Scheduling Reports

You can schedule reports to run once or on recurring periods in the future. When the test runs, the results will be saved to the Results tab for the report, and in Analytics > Generated Reports.

Prerequisites

When you schedule a report, you can specify notifications that should be sent for that report. In addition, you should make sure that the d efault settings for notifications for all scheduled reports have been set up.

Procedure

1. Log in to your Supervisor node.
2. Go to Analytics > Reports.
3. Select the report you want to schedule.
4. Select Schedule this report for:
5. For multi-tenant deployments, select the Organization for which this report should apply.
6. Select the Report Time Range.
7. Select the Schedule Settings.
8. Select the Output Format, whether you want to include the Chart in the output, and the Maximum Rows to Display.
9. Specify the Notifications that should be sent when the report runs.

Click Specify custom notifications if you want to send notifications to specific email addresses.

To copy the report to a remote directory, first define the remote location in Admin > General Settings > Analytics > Report to be copied to this remote location when scheduler runs any report. and then select Copy to a remote directory option.

11. Specify the amount of time the report should be retained after it has run.
12. Click OK.

The report will run at the time you scheduled.

Related Links

Setting Up Email Alert Routing for Scheduled Reports

Running System and User-Defined Reports and Baseline Reports

AccelOps includes a number of baseline reports for common data center analytics, as well as over 300 reports relating to IT infrastructure. You can also create your own reports. This topic describes how to run a system-generated or user-defined baseline report.

1. Log in to your Supervisor node.
2. Go to Analytics > Reports and select the subcategory containing the report you want to run.

For baseline reports, select Baseline.

3. Select the report to run.
4. Click Run Now to run the report immediately, or Run Later to schedule the report.
5. If you chose Run Now and have a multi-tenant deployment, select the Organization for which you want to run the baseline report, and then click OK.

The report will run and the results will be displayed.

For baseline results, the values in the Profile Date Type column indicate whether the baseline date type is a Weekend (Saturday and Sunday) – 0 or Workday – 1. The values in Hour of Day, 1 – 24, column indicate the time on which the baseline is based.

You can further refine the results of reports and baseline reports as described in Using Search Results to Refine Historical Searches.

For baseline reports, you can create scatter plots of the report results, use the Quick Info menu to get more information about items in the report results, and also view geolocation information about the results. For other types of reports you can use all the charts and other methods of refining results that are related to historical search.

Related Links

Scheduling Reports

Using Search Results to Refine Historical Searches

System-Defined Baseline Reports

Overview of Historical Search Results and Charts

Using the Analysis Menu

Using Geolocation Attributes in Rules

Refining the Results from Historical Search

Report Bundles

Report bundles are groups of reports for common IT infrastructure analytics, such as Windows Server Health. Be defining a bundle and placing reports into it, you can run all the reports at the same time, and apply the same filter conditions to all reports. You can view system and user-defined report bundles under Analytics > Report Bundles.

Creating a Report Bundle Running a Report Bundle

Creating a Report Bundle

Creating a report bundle involves naming and describing the bundle, adding reports to the bundle, and then setting what you want to include in the report results.

1. Log in to your Supervisor node.
2. Go to Analytics > Reports > Report Bundles.
3. Click the + icon at the top of the Analytics navigation pane.
4. For Group, enter the name of the bundle, and then enter a Description.
5. Under Select Group Members, select the report category that contains the report you want to add to the bundle.

When you select a category, all the reports in that category will be added to the selection window.

6. Select a report and use the >> button to add it to the bundle.
7. Select Show Table if you want all reports to include tables by default.

You can set individual reports to show tables by selecting the report under Show Reports, clicking Edit, and then selecting Show Table.

8. Enter the number of Rows per Table.
9. Click OK.

Running a Report Bundle

1. Log in to your Supervisor node.
2. Go to Analytics > Reports > Report Bundles.
3. Select a report bundle to run.
4. At the top of the Analytics navigation pane, click the blue Arrow
5. For multi-tenant deployments, select the Organization for which the reports should apply.
6. Select the Time Range for the results.
7. Set any Data Conditions to use in filtering the results.

The most common use cases for setting data conditions involves imposing additional restrictions on the reporting devices, for example reporting devices IN a particular device group. These conditions are AND-ed to the filter conditions in every report of the bundle.

8. Click Export.

The reports will run in the background, and when ready, you will see a dialog to save or download the PDF files.

Identity and Location Report

Overview

The Identity and Location Report Display Fields

Report Information and Event Types

Creating New Identity Events

Overview

The Identity and Location report is constructed by associating a network identity like an IP address, or MAC address, to a user identity like a user name, computer name, or domain, and tying that to a location, like a wired switch port, a wireless LAN controller, or VPN gateway. When any element of these associations changes, a new entry is created in the report.

The associations between IP addresses, users, and locations are obtained by combining Windows Active Directory events, DHCP events, and WLAN and VPN logon events, with discovery results to produce a report combining all of this information into a comprehensive listing of users and machines by their identity and location.

The Identity and Location Report Display Fields

The Identity and Location Report contains these display fields:

Report Information and Event Types

This table lists the events and event types that contribute to information in the Identity and Location Report, as well as what information is collected for each type of event.

Creating New Identity Events

There may be a situation in which a new event type is added to AccelOps, and you want to use the parsed attributes of that event in the Identity and Location report. Once you have made sure that the event will parse correctly, you will need to edit the identityDef.xml file for your Supervisor and any Worker nodes in your deployment.

1. Log in to your Supervisor host machine as admin.
2. Change the directory to /opt/phoenix/config/xml.
3. Logon to AccelOps Super as admin
4. Edit the xml file:
   1. Create a new <identityEvent>.
   2. For <eventType>, enter the ID of the event containing the identity attribute.
   3. For <eventAttributes>, enter the name of the event attribute and its corresponding identity attribute. For reqd, enter yes if t he event must have this event attribute for use in the identity and location report. Possible location attributes include: ipAddr macAddr computerName domain domainUser aaaUser vpnUser geoCountry geoState geoCity geoLatitude vlanId netEntryPt netEntryPort
5. Restart identityMaster and identityWorker
6. Repeat for any Worker nodes.

This code sample is an example of a new <identityEvent> entry in the identityDef.xml file

Creating a Report or Baseline Report

Creating a report or baseline report is like creating a structured historical search, because you set the Conditions and Group By attributes that will be used to process the report data, and specify Display Fields to use in the report summary.

1. Log in to your Supervisor node.
2. Go to Analytics > Reports, and select the category for your new report.

Select Baseline for baseline reports.

3. Click New.
4. Enter a report Name and Description.
5. For baseline reports, select Anomaly Detection Baseline.
6. Enter the Conditions to use in your report.

See Selecting Attributes for Structured Searches, Display Fields, and Rules and Using Expressions in Structured Searches and Rules for more information on setting conditions. For creating baseline reports, see Baseline Reports for information on how to use the STAT_AVG and STAT_STDDEV functions in creating expressions for baseline reports.

7. Select the Group By attribute to use in processing the search results.

The topic Example of How a Structured Historical Search is Processed explains how the Group By attribute is used in search results.

8. Set the Display Fields to use in your search results.

See Selecting Attributes for Structured Searches, Display Fields, and Rules for more information on using event attributes in display fields.

9. Click Save.

Your report will be saved into the selected category, and you can now run it or schedule it to run later.

Related Links

Creating a Structured Historical Search

Selecting Attributes for Structured Searches, Display Fields, and Rules

Example of How a Structured Historical Search is Processed

Using Expressions in Structured Searches and Rules Baseline Reports

System-Defined Baseline Reports

The following system provided baseline reports are continuously running in the system.

Network Traffic Analysis

Performance / Availability Monitoring

Logon Activity

Network Traffic Analysis

Performance / Availability Monitoring

Logon Activity

Reports

You can think of reports as saved or pre-defined versions of searches that you can load and run at any time. AccelOps includes over 2000 pre-defined reports that you can access in Analytics > Reports. Topics in this section describe how to access and view information about reports, how to create baseline reports, and how to use specialized reports like the Identity and Location report. You can refine the results of your reports in the same way that you would refine the results of an historical search or a real time search.

Baseline Reports

System-Defined Baseline Reports

Creating a Report or Baseline Report

Identity and Location Report

Report Bundles

Creating a Report Bundle

Running a Report Bundle

Running System and User-Defined Reports and Baseline Reports

Scheduling Reports

Viewing Available Reports

Baseline Reports

How AccelOps Sets Baselines

Evaluating Rules and Detecting Deviations

When you are setting up AccelOps to monitor your IT infrastructure, you may want to define what is “normal” activity within your systems, and have incidents triggered when a a deviation from that normal activity occurs. For example, you can always assume that there will be some logon failures to a server on a daily basis. Rather than creating a rule that will trigger an incident when a certain hard-coded number of failures occurs, you can set up baseline reports that will trigger an incident when the total number of logon failures over a time period is twice the average over the same time period, or when the deviation from the average is threee times the standard deviation over a specific time period.

By creating a baseline report, you can set mean and standard deviations for any metric and use them in rule, and AccelOps will evaluate the current monitored values against the mean and standard deviation for that time period.

How AccelOps Sets Baselines

Establishing a baseline means recognizing that data center resource usage is time dependent:

Usage is different during weekdays and weekends, and may also be different depending on the day of the week or month Usage is dramatically higher during business hours, typically 8am-5pm

AccelOps maintains distinct baselines for weekdays, weekends and for each hour of day – a total of 24*2 = 48 buckets. Baselines for days of the week or month are not maintained to save memory usage, as this would require 31*24 = 1764 buckets, a 15 fold-increase of memory.

A baseline report is a set of Keys that represent the baselined metrics, and a collection of Values. You can see examples of these Keys and Values in the System-Defined Baseline Reports. These are then used in this process to build the report:

1. During the current hour, the Supervisor and any Worker nodes operate in parallel to save a baseline report in memory by analyzing the report events as a stream.
2. When the hour finishes:
   1. The report is written to disk (on NFS for AccelOps cluster).
   2. The Supervisor module summarizes individual baseline reports from all nodes and forms the baseline for the current hour. c. The baselines are stored in a SQLite database on a local Supervisor.
   3. The Supervisor module reads the previous baseline for the current time interval from the SQLite database. Then it combines the previous values with the current values to create a new baseline.
   4. The new baseline is then stored in SQLite database.
3. For the new hour, a new baseline is created following this process

As this process illustrates, baselining is continuous in AccelOps, and new baseline values are learned adaptively.

Evaluating Rules and Detecting Deviations

A baseline rule contains expressions that involve using the functions STAT_AVG() and STAT_STDDEV() to set dynamic thresholds.

These examples show how STAT_AVG() and STAT_STDDEV() would be used to evaluate the conditions for the example of logon failures in the introduction to this topic.

When AccelOps processes these rules:

1. Rule engine computes the current values in memory.
2. Every 5 minutes:
   1. It looks for STAT_AVG(X:ID) and STAT_STDDEV(X:ID) in memory
   2. If it fails, it retrieves them from the SQLite database and caches them for future use during the hour. c. Evaluates the rule conditions

A sample rule condition involving statistical functions is shown below with (X = AVG(fwConnCount); ID = 112).

Viewing Rules

AccelOps includes a large set of rules for Availability, Performance, Change, and Security incidents in addition to the rules that you can define for your system.

1. To view all system and user-defined rules, go to Analytics > Rules.
2. For multi-tenant deployments, use the Organizations menu in the upper-right corner of the Rules List pane to filter rules by organization.
3. Select any rule in the Rules List to view information about it.

All rules have three information tabs: