[Music] hi this is a presentation of the agent client collector for monitoring by servicenow i will show you a demo of how you can actually configure it and actually run it and how you can actually see the metrics and see the events that it may generate so first of all we have an agent health dashboard i can see here that i have four agents one of them actually went into silent mode automatically because it probably used more than the five percent cpu that is uh allocated to it and that's configurable of course all my agents are of the same version uh two of them are associated with the linux mid two of them with a windows mid and two agents are running on linux servers and two agents are running on the windows server so without further ado let's look at the policies policies are actually a set of checks that will run against a certain set of cis the first one to make it simple let's look at the linux events and this is a check this is the policy actually which is configured to run against all the linux servers which are in operational status of operational the there are actually many checks seven of them here and each one of them actually is configured to [Music] do a particular kind of things some of them check the cpu other the memory the desk etc so and this one in particular will just check the cpu and will generate a warning event if the cpu is more than 50 percent and a critical event if it's more than 90 percent just fyi let's run it to see what kind of data it returns let's run it against um this server and i can it returns you can see the it's 99 idol so there's won't be any alarm here now let's for particular purposes let's start the stress test on that server remember it's a dot 142 here right and so let's start this server and we'll see what happens later all right now let's look at another policy which is a linux let's say linux matrix right so this linux matrix is also configured to run on all the linux servers in operational mode and there are many of them again reporting metrics on memory disk cpu um virtual memory process status etc but let's look at a very simple one cpu right so this one actually will return a matrix so obviously there's no threshold or any kind so i'm going to run it against one of my linux servers and in this particular case it's going to return a set of metrics as you can see all the cpu metrics all right so very straightforward now let's look at another policy which would be against the microsoft sql server so let's say it's ms sql and let's look at the matrix as well in this particular case i have only one check this check let's run it and see what it does so let's run the test check it knows because when the agent started it actually did a basic discovery which looked at all the processes and inferred which applications are actually running so it discovered as a result that there is a microsoft sql instance on this server so let's select it and if we run that check it will return a certain set of a microsoft sql server matrix here it is all right now let's pick another one which is a bit different this could be the mysql it's a little bit different and you're going to see why let's look at the mysql matrix here and again it applies to all the mysql instances there's many metrics here but if i pick up let's say this one here here it is actually going to again prompt me for the misql instances that it discovered and it automatically enters the credentials here so when i run the test it's going to actually log into mysql and find out that there is it's going to return the metric associated with that with that check now why did it enter a credentials and that's because the policy is actually um defining a set of credentials because as you know if you log into a linux server or a microsoft server with mysql on it you need the username and password to log into the mysql instance right so in this particular case you do have to pass credentials to the agent to be able to log into that ci now let's look at another policy which has to do with monitoring the apache log files on centos so here that policy again applies to all the linux servers right and it but as you can see not only do i look at the linux servers which are operational but also i specified a particular ip address the way you do this is that you can go into the sandbox and configure the filter based on all the attributes of the sci now if i go into testing this check here so what is it going to do it's going to actually let me get back a bit what does this um check do it actually looking for patterns in this log file either of severe exception or 404 in this log file here so let's run it my website is my web server server is running so it should return no errors right now because okay so there's no errors so it's not reporting any event or warning or critical severity so let me go to that website and type in an invalid url so if i go back here and run this check against the same instance at that point i should get a warning right because it have it found a 404 once all right so you will get an event of warning severity in operator workspace let's look at yet another policy monitoring the http endpoints this particular case let's look at the http endpoint matrix so there's only one check and if you look at the policy it goes against all the http entry points and has specified just two ip addresses again you can specify any filter whether it's by name or by location of any attribute associated with that ci and then you need to specify the proxy setting right because if you test a website there is no point in testing it from the server on which the website is running right so you want to run it from some other agent so that's why you specify the proxy setting scheduling it runs every 60 seconds and here you don't specify any credentials because you're accessing a website so there is no credentials needed but if you if it were an api endpoint where you would need to log in you will specify the set of credentials here so let's run this check quickly here it is going against my http entry point it's prompting me for to define a proxy so let me pick up this windows machine for example and no credentials so let's run it right away and here it is here is a total time uh total latency to access this website and some other metrics here as well all right so let's do one more let's look at the snmp checks for example oh so let's do a snp status using linux well the reason why it's linux b is because i installed for the purpose of this demo i installed an snmp agent on the linux server which is why i called it that way and here again it is an snmp agent that goes against a specific object identifier and we'll um will create an event if uh if it the value is not zero right so let's run it again here it prompts me for the instance where i discovered an snp agent it is prompting me for an snmp agent here so let's do this one in terms of credentials i got a couple of them so actually this is the one i want to use and this which is the snmp community strength that needs to be passed to be able to connect to the snip agent and yes all is well so i will not be getting an alert now just like for monitoring the website uh monitoring an snmp device which cannot have an agent installed on it you need to also to specify the proxy settings right so in this particular case this policy will apply to this um ip so it could be a rather or a switch or any snp device you specify where you want to test this snmp device from and you need to specify the community string because it's a an snp device all right so i think that summarizes basically what what i wanted to show you now okay you remember that i started a stress test on the server.142 to increase the cpu so it's been running for a while and as a result as you know the cpu was 100 so what would we expect obviously we would expect a critical alert on that service now if we visualize that service it especially the service map we can see that that 142 server has the critical alert if we go into the details of that service we can see that there is one related alert which has to do with cpu critical so let's go into this alert itself and let's look at the details i can see that it is the cpu eighty-nine percent user ten percent idle etc and see this is the explanation of the alert and if i look at the matrix on that ci it will give me an additional matrix such as the load and you can see the spike as a result of the stress test so this illustrates how you can actually visualize the alerts in operator workspace which are triggered by an event from the asian cloud collector for monitoring now let's see how we can visualize these metrics as well in inside explorer this is the cpu the load average five on that server and you can see that i ran off several stress tests actually this one i stopped it partially uh and then restarted it so you can see now it stopped it so the load average starts going down but this shows you how the cpu actually goes out of bound as a result of the automatic band which is calculated as part of its anomaly detection so this illustrates for you how the asian collector works it starts with an asian health dashboard and i showed you the various policies that you can configure in um having to do with apache apache logs apache cell docker f5 http entry points iis jbox linux windows ms sql oracle mysql ping of course that goes without saying tomcat websphere etc so there's more and more checks coming up in every release on the on the store and on that positive note thank you for your time