Share This:

BMC PATROL uses variables in the BMC PATROL configuration database to store information about exclusion and inclusion lists. The two variables are

 

>> /PatrolAgentSetup/application.filterList - contains the list of instances to include or exclude depending upon the value of application.filterType

 

The format is a comma-separated list of instances or regular expressions. The variable has a limit of 1024 characters. Regular Expressions can be used to alleviate this limitation. The belo error is generated when a filter exceeds the maximum size allowed for an PatrolAgent configuration variable.:

------------

Exclusion list too long. Please use regular expression exclusion.

------------

 

>> /PatrolAgentSetup/application.filterType - determines whether the list is an exclusion or inclusion If application.filterType does not exist, the list defaults to exclude. Valid values are:

 

- exclude

- include

 

The exclusion list feature is designed for ignoring a small number of instances. If you want BMC PATROL to ignore a majority of instances, you can create an inclusion list, which forces BMC PATROL to ignore all but the instances that you specify. However, monitoring by inclusion has a few limitations.

 

Benefits of Creating Exclusion Lists Using Menu Commands:

BMC Software recommends that you use the menu options Stop Monitoring and Edit <application> Exclusion List to exclude application instances. These menu options are accessed from the pop-up menu of the instances.

 

The menu commands add two entries into the /PatrolAgentSetup/application.filterList for each instance excluded.

 

To accomplish monitoring of all application classes in local monitoring and selected application classes in remote monitoring, let's first understand the way Unix KM creates instances of each application class.

 

For local monitoring, in case of single instance application classes like CPU, MEMORY, KERNEL, km creates instances with those names.

 

Eg. PatrolAgent with only local monitoring would create CPU instance with name CPU.

 

When remote monitoring is configured, KM creates CPU instance for remotely monitored host as CPU@<remote host name>, similarly for KERNEL it would create KERNEL instance with name KERNEL@<remote host name>

 

 

PATROL PatrolAgent provides instance filtering functionality which can be configured by adding pconfig variable with key

/PatrolAgentSetup/<APPLICATION_CLASS>.filterList and  instance name as value.

 

Thus, to enable CPU monitoring in local and exclude the same in remote, add variable

Key - /PatrolAgentSetup/CPU.filterList

Value - CPU@.*

 

For unix, it is CPU@.*

For Windows it is *.@CPU

 

In case of application class which has multiple instances like NETWORK/DISK/SWAP, km creates instances under corresponding containers with <Instance Name>@<remote host name>

 

Eg. For host pl-pun-pat-qa01, eth0 instance of NETWORK application class will get created as eth0@ pl-pun-pat-qa01

 

To avoid instance creation, appropriate regex should be used or comma separated list of instances can be added in /PatrolAgentSetup/NETWORK.filterList

 

Also, you can suspend a application class from event management KM. I would like to inform you that EM KM is a default KM and you just need to load it. If possible reload it and follow the steps given below:

 

To deactivate the application class permanently, you can use EM km.

 

>> Right Click on Agent

>> KM Commands

>> Event Management

>> Instance Filtering

>> Select application class

>> Select the proper Application Class (Remot_cont in case of remote monitoring)

 

The first check box needs to be unchecked in case you do not want the parameter to be active.

 

There is no GUI option from CMA to create a filtering policy for REMOT KM to filter out remote application classes. We can create below ruleset to filter CPU application class remote machine.

 

Ruleset:

"/AgentSetup/CPU.filterList" = { REPLACE = "CPU@137\\.72\\.245\\.223" }

 

The default filter type is exclude and here, the host ip is: 137.72.245.223

 

If we want to exclude CPU monitoring for all remote systems, we can apply below:

 

"/AgentSetup/CPU.filterList" = { REPLACE = "CPU@*" }

 

Similar way, we can do for rest of the application classes.

 

Apart from disabling some application classes using filterList,  as a best practice, all the related collectors must be disabled.

 

To disable collector parameters in remote monitoring, add following rules in agent configuration (Event Management KM must be loaded )

 

Eg. To disable SMPColl

Key - /AS/EVENTSPRING/PARAM_SETTINGS/THRESHOLDS/COLLECTORS/COLLECTORS@{re:*}/SMPColl

Value - 0,0 0 0 0 0 0,0 0 0 0 0 0,0 0 0 0 0 0

 

Key - /AS/EVENTSPRING/processWildcards

Value - 1

 

We can disable Service monitoring for all services on PatrolAgent machine using below variable:

 

"/PSX__P4WinSrvs/PWK__PKMforMSWinOS_config/ServiceMonitoring/DisableServiceMonitoring" = { REPLACE = "1" },

 

where, 1 = do not monitor; 0 = monitor all services

 

And then we can enable monitoring of selected services using below variables:

"/PSX__P4WinSrvs/PWK__PKMforMSWinOS_config/ServiceMonitoring/ServiceList/CryptSvc/OverrideGlobalServiceMonitoring" = { REPLACE = "1" },

"/PSX__P4WinSrvs/PWK__PKMforMSWinOS_config/ServiceMonitoring/ServiceList/CryptSvc/SvcConfigVars" = { REPLACE = "0,0,1,0,1,1,0,0,0" },

 

The information is available at below URL:

 

https://docs.bmc.com/docs/display/public/mswindows47/PATROL+KM+for+Microsoft+Windows+OS+configuration+variables

 

We can disable Service monitoring for all services on PatrolAgent machine using below variable:

 

"/PSX__P4WinSrvs/PWK__PKMforMSWinOS_config/ServiceMonitoring/DisableServiceMonitoring" = { REPLACE = "1" },

 

where, 1 = do not monitor; 0 = monitor all services

 

And then we can enable monitoring of selected services using below variables:

"/PSX__P4WinSrvs/PWK__PKMforMSWinOS_config/ServiceMonitoring/ServiceList/<service-name>/OverrideGlobalServiceMonitoring" = { REPLACE = "1" },

"/PSX__P4WinSrvs/PWK__PKMforMSWinOS_config/ServiceMonitoring/ServiceList/<service-name>/SvcConfigVars" = { REPLACE = "0,0,1,0,1,1,0,0,0" },

 

We can disable Service monitoring for all services on remote machine using below variable:

"/REMOTE/HOSTS/<ReplaceThisWithRemoteHostname>/PSX/PSX__P4WinSrvs/PWK__PKMforMSWinOS_config/ServiceMonitoring/DisableServiceMonitoring" = { REPLACE = "1" },

 

And then we can enable monitoring of selected services using below variables:

"/REMOTE/HOSTS/<ReplaceThisWithHostname>/PSX/PSX__P4WinSrvs/PWK__PKMforMSWinOS_config/ServiceMonitoring/ServiceList/OverrideGlobalServiceMonitoring" = { REPLACE = "1" },

"/REMOTE/HOSTS/<ReplaceThisWithHostname>/PSX/PSX__P4WinSrvs/PWK__PKMforMSWinOS_config/ServiceMonitoring/ServiceList/<service-name>/SvcConfigVars" = { REPLACE = "0,0,1,0,1,1,0,0,0" },