Ipswitch WhatsUp Gold User Guide - Ipswitch Documentation Server

Ipswitch WhatsUp Gold User Guide
Troubleshooting
Having problems with your WMI monitor returning false negatives?
xxi) How to use WMI Monitors
This topic describes the overall process for configuring a WMI monitor, assigning it to a
device, and getting feedback from the monitor.
1 Determine which WMI object you want to monitor.
2 Decide whether to create a single monitor with multiple WMI objects, several monitors
with one object, or some combination.
To start, it may be simpler to create one monitor for each WMI object that you want to
monitor. Whether you set up one monitor or many has a bearing on how the information
is reported in WhatsUp Gold logs and by actions. For example, a single monitor to check
errors on logon, named LogonErrors, is reported in logs with this name. If LogonErrors is
reported down, you know it's a specific problem.
3 Configure a WMI Monitor with your objects.
4 Add the WMI Monitor to the device that represents your application host or server.
5 Set up an action to inform you when the monitor goes down or comes back up.
Note: The monitor is reported down if any of the objects that you select to monitor are
down.
xxii) Example: WMI Monitor
Imagine that a device on your network has been illegally logged into through a brute force
attack (an attack where an intruder runs a script to try random usernames and passwords on
a range of IP addresses on your network). These types of attacks are extremely dangerous if
the device in peril is on your domain or is storing sensitive information.
You can use a custom WMI Active Monitor to check the appropriate performance counters on
a Windows device and notify you when this type of attack occurs, so you can do something
about it before a potential intruder gains access to your network.
To configure this type of active monitor:
1 Using the WhatsUp Gold web interface, create the WMI monitor.
a) Click the Admin tab, then click Monitor Library. The Active Monitor Library appears.
b) Click the Active tab inside the dialog.
c) Click New. The Select Active Monitor Type dialog appears.
d) Select WMI Monitor and click OK. The Add WMI Monitor dialog appears.
e) In the Name box, enter "ErrorsLogon" to identify that this monitor checks for logon
errors.
f) Click the Browse (…) button next to Instance to access the Performance Counters
dialog.
223