Add device

To add a device in the Devices group, select Add Device:

Device - common settings


  • Use template
    • If a device template has been defined (see chapter Templates), it can be chosen from the dropdown list.
  • Name
    • Name of the device. Usually this is the native name or the host name.
  • Type
    • Select the closest match for the device type:
      • Firewall
      • Firewall PIX
      • Gateway
      • Host
      • IDS/IPS
      • Interface
      • Load balancer
      • Other
      • PC
      • PC (EEM Robot)
      • Proxy
      • Printer
      • Remote access
      • Router
      • SAN
      • Server (default)
      • SSL terminator
      • Switch
      • VPN concentrator
      • WLAN access point
  • Address
    • This can be either the IP address or the FQDN. If the FQDN is specified, all relevant jobs will do a DNS lookup before each execution
  • Subnet mask
    • Only used for search and reference
  • Alarm parent
    • Select the alarm parent of the device, to avoid alarm spamming
  • Default collector 
    •  Select a default collector for jobs that will run on this device. This is only relevant if external collectors have been configured.

As soon as the first job was created on the new device, there will be an additional setting visible named Job alarm parent. Please find a description of this setting further below


Device - properties


  • Agent password
  • Agent port
  • Agent secure conn.
  • Agent username
  • Alarm file
    • The file name of the alarm file that should be submitted if this device issues an alarm
  • Don’t export or update in eDesigner mode
    • For internal purposes only
  • EEM Parameters
  • Geo location
    • Geographical coordinates of the object for display in a Geo Map (latitude/longitude), separated by comma, slash, semicolon or space. Example coordinates: 47.4612,8.3021
  • Syslog level
    • Specify the default syslog level (see section Show syslog)
  • Syslog source
    • Insert the name for the syslog source. By default, this is the host name (see section Show syslog).
  • TID
    • 3rd party identification - a unique identification for a 3rd party system, e.g. a CMDB or an asset database. Once set, this attribute cannot be changed.

Device - custom properties

Please refer to section Custom Properties.

Device - permissions

Please refer to chapter Permissions

Device - example

SKOOR Engine server with defined custom properties:

Network protocol handler

In the Edit Device menu, one can enter a network protocol handler as the custom property Remote Access:

Links appear in the device detail page in the UI and dashboards afterwards:

While the Mail and Weblink links work without any configuration and open the default Email client or the default browser accordingly, some tweaking is required for the remote protocol handlers to work. The following example shows how to set up an ssh protocol handler. This handler should launch the ssh client C:\Programme\Putty\putty.exe. The wrapper script ssh.cmd (see below) should reside in the same directory:

ssh.cmd
@FOR /F "tokens=1* delims=:" %%a IN ("%~1") DO C:\Programme\Putty\putty.exe %%b

The following registry file needs to be imported:

ssh.reg
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\ssh]
@="URL:ssh Protocol"
"EditFlags"=dword:02000000
"URL Protocol"=""
[HKEY_CLASSES_ROOT\ssh\shell]
[HKEY_CLASSES_ROOT\ssh\shell\open]
@=""
[HKEY_CLASSES_ROOT\ssh\shell\open\command]
@="c:\\programme\\putty\\ssh.cmd \"%1\""

A click on the Remote access link in device detail will now open putty to start an ssh shell on the device.

Alarm parent

The Alarm parent function is used to suppress alarm spamming. If, for example, the core switch fails, all device states turn bad, since they are not reachable anymore. This is a completely desired attitude for service monitoring, but not for technical alarming. If the Alarm parent is not set, every alarm device on the device level will send out an alarm. If the devices have this core switch set as an alarm parent, they first await a state push from the job alarm parent of this device or, if not defined, any core switch job, or a maximum of 5 minutes to give the jobs the chance to update. If the parent has a better state then their own, they will alarm - otherwise their alarm will we suppressed. Alarm parents can be cascaded. A device Alarm parent can be the group or floor switch, which has the core switch as its parent.

The Alarm parent function, as described in this section, applies for normal alarm recipients, not for alarm recipients for jobs

Job alarm parent

The Job alarm parent is used to set the default Alarm parent for a device. It does not have to be set on each single job, unlike the standard Alarm parent function. There have to be jobs on a device to be able to select a Job alarm parent. Once jobs are added, the first Icmp type job is automatically selected as the alarm parent for the device. Select any other job if suitable, or select undefined to disable this feature.

As described above, when a Job alarm parent is defined on the device, other jobs will trigger alarms only if their Job alarm parent is in state OK. The Job alarm parent has to run once after the job itself got into a bad state or 5 minutes have to pass before the SKOOR engine decides if an alarm has to be sent.

The Job alarm parent function, as described in this section, applies for alarm recipients for jobs



This is only effective if an Alarm recipient is linked to the device or a job of the device: