Usage agent

Agent Settings page. If you cannot enable an agent, check the Endpoint Agent licence usage on the Usage and Billing page and ensure the licences in your plan are not all used (see Figure 1.6). If all licences are used then free up a licence by disabling another Endpoint Agent back on the Agent Settings page (see Figure 1.1).1.6. If the agent is now checking in, revert back to where you left off on the Endpoint Agent troubleshooting flow diagram to continue troubleshooting. If the agent is still not checking in, contact the Customer Engineering Team for assistance.Step 2 of 6. Troubleshooting Endpoint Agent updates problemsIt is important Endpoint Agents deployments are updated when new releases are made available as they contain product enhancements and may also include bugs fixes. We publish Release Notes in the Customer Engineering Centre along with every release or you can subscribe to the regular Release Notes via email. The Release Notes contain a summary of all new Endpoint Agent release changes. New Endpoint Agent packages are released by the ThousandEyes Engineering team every other Tuesday. Once the new Endpoint Agent package is released it is made available to organisations randomly over the following 5 day period immediately after a release. It is possible you'll receive the Release Notes before the update is made available to your organisation. The larger the Endpoint Agent deployment the longer it takes to fully deploy as deployments within an organisation are staggered. For large organisation please expect updates to be completed over a 2-3 day period after your first agent has updated. Endpoint Agents continually check every 3-4 hours for version updates and provided the download from thousandeyes.com domain is not being blocked no user intervention should be required for agent to update themselves.Troubleshooting Endpoint Agent update steps:1.1. Check

The Gen 1 agent uses a Distributed Environment to upload data directly to a Message Collector (MC). Next, Dynamic Applications running on a Data Collector query data from the Message Collector with an API. The Data Collector (DC) then sends the data to the SL1 Database Server: The Gen 1 agent provides limited infrastructure health reporting, including Log File Monitoring, Processes, and System Vitals like Availability, CPU Usage, Memory Usage, and Disk Usage. This agent is sometimes called the "P0" agent. Gen 2 agent: This version of the agent has been deprecated. Gen 3 agent: Introduced in SL1 version 8.12.0, the Gen 3 agent uses the SL1 Extended Architecture to upload data through a load balancer to the "Streamer" service running on the SL1 Compute Node cluster. The Streamer service then forks and forwards data to other services, and eventually some services will store parsed data in the SL1Database Server: The Gen 3 agent provides full infrastructure health reporting, including system vitals (file system, network interface, and Windows service data), log monitoring, and optionally allows you to align PowerShell Dynamic Applications to your device. Also, the Dynamic Applications in the ScienceLogic: Agent PowerPack are automatically aligned with the device with the Gen 3 agent installed on it. If you are already running the Gen 1 agent in a distributed environment and you upgrade your SL1 system to use the SL1 Extended Architecture, any existing devices monitored by SL1 agents will work the same as before (streaming data to a Message Collector). However, if you upgrade to the SL1 Extended Architecture, ScienceLogic recommends that you start streaming your agents to the Compute Node cluster instead of to a Message Collector. To identify the version of the agent installed on a device: Gen 1. On the Devices > Device Investigator > Settings tab for that device, the Collection Poller field displays the name of the collector group that includes the Message Collector used by the agent. On the Device Manager page (Devices > Device Manager), the Collection Group column displays the name of the collector group that includes the Message Collector used by the agent. Gen 3. On the Devices > Device Investigator > Settings tab for that device, the Collection Poller field displays the label Agents. On the Device Manager page (Devices > Device Manager), the Collection Group column displays the label Agents. The following table provides an overview of the features available when using the Gen 1 or the Gen 3 agent: Product Capability Gen 1 Agent Gen 3 Agent System Vitals Availability and Uptime Yes Yes CPU, Memory, File Systems, and Network Interface CPU and Memory only Yes Processes and Windows Services Processes only Yes Installed Software No Yes

RequirementsAurora runs on Windows 7 or newer and requires administrative privileges.Other OS (Linux or macOS) are not supported.The AURORA Agent is a lightweight service. Memory usage of the agent is around 200 MB, which makes it very unobtrusive. The agent will use up to 50 MB of hard disk. There are no requirements pertaining to the CPU.SupportedWindows 7 x86 / x64Windows Server 2008 R2 x64Windows 8.1Windows Server 2012Windows Server 2012 R2Windows 10Windows 11Windows Server 2016Windows Server 2019Windows Server 2022Update ServersTo download the newest updates for Aurora and our signatures, you need anactive internet connection. The endpoint performing the update needs toreach our update servers to do this.For a detailed and up to date list of our update and licensingservers, please visit do not need an active internet connection to run Aurora on an endpoint.This is only needed if you want to update to the latest Aurora or signature versions.Define an Antivirus / EDR ExclusionIt is recommended to exclude Aurora from your Antivirus / EDR solution.Depending on your architecture and whether Aurora was installed or started interactivelyfrom a temporary directory, the exclusion paths are:For an installed AuroraC:\Program Files\Aurora-Agent\aurora-agent-64.exeC:\Program Files\Aurora-Agent\aurora-agent.exeFor a interactively started Aurora the path you have used for extraction. For example:C:\aurora\aurora-agent-64.exeC:\aurora\aurora-agent.exeQuick InstallationExtract the program package into a temporary folder (e.g. C:\aurora)Make sure to place the license file (*.lic) into the extracted folderStart a cmd.exe as administratorChange directory to the extracted folder (cd C:\aurora)Run one of the following commands (with/without GUI)C:\aurora>aurora-agent.exe --installC:\aurora>aurora-agent.exe --install --dashboardVerify new events in the local "Application" event log (Event Viewer) or the Aurora DashboardRun the following commands to get details on the current status of the agentC:\aurora>aurora-agent.exe --statusC:\aurora>aurora-agent.exe --status --traceSee the :ref:`usage/function-tests:Function Tests` section for ideas on how to test Aurora is working as expected.Manual installationInstall AuroraYou can install the agent using the following command line from command line terminal that has been started "As Administrator".C:\aurora>aurora-agent.exe --installAfter the installation the agent, configuration files and rules reside in C:\Program Files\Aurora Agent\.It automatically copies all rule files located in the sub-folders signatures\sigma-rules and custom-signatures.The signatures\sigma-rules folder contains the current open source rule set maintainedin the Sigma repository.The custom-signatures folder can be used to add your own sigma rules.Aurora comes with with 4 configuration presets that we encourage you to explore and use:Standard (agent-config-standard.yml)Reduced (agent-config-reduced.yml)Minimal (agent-config-minimal.yml)Intense (agent-config-intense.yml)The different presets are explained in more detail in the chapter :ref:`usage/configuration:configuration`.An installation that uses the preset named "reduced" would look like this:C:\aurora>aurora-agent.exe --install -c agent-config-reduced.ymlCustom SettingsAdding your own Sigma rules or IOCs is described in chapter :ref:`usage/custom-signatures:Custom Signatures and IOCs`.The preferred way is to add them to the custom-signatures folder before you install Aurora.All the flags that you use after --install get written to the configuration filenamed agent-config.yml in the C:\Program Files\Aurora Agent\ folder and will be used by the service.A typical command to install Aurora would look like thisC:\aurora>aurora-agent.exe --install --activate-responsesUninstall AuroraTo uninstall the agent simply run the following command:C:\Program Files\Aurora-Agent>aurora-agent.exe --uninstallIf the uninstaller fails due to unknown errors, you can uninstall Aurora manually with these commands (Run from an administrative shell)C:\Users\nextron>sc

OperationFlexNet Inventory Scanner: Operation on WindowsFlexNet Inventory Scanner: Operation on UNIX-Like PlatformsFlexNet Inventory Scanner: System RequirementsFlexNet Inventory Scanner: Accounts and PrivilegesFlexNet Inventory Scanner: ImplementationFlexNet Inventory Scanner: Implementation on WindowsConfiguring WMI for FlexNet Inventory ScannerFlexNet Inventory Scanner: Implementation on Unix-Like PlatformsConfiguring ndtrack.ini for UNIX-like PlatformsCustomizing Searches for FlexNet Inventory ScannerFlexNet Inventory Scanner Command LineFlexNet Inventory Scanner: Troubleshooting InventoryCore Deployment: DetailsCore Deployment: Normal OperationCore Deployment: System RequirementsCore Deployment: Accounts and PrivilegesCore Deployment: ImplementationCore Deployment: Troubleshooting InventoryCommon: DetailsCommon: Child Processes Invoked by the TrackerCommon: Child Processes on UNIX-Like PlatformsCommon: Child Processes on Windows PlatformsCommon: Supporting Mutual TLSCommon: Collection from Virtual EnvironmentsCommon: Gathering Inventory from Solaris ZonesCommon: Targeting for Solaris ZonesCommon: License Reconciliation Considerations for Processor-Based LicensesCommon: Acting on Inventory ResultsCommon: Resolving Inventory RecordsCommon: Ensuring Distinct InventoryCommon: Identifying Related InventoryCommon: Choosing Values from Multiple Inventory RecordsSelecting Inventory BeaconsOverviewSaving the ConfigurationPrioritizing Inventory BeaconsUsing a Single Inventory BeaconSupplied AlgorithmsMgsADSiteMatch: Match to Active Directory SiteMgsBandwidth: Bandwidth PrioritiesMgsDHCP: Retrieve location list from DHCP server optionsConfiguring the DHCP OptionMgsDomainMatch: Match to Domain NameMgsIPMatch: Match to IP AddressMgsNameMatch: Match Prefixes of Computer NamesMgsPing: Server with the Fastest ResponseMgsRandom: Random PrioritiesMgsServersFromAD: Retrieve List from ADMgsSubnetMatch: Match to SubnetCommand Linesflxconfig Command Linendschedag Command Linendtrack Command Linendupload Command LinePreferences [Registry] ExplainedAddClientCertificateAndKeyApplicationAutoPriorityCALInventoryCALInventoryPeriodCatchupCheckCertificateRevocationCheckServerCertificateCommonAppDataFolderCompress (application usage component)ComputerDomainCRLDirectoryDateTimeFormatDirectoryDisableAllAgentUploadsDisabled (application usage component)Disabled (schedule component)DisablePeriodDownloadSettingsEmbedFileContentDirectoryEmbedFileContentExtensionEmbedFileContentMaxSizeExcludeDirectoryExcludedMSIsExcludeEmbedFileContentDirectoryExcludeExtensionExcludeFileExcludeFileSystemTypeExcludeLocalScriptRuleExcludeMD5ExcludeUnixSoftwareProcessDirectoryExecutablePathGenerateMD5HardwareHardwareChangesClassPropertyBlacklistHighestPriorityHosthttp_proxyhttps_proxyIBMDB2CommandTimeoutSecondsIncludeDirectoryIncludeExecutablesIncludeExtensionIncludeFileIncludeFileSystemTypeIncludeLocalScriptRuleIncludeMachineInventoryIncludeMD5IncludeNetworkDrivesIncludeRegistryKeyIncludeUserInventoryInventoryFileInventoryScriptsDirInventorySettingsPathInventoryTypeJavaFullVersionLogFile (agent configuration component)LogFile (application usage component)LogFile (inventory component)LogFile (upload component)LogFileOld (agent configuration component)LogFileOld (application usage component)LogFileOld (upload component)LogFileSize (agent configuration component)LogFileSize (application usage component)LogFileSize (upload component)LogLevel (inventory component)LogModules (application usage component)LogModules (inventory component)LowestPriorityLowProfile (application usage component)LowProfile (inventory component)MachineIDMachineInventoryDirectoryMachineNameMachineScheduleDirectoryMachineZeroTouchDirectoryManualMapperDefaultPriorityMaxFSScanReportFileSizeInMBMaxKeepAliveLifetimeMaxKeepAliveRequestsMinInventoryIntervalMinRunTimeMSINamendsensNetTypeNetworkHighSpeedNetworkHighUsageNetworkHighUsageLowerLimitNetworkHighUsageUpperLimitNetworkLowUsageNetworkLowUsageLowerLimitNetworkLowUsageUpperLimitNetworkMaxRateNetworkMinSpeedNetworkSpeedNetworkTimeoutno_proxyOnConnectOnlyGenerateIfHardwareChangedOracleEnvironmentCmdTimeoutSecondsOracleInventoryAsSysdbaOracleInventoryUserPasswordPerformDockerInventoryScanPerformIBMDB2InventoryPerformIBMWebSphereMQScanPerformJavaScanPerformKvmInventoryPerformLocalScriptingPerformOracleEBSAuditScanPerformOracleFMWScanPerformOracleInventoryPerformOracleJavaAuditScanPerformOracleListenerScanPerformPodmanInventoryScanPerformSymantecSFScanPerformUnixSoftwareProcessScanPerformVirtualBoxInventoryPortPreferenceUpdatePeriodPreferIPVersionPrioritizeRevocationChecksPriorityPriority (manual mapper)ProcessUpdatePeriodProductUpdatePeriodProgramFiles, ProgramFilesX86Folder, ProgramFilesX64FolderProtocolRecurseRegexRunInventoryScriptsScheduleTypeScriptDirSelectorAlgorithmSendTCPKeepAlive SessionBackupPeriodShowIcon (inventory

This template assesses the status and overall performance of a Symantec Backup Exec Server. This template was created on Backup Exec version 13.0 R3, SP1. Prerequisites WMI access to the target server. Credentials Administrator on target server. Component monitors Click here for an overview about SAM application monitor templates and component monitors. SAM API Poller templates are also available. You need to set thresholds for counters according to your environment. It is recommended to monitor counters for some period of time to understand potential value ranges and then set the thresholds accordingly. All Windows event monitors should return zero. Service: Backup Exec Agent Browser This monitor returns CPU and memory usage of the Agent Browser service. This service allows the Backup Exec job engine to discover the Backup Exec agents that are available on the network. Service: Backup Exec Device and Media Service This monitor returns CPU and memory usage of the Device and Media service. This service provides several COM server interfaces for managing and accessing devices and media. Service: Backup Exec Error Recording Service This monitor returns CPU and memory usage of the Error Recording service. Service: Backup Exec Job Engine This monitor returns CPU and memory usage of the Job Engine service. This service receives job requests from the Backup Exec Server and moves data to the specified media. Service: Backup Exec Remote Agent for Windows Systems This monitor returns CPU and memory usage of the Remote Agent service. This service provides Backup and Restore services to Backup Exec. Service: Backup Exec Server This monitor returns CPU and memory usage of the Backup Exec Server service. This service implements job scheduling, server configuration, job definitions, job history, and the Backup Exec Management SDK. Engine: Aborted Jobs This monitor returns the number of jobs that were aborted since the Backup Exec Engine Service last started. The returned value should be as low as possible. By default, this monitor has the Count statistic as difference box checked, so it will return value between polling cycles. Engine: Backup Job Count This monitor returns the number of backup jobs that were