tool templates?

All-

We just purchased Log and Event Manager, and are working on adding all of our servers into the appliance. I am starting with Domain Controllers, and with servers in the double digits, this could be a pretty big task alone, not including app servers, db servers, net devices, etc. What I am hoping is that there is some sort of "tool template". I want to be able to install the agent on one Domain Controller, configure all of the tools that I want on it, and then once all of the tools are configured, apply them to all of the other domain controllers that have agents installed. Is this possible?

Find more posts tagged with

lem_tools

Accepted answers

Jeffster

You can definitely do what you are wanting only in a different order than the way you think.

Here is how we did ours: I first installed the agent on the domain controllers (ok, so I did all my servers at once). Next, in the LEM web console, go to Build>Groups> and clone the tool profile "Default: Windows DC." Then choose to edit the cloned profile and rename to "Domain Controllers". When you are in edit mode there is an Edit Tools button in the lower left corner. This is where you setup the tools for the group. By default the DC group still has the Windows NT/2000/XP Security Log tool associated, I had to remove it since we are running 2008r2. I then added the Windows7/2008/Vista Security Log tool and renamed the alias from Vista Security to 2008 Security Log (confusing to see vista security scrolling by). Once you've got the tools the way you want, click the activate button in the lower right corner and then choose close. You should now be back at the Tool Profile with the list "Available Agents" on the left. Just click the > to the right of the agent to move it to the right side list "Contained Agents". When you are done click save.

Now go to Manage>Nodes and I like to sort by Profile. Find the profile you just created and look at the configured tools associated with the server. They should match what you did to the tool profile. If you edit from the node and not the profile it will give you the option to edit the "Tool Profile" or the Agent Tool Configuration. If you choose the latter, the node will be removed from the tool profile.

All comments

Jeffster

You can definitely do what you are wanting only in a different order than the way you think.

FormerMember

Thanks, Jeffster, this is absolutely the right answer. Tool profiles were designed to do exactly this. As a bonus you can also use them in rules, filters, and searches, for refining stuff based on being a member of that group.

kris_mortensen

Thanks for your help! This definetly does what I want it to do... but I want to append my question if that is ok. Now that I have the tool profile set up, I was hoping that under "Monitor" and "Filters", I would be able to see all of the Domain Controller monitoring via the filter called "Domain Controllers (all)", but that filter shows a status of "off". How do I make that work?

FormerMember

First, edit the filter (double click) to make sure your DCs profile appears in the right hand side (drag yours over the placeholder). (This is why it's off by default)

Then, click on the filter (make sure the right one is selected), and go up to the gear on the top, and click "Turn On".

kris_mortensen

Nicole-

Thanks for the help! That worked great!