser client session is running on the same machine or remotely. With a local session the "browse" button can be used for finding this file, but it cannot for a remote session. This feature allows keeping only one copy of all the control files, in one place, but accessing them from anywhere on the network.

Control file will save as...
Enter a path and filename here to save all the current data under this new filename. Use the browse button to find an existing file to overwrite with the new one, or to find a directory path. Since browser local filesystem browsing capability is only for file reading the browse button cannot be used for saving a new filename directly. Use the browse button to find the directory into which you want to save your new file and select a random file within that directory to "open". Then edit the filename to your chosen new filename in the input box, replacing the randomly selected filename, before doing a "Save All" or "Save and Run" .
Courier's email address
This address is used in the 'from' address field of all mail sent by the Courier. It must be a fully qualified email address. Courier must be located at an IP address from which the server will accept mail without requiring authentication of the sender. This can often mean that Courier and its mail server(s) must be behind the same firewall. The Courier's email address is always required because its domain portion is used to identify and group the files it captures.

Builder's email address
The Builder must have an email account on a POP3 email server to which Courier can mail the files it captures. Enter that full email address here. Courier and Builder may use different mail servers, behind different firewalls. This feature allows one central site to monitor many networks, independent of firewalls.
Path for filesystem Couriering
If no SMTP mail server is entered in this control file, files will be couriered between Courier and Builder by writing them to a common filesystem directory to which they both have access. Enter that directory path here using the directory separator appropriate to the system hosting it. We strongly recommend making an entry here in all cases: This directory is also used for emergency file saving under certain error conditions, to prevent loss of information. Email accounts for both Builder and Courier are always required, whether or not filesystem couriering is used.
Time between capture runs
Courier will run and capture the files listed and mail them to the Builder on this schedule. The CMC will setup a cron file (Unix's), or 'at' entries (WinNT's) to do this. The most common choices of schedule are provided in this automatic scheduler included with CMC. Courier will run on any schedule you wish. Setup other values by creating your schedule manually.
Primary SMTP mail server
An outgoing mail server that will send mail for Courier. This must be an SMTP server, and must allow relaying mail from the Courier without requiring authentication. This generally means that Courier's host computer must have an IP address within a "safe" range recognized by the mail server, typically within its own network and behind its own firewall. All files that Courier mails are sent via this server. Enter the name in fully qualified dot notation (myorgs.mailserver.org) or as an IP address 123.123.45.67.

Enter '0' here to use filesystem couriering instead of email, i.e. to have Courier write the compressed log files it captures to a directory for pickup by Builder. This method is useful should Builder and Courier be running on the same machine or both have access to the same network share.

Secondary (backup) SMTP mail server
Courier will attempt to connect and mail thru this mail server if it cannot connect to the primary mail server.
License key (22 characters)
Enter the evaluation or purchased 22 character license key obtained from Nova Software. Do not enter any leading or trailing spaces. (A careful copy and paste is the safest method.)
First capture run begins at
Choose the hour and minute of the day at which the first automatically scheduled run will occur. The remaining runs of the day (if less than a 24 hour interval is selected) will occur 1, 2, 3, etc. intervals later. If the hour selected is -- then no automatic scheduling will occur, and any existing automatic schedule for this control file will be erased when the file is saved.

Help for Individual Capture Line Settings and Defaults
IP Address of the element
Enter the IP address in 123.145.67.89 'dotted-quad' style decimal notation of an active telnet server port on a system to be monitored. If this system is to use all the default values defined in the defaults section of this form then this entry is the only one needed. 'Save All' and enter the next system to be monoitored in this box, and so on, to build your list of monitored systems. Visit www.nepm.net/telnet.html or consult the Appendix on telnet servers in the Users' Guide for more detail on what constitutes a useable telnet server on a Windows target system.

NEPM:LE will function satisfactorily with host domain names instead if you prefer (e.g myhost.mynet.myorg) as long as the system hosting the NEPM Courier has access to a DNS resolver that will resolve the name to an IP address. We discourage using domain names, however, and recommend using only numerical IP addresses because it reduces the delay of the additional lookup step across the network, and avoids having data collection failures due to purely DNS failures.

Login ID
The user ID for telnet login on the target system. The default is set by the default entry and is used when each individual capture line is created unless a value is supplied. This makes it possible to use and easily enter one account for some or all systems if desired. The rest (or all) can be accessed thru their own unique user ID entered in the individual capture section.

WINDOWS TARGET SYSTEMS: Most telnet servers for Windows, including that distributed by Nova Software, require both the Windows domain and userid in the login, separated by '\', thus: your_domain\Your_login_id. Entering the windows domain as a separate entry is not supported in this release of NEPM.

Password
The password for the above user ID. The default is set by the default entry and is used when each individual capture line is created unless a value is supplied.
Prompt after login
Set the command line prompt that the target system issues after login succeeds, in regular expression form. For Unix's (\$\s*)$ is the best choice for the usual user prompt of $. The internal default is [[:upper:]]:(.+>)$ if nothing is entered and works for WinNT's typical > prompt. Other UNIX equivalences are (#\s*)$ for # , (>\s*)$ for > , (!\s*)$ for ! , (:\s*) for : . Keep the prompt regular expression as specific as possible to avoid false matches in log text. Consult the User Guide here for more detail on prompt equivalences in regular expression form.

If you receive repeated "pattern match timed-out" messages after Courier sends username and password during login check that this value is correct for that target system. A mis-match between the two is most often the cause for such messages.

Telnet port#
The telnet server port number on the target system, normally 23. The Nova-Software-supplied telnet server for WinNT defaults to port 1023 unless you override the default.
OS (Operating System) type
Select the general type of operating system of the target host: WinNT, Unix, or Cisco IOS and compatibles. WinNT systems include WinNT4.0, Windows2000, Windows2003 and WinXP. (WinNT's prior to 4.0 may function satisfactorily with NEPM but are not directly supported by Nova Software.) Unix's include commercial Unix's such as Solaris, HP-UX, AIX, and IRIX, as well as BSD and Linux variants, and others that use '/' as the directory separator character and include the common Unix commands such as 'ls', 'cat' and 'more'. Select WinNT for any operating system types that use '\' as the directory separator, and that include common Windows commands such as 'dir', 'type' and 'more'. Routers and switches compatible with Cisco's IOS choose IOS.

Select the Telnet Relay option when connecting to the next system from this one in a "relayed" telnet session, rather than connecting to it directly from the Courier. Such relayed sessions make it possible to monitor equipment on isolated networks, such as test labs, through a gateway host with a telnet port accessible from outside. Consult the Users' Guide for more detail.

The telnet server and client components supplied with NEPM or equivalent ones purchased from third parties must be used when relaying on WinNT systems: The MS native Windows telnet client and server will not relay. Select Pragma Telnet Relay for telnet relay in this case. Consult the Users' Guide for more detail.

When capturing data by relay from a system on an isolated network enter a relay line for each host relaying the capture session, ending with a normal capture line for the target system. As many connections as needed may be chained to create a relay session to the target system. Enter a separate capture line with proper OS type to capture from a system also used for relaying. Consult the Users' Guide for more detail.

Delete files after capture
By default the Courier leaves each log file it reads in place after sending a copy to the Builder. Enable this option to have Courier delete each file after transmitting it. Since Builder archives all incoming files in compressed form this option makes NEPM:LE function as your central log archiving system as well. Courier includes safeguards that save a copy of the logs on the Courier host machine in the event that mail to the Builder fails, thereby insuring that no log files are lost. The account that Courier uses on each monitored target system must have write permissions on the log files to delete them.
Privileged mode command
Some systems such as Cisco's IOS only allow log files to be read by a privileged user. Use this command to raise the Courier's privilege level after logging in on such systems. For IOS use 'exec'. For UNIX's use 'su root' to change to an account such as 'root' with privileges to read system logs. Elevated privileges may also be required to use the 'delete after capture' option on some systems.

This entry is ignored on WinNT systems. You must login initially as Administrator if elevated privileges are required.

Privileged mode password
The 'exec' password on IOS compatible systems, or the root password if root privileges are required on UNIX's. Not applicable to WinNT's
Privileged mode prompt
Typically (#\s*)$ for IOS and UNIX systems. Not applicable to WinNT's.
Element names to be captured
Enter a descriptive name for each type of logged sub-system to be monitored on a target machine, such as 'System' for the OS, 'Apache' or 'IIS' for a web server, 'Enet' for an ethernet interface, etc. This name is used for reporting results and can be any name you wish. It is sent along with the captured log files to the NEPM:LE Builder which matches it with an event list identified by this name and the OS type. The events in this list are then extracted from the corresponding captured log files and reported. The name should indicate the general type of sub-system being monitored, but not the specific one, e.g. 'web_server' not 'web_server_1', unless you wish to provide event lists in Builder specialized by individual target system. Include 'System' as part of an element name to use the default event lists for operating systems provided with the Builder. Enter one name per input box. Edit a Courier control file directly and reload it into CMC if you wish to enter more than three element names per capture line.

CRITICAL: Element names must contain only alphanumeric characters (upper and lower case letters and numbers) and underscore, '_'.

Element log files to be captured
Enter the list of the log files to be captured for this element, separated by the vertical bar (pipe) symbol, '|'. As many spaces as desired for visual clarity can be inserted AFTER the '|' symbol. Do not put any spaces in front of the '|' symbol. The characters ; : / \ | < > " must not appear within filenames. File pathnames may contain spaces. Do not put quotes around file pathnames with spaces -- this function is provided by the single '|' symbol at the end of each file pathname. The directory separator in pathnames must be that appropriate to the target system, i.e '\' for WinNT type and '/' for UNIX's.

For Windows NT systems the Event sub-logs must be specified without any pathname simply as ::EventLog_System, ::EventLog_Application, ::EventLog_Security and ::EventLog_DNS. Use NO extra spaces with this type of log name. This syntax tells the Courier to capture these files with the WNTELC tool included with NEPM, since they are not directly readable while in use by Windows.

Specifiy IIS dated logs with the pathname but use ::DatedLogs at the end in place of the filename, e.g. C:\WINNT\system32\LogFiles\W3SVC1\::DatedLogs. Use NO extra spaces with this type of log name. This syntax tells the Courier to capture the latest two logs in this directory, ignoring the filename, which will change hourly, or daily, etc. , and may also be used with numbered rather than dated logs created by IIS.

On systems using periodic log rotation, such as the standard logrotate on RedHat Linux, list the latest two log names with the oldest one first, on the left. For example, for an Apache web server on Linux this could be |/var/log/httpd/access_log.1|/var/log/httpd/access_log|. You may enter as many log pair names as you need on this line, such as including both system logs and Apache error logs to capture events recorded uniquely in each, i.e. |/var/log/messages.1|/var/log/messages|/var/log/httpd/access_log.1|/var/log/httpd/access_log|/var/log/httpd/error_log.1|/var/log/httpd/error_log|

CRITICAL: Multiple file pathnames within each related subgroup MUST be listed in chronological order, earliest on the left, latest on the right, as in the examples above.

When logs are rotated the latest two log names are required in order to insure capturing events near the boundary between the two logs. See the discussion in the NEPM:LE User Guide here for more detail on this requirement.

Deleting and Editing existing Capture entries
Each existing individual capture line in your Courier Control File is displayed in an input box. You may simply edit this line directly or delete it if you wish. Your changes are saved to the control file named in your "save as" box at the top when you do a "save all" or "Save and Run". USE CARE WHEN EDITING to preserve the correct syntax for capture lines. Syntax errors will only be detected when the control file is next run. Make a trial run to verify your changes before closing CMC.

Copyright © Nova Software, Inc. 2001-2004     All rights reserved.     www.nova-sw.com
rev. 041128