optimizing and maintaining your n-central environment · optimizing and maintaining your n-central...

Jan 21, 2015 N-central 9.5 Editor: Scott Parker

Optimizing and Maintaining your

N-central Environment

v.2.3

Optimizing and Maintaining your N-central Environment

2

Contents Important Information regarding this document ......................................................................................... 4

Implementation Strategy .............................................................................................................................. 4

Resources and Time Budgeting ................................................................................................................. 4

Training and Supplementary Materials .................................................................................................... 4

Introduction – Your goals within N-central .................................................................................................. 5

Where will N-central fit into my organization .............................................................................................. 5

The N-central clean-up process .................................................................................................................... 6

Identifying an N-central server that requires a clean-up .......................................................................... 6

Test #1: Is there an overabundance of non-critical Active Issues? ....................................................... 6

Test #2: Does the N-central server have Misconfigured or Stale services? .......................................... 7

Test #3: Is my support team getting too many Notifications? ............................................................. 7

Test #4: Am I seeing many failed probes across my customers?.......................................................... 7

System Clean-Up Phase 1 – Building a solid foundation .......................................................................... 7

Step 1 – Take note of your current state .............................................................................................. 7

Step 2 – Review and Resolve N-central Probe issues ........................................................................... 8

Step 3 – Employing Deployment Best Practices for all environments ................................................ 10

Step 4 – Upgrade your On-premises N-central Server to the latest version ...................................... 10

System Clean-Up Phase 2 – Aligning your core monitoring ................................................................... 11

Step 1 – Ensure all Customers appear in default Service Organization Level Rules ........................... 11

Step 2 – On-premises adjustment of Virtual Memory ........................................................................ 12

Step 3 – Resolving Exchange/SQL server memory and disk monitoring ............................................ 13

Step 4 – Remove “Connectivity” from Workstations and Laptops ..................................................... 15

Step 5 – Review and Re-apply Workstation and Laptop Service Templates ...................................... 16

Step 6 – Removing Warranty alerting from Workstations and Laptops ............................................. 20

System Clean-Up Phase 3 – Customer level maintenance ..................................................................... 23

Step 1 – Configuring asset discovery .................................................................................................. 23

Step 2 – Populating credentials for all Customers .............................................................................. 24

System Clean-Up Phase 4 – Leveraging the All Devices view for Maintenance ..................................... 26

Step 1 – Devices who’s Agents have not checked in for over 30 days ............................................... 26

Step 2 – Devices classified as “Other” ................................................................................................ 27

Step 3 – Devices with Failed Connectivity .......................................................................................... 28


3

System Clean-Up Phase 5 – Resolving remaining Active Issues ............................................................. 31

Generic SQL Server – 1433 (Failed) and .............................................................................................. 31

SQL Server _ Total (Misconfigured) .................................................................................................... 31

Guest Status VMware – SERVERNAME (Failed) .................................................................................. 31

Disk I/O (Failed or Warning) ................................................................................................................ 32

HTTP/HTTPS (Failed) ........................................................................................................................... 34

Windows Services (Failed) .................................................................................................................. 34

Exchange 2003 (Misconfigured).......................................................................................................... 34

Basic workflow for troubleshooting unnecessary Active Issues (All other types) .............................. 35

System Clean-Up Phase 6 – Configuring Notifications ........................................................................... 37

State 1 - Legacy format using “0 Minute Delay” type titles ................................................................ 37

State 2 – N-central 9.1+ format with a Notification per function ....................................................... 37

State 3 - Mixed or user configured ..................................................................................................... 38

System Clean-Up Phase 7 – Completion and Keeping Things Clean ....................................................... 39

Feedback ................................................................................................................................................. 39

Appendix A – Reviewing leveraging Filters to focus attention on critical issues ........................................ 40

Viewing only Failed and Warning states ................................................................................................. 40

Hiding non-critical failures ...................................................................................................................... 41

Filtering for items that generate a notification only............................................................................... 41

Resetting your filter in Active Issues ....................................................................................................... 41

Appendix B .................................................................................................................................................. 42

Recommended maintenance schedule for MSPs ................................................................................... 42

Things to do Weekly (Maintenance): .................................................................................................. 42

Things to do Daily (Reacting to and resolving issues): ........................................................................ 42

Appendix C .................................................................................................................................................. 43

Best Practice for new client onboarding ................................................................................................. 43

Appendix D .................................................................................................................................................. 44

9.1+ Notification Structure ..................................................................................................................... 44


4

Important Information regarding this document Section specific Warnings, Notes and Best Practices Tips should be understood before continuing with

your changes. Please be sure to read them carefully. This content is identified by the images below:

Implementation Strategy

Resources and Time Budgeting The process contained in this guide may take several days of work with a

dedicated group of resources depending on the current state of your N-

central server. It is highly recommended that you budget appropriate time

to resolve the issues and work as a team to implement the processes in

these pages to get the most out of your N-central system. A successful N-

central implementation coupled with improved change management will

result in a more efficient, proactive service offering and increased

satisfaction from both your technical team and your end users.

Training and Supplementary Materials

Ideally your resources should review this document and then attend the

training course offered by N-able titled “Optimizing your N-central

Deployment”. In this course you will be given a high level overview of the

entire process and have the opportunity to discuss questions with an

expert. This is a highly valuable starting point and is the recommended

approach for anyone undertaking a server clean-up or simply looking to

become more familiar with the inner workings of the system. To attend a

session please follow this link:

SUBSCRIPTION TRAINING CALENDAR

https://nrc.n-able.com/training/subscription/Pages/Default.aspx


5

Introduction – Your goals within N-central N-central is a comprehensive monitoring tool that will give you high visibility into the health of your

managed environments. It has been configured out of the box to offer a wide spectrum of monitoring

and alerting across a multitude of device classes.

Your goal as an administrator of N-central should be to ensure the systems’ monitoring and notifications

match with your needs as a managed service provider (MSP) and that the Active Issues view remains

free of clutter, allowing your technical team to focus on incidents that are of importance to you and

your customer.

Without proper configuration clutter may build up, rendering the Active Issues view unable to perform

its function as a dashboard of issues that require attention. If you are finding that there are warnings in

this view that are considered unimportant by your team, you should take steps to remove them. You

may also find that you are receiving an over-abundance of Notifications as a result of a cluttered Active

Issues view and may wish to re-focus your email alerts to critical issues only.

Where will N-central fit into my organization Properly implemented and managed, N-central will be a key tool in your day to day service operations.

The primary resource for the identification of reactive and proactive issues

Using a properly filtered Active Issues view, Notifications, Ticketing, Dashboards and Reporting we will

focus attention on critical issues and organize our service efforts.

Provide visibility and accessibility for your support team

By effectively working with Active Issues and Dashboard views, connecting your team through mobile

devices and effectively assessing customer environments through targeted reporting we can provide a

high level of visibility for your support team. Remote control to all managed devices should be

functional and configured to your needs for all devices.

Act as a resource for sales opportunities

Leveraging N-central reports such as the Executive Summary, Patch Status, Endpoint Status and System

Warranty we can bring potential opportunities to light for your sales team. Report Manager for On-

premises servers makes available advanced reports including an expanded Executive Summary that can

dramatically deepen the value of the content you bring to regular customer reviews.

A platform for the automation of tasks

Using N-central’s robust automation options, we are able to schedule regular maintenance, execute on-

demand remote commands and perform file transfers and application installs.


6

The N-central clean-up process

Identifying an N-central server that requires a clean-up If you answer “yes” to any of the following questions, you should plan to perform a server clean-up

within your environment:

Test #1: Is there an overabundance of non-critical Active Issues?

1. Expand the filter in your N-central Active Issues view by using the tab at the right hand side of

your screen (requires N-central 9.1 or higher).

2. Click “Reset Filter” (highlighted in green below).

3. Select the options to filter Active issues by Failed and Warning only (highlighted in red).

4. Selectively remove the Patch Status, Printer Status and Printer Toner services (highlighted red).

5. Review the remaining Active Issues:

a. Are there large groups of the same issue (Memory, SQL, etc.)?

b. Are there services failing that you can identify as not “true” problems?

c. Do you see issues that you will never realistically respond to because either you are not

contractually obligated or they are better explored during regular business reviews or

using reporting?


7

Test #2: Does the N-central server have Misconfigured or Stale services?

1. Click “Reset Filter” in the Active Issues Filter.

2. Filter Active Issues for Misconfigured and Stale .

3. Selectively remove the Patch Status, Printer Status and Printer Toner services.

4. Review the Active Issues view. Any number of misconfigured and stale issues indicates a need

to clean the system.

Test #3: Is my support team getting too many Notifications?

1. A common result of a cluttered Active Issues is an overabundance of Notifications flowing

from N-central and overburdening your technical team. If you feel your team is suffering from

this issue, your N-central server requires a clean-up.

Test #4: Am I seeing many failed probes across my customers?

1. From the Service Organization (SO) level in N-central, scroll down the left hand side menu

system to the Administration category.

2. Click on “Probes”.

3. This list should not have anything but Normal green checkmarks . Any probe that is either

Stale , Misconfigured , or Failed will need to be resolved.

4. Every Customer environment should have a probe if at all possible. Are any missing one?

System Clean-Up Phase 1 – Building a solid foundation

All thresholds and modifications in this document are suggestions based in best practices. You should evaluate and

adjust these recommendations to best suit your own company’s requirements and obligations to your customers.

Step 1 – Take note of your current state

In order to see progress it is important to know where your server started. During this process the

Active Issues view will fluctuate with various numbers of alerts.

Pause now to document how many Active issues you see when filtering on Failed & Warning only, with

the 3 services disabled (Patch Status, Printer Toner and Printer Status). We will also document how

many notifications you get daily (approximate). We will be focusing on streamlining these as well. This

information is visible at the bottom right of your filtered Active Issues screen.


8

Step 2 – Review and Resolve N-central Probe issues

1. From the Service Organization (SO) level in N-central, scroll down the left hand side menu

system to the Administration category.

2. Click on “Probes”.

3. Sort this list by Customer/Site by clicking the heading.

4. Review the displayed list:

Probes in a status other than Normal will result in further misconfigured or stale

services, failed patch management and agent deployment as well as many other

issues. We will want to resolve these first.

o As per Deployment Best Practices it is recommended you create a Domain

Administrator account for the probe to use, with a complex password that

will not expire. If however the password does expire, the probe will fail.

You will need to log into the server that hosts the probe and re-install it

should this occur.

o Ensure the Windows Software Probe service is installed and running. It may

simply need to be restarted.

o N-central Probes require .NET4. If for some reason .NET fails, the probe

service may fail as well.

o A common problem with Probes is that the Administrator password you

gave them during install has since expired or an upgrade occurred and the

probe failed to inherit the credentials from the previous install resulting in

permission denied errors. You can reset the password and account the

probe is using by following these steps:

Log on to the server or device that hosts your probe. Run the windows application services.msc on the probe device. Stop the probe services:

- Windows Software Probe Maintenance service. - Windows Software Probe service. - Windows Software Probe Syslog service.

Open the Properties of the Windows Software Probe service by right clicking the service.

Select the Log On tab. Enter the new Domain Administrator credentials. Click Apply. Select the General tab. Enter the following in the Start Parameters field:

username=yourDomain\User Password=Yourpa$$word


9

Select the Start button. Re-start the other Windows Software Probe services.

o If you decide to re-install the probe, you may simply manually install the

appropriate customer specific Probe directly over top of the existing one on

the customer’s server. The first time you launch the installer it will remove

the existing probe. You will commonly need to run it a second time to

install a new probe service.

o If you choose to install the probe on a different system, DO NOT DELETE THE

EXISTING PROBE IN N-CENTRAL until you have performed a Task Transfer in

the Administration > Probes section of the N-central UI to move the

requirements of the one probe to the new device.

Best Practices Tip: Every environment (including workgroups) should have an N-central Probe. They facilitate agent deployment, patch management, device discovery and act as a source for the monitoring of network devices. If you have an environment without a server, consider building a small box running Windows 7 to place into the environment to run your probe. Alternatively, designate a PC in the environment to stay on permanently and run the probe.


10

Step 3 – Employing Deployment Best Practices for all environments

Phase 2 of the Deployment Best Practices guide (found in the N-able Resource Center, NRC,

http://nrc.n-able.com under Product Documentation) and the Runbook suggest several pre-deployment

steps that are designed to make domain based devices easier to identify and on-board. If you have not

previously completed the following steps, it is encouraged that you not only revisit your clients and

configure them, but also incorporate these steps into all future deployments:

1. Configure a Group Policy to open three items in the workstation and server firewalls to allow

easy detection and agent deployment:

a. File & Print Sharing

b. ICMP Inbound Echo Requests

c. Inbound Remote Administration

2. On your DNS server, configure scavenging to ensure we do not have devices with multiple IP

addresses.

3. On network devices such as routers, firewalls and switches, enable read only SNMP.

4. On physical name-brand servers enable SNMP and install Dell, HP or Intel management

software such as Dell Openmanage.

Best Practices Tip: All of the above suggestions are covered in detail in the Deployment Best Practices guide. It is HIGHLY recommended that your technical team download and follow this document for trouble free deployments in future.

Step 4 – Upgrade your On-premises N-central Server to the latest version

Every release of N-central brings improvements and new features that we can use to better manage and

maintain the system. You should update your server to get access to these features and improved

monitoring templates.

Hosted customers will not need to do this step as N-able automatically updates your system for you.

To update your server, open the online help in the N-central UI and search for “Upgrade N-central”.

Follow the instructions and contact the N-able support team if there are questions or problems. The

Release Notes of the updates will detail the pre-requisites for updates and system requirements.

In N-central version 9.2 you will see WSUS management of patching disappear, proper steps should be taken to

migrate your patch management. These steps are not covered in this guide but are outlined in the release notes for

that version. In 9.3 we have released a new AV Solution, and migration steps in the online help (hover over the

System Time in the top right of the N-central UI and it will reveal a (?) Help Icon) should be followed as well.

Best Practices Tip: Be sure to have a backup of your N-central data before performing an update. Backups are configured at the System level (typically red) of your on-premises server under the Administration > Backup & Restore section. DO NOT KEEP A VIRTUAL SNAPSHOT AS THEY WILL CREATE HIGH SYSTEM LATENCY AND WILL GROW EXPONENTIALLY DUE TO THESE CHANGES.

http://nrc.n-able.com/


11

System Clean-Up Phase 2 – Aligning your core monitoring

Step 1 – Ensure all Customers appear in default Service Organization Level Rules

If you have a Hosted server, or you have upgraded your own on-premises server from version 7.x or

earlier you may find that several of the core Rules did not apply to your older customers. This may

indicate that devices have not had their appropriate Service Templates applied and you are missing core

monitoring. It will also hinder your ability to manage your clients top down, requiring unnecessary

granular changes at the customer level. We will add all customers back to the SO level Rules and clean

up any residual Customer level clutter to avoid conflicts.

1. From the Service Organization level (typically orange in colour) and in the left-hand side menu

of the UI click on Configuration, Monitoring and then Rules.

2. Open each Rule in turn and review the last tab named “Grant Customer/Sites Access”. If the

“Propagate to all new customers/sites” tab is selected (see warnings highlighted in red below),

typically all customers should be in the right hand side box labeled “Selected Customers/Sites.

Best Practices Tip: Create a list of the Customers that had remained on the left hand side (not applied to the Rule), you will have some clean-up work to do at their Customer level (green by default) in the next step.

Not ALL Rules need all customers in the Grant Customer/Site Access box. For example rules for Patch or AV

management rules typically will only include customers that get AV or Patch management. If the “Propagate to all

new customers/sites” is checked, then typically all Customers should be added to this Rule.

Applying Customers to Rules will re-deploy your monitoring templates for those affected. Expect a considerable

amount of new Active Issues/Notifications during this process and inform your helpdesk accordingly. Also expect that

any granular/custom threshold changes done at a device level will be overwritten with defaults.

Applying a Rule (and its associated templates/notifications) to a large number of clients/devices at once may cause a

database deadlock in N-central. It is advisable that you add only 10 or fewer Customers at a time to SINGLE Rule to

avoid this problem. Save the Rule with the added clients, allow it to complete its change (a warning icon will appear

while the change is in progress) before continuing making additional changes or adding additional Customers.


12

3. Once all clients are added to the core system Rules, you will want to go to each of the Customer

level’s (green by default) you identified as having been left out of Rules and clean up any

remaining unnecessary customer Rules.

a. Under the Customer Level > Configuration > Monitoring > Rules look for Customer

Rules identified by the icon without a small yellow lock , as seen circled in red below:

b. You can safely select and delete these Customer level Rules as long as you are

confident you have not created them to enforce granular changes at that Customer level

at some point. In most cases, they were created unnecessarily during an update from

N-central 7 to 8.

Do not delete the Service Organization level rules! Pay close attention to the icon indicator at the Customer level:

This indicates the Rule was created by a level above (ie: the Service Organization level).

Step 2 – On-premises adjustment of Virtual Memory

If you are using an On-premises version of N-central we can make a quick change that will produce a

significant reduction in unnecessary Active Issues. Hosted users can skip this step we will address these

items through Service Templates.

The problem we will address here is that Virtual memory thresholds on many servers was set initially far

too aggressively. It will begin to warn and fail at only 40% utilization. Many new devices on their first

day on will exceed 40%. We need to quiet this particular threshold down and the easiest way to

accomplish this task is through the back end of your N-central server.

1. Log into the back end of your On-premises server (https://yourserverIP:10000).


13

2. Look for a menu item called “Default Service Thresholds” under the Services heading:

3. Find “Memory (%)” for “Virtual Memory Usage” and adjust it to have a Normal range of 0-85, a

Warning range of 80-95% and a Failed range from 90% to 100%. *Note that if you prefer a

more aggressive threshold you are free to set it.

4. Check the box at the right of the screen and scroll down to the bottom of the page and click

SAVE. This will commit your changes.

5. Back in N-central, you will see changes to the number of memory errors and warnings visible in

the Active Issues console within 5 or so minutes.

You may also want to adjust the thresholds for Inbound and Outbound Discards for the Interface service if you find you

have too many alerts on those type of Active Issues. Generally however, you will not want to adjust thresholds in the

NAC unless you are SURE you want to adjust the default system wide.

Step 3 – Resolving Exchange/SQL server memory and disk monitoring

As it is common for these systems to use as much physical memory as they can find, we need to make

some adjustments to our monitoring to accommodate this. We do not need to see that an Exchange or

SQL server has used 98% of its physical memory. We also need to take into account that if an exchange

server today falls below 4GB of space we will begin to experience “backpressure”, which will slow or

stop mail traffic altogether. We will need to adjust the Disk monitoring on these devices.

Templates have already been added to your system to enable these changes however if you have

upgraded, they are likely waiting for you to apply them. If you have installed a fresh new N-central

server that is version 9.2 or later, they are likely already in effect. To make the necessary adjustments

on older servers that have recently upgraded, follow these steps:


14

1. Switch to the Service Organization level (orange by default) of N-central and navigate to

Configuration > Monitoring > Rules.

2. Find the “Exchange 2007” Rule and open it.

a. Tip: Be sure not to accidentally choose the CAS or Transport Rules.

3. Navigate to the “Monitoring Options” tab in this Rule.

4. Under “Service Templates” we will find “Exchange 2007 – Memory/Disk Modification” and

move it over with a click of the single-arrow button so that it appears under “Selected Service

Templates as seen below:

5. SAVE the changes to implement this template system wide.

6. Repeat these steps for the “Exchange 2010” Rule. We will be adding the “Exchange 2010 –

Memory/Disk Modification” template in this case:


15

7. Save and Re-Apply your SQL 2000, SQL 2005 and SQL 2008 Service Templates as these contain

the Memory adjustments.

If you have previously deleted the SQL_Total or and SQL Related services they will re-appear on their respective

devices. We will resolve them at a later stage.

Step 4 – Remove “Connectivity” from Workstations and Laptops

The Connectivity service is a ping test from the local probe or central server to the device to identify if

the device is still attached to the network and responding. Because laptops and workstations tend to

turn on and off during the day, this service will constantly be in a failed state if applied to these devices.

It follows then that Connectivity should never be applied to a workstation or laptop.

In some cases however, Connectivity will have been accidentally applied to your systems. We need two

service templates targeting both laptops and workstations that remove connectivity and a Rule that

applies this change out to all laptops and workstations.

1. At the Service Organization level, drop down to Configuration > Monitoring > Service

Templates.

2. ADD a new template and call it “Removal – Connectivity on Laptops”.

3. Choose the appropriate device class of “Laptops – Windows”.

4. Search for the Service “Connectivity” and ADD it to the list.

5. Skip through the threshold configuration, we are removing the service so this is irrelevant.

6. Once added into the list, change the ACTION to “Remove”.

7. SAVE your template.


16

Repeat steps 1-7 to create another template for the “Workstations – Windows” class. We now have 2

Service Templates that will remove connectivity on their respective devices.

We will now create a RULE to propagate these 2 Service Templates out to your system devices:

1. Under the SO level, Configuration > Monitoring > Rules we will ADD a new Rule.

2. Name the rule “Removal – Connectivity on Laptops and Workstations”.

3. Add in the 2 filters for “Laptops – Windows” and “Workstations – Windows”.

4. Under the MONITORING tab, scroll down to the Service Templates section and add in our 2

newly created Removal templates.

5. On the Grant Customer/Site Access tab, add in all clients and check off “Propagate to new

customers”.

6. Check the PREVIEW tab on the right side of your screen. Verify all appropriate devices are

targeted.

7. SAVE to make the change system wide.

To resolve this issue permanently we need to adjust how N-central applies the Connectivity service. N-

able has already added Connectivity to the appropriate device templates, we now need to remove it

from the list of services that auto-apply on discovery; this is the root of the problem:

1. Under the Service Organization level navigate to Administration > Defaults > Discovery

Defaults.

2. Remove “Connectivity” from the list if it exists there by selecting it under “Assigned Services”

and clicking the single left facing arrow to move it under the “Available Services” column.

3. SAVE to complete the change. Note that you should not check “Propagate”.

Step 5 – Review and Re-apply Workstation and Laptop Service Templates

Typically you will not need as in-depth alerting on workstations as you might a server. When a

workstation launches an application it tends to trigger CPU and Memory warning/failures which are all


17

but ignored by technicians. Workstation class devices also commonly have a nearly full restore partition

which triggers unnecessary capacity warnings on a drive you expect to be nearly full.

We will adjust or turn off thresholds to more effectively monitor these devices for critical failures that

your team.

Turning OFF thresholds does not stop data gathering, it simply stops alerts from occurring on that particular service.

When you come to your regular reporting these devices and their services will still be included with full details.

If you are on N-central 9.1 or later your “Workstation – Windows” and “Laptop – Windows” templates

should already have been modified. You will want to confirm this by following these steps:

1. From the Service Organization level, navigate to Configuration > Monitoring > Service

Templates.

2. Find the “Workstation – Windows” template and click to open it. It should appear as the

example below:

3. Each service has been modified to conform to a standardized best practice. Explore each one in

turn and verify they are configured appropriately:

a. CPU (WMI) thresholds should typically be set to OFF. We do not want to see when a

workstation has a high CPU usage moment by moment, we want to see how busy it was

over a period of time, in a quarterly report for example. This can help us promote a PC

refresh plan for our customers but not overrun the support team with alerts:


18

b. Disk (WMI) should have the option to Use Asset Info unchecked, and the drive C:

entered as the Volume Name, as seen here:

This will ensure that for devices on-boarded in future we will only monitor drive C:

(arguably the only important drive from a service provider’s perspective; we typically

don’t want alerts on recovery partitions, USB thumb drives, etc.).

You may also elect to adjust the Thresholds as the current 2GB free space failure point

may not be adequate for your needs. Recommended settings are provided below. In

this example we will set the drive to Fail when it reaches 2GB free space, and Warn at 5

GB free (represented in kilobytes). We will also turn OFF the Disk Usage percentage as it

is too arbitrary to be effective. See below for an image of these changes:

c. Next we want Memory (WMI) adjusted to turn Physical Memory thresholds to OFF and

raise (or turn OFF) the Virtual Memory threshold as suggested below. Whether you

choose to simply turn off the Virtual memory monitoring or not is up to your

organization however it is very rare that a service team will proactively respond to high


19

memory use on a workstation and information on this item are typically not required

beyond reporting:

4. We do not typically need to make changes to Patch Status or System Warranty (if it is visible

here) however you may want to explore these thresholds as a team and make any changes you

see fit.

5. To make changes to ALL workstations system wide we will click on the Associated Devices tab,

check off all devices, and click Save & Re-apply Service Template at the bottom of your screen.

Give the system time to complete these changes before moving on. Additionally, all future

devices that you on-board into N-central will adopt these thresholds:

Adjusting templates does not make changes for existing devices. You will need to Save & Re-apply Service Template.

6. We will want to repeat this process with the “Laptop – Windows” Service Template. As this

class of devices is typically treated the same as a Workstation simply repeat the above 5 steps as

indicated and “Save and Re-Apply” the Service Template:


20

You should not need to make any changes to the LocalIP service, if it appears on this template.

Step 6 – Removing Warranty alerting from Workstations and Laptops

The N-central system by default will retrieve Warranty information and populate a device’s Asset tab

and apply a System Warranty service to the Status tab. The service does not need to be present to use

the warranty data in reporting, and typically this is where you will want Workstation and Laptop

warranty represented. It makes sense then to turn the alerting thresholds OFF on these devices to avoid

cluttering our Active Issues view and keep that data for quarterly business reviews. Server warranty

status will remain untouched as this is arguably more important and you may want to see it in Active

Issues or Dashboards.

To turn thresholds off for System Warranty on workstations and laptops, complete the following:

1. ADD a Service Template under the Service Organization level (orange by default) >

Configuration > Monitoring > Service Templates.

2. Name it “Adjust – Warranty on Workstations”

3. Choose the class of “Workstation – Windows” for this template.

4. Add the “System Warranty” service, and under the Thresholds set them to OFF.


21

5. Change the System Warranty service Action to “Modify” as we typically do not want to add it

where it was previously deleted.

6. Verify it looks as this example does and Save:

7. Repeat steps 1-6 and create a second template targeted at the device class of “Laptop –

Windows”, named “Adjust – Warranty on Laptops”.


22

8. Now we will create a Rule to put these templates into effect within all of N-central. Under the

Service Organization level (orange by default) navigate to Configuration > Monitoring > Rules.

9. ADD a new Rule with the name of “Adjust – System Warranty on Laptops and Workstations”

10. Filter by using the “Workstations and Laptops – Windows”

11. Skip down to the Monitoring tab, and add in your 2 newly created service templates to Adjust

System Warranty.

12. Under Grant Customer/Sites Access tab we will add in all customers and check off the option to

propagate to future customers.

13. Save your Rule to commit its changes to the system.

These changes will not take effect until the System Warranty services check in, which typically takes about 24 hours.

Your Active Issues view will not clear until this time has passed.


23

System Clean-Up Phase 3 – Customer level maintenance

Step 1 – Configuring asset discovery

Deployment Best Practices recommends that you create one recurring Discovery job per Customer

subnet that does not auto-import devices, but instead allows you to see what new items have appeared

over a weeks’ or months’ time. This avoids accidentally on-boarding devices such as contractor owned

workstations and cell phones etc. that are simply passing through the environment. If you have not

already done so, we need to configure this in your system:

1. From the Customer level (green by default) we will navigate to Configuration > Discovery

jobs.

2. Delete any existing discoveries you find there.

3. Create a new Discovery job named as seen here: “CompanyName – Recurring Discovery”

a. Do not include any options to Auto Import devices, see below:

b. Do include the SNMP community string on the Advanced Settings tab:

c. Do set it to be a Recurring Discovery. Pick a time during the workday, once a week.

Be sure to stagger these Discoveries across various days between Monday and

Thursday, 9 – 5pm for your various clients. The schedule should be built similarly to

the one demonstrated here:


24

Setting Recurring Discoveries during a new customer on-boarding:

1. When completing an on-boarding of a new client, review your list of devices in the All

Devices view and ensure you have all the systems you intend to monitor imported and

configured.

2. From the Service Organization level (orange by default) review the Actions > Add/Import

Devices list of devices to be imported and choose to “IGNORE” anything remaining.

3. Create a Recurring Discovery as indicated at the beginning of this phase.

Devices that are “Ignored” will re-appear if their details change. For example a VOIP phone “ignored” today in a

DHCP range may re-appear in a subsequent discovery if it’s IP, Mac address or asset details change.

Using Recurring Discoveries during a regular weekly maintenance:

1. Once a week (typically Friday or the weekend) review the Add/Import list for new additions.

a. Import the devices you want (be sure to choose to deploy an Agent to the Windows

based devices. You may also want to set their license type before importing.

b. Ignore the devices you have no intention of monitoring.

c. Delete those you are unsure about, leaving a clean list.

2. Review this list on a weekly basis. Focus on keeping this list as clear as possible.

Devices that are “Ignored” will re-appear if their details change. For example a VOIP phone “ignored” today in a

DHCP range may re-appear in a subsequent discovery if it’s IP, Mac address or asset details change.

Step 2 – Populating credentials for all Customers

The credentials on the Properties tab of every workstation, laptop and server device is key to ensuring

scripting, file transfers and third party software pushes functions correctly from N-central. Typically, we

will add these credentials during a Best Practice deployment as directed by that guide; however if this


25

step was missed you will see many devices without any kind of information for User Name or Password

as seen below:

To resolve this across your customers, follow these steps:

1. At the Customer level (green by default) navigate to Administration > Defaults > Appliance

Settings.

2. Navigate to the “Credentials” tab and populate a username and password.

3. Check off the option to “Propagate”.

4. Save to complete the operation and put those credentials on every device.

Best Practices Tip: It is recommended that the credentials you use for every customer be a custom made domain administrator account with a password that does not expire. If the password should ever be reset you will need to log into the customer’s server and reset it in the Windows Software Probe service itself.


26

System Clean-Up Phase 4 – Leveraging the All Devices view for Maintenance

The N-central All Devices view, through the use of Filters, can be leveraged to identify common issues or

find devices that may have slipped through the change management process. It is recommended you

perform these tasks as part of a weekly maintenance schedule for N-central.

Step 1 – Devices who’s Agents have not checked in for over 30 days

It is not uncommon to find an N-central server cluttered with old devices that have long since been

decommissioned, disappeared into loner-pools, or simply lost. A Filter has been created for you in a

recent release of N-central to help identify these devices so that you can clean them up:

1. At the Service Organization level switch to the All Devices view.

2. Click the FILTER button and select “Agent Check in over 30 Days”:

3. A list of devices will appear, and every one either has an Agent that has not checked in with

N-central in over a month, OR a Windows device that has no agent at all (indicated by a -- in

the Agent Version column as seen below):

4. Address the Workstations and Laptops however you see fit:

a. Try to re-deploy the Agent to them by opening the device (click the device Name)

and selecting the Properties tab. Uncheck Local Agent. Save. Re-check Local Agent

and select the local probe (do not use “Best Available” unless necessary). Save. You

should now see a line of text indicating an agent is being installed:


27

b. If the agents still refuse to deploy to a device, you might consider simply deleting

them from N-central. They have not reported back to N-central in over a month,

chances are they are not coming online because they have been decommissioned.

It may be wise to save some time and delete the devices and let your previously

configured recurring discoveries find them again if they still exist in the customer

environment.

5. Address the Servers as you see fit:

a. These devices are typically a bit more critical. We will want to confirm that the

server has been taken intentionally offline or that the monitoring Agent has been

removed on purpose.

b. In the case of a server, it is unlikely we will be satisfied with simply deleting it and

waiting to see if it comes back. Address the issue directly with the client or your

technical team. If it has indeed been decommissioned, you may want to consider

deleting it.

The first time you use this filter you will *likely* have many devices to deal with. Subsequent uses however should be

considerably less cluttered assuming you are able to keep up the suggested weekly routine.

Typically the best defense against a large list of defunct devices is to have a strong change management plan in your

environment. Think as a team on how changes in the field to hardware can be reliably reflected back in N-central.

Step 2 – Devices classified as “Other”

During the discovery process our local Probe will identify anything with an IP address and classify them

based on the SNMP or WMI data it is able to retrieve. Discovery Best Practices will suggest that you do

not auto-import devices classified as “Other” and the reason for this is that we typically do not know

what they are. We do not want a monitoring system filled with unclassified devices whose only

identifier is an IP address; especially because the only service added to these devices, connectivity, will

fail every time the device goes offline or leaves the environment and your team will not know how to

respond, or if they should be responding. This is particularly difficult if you offer 24x7 support.

1. From the Service Organization level (orange by default) we will navigate to the All Devices

view.

2. Filter by “Other” using the Filter dropdown at the top of the page.

3. Review and address this list:

a. Re-classify and resolve any items in this list that should not be “Other”. This may

include switches, routers and Firewalls etc.

b. Delete any “Other” devices that may have been accidentally imported through the

discovery process or otherwise. If you don’t know what they are and are not

obligated to monitor them, remove the clutter.

During the ADD/Import phase you have the ability to view details such as MAC Address, Serial Number and ports that

may assist you in discovering what the device is. Simply click the + icon at the right of the screen to allow these details.


28

Best Practices Tip: If you do need to have an “Other” classified device, be sure to identify it appropriately on its Properties tab in the “Name:” field. Do not leave it simply as an IP address because although the address may mean something to you, it may not to your support team or future hires.

Step 3 – Devices with Failed Connectivity

During an initial cleanup you will find typically find many devices with Connectivity (a ping test from

probe to device) failed even though we have resolved the Connectivity issues on Workstations and

Laptops in Phase 2, Step 4 and we have resolved the Probe issues in Phase 1, Step 2. These devices are

commonly Network related such as routers and switches, ESX Hosts or Servers. Typically the reason for

these remaining Connectivity failures is that the device has been decommissioned or otherwise

removed from the environment. We will run a filter to identify these devices and address the various

issues that might cause a Connectivity failure.

1. Create a new Filter to identify devices with a failed Connectivity service:

a. From the Service Organization level (orange by default) we will navigate to

Configuration > Filters.

b. Click the ADD button at the top of the screen and begin the process of creating a new

filter.

c. Name the filter “Devices with Failed Connectivity”

d. Add a description that explains the filter will find devices where the Connectivity service

has failed.

e. Create a filter as seen below using “Monitoring” “N-central service in status” of

“Failed”:

f. SAVE your Filter.

Remember that in order for others to see and use your Filter you will need to use the “Show In Other Users Drop-Down”

button at the top of the Filters section. Select your new filter by moving it to the right-hand side box and save.


29

2. Use our Filter to find devices in the system where Connectivity has failed:

a. From the Service Organization level (orange by default) we will navigate to the All

Devices view.

b. Under the Filter dropdown, find and select the newly created “Devices with Failed

Connectivity”.

3. Resolve the issue of failed Connectivity. This issue can be caused by several things and should

never be left unresolved:

a. Problem 1 – A probe was deleted unexpectedly and the Connectivity service defaulted

to the closest available monitoring device, the N-central server, which of course cannot

reach the device sitting inside of a client’s network:

To resolve this, we will need to ensure there is an active probe in this environment (see

the section earlier on probes) and then edit the Connectivity service’s Details to modify

it from using the Central Server to the local N-central probe instead:

To avoid this issue in future, remember to “Transfer Tasks” of one probe to a new one

before deleting them from N-central. This can be done at the Customer level under

Administration > Probes.

b. Problem 2 – The device has gone offline or become otherwise unreachable. Check on

the Properties tab of the device to ensure under the Network Address section we are

communicating with the appropriate IP or FQDN.


30

You may also want to check the network routing in your environment. Is ping somehow

restricted? Are you pinging from the correct probe? Check the Probe/Agent column on

the Status tab to ensure this is the case and edit the Connectivity service’s Details if

needed. Try to ping the device from the server the probe resides on to test your

routing. Ensure DNS scavenging is engaged in the environment as directed in the

Deployment Best Practices guide.

c. Problem 3 - Is “Time to Live” turned on in an IPv6 environment? N-central’s service is

not IPv6 compliant and Time to Live will fail. It has been turned off in your system by

default but this change may not have taken hold on existing devices. Under the

thresholds tab we will want to disable Time to Live:


31

System Clean-Up Phase 5 – Resolving remaining Active Issues

In some cases monitoring services may be applied to devices on which you do not intend to use them,

for example Exchange monitoring on an SBS server that is not being used as an Exchange mail server.

This can cause unwanted failure or warning Alerts and notifications and it is important to clean up these

services to avoid cluttering your Active Issues view.

Return to the Service Organizational (orange by default) level in N-central and navigate to the Active

Issues view. Click on the Show Filter tab at the right hand side of your screen and ensure we have

selected only Failed and Warning and Misconfigured as Status options, and deselected Patch Status,

Printer Toner and Printer Status. Close the filter by clicking the Hide Filter tab. Review the Active issues

that are left by clicking the column heading for “Service” to arrange things alphabetically.

We will want to evaluate this list and resolve any issues that are not “real” critical problems either by

adjusting thresholds to better align monitoring with our needs or by disabling the services. We will also

want to resolve any Misconfigured services.

Generic SQL Server – 1433 (Failed) and

SQL Server _ Total (Misconfigured)

This service, along with SQL Server -_Total, tends to be applied to devices that appear to have a full SQL

package on them, but in fact only have an Express version installed. This is common on a system

running Backup Exec or Quickbooks. The 1433 service is monitoring the availability of the port that SQL

commonly uses to communicate on, and the _Total service is verifying the health your database (this is

only available on full blown SQL databases). In most cases, the solution here is to simply disable both of

these services as they are not relevant.

Best Practices Tip: Remember to always Disable, not Delete, a service. If you delete a service, there is a chance it could return if you, or the N-central system, were to re-apply the associated Service Template. Multiple this chance over hundreds of deleted services and there is always a risk you could have a significant amount of work to do someday if an upgrade should trigger a re-evaluation of templates.

Guest Status VMware – SERVERNAME (Failed)

There is currently an issue with some older versions of ESX Guests reporting a high volume of Guest

Dropped Packets Received and Transmitted (under Network Consumption):


32

If you find your Active Issues cluttered by this, you may choose to turn off the thresholds that are the

cause temporarily.

1. Under the Service Organization level (orange by default) we will navigate to Configuration >

Monitoring > Service Templates. 2. Find the Servers – ESXi template and click into it. 3. Click the Guest Status (VMware) service and then select the Thresholds tab. 4. Find the two options for Dropped Packets and set these thresholds to OFF. 5. Save. 6. Under the Associated Devices tab, select all of the devices and Save and Re-apply the

Service Template to commit your changes to all ESX hosts.

Disk I/O (Failed or Warning)

The Disk I/O service was created to monitor read/write activity on your physical disks. There are many

data points gathered by this service, but ideally you will want to confine your alerting to Idle Time and

explore the service should it fail to see what specifically is causing a low idle. Idle Time reflects the

amount of time your drive is “available” to write or read new data. If this threshold drops to 0 then the

drive is fully utilized and if it remains at 0 for a prolonged period of time likely indicates something on

the system is stalled during a read/write process.

In some cases (upgrades) the Disk I/O service was added with all thresholds set to Default (on), in other

cases, Current Queue Length may have been left on which is commonly what causes the service to fail.

You will want to decide if there is value in seeing a high current queue length for your business.

To adjust the DISK I/O service we will take a two-part approach:


33

Part 1: Adjust the thresholds in the Server – Windows template where it is commonly applied from.

This will resolve the problem for all future devices that come onboard:

1. From the Service Organization level (orange by default) navigate to Configuration > Service

Templates and find the Server – Windows template.

2. Edit the Disk I/O service. It is recommended you set all thresholds to OFF with the

exception of Idle Time which we will set to Default.

Part 2: Adjust Disk I/O across all servers using a new Service Template and a Rule to ensure everything is

in sync with your monitoring intentions.

3. From the Service Organization level (orange by default) navigate to Configuration > Service

Templates.

a. Click “ADD” to create a new template.

b. Create a template named “Adjust – Disk IO”, targeted at the device class of “Servers

– Windows” and add the DISK I/O service.

c. Set the service’s action to “Modify” as seen below:

Be sure not to choose anything other than “Modify”. This setting will adjust any Disk I/O services it finds,

but it will not add a new one. This is the behavior you will want.

d. SAVE the template.

4. Navigate to the Service Organization level and under Configuration > Monitoring > Rules.

a. Click “ADD” to create a new Rule.

b. Give the Rule a name such as “Adjust – Disk IO for Servers”

c. For a Filter, we will select both the “Server – Windows” and “SBS Servers” filters to

cover the entire range of Windows based servers in the system.


34

d. Under the Monitoring Options tab we will add our recently created service

template “Adjust – DISK IO”.

e. Under the “Grant Customer/Sites Access” tab we will add all customers and check

off the option to Propagate.

f. Save your Rule to associate the template to all devices and it will update Disk I/O

system wide.

g. Once complete (5-10 minutes), you can in fact delete this Rule. It will no longer be

necessary.

HTTP/HTTPS (Failed)

These services are added by several templates to check for the following:

- Port accessibility (80 or 443)

- Query response (Did N-central receive, for example, a 402 response indicating things are good?)

- Login (you can provide a username and password in Service Details)

- Certificate validity for HTTPS

It may be that one of these things is out of alignment, or it may be that the port is simply closed. If you

do not need to monitor this on the device, simply Disable the service.

Windows Services (Failed)

In some cases services are expected for certain applications such as POP for Exchange servers. N-central

has attempted to monitor these for you, but finds them shut off (not many Customers use POP

anymore, however it is an expected service in Exchange, for example.)

If you do not need to monitor a given Windows service, simply Disable it on the Status tab of the device.

Exchange 2003 (Misconfigured)

The Exchange 2003 service, unlike other Exchange services, is unable to determine where your

information stores are located. You will need to tell this service where to look if the exchange stores are

not in the default location c:\Program Files\Exchsrvr\MDBDATA\pub1.edf. To adjust, do the following:

1. Click the Exchange 2003 service and navigate to the Service Details tab.

2. Edit the location of your exchange public and private stores.


35

3. SAVE to commit your changes.

4. On the Status tab of the Exchange device, select the Exchange 2003 service with a

checkmark and under More Options you will Disable and then repeat the process and

Enable the service.

5. Within a few minutes the service should come up with appropriate monitoring.

Basic workflow for troubleshooting unnecessary Active Issues (All other types)

If you have identified a service in the Active issues view that is not properly reflecting the state of an

Application or Hardware and needs adjustment or removal we will follow a standard troubleshooting

workflow:

1. Click into the device itself (not the service) from the Active Issues view

2. Now click into the service that is having an issue.

a. If the service is Misconfigured, we will typically see a reason listed.

1. SNMP issues are typically caused when it is not properly enabled, either on

the hardware itself or in the N-central UI, during our initial discovery.

Confirm that SNMP is checked off on the Properties tab of the professionally

licensed device. You will also want to confirm that the proper community

string is populated there. On the hardware itself, ensure SNMP is enabled

in all the various locations necessary (Sonicwall for example must have it

enabled in both Administration and the LAN interface under Networking).

To complete this solution, you will need to re-discover this particular device

with a valid community string and re-apply the Service Templates in the N-

central UI.

2. Service Details may not be correct as we see in the case of the Exchange

2003 service. Have a look on the service details tab and inspect any

dropdown or box containing service specific details. Of the various

possibilities, some potential questions will be: Is the right service listed to be

monitored? Is the drive location that is populated correct?; Are we looking

for the proper RAID card (or other device such as a fan) if more than one

was detected; does a backup job name need to be populated, etc.

3. Is an aspect of the monitored service missing? In the case of Dell RAID

cards for example we will run into onboard RAID with no battery. The

misconfigured message will complain that there is no state for the battery

and as this is required for the service, it may fail. For On-premises

customers there is a Custom Service that will allow you to monitor Raid

cards from Dell without batteries.

4. Is this service simply not valid on this hardware? As we have seen in the

case of SQL Server _ Total, in some cases services get added by default but

there is nothing on the device of that nature to monitor. We should simply

disable these services to clean up the clutter.


36

b. If the service is Failed, we can explore:

1. Is the service relying on something that isn’t reachable? For example most

services are monitored from the Local Agent or Probe. Central Server

should only be monitoring services that talk directly to N-central, such as

Agent Status. The Connectivity service will fail (for example) if you are trying

to perform a ping from your N-central server, or if DNS does not allow the

local probe to route to itself and perform the test on its own IP. Does

something in this regard need adjusting under Service Details, or do DNS

changes need to happen in that environment to allow the routing?

2. Is the service relying on something that isn’t working? Ensure that if a

service is using the local Probe that the probe is up and functional. This can

be confirmed under Administration > Probes. If it is relying on an Agent, is

the agent installed and functional? If it is relying on a path or file being

present, does this item exist?

3. Is the threshold too aggressive? Perhaps the service is failed because we

have asked it to switch to failure too aggressively. Explore the possibility of

adjusting the template that governs this service to change the thresholds

and ensure you are alerted only when a valid failure to your standards

occurs.


37

System Clean-Up Phase 6 – Configuring Notifications

Your current notifications (visible under the Service Organization level > Configuration > Monitoring >

Notifications) may either not be configured appropriately or may simply be too noisy in their current

configuration. It is important to assess what you are receiving when things Fail or Warn and generate a

Notification. Based on this assessment, you may want to adjust the current Notifications or simply

remove them and start fresh. Your Notifications will generally be in one of three states:

State 1 - Legacy format using “0 Minute Delay” type titles

You may have this form of Notification if you are on an older version of N-central (9.1 or earlier) or if a

recent N-central upgrade decided to leave your existing Notifications in place because they had been in

some way modified in the past. Issues you will see with this setup are:

Chances are you are receiving a multitude of alerts for Windows Event Logs from the 0

Minute Delay > Server Applications > Windows Event Logs trigger.

Alerting for both applications and hardware are hidden under very few notifications making

it hard to identify exactly what needs to be adjusted. A single Notification could contain

Exchange, SQL, physical drive status and Raid status all under one heading.

You are not on the most current Notification scheme making it harder for support and your

Sales Engineer to assist you. The new scheme is also quite a bit more intuitive to use.

Solution A: You may want to reconfigure your Notifications to get them in line with the most current

solution. Appendix D (9.1+ Notification Structure) will guide you through creating your new

Notifications, or alternatively you can create an N-central Hosted Trial from http://n-able.com/trials and

copy what you see under the Service Organization level > Configuration > Monitoring > Notifications

section after deleting your existing Notifications.

Solution B: You may want to build new Notifications from the ground up to suit your needs. This will

require an in depth knowledge of how these are created and used. There is training available on the N-

able Resource Center (http://nrc.n-able.com) under the Training > Onboarding section however you will

ultimately want to have some time set aside to experiment.

State 2 – N-central 9.1+ format with a Notification per function

This is the ideal configuration to be in for the purposes of this document. You have the current

Notification scheme in the format shown below and it remains untouched. You will simply need to add

a contact to these Notifications to put them into effect. Ultimately, as you become more familiar with

Notifications you may choose to adjust these to meet your service requirements, but this configuration

will start your organization on the right foot.

http://n-able.com/trials

http://nrc.n-able.com/


38

Windows Event Logs are not dealt with in the current Notification scheme. To enable them, and set them up

appropriately, it is recommended you review this linked video: http://www.youtube.com/watch?v=2jwiA0-oU1o

State 3 - Mixed or user configured

In some cases you may see elements of the 9.1+ Notifications along with the older legacy format.

Alternatively, you may have worked on configuring custom Notifications in the past and have remnants

of those lingering in the system. If you are comfortable with your user configured Notifications and

choose to keep them be sure to assess carefully what emails they are generating. Make certain they

meet your needs in their current form. It could be that your Notifications are properly configured and

simply suffering from overwhelming alerts which we will have begun to resolve in the previous steps.

Windows Event Logs may be something that need to be addressed, even in your properly configured setup. It is

recommended you review this linked video for guidance: http://www.youtube.com/watch?v=2jwiA0-oU1o

http://www.youtube.com/watch?v=2jwiA0-oU1o

http://www.youtube.com/watch?v=2jwiA0-oU1o


39

System Clean-Up Phase 7 – Completion and Keeping Things Clean

By this time, your Active issues view should contain ONLY items that you deem of importance and that

you plan to react to in some way. The Notifications from your system should similarly contain only

important content and not flood your inbox with the exception of perhaps a full environment going

offline (there is no way to avoid this should it happen).

To maintain this, we encourage you and your team to review the following appendices with regards to

implementing a regular routine of weekly maintenance, as well as developing your own process around

onboarding new clients, naming conventions and basic day to day use of N-central.

Be aware that with new features and upgrades comes the possibility of new items to address. Ensure

that your team reviews these new services and functions and aligns them and their thresholds to your

goals and responsibilities as a Managed Services Provider. Ensure you are adding these new services

along with any custom services you import to Notifications so they remain visible.

If you encounter services you are unable to resolve please create a ticket on the N-able Resource Center

and the N-able team will assist you, or join our Daily Q&A session help at 4PM EST. Details are on the

NRC under Training > Live Q&A.

Feedback We would greatly appreciate any feedback you have on this document. If you feel it was of value to

your organization and made an impact on your day to day experience with N-central, or if you feel a

certain section could use some additional elaboration please write to [email protected] and share

your thoughts.

mailto:[email protected]


40

Appendix A – Reviewing leveraging Filters to focus attention on critical issues

Filters image

The following image will be referenced throughout this section:

Viewing only Failed and Warning states

It is generally standard practice during day to day operations to filter your Active Issues view by Failed

and Warning status. Selecting these two states will allow you to view only the items that are currently

requiring technical attention in your client environments. N-central 9.0 introduced a new location for

these filters. They can be found by clicking the “Show Filter” tab at the right hand side of your screen

(Filters image, item 1). A slide-out field will appear and here you are able to select that only Failed and

Warning states be visible by checking the respective boxes under Status (Filters image, item 2). Close the


41

filter slide-out by clicking the “Hide Filter” tab. You will notice your Active Issues view has dynamically

adjusted to your new settings.

Hiding non-critical failures

In some cases there are items in the Active Issues view that are legitimately “failed” however we may

prefer to see them through monthly reporting rather than in the list of critical items. Good examples of

these monitored services are maintenance items such as Patch Status (this is better seen through a

report or a dashboard), Printer Status (is the device asleep) and Printer Toner Status which often

overrun even the best kept Active Issues view. Be sure not to hide things that might be of concern to

you such as Connectivity. There are better ways to deal with clutter of that nature and those options

will be covered in this guide.

To hide unimportant items, click on the Show Filter tab (Filters image, item 1) at the right hand side of

your screen. You will see at the bottom of the window that slides into view a section called Services

(Filters image, item 3). Unselecting a service will remove it from your Active Issues view. As previously

mentioned the commonly removed services are Patch Status and System Warranty. The services will

continue to be monitored and appear in reporting; they will simply not be visible in your Active Issues

view.

Filtering for items that generate a notification only

You may choose to be even more selective in your view, especially if this view is to be

used for a NOC view on a large monitor etc. In most cases the critical events in your

system will be configured to generate a notification. Active Issues that have

generated a notification will have a small indicator icon under the Notification field.

You can selectively view only these issues by opening the Active Issues filter (Filters

image, item 1) and choosing both Unacknowledged and Acknowledged under the

Notification section (Filters image, item 4).

Resetting your filter in Active Issues The changes you make to your filter will be remembered by the system for your user account. If for any

reason you wish to return to defaults and clear your filter changes, simply click the “Show Filter” tab and

“Reset Filter”.


42

Appendix B

Recommended maintenance schedule for MSPs

Things to do Weekly (Maintenance):

1. Review your Probes under the Service Organization level > Administration > Probes. Resolve any that are not “Normal”.

2. Review ADD/IMPORT DEVICES from the SO level on a weekly basis and import/ignore/delete what devices are found there. i. Import what you need.

ii. Ignore what you can (as long as they are not on DHCP and tomorrow may be a useful and wanted device. Typically here we can ignore VOIP phone ranges etc.)

iii. Delete all remaining items when completed. 3. Use a filter to identify Agents that have not checked in over 30 days and address them. 4. Use a filter to identify devices with Connectivity failed and address them.

Things to do Daily (Reacting to and resolving issues):

1. Review Active Issues regularly and cleaning it up of Failed issues (critical items, reactive response).

2. Review Warning issues and deciding if there is action to be taken or not (non-critical items, proactive response).

3. Review Notifications in real-time and Acknowledging them in the Active Issues view and responding or not. i. If not, adjusting global thresholds to better monitor these devices.

4. Approving patches on a weekly basis from the SO level. 5. Reviewing Patch, Backup and AV status from a dashboard or report.


43

Appendix C

Best Practice for new client onboarding

1. Follow Discovery Best Practices (available in the Runbook), and do the pre-deployment steps fully including the suggested 3 group policy changes (Enable ICMP, Remote Administration and File/Print Sharing) as well as a 12 hour DNS scavenging set up.

a) An ounce of prevention saves a pound of cure later on. Even if the environment doesn’t need these changes, they won't hurt. For the environment that does, it can save hours of routing through “Other” classed devices.

2. Do deploy a probe whenever possible. It has value with regards to continued scanning of the environment for new devices, it provides the ability to push agents, and it gives the ability to monitor syslog and SNMP and will soon be needed for patching.

3. Fully complete your on-boardings. Be sure to check if you have brought in all devices you are contractually obligated to manage. Be sure that you have applied Dell/HP/Intel templates as required for servers with management software installed.

4. Ignore all extra devices from ADD/IMPORT devices (excluding DHCP ranges, we can’t ignore those, simply delete them.)

a) This will avoid you having to sort through them later as new things are discovered. 5. Set up a recurring discovery that doesn’t auto import. Review weekly as per the above

maintenance process. 6. Check all servers that were imported, be sure that items that do not need to be monitored for

Exchange, AD etc. are DISABLED (not deleted). They will typically be misconfigured or failed. 7. Ensure credentials are populated for all devices (Administration > Defaults > Agent/Probe

Defaults > Credentials) and Propagated 8. Clear Active Issues of Failed/Warning that are not relevant by adjusting thresholds or disabling

services. 9. Clear Active Issues of Misconfigured/Stale. Engage support if you are unable to resolve.


44

Appendix D

9.1+ Notification Structure

Name Profile

type Delay Recipients Repeat

Trigger

Name State

Retur

n to

Norm

al

Service Associated

Rules

Agent/Probe

Failure(5

mins)

Multiple

Device /

Single

Service

0 min Product

Administrator 0

Agent/Probe

Status Failed No

Agent Status

Probe Status

SBS - Servers

Servers -

Windows

Connectivity

Failed

Single

Device/

Single

Service

0 min Product

Administrator 0

Connectivity

Failed Failed No Connectivity

Servers - Generic

SBS Servers

Servers -

Windows

ESXi Servers

Network Devices

Server

Hardware

Single

Device/

Single

Service

6 min Product

Administrator 0

HP Servers Failed No

Fan Status

(HP)

Physical Drive

(HP)

Power Supply

(HP)

RAID Status

(HP)

Server

Temp(HP)

Servers - Generic

SBS Servers

Servers -

Windows

ESXi servers

Dell Servers Failed No

Fan Status

(Dell)

Logical Drive

(Dell OM 2.2)

Physical Drive

(Dell)

Power Supply

(Dell) (Power

Supply 1)

RAID Status

(Dell)

Server Temp

(Dell)

Servers - Generic

SBS Servers

Servers -

Windows

ESXi servers

IBM Servers Failed No

Fan Status

(IBM)

Logical Drive

(Adaptec)

Memory

Status (IBM)

Physical Drive

(Adaptec)

RAID Status

(Adaptec)

Server Temp

Servers - Generic

SBS Servers

Servers -

Windows

ESXi servers


45

(IBM)

Anti-Virus

Single

Device/

Single

Service

0 min Product

Administrator 0

AV Defender Failed No

AV Defender

Security Event

AV Defender

Status

SBS Servers

Servers -

Windows

Windows-

Workstation’s

Laptop -

Windows

Endpoint

Security Failed No

Endpoint

Security Event

Endpoint

Security

Status

SBS Servers

Servers -

Windows

Windows-

Workstation’s

Laptop -

Windows

AV Status Failed No AV Status

SBS Servers

Servers -

Windows

Windows-

Workstation’s

Laptop -

Windows

Firewall

Utilization

High for 15

minutes

Single

Device/

Single

Service

10 min Product

Administrator 0

Cisco

ASA/Pix

Firewall

Failed No

CPU (Cisco

ASA)

Cisco -

Connections

CPU (Cisco)

Switch/Router

SonicWall Failed No

Connectivity

SonicWALL

Connections

SonicWALL

CPU

SonicWALL

Memory

Switch/Router

Watch Guard Failed No

Connections -

Watchguard

CPU –

Watchguard

Switch/Router


46

Juniper Failed No

Juniper Secure

Access -

Concurrent

Users

CPU - Juniper

Secure Access

Memory -

Juniper Secure

Access

CPU Juniper

(ScreenOS)

Memory -

Juniper

(ScreenOS)

Juniper

(ScreenOS) -

Sessions

Switch/Router

Firewall

(Crtical

Activity

Detected -

Syslog)

Single

Device/

Single

Service

0 min Product

Administrator 0

Syslog

Message Failed No

FW-Juniper

FW-Cisco

FW-Fortigate

FW-

Watchguard

FW-

SonicWALL

Switch/Router

Switch/Rout

er

Performance

Single

Device/

Single

Service

10 min Product

Administrator 0

CPU/Memor

y Utilization

high for 15

mins

Failed No

CPU (Cisco)

Cisco -

Memory

Switch/Router

Port health

degraded Failed no

Interface

Health Switch/Router

Traffic

Utilization

Single

Device/

Single

Service

10 min Product

Administrator 0

Traffic

Utilization

High for 15

minutes

Failed No Traffic Switch/Router

Patch Status

Single

Device/

Single

Service

21

days

Product

Administrator 0

Patch Status

Failed for 21

days

Failed No Patch Status

SBS Servers

Servers -

Windows

Active

Directory

Single

Device/

Single

Service

6 min Product

Administrator 0

Active

Directory\D

NS service

failed for 10

mins

Failed No

Active

Directory

DNS

SBS Servers

Servers -

Windows


47

Exchange

Server

Single

Device/

Single

Service

0 min Product

Administrator 0

Exchange

services

exceeded

thresholds

Failed No

Exchange

2003

Exchange

2007/2010

Exchange

2007 Store

Size

Exchange

Database

Store Mount

Status

Exchange E-

mail

Protection

Event

Exchange E-

mail

Protection

Status

IIS

IMAP

SMTP

Exchange

2007 HUB

Message

Queue

Exchange

2007 Message

Queue

Exchange

2007/2010

Delivery

Queue

SMTP queue

Exchange 2003

Exchange 2007 -

CAS Role

Exchnage 2007 -

Hub and mailbox

Exchange 2007

Exchange 2010 -

CAS Role

Exchange 2010 -

Hub and mailbox

Exchange 2010

SQL Server

Single

Device/

Single

Service

0 min Product

Administrator 0 SQL Server Failed No

Generic SQL

Server

SQL Server

SQL 2000

SQL 2005

SQL 2008

VMware

Host

Single

Device/

Single

Service

6 min Product

Administrator 0

Host

Hardware

Utilization

High

Failed No

CPU Datastore

( Vmware)

Lisensing

Status (

Vmware)

Logical Drive (

Vmware)

Maintenance

Mode(Vmwar

e)

Memory

(Vmware)

NIC Status

(Vmware)

Power

Consumption(

Vmware)

Servers - ESXi


48

Raid Status

(Vmware)

VMware

Guest

Single

Device/

Single

Service

0 min Product

Administrator 0

Guest

Utilization

High

Failed No

Guest

Status(Vmwar

e)

Servers - ESXi

Server

Performance

CPU

Single

Device/

Single

Service

26 min Product

Administrator 0

CPU

Utilization

high for 30

mins

Failed No CPU

Servers - Generic

SBS Servers

Servers -

Windows

Server

Performance

Disk

Single

Device/

Single

Service

0 min Product

Administrator 0

Disk Nearly

Full Failed No Disk

Servers - Generic

SBS Servers

Servers -

Windows

Server

Performance

Memory

Single

Device/

Single

Service

26 min Product

Administrator 0

Memory

Utilization

high for 30

mins

Failed No Memory

Servers - Generic

SBS Servers

Servers -

Windows

Backup

Manager

Single

Device/

Single

Service

0 min Product

Administrator 0

Backup

Manager Failed No

Backup

Manager

Status

Backup

Manager

Events

Laptop -

Windows

SBS Servers

Servers -

Windows

Windows

workstations

Server

Process/Win

dows Service

Single

Device/

Single

Service

0 min Product

Administrator 0 Process Failed No Process

SBS Servers

Servers -

Windows

optimizing and maintaining your n-central environment · optimizing and maintaining your n-central...

Documents