Quick start: how to create a policy

This section provides an overview of the steps needed to create a new policy, and provides links to the sections in the help that explain the steps.

Select the kind of policy that you want to create, and the procedure below will change to reflect the necessary steps. Note that as you fill in the text boxes of the policy editor, that only those with an asterisk (*) are required. (If you don't know what kind of policy you should write, learn how to choose a policy type.)

Logfile Entry Measurement Threshold Open Message Interface Service/Process Monitoring SNMP Interceptor Windows Event Log Windows Management Interface ConfigFile Flexible Management Node Info Scheduled Task Service Auto-Discovery Remote Action Security Server-based Flexible Management Server-based MSI

1. Open the policy editor
2. Review the information in the General tab.
3. Use the Data tab to modify the configuration file that is written to the node when the corresponding policy is deployed.
4. Configure the remote action security policy.
5. Configure the server-based flexible management policy.
6. Configure the server-based MSI policy.
7. Type the configuration file in the agent-based flexible management policy editor. See Syntax for agent-based flexible management Templates for more information.
8. Type the configuration file in the node info policy editor. Refer to Node Info Policy Type for more information.
9. Optional Steps: Select the Options tab and set up the following sections:
   • Log local events
   • Unmatched events
   • Pattern-matching options
   • Processing options
10. Select the Source tab and indicate which log file that you want to monitor
11. Select the Source tab and indicate which event log that you want to monitor
12. Indicate the WMI instance or event that you want to monitor.
13. Indicate what command should be started, and what messages should be sent
14. Can you get all the information you need from one source?

    Only one source is needed Several sources are needed

    Select the Source tab and indicate one source for the threshold data

    1. From the source tab, select Add source...
    2. Indicate the first source for the threshold data and select OK.
    3. Select New... and add another source. Repeat for each source you need.
15. Optional Steps: Select the RulesThresholds tab and define the default message:
    • Message attributes
    • Message correlation properties
    • Message instruction properties
    • Message stream interface
16. In the Rules tab, select New and configure a rule:
    1. In the Condition tab, define the properties of the opcmsg message that the policy should look for.
    2. In the Actions tab, define what the policy should do if it finds an opcmsg message with these properties.
    3. Repeat steps A and B for every opcmsg message that you want the policy to look for.
17. In the Rules tab, select New and configure a rule:
    1. In the Condition tab, define one pattern that the policy should look for in the log file.
    2. In the Actions tab, define what the policy should do if it finds this pattern.
    3. Repeat steps A and B for each pattern that you want to look for in the log file.
18. In the Rules tab, select New and configure a rule:
    1. In the Condition tab, define one pattern that the policy should look for in the event log.
    2. In the Actions tab, define what the policy should do if it finds this pattern.
    3. Repeat steps A and B for each pattern that you want to look for in the event log.
19. Indicate the match conditions for an SNMP interceptor rule.
20. In the Rules tab, select New and configure a rule:
    1. Enter a description in the Rule Description box.
    2. Select Add and indicate the WMI properties that the policy should look for in the class you chose.
21. In the Rules tab, select New and configure a rule: Do you want to evaluate each instance with the same threshold levels,
    or do some instances need threshold levels that are different from others?

    If all instances have the same thresholds, then: Some instances need unique thresholds, then: What's an instance?

    An instance, in the context of measurement thresholds, refers to one INSTANCE of the thing being monitored. For example, a monitor might measure the available disk space, with the logical partitions (C:, D:, E:,) being the different instances. In the Rules tab, select New and set the threshold levels

    1. Select Specify instance filters.
    2. In the Conditions tab, specify the instance that you want to monitor.
    3. In the Actions tab, select New and set the threshold levels
22. Indicate when the command should take place
24. Specify whether the policy is to monitor Windows services or processes.
26. Add a Windows service or process to the policy:
    • Add a Windows Service to Monitor
    • Add a Process to Monitor

    NOTE
    You cannot use one policy to monitor a combination of Windows services and policies. Use one policy to monitor Windows services and a separate policy to monitor Windows processes.

27. Define the details of the Windows service or process you add to the policy:
    • Windows Service Monitor Properties
    • Process Monitor Properties
28. Specify the actions to occur when a policy rule matches:
    • Windows Service Monitor Default Actions
    • Process Monitor Default Actions
29. Save the policy
30. Deploy the policy

31.  

    Service Auto-Discovery policies are usually only deployed in conjunction with a Smart Plug-in (SPI). Refer to the SPI documentation for information about services that the SPI discovers.