 |
|
|
Any CIO or CTO can tell you about the importance of monitoring. In fact, they
would consider it one core component that must be present for any network to be
succesful. Not monitoring your network is like flying blindly.
There are several things to be monitored on a network and correspondingly
there are several ways to monitor.
The following diagram illustrates the most common way of monitoring your network.
On this network, the router, server, desktop and laptop all send their status to a centralized
console that shows instant data on intrusion attempts, low disk space, virus outbreaks,
un-patched Microsoft software, and backups. Most devices on your network can send data
to a monitoring console via SNMP and you can pull information via custom scripting solutions
such as WMI.
We offer several options for monitoring your network and most of them are included
when you subscribe to a monthly maintenance agreement. Surprisingly, many businesses
are not aware of the need to address many of these issues. Some of the things requiring
monitoring include the following:
Event Logs
This is the central repository for all events that happen on your server.
While all events are logged to this facility, it takes a human with knowledge of your network
to browse these logs on a regular basis and check for things such as the following:
- Intrusion attempts - examining the security log will show failed attempts to access
resources on your network.
- Failing devices - things like hard drives, memory, and power supplies will start to
show problems well before there is an actual failure.
- Corrupt programs - failing programs will show up here and could be a sign of bad sectors
developing on a hard drive.
- Bad drivers - when a driver fails, so does a component that is attached to it.
This is often a sign of imminent failure of the server.
Performance Monitor
This is where the overall performance on the server is measured.
When performance degrades, the entire server is affected. We install monitoring scripts that
check all key resources and send alerts when a certain threshold has been reached.
Some of the key devices to monitor include the following:
- CPU - if the CPU is consistently running at a high percentage,
either the server is under-powered, or some program is consuming valuable resources.
- Hard Drives - if the hard drives are constantly reading and writing,
there can be a problem with insufficient memory or an under-powered processor.
This will cause a hard drive malfunction sooner due to the constant load.
Another key counter to check is free space. Lack of free disk space will cause
a server to slow to a crawl and eventually crash.
- Memory - insufficient memory will cause wear and tear on your hard drives.
Also, malfunctioning memory modules will cause intermittent problems with programs
running on the server.
Antivirus
The best plan for Antivirus in an enterprise is installing a centralized server-based antivirus software.
If your company has an internal email server, it is also important to have an antivirus scanner
directly on the server that scans each email before it get to the users desktop.
The following items are included in this plan:
- Updates- it is very important to make sure that your updates do not expire.
With the sheer number of viruses released each day, having expired updates is synonymous
with not having any antivirus at all.
- Outbreaks- keeping abreast of the latest virus outbreaks is important for
troubleshooting purposes. Many times a virus will cause problems in other parts
of your network due to the sheer number of inbound violations.
Firewall Logs
The firewall keeps a record of all activity and dumps it into a log file.
This file resides on one of your local servers. Due to the huge amount of data,
a specialized log analyzer is employed to sift through the contents and report on any problems.
When there is a sign of a breach, the logs must be read and appropriate action must then be taken.
Sometimes the action taken is disallowing the other computer connectivity to your network -
we can "blacklist" any computer or entire network with a few commands on the firewall.
Backup
A consistent backup is essential to any solid disaster recovery plan.
The following items must be done on a regular basis to maximize success:
- Sending a daily email on the success or failure of the backup.
- Periodically restoring a test file to ensure data integrity.
- Enabling an online backup in the form of a .zip file for a second backup system
and for easy restoration of deleted files.
Service Packs & Hotfixes
Microsoft is continually finding huge vulnerabilities in their Operating Systems
and programs and releasing fixes in various forms on the Internet. The job of any good network
manager is to assess these fixes and determine if they are needed based on the current setup.
Some fixes actually cause more problems than they are worth. This is done on at least a weekly basis.
- Operating Systems
- Office Applications
- MS SQL Server
- Exchange Server
|
|
