5 Replies Latest reply on Oct 19, 2012 3:13 PM by kris_mortensen

    tool templates?

    kris_mortensen

      All-

      We just purchased Log and Event Manager, and are working on adding all of our servers into the appliance. I am starting with Domain Controllers, and with servers in the double digits, this could be a pretty big task alone, not including app servers, db servers, net devices, etc.  What I am hoping is that there is some sort of "tool template". I want to be able to install the agent on one Domain Controller, configure all of the tools that I want on it, and then once all of the tools are configured, apply them to all of the other domain controllers that have agents installed. Is this possible?

        • Re: tool templates?
          Jeffster

          You can definitely do what you are wanting only in a different order than the way you think.

          Here is how we did ours:  I first installed the agent on the domain controllers (ok, so I did all my servers at once).  Next, in the LEM web console, go to Build>Groups> and clone the tool profile "Default:  Windows DC."  Then choose to edit the cloned profile and rename to "Domain Controllers".  When you are in edit mode there is an Edit Tools button in the lower left corner.  This is where you setup the tools for the group.  By default the DC group still has the Windows NT/2000/XP Security Log tool associated, I had to remove it since we are running 2008r2.  I then added the Windows7/2008/Vista Security Log tool and renamed the alias from Vista Security to 2008 Security Log (confusing to see vista security scrolling by).  Once you've got the tools the way you want, click the activate button in the lower right corner and then choose close.  You should now be back at the Tool Profile with the list "Available Agents" on the left.  Just click the > to the right of the agent to move it to the right side list "Contained Agents".  When you are done click save.

           

          Now go to Manage>Nodes and I like to sort by Profile.  Find the profile you just created and look at the configured tools associated with the server.  They should match what you did to the tool profile.  If you edit from the node and not the profile it will give you the option to edit the "Tool Profile" or the Agent Tool Configuration.  If you choose the latter, the node will be removed from the tool profile.

            • Re: tool templates?
              nicole pauls

              Thanks, Jeffster, this is absolutely the right answer. Tool profiles were designed to do exactly this. As a bonus you can also use them in rules, filters, and searches, for refining stuff based on being a member of that group.

              • Re: tool templates?
                kris_mortensen

                Thanks for your help! This definetly does what I want it to do... but I want to append my question if that is ok.  Now that I have the tool profile set up, I was hoping that under "Monitor" and "Filters", I would be able to see all of the Domain Controller monitoring via the filter called "Domain Controllers (all)", but that filter shows a status of "off". How do I make that work?