To add a device in the Devices group, select Add Device:

Device - common settings

• Use template
  • If a device template has been defined (see chapter Templates), it can be chosen from the dropdown list.
• Name
  • Name of the device. Usually this is the native name or the host name.
• Type
  • Select the closest match for the device type:
    • Firewall
    • Firewall PIX
    • Gateway
    • Host
    • IDS/IPS
    • Interface
    • Load balancer
    • Other
    • PC
    • PC (EEM Robot)
    • Proxy
    • Printer
    • Remote access
    • Router
    • SAN
    • Server (default)
      
    • SSL terminator
    • Switch
    • VPN concentrator
    • WLAN access point
• Address
  
  • This can be either the IP address or the FQDN. If the FQDN is specified, all relevant jobs will do a DNS lookup before each execution
• Subnet mask
  • Only used for search and reference
• Alarm parent
  • Select the alarm parent of the device, to avoid alarm spamming
• Default collector 
  •  Select a default collector for jobs that will run on this device. This is only relevant if external collectors have been configured.

Device - properties

• Agent password
  • See section SKOOR Engine agent jobs
• Agent port
  • See section SKOOR Engine agent jobs
• Agent secure conn.
  • See section SKOOR Engine agent jobs
• Agent username
  • See section SKOOR Engine agent jobs
• Alarm file
  • The file name of the alarm file that should be submitted if this device issues an alarm
• Don’t export or update in eDesigner mode
  • For internal purposes only
• EEM Parameters
  • See section EEM Project with EEM Timer jobs
• Geo location
  • Geographical coordinates of the object for display in a Geo Map (latitude/longitude), separated by comma, slash, semicolon or space. Example coordinates: 47.4612,8.3021
• Syslog level
  • Specify the default syslog level (see section Show syslog)
• Syslog source
  • Insert the name for the syslog source. By default, this is the host name (see section Show syslog).
• TID
  • 3^rd party identification - a unique identification for a 3^rd party system, e.g. a CMDB or an asset database. Once set, this attribute cannot be changed.

Device - custom properties

Please refer to section Custom Properties.

Device - permissions

Please refer to chapter Permissions

Device - example

SKOOR Engine server with defined custom properties:

Network protocol handler

In the Edit Device menu, one can enter a network protocol handler as the custom property Remote Access:

Links appear in the device detail page in the UI and dashboards afterwards:

While the Mail and Weblink links work without any configuration and open the default Email client or the default browser accordingly, some tweaking is required for the remote protocol handlers to work. The following example shows how to set up an ssh protocol handler. This handler should launch the ssh client C:\Programme\Putty\putty.exe. The wrapper script ssh.cmd (see below) should reside in the same directory:

@FOR /F "tokens=1* delims=:" %%a IN ("%~1") DO C:\Programme\Putty\putty.exe %%b

The following registry file needs to be imported:

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\ssh]
@="URL:ssh Protocol"
"EditFlags"=dword:02000000
"URL Protocol"=""
[HKEY_CLASSES_ROOT\ssh\shell]
[HKEY_CLASSES_ROOT\ssh\shell\open]
@=""
[HKEY_CLASSES_ROOT\ssh\shell\open\command]
@="c:\\programme\\putty\\ssh.cmd \"%1\""

A click on the Remote access link in device detail will now open putty to start an ssh shell on the device.

Alarm parent

The Alarm parent function is used to suppress alarm spamming. If, for example, the core switch fails, all device states turn bad, since they are not reachable anymore. This is a completely desired attitude for service monitoring, but not for technical alarming. If the Alarm parent is not set, every alarm device on the device level will send out an alarm. If the devices have this core switch set as an alarm parent, they first await a state push from the job alarm parent of this device or, if not defined, any core switch job, or a maximum of 5 minutes to give the jobs the chance to update. If the parent has a better state then their own, they will alarm - otherwise their alarm will we suppressed. Alarm parents can be cascaded. A device Alarm parent can be the group or floor switch, which has the core switch as its parent.

Job alarm parent

The Job alarm parent is used to set the default Alarm parent for a device. It does not have to be set on each single job, unlike the standard Alarm parent function. There have to be jobs on a device to be able to select a Job alarm parent. Once jobs are added, the first Icmp type job is automatically selected as the alarm parent for the device. Select any other job if suitable, or select undefined to disable this feature.

As described above, when a Job alarm parent is defined on the device, other jobs will trigger alarms only if their Job alarm parent is in state OK. The Job alarm parent has to run once after the job itself got into a bad state or 5 minutes have to pass before the SKOOR engine decides if an alarm has to be sent.

This is only effective if an Alarm recipient is linked to the device or a job of the device: