Monitor and Alert When Servers Go Offline

Products

• Server Management Suite
• IT Management Suite

Issue/Introduction

Monitor solution can be used to alert and send emails when servers go offline/crash/shut down. This is done by creating an Agentless Monitor Policy that uses the ICMP Availability Status metric, which causes a Remote Monitor Server (RMS) to ping other servers on a constant interval and alert when a server becomes unresponsive. Keep in mind this can result in false positives when servers become too busy to respond to pings.

Environment

Altiris - ITMS 8.x

Resolution

Create an Agentless Monitor Policy

1. Go to Manage>Policies then go to Monitoring and Alerting>Monitor>Monitor Policies
2. Right click on a folder and select New>Monitor Policy (Agentless)
3. Rename the policy "Ping Servers" or something appropriate

Add a Metric Rule

1. Click the blue + (Add) button under the Rules tab
2. In the Select Rule window search for ICMP Availability Status (True/False)
3. Select the ICMP Availability Status (True/False) metric and click the pencil (Edit) button
4. In the Edit Metric Rule window select the If ICMP Availability Status line and click the pencil (Edit) button
5. In the Edit Metric Evaluation window click on ICMP Availability Status
6. In the Select Metric window select ICMP Availability Status and then click the pencil (Edit) button
7. In the next window click Yes
8. In the Edit Ping Metric window note that the polling interval is set to 300 seconds (5 minutes); note that this setting will not ping servers frequently enough to alert if they are rebooted. If it is desired to alert when servers are rebooted, reduce this interval to about 20 seconds, but keep in mind that this will cause much more traffic and work for the Remote Monitor Server (RMS).
9. Click OK to close the Edit Ping Metric window
10. Click OK to close the Select Metric window
11. Click OK to close the Edit Metric Evaluation window
12. In the Edit Metric Rule window the repeat count can be increased to reduce the occurrence of false positives, but this will also make detecting reboots less likely.
13. Click OK to close the Edit Metric Rule window
14. Click OK to close the Select Rule window
15. Click Save changes to save progress on the policy

Target the Policy

1. Under Monitored Targets click Apply to>Resources (NOTE: the resources must have IP Address data or the RMS server will not know how to ping them, thus the resources should be imported through Network Discovery if they are not managed computers)
2. Click Add rule
3. Set the rule to exclude resources not in
4. To target a filter start typing the name of the filter in the empty box, then select the filter
5. To target a computer list change Filter to Resource List, then click the … button. In the Select Resources window search for the desired computers in the left box and then move them to the right box, then click OK.
6. Click Update results to verify the desired computers are targeted, then click OK
7. Click Save changes to save progress on the policy

Add an Email Action (Optional)

1. Open the Actions tab
2. Go to the Major tab
3. Click the blue + (Add) button
4. Browse to System Jobs and Tasks>Monitoring and Alerting>Monitor>Tasks>Send Email (or a custom task), then click OK
5. In the Task Configuration window click Edit task
6. In the Send Email window enter the desired To: email address
7. Click Save changes then close the Send Email window
8. Click OK to close the Task Configuration window
9. If it is desired to get emails both when a server goes down AND when it comes back online, go to the Normal tab and follow the same procedure to add an email task action
10. Click Save changes to save the policy
11. The policy can be tested by shutting down a targeted server or by blocking ICMP via firewall on a targeted server. Please note that it may take up to an hour for the policy to become active on the RMS unless configuration is updated manually on the RMS agent.