The General Options available on this form are explained below:
Figure1: General Options
Process Priority
Configurable Process Priority to fine-tune application behavior.
Queue Limit
The applications keeps an in-memory buffer where events received but not yet processed are stored. This allows the product to handle large message bursts. During such burst, the event is received and placed in the in-memory queue. The processing of the queue (via rule sets) itself is de-coupled from the process of receiving. During traffic bursts, the queue size increases, causing additional memory to be allocated. At the end of the burst, the queue size decreases and the memory is freed again.
Using the queue limit, you can limit that maximum number of events that can be in the queue at any given time. Once the limit is reached, no further enqueueing is possible. In this case, an old event must first be processed. In such situations, incoming events might be lost (depending on the rate they come in at). A high value for the queue size limit (e.g. 200,000) is recommended, because of the risk of message loss. It is also possible to place no limit on the queue. Use the value zero (0) for this case. In this case, the queue size is only limited by virtual memory available. However, we do not recommend this configuration as it might cause the product to use up all available system memory, which in turn could lead to a system failure.
CustomerID
CustomerID is of type integer provided for customer ease. For example if someone monitors his customer's server, he can put in different CustomerIDs into each of the clients. Let us say someone monitors servers A and B. A has 5 servers all of them with CustomerID = 1 and B has 2 servers all of them with CustomerID = 2. Both A and B happen to have a server named "SERVER". Together with the customerID, these machines are now uniquely identifiable. This is user configurable.
SystemID
SystemID is of type integer to be used by our customer. In addition, it is user configurable.
Location of your MIBS
Click the Browse button to search for your MIBS location or enter the path manually.
Default TimeValues based on UTC or Local Time
This option allows you to configure the timemode that is to be used e.g. in File Logging, Database Logging, Send Email actions and everywhere, where time is used. In addition to this it also set the time mode in all those places where time mode either UTC or Local Time is not defined.
Protect Service against Shutdown
The service keeps an in-memory queue of yet unprocessed events. When the service is stopped, this in-memory queue is drained. Not yet processed events are lost in such a case. If you click "Protect Service against Shutdown", it ensures that all events are processed before the service is stopped. Please note, however, that this may cause the service to look hanging. This is especially the case if there is a large in-memory queue.
Log Warnings into the Windows Application Eventlog
If this option is enabled it will, as the name already says, log Program Warnings into the Windows EventLog.
Special Unicode Conversion for Japanese Systems
On Japanese Systems, the character handling is different and if you experience problems with the encoding of received messages, kindly turn on this new Option.
Engine specific Options Tab
The Engine specific Options are explained below:
Figure2: Engine specific Options
Action specific
Enable retry of Actions on failure
If enabled, the Agent retries Actions on failure (until the retry counter is reached). Note that the Event error 114 will only be written if the last retry failed, previous error's will only be logged in the debug log (With the error facility). Note that you can customize the Retry Count and the Retry Period in ms as well.
Rule Engine specific
Abort Rule Execution when one Rule fails?
If checked, and an action fails, the execution will be aborted.
If unchecked, and an action fails, simply the next action in this rule will be executed.
DNS Cache Options
Enable internal DNS Cache
The DNS cache is used for reverse DNS lookups. A reverse lookup is used to translate an IP address into a computer name. This can be done via the resolve hostname action. For each lookup, DNS needs to be queried. This operation is somewhat costly (in terms of performance). Thus, lookup results are cached. Whenever a lookup needs to be performed, the system first checks if the result is already in the local cache. Only if not, the actual DNS query is performed and the result then stored to the cache. This greatly speeds up revers host name lookups.
However, computer names and IP addresses can change. If they do, the owner updates DNS to reflect the change. If we would cache entries forever, the new name would never be known (because the entry would be in the cache and thus no DNS lookup would be done). To reduce this problem, cache records expire. Once expired, the record is considered to be non-exisiting in the cache and thus a new lookup is done.
Also, cache records take up system memory. If you have a very large number of senders who you need to resolve, more memory than you would like could be allocated to the cache. To solve this issue, a limit on the maximum number of cache records can be set. If that limit is hit, no new cache record is allocated. Instead, the least recently used record is overwiritten with the newly requested one.
How long should DNS names be cached?
This specifies the expiration time for cache records. Do not set it too high, as that could cause problems with changing names. A too low-limit results in more frequent DNS lookups. As a rule of thumb, the more static your IP-to-hostname configuration is, the higher the expiration timeout can be. We suggest, though, not to use a timeout of more than 24 to 48 hours.
How many DNS records can be cached?
This is the maximum number of DNS records that can be cached. The system allocates only as many memory, as there are records required. So if you have a high limit but only few sending host names to resolve, the cache will remain small. However, if you have a very large number of host names to resolve, it might be useful to place an upper limit on the cache size. But this comes at the cost of more frequent DNS queries. You can calculate about 1 to 2 KBytes per cache record.
Ressource Library Cache Options
How long should libraries be cached?
This feature will be mainly useful for EventLog Monitor. For events with the same reoccuring event sources, this will be a great performance enhancement. The cache will also work for remote system libraries (requires administrative default shares). All libraries will be cached for 30 minutes by default.
Debug Options Tab
This tab can be used to debug rule bases. Especially with complex bases, it might be necessary to learn what application is internally doing while it is processing them. With the debug log, the service tells you some of these internal workings.
Other than rule basis testing, the debug log is also helpful when contacting Adiscon support. An Adiscon support engineer might ask you to set the debug log to a specific level while doing troubleshooting.
Important: Debug logging requires considerable system resources. The higher the log level, the more resources are needed. However, even the lowest level considerable slows down the service. As such, we highly recommend turning debug logging off for normal operations.
Figure3: Debug Options
Enable Debug output into file
If checked, the debug log is enabled and written as the service operates. If unchecked, no debug log is written.
For performance reasons, it is highly recommended that this box is unchecked during normal operations.
File and path name
The full name of the log files to be written. Please be sure to specify a full path name including the driver letter.
If just the file and/or path name is specified, that information is local to the service default directory. As this depends on a number of parameters, it might be hard to find the actual log file. So for consistency purposes, be sure to specify a fully qualified file name including the drive.
Note: If the configured directories are missing, they are automatically created by application i.e. the folder specified in "File and Path Name".
Debug Levels
These checkboxes control the amount of debug information being written. We highly recommend only selecting "Errors & Warnings" as well as "Minimum Debug Output" unless otherwise instructed by Adiscon support.
Circular Debug Logging
Support for circular Debuglogging has been added as the debuglog can increase and increase over time. This will avoid an accidential overload of the harddisk. Or course you can also customize or disable this feature.
Queue Manager Tab
Figure 4: Queue Manager Options
Queue Manager DiskCache
This feature enables the Agent to cache items in its internal queue on disk using a fixed data file. First of all a Warning. Only use this feature if you really need to! Depending on the speed of your hard disks, it will slow down processing of the actions, in worst case if the machine can't handle the IO load, the Queue will become full sooner or later. The DiskCache is an additional feature for customers, who for example want to secure received Syslog messages which have not been processed yet.
The diskcache will not cache infounits from services like EventLog Monitor, as this kind of Service only continues if the actions were successfully. All other information sources like the Syslog Server will cache it's messages in this file. If the Service or Server crashes for some reason, the queue will be loaded automatically during next startup of the Agent. So messages which were in the queue will not be lost. Only the messages which was currently processed during the crash will be lost.
File and Pathname
As everywhere else, you can define here, where the queue file should be stored.
Queue File Size
Be carefull with the queue size you configure. You should never configure a higher queue size then System memory is available. We recommend to have at least 512 MB less than the total system memory. In case a full queue file is loaded into memory during startup, it could come to unexpected problems caused by insufficient memory. The queue file size is currently limited to the maximum of 2048MB, however if you think you need more please contact Adiscon Support for further discussions.
If you change the size of the queue file, the queue file will be recreated during next startup. However the old contents will not be converted into the new file. So please make sure that the queue has been successfully processed before. This typically happens when you stop the Agent, unless the Agent process is killed after a default timeout of 60 seconds.
Depending on how big the queue file is, and how many unprocessed queue items have been stored in the file, it can take some time on startup of the Agent to finish initialization.
Queuelimit (General Options)
If the Queue Manager Diskcache is enabled, this limit will also be important. Regardless how large the queue file is, this is the maximum of items which will be stored in the queue. Also if the Agent restores the queue from disk.
Race conditions
When a server or computer crashes, it can always come to corruptions on the file system or within the queue file. If we detect such a corruption on startup of the Agent, we will initialize the cached queue as far as possible, and reset the queue file then. This is the best thing we can do in such cases.
Processing Pointer
The processing pointer defines, at which position in the diskqueue the the pointer is. The pointer is always at the last processed entry.
Saving Pointer
This pointer shows you, at which position the last saved entry is.
Queue Manager specific
Number of worker threads
Defines the number of worker background threads that MWAgent uses to process it's queue.
_____________________________________
Join the MonitorWare Agent MailingList
Adiscon offers a free notification mailing list. The list provides information on important product enhancements and discovered bugs. Click the text to subscribe to this list. Please note that you can unsubscribe at any time and the list is not used for marketing mails.
_____________________________________