Deploying a monitoring agent on devices

Endpoint Manager provides an immediate summary of a device's health when the Real-time inventory and monitoring agent is installed on the device. The monitoring agent is one of the agent components that can be installed on managed devices.

The Real-time inventory and monitoring agent checks the device's hardware and configuration on a regular, periodic basis and reflects any changes in the device's health status. The device's status is shown in three places:

  • The status icon in the Devices lists in the network view
  • Health status shown in the Health Dashboard (click Tools > Reporting/Monitoring > Health Dashboard)
  • Data shown in the Real-time Inventory and Monitoring dashboard for the device (right-click the device in the network view and select Real-time inventory and monitoring)

For example, a monitored device with a disk drive that is filling up can display a warning status icon when the disk is 90% full, changing to a critical status icon when the disk is 95% full. You may also receive alerts for the same disk drive status if the device has an alert ruleset that includes performance monitoring rules for a drive space alert.

Create performance monitoring rules

You can choose what performance items are monitored on a device by defining monitoring rules that specify what the monitoring agent checks on the device. To do this you need to deploy a ruleset to the device that includes a Performance monitoring alert rule.

There are a large number of performance counters that can be monitored. When you create a performance monitor rule you can turn any of these items on or off, specify how frequently to check them, and, for some items, set performance thresholds. You can also select services running on the devices that you want to monitor.

The overall process for creating performance monitoring rules is as follows:

  1. Include Performance monitoring as a rule in the alert ruleset for the device.
  2. Deploy the alert ruleset to the device. (You can target multiple devices to deploy the ruleset to multiple devices, but then need to define performance monitoring on individual devices.)
  3. Create performance monitoring rules on the device using the Real-time inventory and monitoring console. Some events such as services also require that you select each service you want monitored (see detailed steps below).
To select a performance counter to monitor
  1. Click Tools > Reporting/Monitoring > Health dashboard.
  2. In list of devices, double-click the device you want to configure.
    The Real-time inventory and monitoring console opens in another browser window.
  3. In the left navigation pane, click Monitoring.
  4. Click the Performance counter settings tab.
  5. From the Objects column, select the object you want to monitor.
  6. From the Instances column, select the instance of the object you want to monitor, if applicable.
  7. From the Counters column, select the specific counter you want to monitor.
  8. If the counter you want doesn't appear in the list, click Reload counters to refresh the list with any new objects, instances, or counters.
  9. Specify the polling frequency (every n seconds) and the number of days to keep the counter history.
  10. In the Alert after counter is out of range box, specify the number of times the counter will be allowed to cross the thresholds before an alert is generated.
  11. Specify upper and/or lower thresholds.
  12. Click Apply.
Notes
  • Performance log files can quickly grow in size; polling a single counter at a two-second interval adds 2.5 MB of information to the performance log daily.
  • A warning alert is generated when a performance counter drops below a lower threshold. When a performance counter exceeds an upper threshold on a Windows device, a critical alert is generated.
  • When you set thresholds, remember that alerts will be generated regardless of whether an upper or lower threshold is crossed. In the case of something like disk space, you may want to be alerted only if the device is running low. In this case, you would want to set the upper threshold to a high enough number that you would not be alerted if a lot of disk space became available on the device.
  • Changing the Alert after counter is out of range number lets you focus on an issue when it is a persistent problem or when it is an isolated event. For example, if you are monitoring the bytes sent from a Web server, you will receive alerts when the bytes/sec consistently runs high. Or, you can specify a low number such as 1 or 2 to receive an alert whenever your anonymous FTP connections exceed a certain number of users.
  • When you edit services in a monitoring rule, the Available services list displays known services from the inventory database. No services are displayed in the Available services list box until an agent has been deployed to one or more devices and an inventory scan is returned to the core.

Generate an XML file for a ruleset

As part of the deployment process, an XML page is created that lists the deployed ruleset and devices the ruleset was deployed to. This report is saved on the core server in the Ldlogon directory, and is named with a sequential number assigned by the database.

If you want to view this XML page separately from deploying a ruleset, click the Generate XML button and then click the link to view the XML file. Generating a ruleset as XML also allows it to be displayed in the list of available rulesets in the Agent configuration settings.

View performance monitoring data

The Monitoring page lets you monitor the performance of various system objects. You can monitor specific hardware components, such as drives, processors, and memory, or you can monitor OS components, such as processes or bytes per second transferred by the system's Web server. The Monitoring page includes a graph that displays real-time or historical data for counters. 

In order to monitor a performance counter you must first select the counter, which adds it to the list of monitored counters. When you do this you also specify the frequency for polling the item and set performance thresholds and the number of violations that are allowed before an alert is generated.

To view monitored performance counters
  1. Click Tools > Reporting/Monitoring > Health dashboard.
  2. In the list of devices, double-click the device you want to configure.
    The Real-time inventory and monitoring console opens in another browser window.
  3. In the toolbox, click Monitoring.
  4. Click the Active performance counters tab, if necessary.
  5. In the Counters drop-down list, select the counter you for which want to see a performance graph.
  6. Select View real-time data to display a graph of real-time performance.
  7. To display a graph showing performance over a period of time, select View historical data (Keep history) when you select the counter.

Notes

On the performance graph, the horizontal axis represents time that has passed. The vertical axis represents the units you are measuring, such as bytes per second (when monitoring file transfers, for example), percentage (when monitoring percentage of the CPU that is in use), or bytes available (when monitoring hard drive space). The line height is not a fixed unit. The height of the line changes relative to the extremes in the data; for one counter the vertical axis might represent 1 to 100 and for another it might represent 1 to 500,000. When the data varies across a wide extreme, minimal changes can appear as a flat line.

Monitored counters are listed with columns for how often they are checked, the number of times the counter is out of range for an alert to be sent, and the upper and lower threshold settings.

Selecting another counter refreshes the graph and resets the units of measurement.

If you receive an alert generated by a counter in the list, right-click the counter and click Acknowledge to clear the alert.

Stop monitoring a performance counter

  1. Click Tools > Reporting/Monitoring > Health dashboard.
  2. In the list of devices, double-click the device you want to configure. The Real-time inventory and monitoring console opens in another browser window.
  3. In the toolbox, click Monitoring.
  4. Click the Active performance counters tab, if necessary.
  5. Under Monitored performance counters, right-click the counter and click Delete.