system_description

Easy Works is an add-on module to SNMPc that collects information from all Switches and Servers in SNMPc. The collected information is presented in a number of searchable Reports.

The software is installed on the SNMPc Server. If you are using Remote Pollers the software should be installed at these pollers too. If you would like to start the program from the SNMPc Remote Console, the software must also be installed at the PC running the Remote Console.

1. The Console application is started from the SNMPc Console (local or remote) and requires the argument $i

(Exec Program: easyworks.exe $i)

2. The Server component reads the SNMPc map database once every 24 hour and creates a number of reports for all devices in the map that is configured for SNMPv1 or SNMPv2c.


getting_started

We assume you now have installed the software at the SNMPc Server, and started the Easy Works Console.

Go to menu Settings/General

  1. Add Routers. Add one or more routers that holds the ARP Cache in your network.

  2. Reports. A number of reports are created once every 24 hour. Information is retrieived from all devices in SNMPc that is configured for SNMPv1 or SNMPv2c. For a mid-sized network (300-500 devices) the data collection takes about 1 hour.

  3. MAC Address Scanning. To build-up a User database we need to read the MAC address tables a couple of times each day.

  4. Trunk Port Identification. To speed up the MAC Address Scanning and build-up a correct User database, we must exclude all trunk ports (native/management VLANs) from scanning. Enter one or more Vlan IDs separted by commas. If you for some reason are using an untagged Vlan ID on a trunk port, you can mark these ports as trunks by setting a 'tag name' on the object ifAlias.


conf_snmpc

Configure SNMPc

Select one or more devices and change Exec Program on the Device Attributes tab to:

easyworks.exe $i

$i=database record id


Toolbar

The Program button group is shortcuts to programs/bitview script.

The Scrollist shows your favorite MIB View Names.

The Table button is always enabled.

The Graph/Chart buttons are only enabled when a row is selected in a grid table. The instance will be retreived and displayed in a graph/chart.


system

Real Time - System

Tab - Device Information

Left column shows information retreived from the device.

- Vendor is taken from SnmpVendor.txt

- Platform and Version is taken from sysDescr.

Right column shows device properties retrieved from the SNMPc map database.

Some common fields could be changed. For example you can set the device to UnManaged by setting Poll Interval=0, or to Managed by setting Poll Interval > 0. (You must run SNMPc 7.1 or greater to be able to change a value).

Ack Events clears all active events that is bound to the device.

Tab - Incident Information

Here you can send Incident Information about why a device is down or has some failures.

Tab - Maintenance Mode

Schedule maintenance by setting Poll Interval to 0 or by Moving the Device Into Another Group (where you have filters that reacts with other colors, notifications etc. when a device does not respond). If you schedule a start time previous current time the device goes direct into maintenance mode.


user

Real Time - Switch

Tab - Neighbor

Shows neighbor info from devices supporting CDP (Cisco Discovery Protocol) or LLDP (Link Layer Discovery Protocol).

Tab - Port

Shows Access/Trunk Ports from devices supporting the Q-Bridge-MIB or the Cisco-VLAN-MIB/Cisco-VTP-MIB.

Cisco Trunk Ports will be shown with Vlan ID= -

Switches only supporting the Bridge-MIB will be shown with Vlan ID= 0.

Tab - User

Shows MAC and IP info from devices supporting the Q-Bridge-MIB or the Bridge-MIB.

(Note: To see the IP address you must have configured the router(s) that holds the ARP cache on the Settings/General page.)


user

Real Time - Server

Tab - General Information

Shows disk, cpu and inteface info from devices supporting the Host-MIB.

Note: Press the mouse button over a bar to show the values.

Tab - Running Software

Shows cpu and memory usage from devices supporting the Host-MIB.

Tab - Installed Software

Shows installed software from devices supporting the Host-MIB.


rep_system

Reports - System

Tab - Device Information

The Device Report gives you an overview of all devices in SNMPc that has been setup to use SNMP. The Report is recreated every 24 hour.

The Vendor Column is taken from SnmpVendor.txt. The Platform and Version Column are taken from sysDescr.

Tab - Incident Information

The Incident Report gives you a history of all Incidents that has been manually sent into the system.

Tab - Config Backup

The Config Backup Report gives you an overview of all Backup jobs. The Report is updated every 24 hour.

NB! Regarding Version Control with ExamDiff

On the Easy Works Remote Console you MUST do this:

- map a network drive to the directory where the config files are saved.

- enter this network drive as the 'Backup Directory'

ex. z:\cisco

Note: ExamDiff is a free light-version of ExamDiff Pro.

(http://www.prestosoft.com/edp_examdiffpro.asp)


rep_system

Reports - Switch

Tab - Neighbor

The Neighbor Report shows all connections based on info from devices that supports CDP or LLDP. The Report is recreated every 24 hour.

Tab - All Ports

The Port Report shows all physical ports (both Access and Trunk ports). The Report is updated every 24 hour. Ports that has not been updated during the last 5 days (due to switch is down or the ports has been renumbered) is removed. New switches/ports are added every 24 hour.

VLAN ID on Cisco Trunk ports is displayed with a '-' and VLAN ID on switches that only support the Bridge-MIB is displayed with a '0'.

Ports that have never been used (ifInOctets=0) will be timestamped as Last Used=switch uptime and Oper=notUsed.

Tab - Access Stats

The Access Report shows traffic data for all ports that is not a trunk port.

Tab - Trunk Stats

The Trunk Stats Report shows traffic data for all ports that is a trunk port.

Note:

See Settings/General for how to control what should be treated as a trunk port. The Stats Reports is updated every 24 hour. Only ports that has received data during the last 24 hour will be shown.

Ports that has received less than 1 MB data will be displayed as '0'. Ports that does not support the IF-MIB (ifHCInOctets, ifHCOutOctets, ifInMulticastPkts) will be displayed with a '-' in the 'In Volume', 'Out Volume' and 'In Multicast' column.


rep_system

Reports - Server

These Reports are based on info from devices that supports the Host-MIB.

Tab - Disk Information

The Disk Report shows all fixed and network disks. The Report is updated every 24 hour. Disks that has not been updated during the last 14 days (due to server is down or disks has been replaced) is removed. New servers/disks are added every 24 hour.

Tab - Running Software

The Running Software Report shows all running programs (processes). The Report is updated every 24 hour. Processes that have not been updated (due to server is down or processes has been restarted) is removed. New processes are added every 24 hour.

Note:

CPU Secs 24H will be displayed with a '-' the first time a process is seen or if the process has been restarted between two readings.

Tab - Installed Software

The Installed Software Report shows all installed programs and patches. The Report is recreated every 24 hour.


rep_system

Reports - User

Tab - User Tracking

The User Tracking Report shows all uniq MAC addresses. Via the scheduled 'MAC Address Scanning' process we control how frequently we shall scan the switches. In parallell with this scanning we also read the ARP cache every full hour from one or more routers. In the end of the day a pairing is performed and the database is updated.


rep_system

Monitor - Server

Tab - Disk Space Condition

The List is proccessed once every 24 hours (in the morning, after the daily reports are finished).

For every disk in the 'Disk Report' this List is processed from top to bottom according the following algoritm:

If a match is found on Device+Disk Then
If Free value is less than condition Then
send trap with Severity=Critical
ElseIf Used % value is greater than condition Then

send trap with Severity=Warning
End
Exit List
End

Note: When a trap is sent the first 30 char of the Device Name is used as Trap Community.

Tab - Running Software

The List is processed once every poll inteval (poll interval is configured on the Settings/General page).

Configuration changes in the List is updated every full hour.
If Remote Pollers is used the monitoring runs in parallell on each Poller.

If Process+Path+Parameter could not be found a trap is sent with Severity=Critical.
When Process+Path+Parameter is up again a trap is sent with Severity=Normal.

If Device is not responding NO trap is sent.

Attributes when reading the process list from a device.
- Timeout = 2 sec
- Retries = 2
- Max-Timeout = 40 secs

Note: Because Easy Works recognize a process by Name+Path+Parameters it's only possible to monitor one instance of the same process. So, if you have more than one instance running of a process (with the same Name+Path+Parameters), you can either try to start the 2nd instance with an 'dummy' parameter or make a copy of the process name (i.e. notepad.exe and notepad2.exe).

When a trap is sent the first 30 char of the Process Name is used as Trap Community.


cons_sett

Console - Settings

Easy Works Server

IP Address and Port when connecting to the Server component.

General

Debug Mode sends output to a file named Ew-Debug.txt. The file is recreated every time you start the Easy Works Console and is located in the apiexec directory.

Toolbar Buttons

Enter a program to start. Use $a to include the ip address as one of the arguments.

Ex.)

telnet.exe $a (starts a telnet connection to the selected node)

mstsc.exe /v:$a (starts a remote desktop connection with login credentials to the selected node).

MIB View Names

A list of common SNMP queries. It could be any compiled MIB Table name or Custom Table name.


serv_sett

Server - Settings

TCP Server

IP Address and Port to be used for the Server component.


serv_sett

SNMP Agent - Settings

SNMP Agent

Parameters for the SNMP Agent.

Send App Events as Traps

Application Info/Error Messages are logged into 3 files in the Debug directory. If you prefer you can also send these messages to SNMPc as traps.

Note:

To be able to send 'Incident Information' and/or 'Application Info/Error Messages' as traps the SNMP Agent must be started.


serv_sett

General - Settings

Routers

The IP address of one or more routers that holds the ARP cache. The internal ARP Cache in Easy Works is updated every full hour between 7-21 based on info from these routers. The routers must exist in the SNMPc map with the same IP address. Read community name is taken from the device in SNMPc.

Note 1: This field is limited to max 250 char, so if you have many routers (about more than 20) you should leave this field blank and instead create a file in the EasyWorks directory called ArpRouters.txt with one IP address/line.

Note 2: If you are not allowed to read the ARP cache from one or more routers, it's possible to read the ARP cache from a file. You must make sure that the file is put into the EasyWorks directory and is called ArpTable.txt. The format should be:

ipAddr<TAB>macAddr<CRLF>

Ex.

192.10.68.0.2 00 dd 01 23 fa 3c

192.10.68.0.4 00 dd 01 27 fb 2d

Display MAC Vendor Names uses the file MacVendor.txt to map MAC addresses to vendor names.

Debug Mode

Sends output to the sub-directory named Debug.

Device Type

This file controls the “query templates” to be used when getting information from a device. After you have saved the file, you must click the button 'Apply Changes' to have the Easy Works Server component updated.

Note: If you have SNMP devices in the map that you would like to NOT invent you should comment out the DevType by adding to hypens (--) at the beginning of that line, or just remove the line. A reason for doing this could be that you have SNMP devices that do not reply with any meaningful information or respond with malformed information. Another way to handle this is to add/change a DevType line for the device that is more narrow for specific models you are interested in.

MAC Address Scanning. To build-up a User database we need to read the MAC address tables a couple of times each day. The time it takes to scan all switches can differ quite much depending on type of switch and network design. Large VLAN Domains creates large MAC tables in the switches.

So the whole scanning process can differ from 5-10 minutes to 1 hour for a mid-sized network (300-500 switches). The scanning process uses about 20-100 Kbps. If you are using Remote Pollers the scanning process is distributed to the pollers and runs in parallell.

Scanning can be scheduled to start every full hour between 7-20.

Trunk/Uplink Port Identification

VLAN ID

A list of one ore more VLAN IDs (separated by commas) which should be excluded when reading Bridge- and Fdb tables. All native/management VLANs should be excluded.

Alias Name

In some situations there could be difficult to know if a port is a trunk/uplink port or not. If you have some ports in your network that are not configured as trunks, but where you expect to see a lot of mac addresses, you can manually configure uniq words on these ports in the switch (using the SNMP object 'ifAlias' from the IF-MIB, or 'port description' if you are using a CLI). Then you use this field to match on one or more words (for example Trunk<OR>Up-Link) which means that these ports should be excluded when reading Bridge- and Fdb tables.

Nbr Platform

If it's difficult to use the 'Alias Name' for some reason, but mostly of your switches are using CDP/LLDP for Neighbor discovery you may find this field useful.

Ex. You have HP switches in your network but do not use specific VLAN IDs for management. You think the Alias Name would require too much administration to use, but all switches uses CDP/LLDP. Go to the Neighbor Report and check what Neighbor Platform string(s) you should match on to identify your trunk/uplink ports.

Port Name

This field is the SNMP object ifDescr from MIB2 (RFC1213-MIB). If you bundle ports on HP Switches (create trunks in HP terminolgy) they will have the string 'Trk' and a number as ifDescr. Normally you only bundle ports if they are a trunk/uplink, so this may be a way to identify trunk/uplink ports.

Note: The OR condition is applied between the fields VLAN ID, Alias Name, Nbr Platform and Port Name. The words are not case-sensitive.

Reports

Enter a start hour. Information is retrieived from all devices in SNMPc that:

- is configured for SNMPv1 or SNMPv2c

- has an IP Address not equal 0.0.0.0

- has an Poll Interval not equal 0

- is uniq (IP Address + Poll Agent)

For a mid-sized network (300-500 devices) the data collection takes about 1 hour. Bandwitdh usage is about 25 Kbps.

If you would like to limit the number of devices, you can use include(=) or exclude (!=) filters. Pattern-matching strings can be used. See below for pattern-matching rules.

Note: The AND condition is applied between the fields Group, Name and Icon.

Monitor Running Software

Poll Interval and Binary/Text matching when monitoring running processes.

Rules for pattern-matching

The pattern-matching features allow you to use wildcard characters, character lists, or character ranges, in any combination, to match strings. The following table shows the characters allowed in pattern and what they match:

Characters | Matches in string pattern
? | Any single character.
* | Zero or more characters.
# | Any single digit (0-9).
[charlist] | Any single character in charlist.
[!charlist] | Any single character not in charlist.

A group of one or more characters (charlist) enclosed in brackets ([ ]) can be used to match any single character in string and can include almost any character code, including digits.

Note:

To match the special characters left bracket ([), question mark (?), number sign (#), and asterisk (*), enclose them in brackets. The right bracket (]) can't be used within a group to match itself, but it can be used outside a group as an individual character.

By using a hyphen (-) to separate the upper and lower bounds of the range, charlist can specify a range of characters. For example, [A-Z] results in a match if the corresponding character position in string contains any uppercase letters in the range A-Z. Multiple ranges are included within the brackets without delimiters.

Other important rules for pattern matching include the following:

An exclamation point (!) at the beginning of charlist means that a match is made if any character except the characters in charlist is found in string. When used outside brackets, the exclamation point matches itself.

A hyphen (-) can appear either at the beginning (after an exclamation point if one is used) or at the end of charlist to match itself. In any other location, the hyphen is used to identify a range of characters.

When a range of characters is specified, they must appear in ascending sort order (from lowest to highest). [A-Z] is a valid pattern, but [Z-A] is not.


serv_sett

General - Reports

Export Reports to MS SQL

Lets you make your own reports or combine the report data with data from other databases. The report data is exported every 24 hour after the daily reports are created.

Reset Internal Tables

Some tables are rebuilt from scratch each day, and some tables are updated each day.

Here you can reset the tables that are updated each day.


serv_sett

General - Config Backup

General About Backups

The Backup job is running as a part of the Daily Reporting job. To include the Backup job you must first edit the Device Type.

- For Cisco devices (mib2 should be changed to ccc).

- For HP switches (mib2 should be changed to hpcc).

See 'Device Types' on the 'General - Settings' page.

Note: Make sure you do not have any firewall that blocks TFTP packets (UDP port 69). Also make sure you have configured a community name for write access in all devices, and that you are using the same community name in SNMPc.

If the Backup job failes on 50 devices or more, all remaining Backup jobs for that day will be cancelled. If this occur an event will be written to 'AppEvent.txt' in the Debug directory.

Automatic Config Backup on HP Switches

To perform a daily backup of the config on HP switches you should do this:

1. Choose a Backup Directory. Note: We recommend that you use a directory on the SNMPc Server.

2. Easy Works first sends a SET (write) command to enable the TFTP Server in the switch. Then it uses an internal TFTP Client to get the config file. Finally it sends a SET command again to disable the TFTP Server.

Automatic Config Backup on Cisco Devices

To perform a daily backup of the config on Cisco devices you should do this:

1. Set up a TFTP/FTP Server. We can recommend the free TFTP Server from Solarwinds. The TFTP/FTP Server can reside on the SNMPc Server or on another computer in the network. Note: We recommend that you install the TFTP/FTP Server on the SNMPc Server.

2. Config backups will be taken on all Cisco devices running IOS 12.x or later. Easy Works uses the Cisco-Copy-Config-MIB and sends a couple of SET (write) commands according to what you have configured.

NB! Regarding Version Control

If you choose to install the TFTP/FTP Server on another computer you MUST do this:

- on the SNMPc Server you should map a network drive to the directory where the config files are saved.

- make sure that the Easy Works Service has access-rights to this network drive.

- enter this network drive as the 'Backup Directory'

ex. z:\CiscoBackup


Statusbar

The statusbar shows:

- a status message about what is happening right now

- the "device type" for this device

- a countdown timer