From Ryan Groom,
Your Guide to Business Security.
FREE Newsletter. Sign Up Now!

No Change Management, No Monitoring, No Uptime

An incident at the office this week prompted me to start thinking about monitoring procedures. IT had performed some work on one of the web servers and then proceeded to plug the twisted pair cable back into the wrong port causing the site to be down all weekend with no one the wiser. This brings two thoughts to mind. First, where was the change management process to prevent arbitrary work being conducted in the first place? Secondly, why was no one alerted that the site was down? Change management we have covered in another article. For today, I want to take a look at monitoring software.

Monitoring Software

Monitoring software has been around almost as long as network cards. Many vendors have may different features. I decided it was time for our company to start using something. I had four criteria that had to be met. The product had to have minimal overhead/maximum effectiveness, be easy to configure, have no client software and not break the bank. I eventually settled on Network Server Monitor (NSM) from GFI. Let’s take a look.

Easy to Configure

Setup is simple and requires minimum intervention. Basically, choosing an install location, a database mechanism (NSM can use SQL Server or MS Access) and access to an SMTP server is all that is required. Once the product is up and running, the built in rules will allow instant configuration for servers such as Exchange, ISA, web server or a SQL Server (to name a few).

This built in cheat sheet greatly reduces the amount of time required to get some basic tests for those services. If new services are required to be managed, you simply create a new rule and specify the criteria. All of the rules are shown in a tree view which can be a little daunting if you have a lot of rules, but overall the simplicity of the rules allows administrators the ability to quickly configure what they need. Click here for screenshot.

Minimal Overhead-Maximum Efficiency

The servers we run are streamlined Web servers with very little in the way of frills installed. Whatever tool we used to monitor could not impact performance of these servers. As much as I can whine about it, the simple fact is that if you install software on a computer, you will introduce overhead. Period. In our situation, the overhead was negligible and had no negative impacts at all. The multi threaded engine of NSM allows upwards of 40 tests simultaneously.

From the efficiency standpoint, I like the fact that NSM actually attempts many of the tests instead of simply relying on the contents of the Event Viewer. For example, it actually simulates logins of terminal server users, instead of relying on being told that a user can sign in. Many of the checks NSM runs mimic administrator interaction to ensure that services that say they are up and functional, actually are. Should something go wrong, NSM can be configured to restart a service or run a specialised script based on the service or component that has failed.

When something does go wrong and trips one of your assigned thresholds, NSM can email page or send an SMS message to a configurable list of administrators.

No Client Software Installed

In our environment, it was not feasible for software to be installed on the other servers. We needed 1 centralised mechanism to push the tests out and report back. NSM allows all tests to be run from a single tool. Using AD or IP ranges, NSM can enumerate for servers on the same network segment making it easy to add new servers. At a glance you can see what has failed and what needs to be addressed without even having to bother the other servers.

Cost Effectiveness

Lastly, with only 10 servers to worry about we didn’t want a solution that would break the bank. NSM retails for about $1200 for a 50 node license or $500 for a 10 node license. All IP`s count as a node. So if you have a machine with multiple web sites and IP`s you will use more of the IP`s on a single computer.

Conclusion

Overall, NSM provides a robust, efficient and trustworthy solution. Well worth the purchase.