Copyright: Sentinel v1.0 Beta 1.0


Sentinel Overview
Overview

Sentinel was created for the purpose of monitoring the status of Windows NT services, eventlogs, performance counters, and other types of data for many servers at once, to generate archives of the gathered data, and to make the gathered data available to other applications in real time.

Sentinel has two core concepts:

•	Server Groups

•	Modules

A Module is loaded into a Group. The same module may be loaded into many different groups, and each group may load many different modules. This allows the user to create a new module, then distribute it to other users. The other users may have different groups, but the module will still gather the data for which it was originally configured.

All modules loaded into a group contain the same list of servers. It is therefore easy to monitor different kinds of data on, for example, a set of laboratory servers.

Let’s look at an example of this:

This screen shows two modules, Objects.pfm (a Performance module) and Generic.svc (a Service module) loaded into the server group My Lab, and one module loaded into My Office -- the same Objects.pfm module as we loaded into My Lab. We can see immediately that the Parport service is running on all servers in My Lab, and that there are 252 Event objects being used on the server MT02. MT05 is not connected, probably due to permissions or network problems.

Configuration, Step-by-Step


Server Group

A Server Group contains the list of Windows NT or Windows 95 computers (“servers”) which are accessible to Sentinel via a network. Each server name specified in Sentinel must match the network name configured in Control Panel->Network on that server.


Module

A Module gathers data; each module type gathers a different kind of data. There are two and a half kinds of modules in the cuirrent version of Sentinel:

•	Service	obtains (and allows control of) Windows NT services

•	Performance	obtains values of Windows NT performance counters

•	Eventlog (half done)	will allow monitoring of Windows NT eventlogs for certain conditions, and allows quick viewing of remote eventlog entries


Step-by-Step Configuration

OK - let’s go over a quick demo of configuring a Sentinel service module.

1.	run Sentinel. You should see the following:

2.	right-click in the Browser pane, Group->New

3.	enter a name for the server group you will create (e.g. “My Office”), OK

4.	right-click the name of the group you just entered, New Server

5.	enter a servername, OK

6.	repeat 4,5 for a couple of servers in your office (or lab or whatever)

7.	right-click the group, New Module

8.	choose Service Module from the list, OK

You should now have something resembling this:

We haven’t added any services yet, but we’ve got everything ready to go!

Add some Services


Add Services to the Module

To add the services to be monitored to a service module, do this:

1.	Edit->Add Service

2.	you may enter a server on which to browse for services, or you may type in a service name directly

3.	enter a display name for the service; this will be displayed in the grid in Sentinel. This name is for your convenience only; you can call it anything you like.

4.	hit OK

5.	repeat as necessary to list all services you wish to monitor

Here’s an example. We wish to monitor the Exchange Server service “Microsoft Exchange Message Transfer Agent (MSExchangeMTA)”, and we wish to call it “MTA” for succinctness.

This is how the configuration page might appear:

...and this is how our example Sentinel module might look:

You can right-click on column headers (e.g. MTA), row headers (e.g. MT06), or individual cells to update status or to control the indicated service(s). You can save this module for future use by selecting File->Module->Save [As]. When you’d like to load it into a group, use File->Module->Open.


Scheduling

Scheduling in the current Beta version of Sentinel is via module type only. Go to the Workspace->Scheduling menu item to edit schedules. There are two schedules, one for all performance modules and one for all service modules. To edit the schedule, select the schedule to be edited, and hit “Edit”. When configuration is done, hit OK.

Future versions of Sentinel will allow any number of user-defined schedules to be attached to any module, group, server, or field (e.g. service, perfcounter, eventlog filter). Future versions will also allow you to save your schedule information, which – irritatingly – you can’t do yet. We’ll be workin’ on it!


Data Output Mechanisms

Sentinel has mechanisms built in to distribute the data it has collected from remote machines. This version supports two kinds:

•	Database (DAO)

•	WinSock


Database Output

To enable database output, you must first have DAO installed on the Sentinel machine. DAO is available in Microsoft Office and in other applications, and should also be available at Microsoft’s World Wide Web page (http://www.microsoft.com).

1. 	Select Workspace->Data Output->Database

2. 	Enable output

3. 	Browse or type in a valid Microsoft Access database name

4. 	if desired for performance gain, enable database transactioning and set a transaction size. Experimentation would seem to indicate that a transaction size of 100 works well.

5. 	OK

The database can be manipulated from within Microsoft Access. Database format details will be published during the next update of Sentinel.


WinSock Output

Sentinel supports WinSock output of all collected data through a WinSock server mechanism. Sentinel clients are easy to develop, and working clients and starter code will be provided during Sentinel’s next release.

Some clients already developed:

•	translate all Sentinel-gathered data to Web pages

•	alert based on numerous and complex conditions potentially involving different kinds of data from Sentinel (e.g. alert if Exchange MTA queue greater than 2000 and MTA throughput less than 200 bytes/sec, or if MTA service status is anything but Running)


Service Module Overview

The service module allows monitoring and control of Windows NT services. See the step-by-step example for configuration details.

Displayed is the color-coded status of the services on each server in the group.

Notes

•	the user under whose NT account Sentinel is running must have administrative priviledges on the machine(s) being monitored

•	updates for a particular server may be temporarily disabled by right-clicking on the server name in the module pane and deselecting the Enabled menu item, and can be reenabled by selecting Enable again

•	the update interval defaults to every 2 minutes, and is configurable through the Workspace Schedules page

•	right-click the upper-left cell (which is blank) and select Update All to refresh all cells, or hit F5


Service Status Indicators

stopped

started

paused

unknown (network problems, lack of permissions, or service doesn’t exist)

A clock symbol overlaid on the indicator means that the state is pending.


Performance Module
Performance Module Overview

The performance module displays the values of the specified Windows NT performance counters on the configured servers.

Configuration

Notes

•	removal of added counters is not yet fully implemeted in this Beta release. Our apologies.

•	the user under whose NT account Sentinel is running must have administrative privileges on the machine(s) being monitored

•	the update interval defaults to every 5 minutes, and is configurable through the Workspace Schedules page

•	there is a memory overhead of approximately 300K incurred for each server being monitored (which allows much faster performance). This may require you to have a substantial amount of RAM available. If you’re not sure how much memory Sentinel is using, launch Task Manager, and monitor the memory usage for Sentinel. One improvement planned for the post-Beta release is improved memory management (we promise!).

•	if really wild numbers (of order 10±300), then the monitored server has been disconnected. Right-click on the server in the module pane and select Reconnect, or select the upper-left (origin) cell and select Reconnect All

•	right-click the origin cell and select Update All to refresh all cells, or hit F5


Configuration of Performance Module

Follow these steps to add performance counters to the list of those monitored in your performance module:

1. 	Edit->Add Counter

2. 	select or type in a server on which to browse performance counters, Next

3. 	select a counter, object (if applicable), and instance (if applicable)

4. 	change the display name if desired

5. 	Add [to list of counters to add to the module]

6. 	repeat 3-5 until all counters from the browsed server are added

7. 	if desired, hit Back to add counters from another server

8. 	OK

For example, this shows several added counters:


Eventlog Module Overview

The eventlog module is not yet fully implemented.

To use the eventlog quick browser that is at least partially implemented:

1.	type the servername into the Server field

2.	Open

3.	you may set the Filter at any time (filter on Type only)