Planet Network Management

A collection of blogs based on VMworld 2010 U.S. conference held this week in San Francisco prove that VMware got its message out – it is more than a virtualization company.

VMworld 2010: A “New IT Stack” and Management & Security are No Longer Aftermarkets

Yankee Group Principal Analyst George Hamilton explains how VMware wants to become the data center operating system and why recent acquisitions of companies such as Integrien and TriCipher will give the virtualization giant the IT management and security technology it will need to achieve its lofty goals.

Virtualization Deployments and the “Trough of Disillusionment”

Stephen Elliot, vice president of strategy for CA Technologies Infrastructure Management and Data Center Automation business unit, took away from VMworld 2010 the impression of a more mature market for virtualization, one in which customers realize they need IT automation, management and other technologies to move beyond initial deployments, over the hump of virtual stall and toward large-scale implementations that could extend into private clouds.

VMware acquires Integrien, TriCipher for IT-as-a-Service Era

ZDnet’s Virtually Speaking blog, authored by Paula Rooney, also focused on VMware’s acquisition news this week. The pending acquisitions of Integrien and TriCipher can help VMware – as well as its customers – move into the third phase of virtualization – IT-as-a-Service, according to Rooney’s post.

Hey Security Guys, VMworld is hitting your playground

Blogger Kendrick Coleman, who co-presented on free tools to manage VMware vSphere, also blogged this week to discuss the virtualization giant’s plans to take on security in current and future product releases.

VMware vShield: A Good Start, but …

Jon Oltsik, senior principal analyst at Enterprise Strategies Group, took to Network World’s Cisco Subnet blog to share his take on VMware’s vShield product plans. While he notes the efforts from VMware are needed and a great beginning, Oltsik points out some potential weaknesses that could help VMware deliver stronger security in future releases.

What was your favorite VMware VMworld 2010 blog? Please leave a comment here or let me know directly via e-mail at Denise.Dubie@ca.com.

Do you Tweet? Follow Denise Dubie on Twitter here.

A small step for SourceForge, a big step for Icinga. Yesterday we passed the 20,000th download of Icinga on Sourceforge.

We think this is a great success for our young project and also an indication for a growing community. Thanks to everybody using and supporting Icinga.

50,000…. We are coming!

I recently gave a presentation at the IDC Asia Pacific CIO Summit 2010 around Identity & Access Management (IAM) and security. It struck me that I should write up and share what I discussed and let you see the slides. Basically, my presentation comes down to the fact that IT managers need a secure and cost-effective approach to IAM.

Security threats are increasingly becoming focused on where an enterprise keeps its critical data: the servers, databases, directories and in other technologies. If these are accessed by unauthorised users, the risk of a business critical data breach, revenue loss, and compliance fines could emerge. With the best of intentions, a simple mistake within a directory-based application among which the above technologies are acting as ‘managed resources’ can knock out access for many people, and for some organisations, can cost equally impressive amounts of money.

A significant challenge faced by organisations today is related to the implementation of intelligent and integrated management of user activity and their access to appropriate systems. Time, money, and effort are invested in collecting security trends about what is happening. However, the problem arises when getting a long list of "whats" does not contribute much to addressing the issue unless it is paired with the “who" and the “when”. Correlation of identity, event, and data provides the most direct route to identifying threats before significant damage is done, but subtracting any one of those reduces the significance of security information so much that the value is doubted.

Distributed environments and complex data centres are already hard enough to manage. If you add an army of power users within an organisation that needs appropriate access to all this technology, it’s imperative that an identity management solution is implemented effectively and timely. IT managers need a secure and cost-effective approach to identity and access management by:

1. Centralising and automating administration
2. Eliminating the complexity of managing multiple identities
3. Enforcing controls necessary to achieve compliance
4. Capturing and securely storing audit events and
5. Easily producing meaningful reports.

However, there are three major flaws or stumbling blocks to proper implementation of such solutions. Let’s take a closer look.

Flaw 1: Employee de-provisioning

It has been an ongoing problem for organisations to properly de-provision a user who has left the company. Too often, accounts are still active, or some kind of accessibility to enter the corporate network from an external location is possible. This gives an opportunity to take information or—if the person is of the right mindset—leave corruptive malware behind. There is a need for organisations to tighten their security measures and workflows for de-provisioning to eliminate former employees’ accessibility.

Integration with the human resources databases to ensure faster response on the elimination of accessibility is the key. Also, watch shared accounts and be prepared to raise the level of activity monitoring if needed. Finally, automated workflows would be the safest approach to ensure all accounts are dealt with and fully documented so they can always be referenced.

Flaw 2: Lack of a centralised identity management solution

Organisations should consolidate and centralise the access controls with one directory service. From here, the access can be extended to other systems and applications to encourage consistent security and configuration policies. Drive down the management headache

and drive down the management cost.  

Risking having multiple accounts to manage on various systems gives way for a lack of synchronisation and upkeep and multiple points of a breach that can be hard to track if there are many diverse systems. It’s easy to stay under the radar when not everything is accessible from a central location and a generic system that isn’t centrally managed may be the back door that allows for unauthorised access.

Flaw 3:  No secure privilege delegation

As we delve deeper into IT security and privilege in the data centre, we must understand how the definition of privilege is evolving. The excessive privileged and access control rights for users have critical financial impact on organisations with regard to the risk of a data breach, revenue loss and compliance fines.

To reduce the chances of unduly solicitation of data by outsiders, it is recommended that organisations implement tighter control by reducing the number of administrators. It eliminates the risk of accidents by managing tightly who can do what, improve auditing, streamline and simplify compliance.

To summarise, managing the identity and integrating identity into an organisation helps protect assets and reduce the impact of a breach. Risks can be properly mitigated, compliance penalties may be avoided, and in general, the overall access to critical information is under tighter control.

While the beta test of PRTG 8 is running we are posting a series of blog articles about new features! In the last blog entries, a lot of new features have already been introduced. To give you an extensive insight into the new Ajax web interface, we've compiled a series of screenshots so you can directly dive into the new look & feel of PRTG.

Devices Tree View

The tree view lists all of your devices in hierarchical order. Here, the Root group is shown with groups and devices, and the sensors for the devices. On the right side, summary charts for monitoring data are shown, as well as a geographical map indicating the location for every device.

Device Detail View

The detail view of a device lists all sensors, monitoring different aspects, such as Ping, different protocols, and ports with status and mini-graphs. Here, a hardware firewall is shown. On the right side, summary charts for monitoring data are shown, as well as a geographical map indicating the location of the device.

Detailed Graph

Detailed graphs visualize your monitoring data. Here, a graph for a Ping sensor is shown. Every line shows one channel of the sensor, such as downtime, minimum and maximum response time, and average Ping time, and Packet Loss in percent.

Toplists Show Bandwidth Usage

NetFlow, sFlow, and Packet Sniffing sensors support customizable toplists. They show the bandwidth usage by IP address, protocol, etc. Here, a toplist of the Top Talkers for a time span in August is shown. The chart shows the bandwidth usage by IP in percent.

Stacked Graphs

Stacked Graphs visualize the components of the total bandwidth usage. The screenshots below show:

1. Packet Sniffer graph, with traffic split into different protocols.
2. The traffic of Paessler's fiber optic connection. Traffic in and out are split at the x-axis, showing traffic out mirrored to traffic in.
3. CPU load graph. Each CPU's load is shown in one graph; the single stacked graphs show the CPU total usage.

Easy Sensor Setup

You can choose from over 80 different sensor types. You can choose a sensor by category, or simply search for a sensor type name.

Alarms and Warnings Lists

The Alarms list shows all sensors that are currently in an Alarm or Warning status. It assists you to gain an overview of all problems in your network very quickly. The list shows the sensors' states, last value, message, and a mini-graph.

Create Own Maps

Using the Maps feature, you can create your own overviews of your network.  Simply add objects from your setup, for example, icons, data tables, or graphs. You can make every Map publicly accessible, if you like.

Create Own Maps—Add Objects

Adding new objects to your Map is easy: Simply select an appropriate icon from the list. You can also choose from geographical maps. Additionally, you can draw lines between objects to visualize network connections.

Cluster Status

Keep track of your cluster's status at any time. The Cluster Status page shows which nodes are connected to the cluster and if there are any connection or performance problems.

Beta Test it Today

Why not go and see for yourself? Download the latest Beta version today and have a look! All information can be found on the PRTG 8 Beta web page.

Last time I posted about Applications Manager's ability to monitor custom applications. However today I will post about an interesting question we got in support from one of our customers. Basically it will help you reduce one step from your usual server troubleshooting handbook. Interested ? Please read on.

Can I/you generate a list of all system processes by CPU/Memory usage when a CPU threshold is violated on a Server monitor?

Answer is YES! We can generate a snapshot of all processes arranged in descending order based on the usage (CPU/Memory) for each process on occurrence of a CPU or Memory alert for Server monitors. This can be done by associating a Threshold and Email Action to the CPU Usage % or Memory Usage% attribute of the Server Monitor. Please refer Threshold configuration and creating Email Actions from our Online Help Document.

Just a quick post to say that I have updated the OTRS package for OpenNMS. It no longer depends on the hard-to-find Perl SOAP::DateTime module and should therefore be a smoother install for new users. No new capabilities are added in this release so you can skip it if you’re already up and running. Thanks to Michiel Beijen of OTRS for the suggestion.

More details can be found in the OpenNMS wiki.

Just a short note that Ronny Trommer has modernized the OpenNMS VMWare Appliance.

There is a wiki page with details, and it can be downloaded from both the Virtual Appliance Marketplace as well as Sourceforge.

Puppet Developer Curriculum (3 Days)

This training is ideal for those who want a Puppet jumpstart. Newer members at an organization already using Puppet, or experienced sysadmins wanting to bring Puppet into their team will get everything they need to deploy solutions.

Prerequisites:

Attendees should have at least the equivalent experience of a junior Unix/Linux administrator.

Topics covered include:

• Day 1: Introduction to Ruby
• Day 2: Extending puppet
  • Overview of API that can be used to extend Puppet
  • Custom facts
  • Custom functions
  • Custom reporting
  • External node classifiers
• Day 3: Writing custom types and providers in Ruby

The topics are covered over 3 days. Sessions will mix theory and practice, balancing lectures with hands-on exercises. (Each student should bring a WiFi enabled laptop with VMWare installed to participate in the labs.)

Pricing

• $2,195.00 by September 27, 2010; $2,395.00 on or after September 28, 2010.

The last two years have been a wild and crazy ride for most companies. Mergers, acquisitions, layoffs, unexpected growth, and reorganization – it all comes down to change. They say that change is good and should be embraced, but sometimes change can have bad results, specifically when organizations don’t change their processes to support changing business models. 

The 2010 Verizon Data Breach Report has received some pretty serious media coverage lately, primarily because it highlights a disturbing trend – the threat of the insider. After all, 48% of breaches were caused by insiders last year. At the end of the day, companies depend on their workforces to drive productive and profitable business. Those workforces are made up of people (insiders if you will) who have specific opinions and feelings about change. Organizations should consider how their people will react to change – will it be embraced, will it cause consternation and morale issues? 

Enter process, stage left.  If organizations don’t consider both people AND process during a time of change, the consequences can be very negative. One of the most visible processes to consider during times of change is user provisioning. If organizations quickly align employee access with new roles and revokes unnecessary access, the threat of employees abusing their privileges is significantly reduced. Furthermore, by removing access of those employees no longer employed, organizations are closing doors that could easily be exploited by insiders posing as someone else or as outsiders gaining access to systems via dormant accounts. 

I happen to believe that people are good and will do the right thing, but I’m also a realist. I recognize we live in a time of real uncertainty that can cause folks to act in ways they normally wouldn’t.  As organizations adapt to new business environments, to ensure their future success it’s incumbent upon them to consider BOTH people and process.

That was an old Austin Powers reference for those who missed it ;-)   So, what do I mean by this?   Well, a question we get asked all the time by customers is “How do I get the pretty charts I see on my Orion website into a report that I can send to my boss on a regular basis to make him/her happy?”.    Seems like a reasonable request, right?   But, before I dive into this topic, you’ll need to ask yourself what types of reports does your boss care about seeing?   Does she want the charts as well as the detailed data behind the charts?    Or, would she be perfectly happy with the Orion website pages she’s seen while looking over your shoulder?  

Let’s start with the latter use-case since it’s the simplest and requires only a few steps in Orion Report Scheduler.

How to send an existing Orion website page as a scheduled HTML email to your boss:

To begin, you’ll need to open the Report Scheduler app on your Orion server (Start > All Programs > SolarWinds Orion > Alerting, Reporting, and Mapping > Orion Report Scheduler).   Click the Add+ button to create a new report job.   You’ll see the following screen where you’ll want to fill in the job name and click Continue. 

 

On the next screen, you’ll see a prompt to add a link to a Web Report or Page in Orion. 

Rather than try to find this URL manually, simply click on the ‘…’ button and you’ll see a browser pop up where you can navigate to the Orion website page you want.   In this example, I’d like to send the “Top 10 List” page so I’ve logged in and navigated to that page below.  

When you click the “Use Current URL” button, this will automatically populate the previous screen as you can see below.  Notice that I’ve also checked the “Retrieve a Printable Version of this Page” option.  This will remove the banner and the menu bar from the page.   BTW, if you’re like me and you can’t stand to wait, try adding “&printable=true” to the URL in Orion to see what the page will look like when it’s sent.

When I click “Continue”, you’ll see I can set up my schedule.   In this case, I’m going to send it every morning at 8am.  You can also schedule it to be sent weekly, monthly, or just this once.

Finally, you’ll need to enter the email address of the folks you want to send it to.   If you want the email to actually go anywhere ;-), make sure to also fill out field on the “Email From” and “SMTP Server” tabs.

Click “Continue” one more time, enter the Windows credentials you want this job to run under (use a service account whose password doesn’t change often), and then you’re done!   You should see your new job listed in the Report Scheduler window.    If you want to run it now to test, simply right-click and select “Run Selected Job Now”.   Just be aware that if it works, your boss will be getting the email each time you run the job!

NOTE:  Some of you may have issues with your email server gobbling graphics in HTML pages.  If you can’t work around this, fear not because we’ve got a solution in the works.  As noted on this post, we’re working on enhancing Report Scheduler to allow you to send Orion pages and reports as PDF email attachments in addition to HTML.  

Ok, but what about first use-case?  That is, the management team that wants their charts and their detailed table-based data too?    Well, you have a couple of options in Orion to address that need.   It’s a little more involved so I’ll talk you through that in part 2 of this series.  

In the meantime, have a great weekend and please let me know in your comments if there’s anything else you’d like covered in part 2!

Please join Tenable's own Ron Gula, Renaud Deraison, Marcus Ranum and Paul Asadoorian for a Security Showcase on October 6, from 8:30am to 2:00pm at the New York Marriott East Side, 525 Lexington Ave. at 49th Street in New York... Paul Asadoorian

This blog was a test for me personally to see if there was any interest in network monitoring and news and stuff related to op5 where i work. The test has been successful, so I have now moved this blog to our new official op5 blog. We have set up a blog platform in order to collect the 5 different blogs, individuals at op5 has started. We hope to make it easier for you as a user to find and follow the posts from any of us.

It’s coming to a year since our first RC 1.0, and we’re still getting much interest in Icinga. Of course, the age old question arises time again–“What’s the difference?”

We’ve tried it in words, we’ve tried it on YouTube and now we’ve tabled it! Thanks to a clever suggestion made by an Icinga user – kudos to Dorian Gray!

Check out the Feature Comparison Table, which puts the latest Icinga 1.0.3, Nagios 3.2.1 and Nagios XI side by side. But as always, the best way to compare is to try it for yourself- download it and let us know what you think.

...or the Southern Hemisphere's Winter.  We have a few members from Australia and New Zealand on this forum so I don't want to leave them out!  As many of you know, I live 2 degrees north of the equator and it's a permanent summer for me

In my absence, due to my circumnavigations, I did not provide any forum highlights last month. So, I've decided to give you a larger update with 10 posts worth noting from the last two months. I would like to send out a special THANKS to my friend and colleague in the London (Staines) office - Alain Salesse - for doing a smashing job providing some very useful custom scripts at the requests of several members of the forum.

1. CounterCorrelate Job for 3+ Counters - by Tim Thomas
2. Monitor Scheduled Tasks by Nelly Figueroa 
3. A Question Regarding Ports by Sam UK
4. Clustering Control Centre by Chris Abel
5. Tracking missing data by David Gringas
6. SQL DSN Issues by Tim Thomas
7. NT Disk Space Job by Ed Knight
8. Troubleshooting NetIQCTRL errors by Gabriel Rosas
9. Monitoring EMC Clarion Devices by Ed Knight
10. Assigning or Removing Custom Properties through a script by Jignesh Jogi

Happy Reading and enjoy!

These are my links for July 9th through September 1st: 500 Internal Server Error – 500 Internal Server Error 500 Internal Server Error – 500 Internal Server Error Seattle Met Magazine / Real Estate / Real Estate Articles / Detail – 107 Neighborhoods by the Numbers -

Nagios Core 3.2.2 has just been released and can be downloaded from www.nagios.org/download. Thanks to everyone in the community that contributed to this release! This latest stable release include several bug fixes, so we recommend you upgrade your older Nagios instances when you get the chance. The changelog is available here.

I just wanted to share a site we came across through a response to our survey (which is still open if you haven’t had a chance to check it out). It is called OpenNMS Patterns and Scripts and it is definitely worth a look. It’s subtitled “Implementing OpenNMS in an enterprise IT environment” and it consists of issues that one might face when deploying OpenNMS along with corresponding solutions. Hat tip to Doug Bakewell for making this happen, and I look forward to his future posts.

As I was checking out the OpenNMS iPhone app today, I noticed that it was published on September 1, 2010.

The OpenNMS Group opened for business on September 1, 2004, so happy anniversary to us. We’ve been so busy I almost forgot about it.

One of the traditional gifts for the sixth anniversary is iron, and I have been blessed to work with the best team one could ever hope to put together – they are Iron Men, every one.

For most people, seeing the business behind OpenNMS get another year older is a non-event. But if you had been a part of it, and had to listen to those “in the know” telling you time and time again how you can’t possibly run a business where you give the software away, that you can’t succeed without outside investment and you can’t possibly grow, each year we’re here is more proof that they are wrong.

I love my job, and I just want to thank everyone who makes that possible. Six years down and many more to go.

UPDATE: There have been some people reporting that it does not run on iOS 3. We are working on determining the issue, but it is confirmed to work on iOS 4 devices.

After nearly a year of work, the OpenNMS iPhone App is now available from iTunes.

It costs US$4.99 and folks with commercial OpenNMS support subscriptions should just drop me a note for a free voucher code.

As I know there will be a few questions about this, I’ve tried to anticipate a couple of them.

Q: Hey, OpenNMS is free software. Why you chargin’ me $5?

OpenNMS is 100% free and open source software, and the iPhone app is no exception. The code is hosted in our git repository and there are complete instructions for downloading and building it on your own.

But, it was not a painless or inexpensive process to get this app created. In fact, the main reason it got completed is that we sent Ben off to the Apple Worldwide Developers Conference and he learned what he needed to finish it (as well as to make it iPad compatible). That little junket cost us about $2000 – or nearly 575 copies of the app once Apple takes their cut.

So we decided to charge for the app but make sure than those who want to take the time have full access to the code.

Q: What about an Android app?

I would love to have an Android version of this app, but at the moment no one has stepped forward to own it. We do have a Nexus One at the office so the hope is that it will happen, and happen soon, but no promises.

So earlier today the nice folks over at twitter figured it was a good time to change all the authentication to oauth ... they might have announced it all over the place .. but it never catched my attention

The onlything that did catch my attention was that after not having ued pidgin for about 2 weeks I didn't have access to twitter anymore.

I`m using the purple-microblog plugin and the default version of that plugin in Fedora 12 wasn't really up2date. The plugin supports OAuth as of 3.0 which was released ages ago.

The version in fedora-updates-testing however was already recent enough ..

So enabling that repo and running
yum  update  purple-microblog
quickly solved my proble .. till I disabled twitter in my pidgin again as there was way to much talk about some weird fruit ...

I’d like to follow up this week’s announcements of VMware’s IT as a Service strategy and VMware vFabric by zeroing in on the challenges surrounding cloud application performance management, and how vFabric Hyperic can help you meet those challenges.

As our CEO Paul Maritz mentioned at yesterday’s VMworld keynote, our industry has hit a tipping point where virtualization has surpassed the physical computing paradigm, due to a need for IT to quickly respond to dynamic business needs at ever-improving price points. To ensure even greater agility and value, the next destination for our industry is cloud computing. Making this shift requires a pragmatic, evolutionary approach that leverages investments in existing architecture.

Yesterday, Rod Johnson, SVP of VMware’s Cloud Application Platform Division, described how VMware vFabric is a key element of enabling our customers to reach this next destination of cloud computing. Delivering the agility and value promised by cloud computing requires a new kind of application — cloud applications — that have their own unique characteristics:

• Dynamic architectures
• Elastic capacity
• Extreme scalability
• Open choice

How do cloud applications change performance monitoring?

These characteristics of cloud applications bring new requirements to application performance monitoring. For instance, dynamic architectures and elastic capacity imply a datacenter defined by constant flux, with pools of hundreds, even thousands of VMs continually being started and stopped, vMotioned, reverted to snapshots, and so on.

This blistering rate of change is a natural outgrowth of responsiveness to business needs. But it is impossible to manage with manually maintained, complex configuration files used by legacy monitoring tools. The only way to get ahead of it is to use a monitoring product that can automatically discover changes to your entire application infrastructure — everything from the application code itself to the vSphere host. Hyperic Autodiscovery does exactly that, updating itself within moments of app infrastructure changes.

The extreme scalability required by cloud applications requires a lot of virtual machines – which leads to a firehose of performance data. For instance, a typical Hyperic customer will collect a million performance metrics per minute. It’s not at all hard to get to this volume of metrics, since we have a number of customers running 1000 (or more!) virtual machines, each with a Hyperic agent collecting about 1000 metrics. So, even though we’re not talking about Google-level scalability, application performance data become a performance problem in itself if not managed properly. Thankfully, Hyperic is engineered to handle high volumes of application performance data.

Open choice means that cloud applications can be built from a wide range of components. For instance, as Rod pointed out yesterday, cloud applications might use WebSphere, WebLogic, JBoss, and our own vFabric tc Server, as well as public cloud platforms, for their Java application server tier. It’s critical to have a monitoring tool that supports a range of popular web application technologies out of the box. But no one tool can support every conceivable technology. It’s understandable – there’s no way one vendor, no matter how innovative, can keep up with the thousands of other innovative companies in our industry. So in addition, it’s critical to have a monitoring tool that makes it easy to build custom monitoring plug-ins, and makes its built-in plugins open source to provide a wide range of code to reference and leverage. Hyperic delivers on this front, providing approximately 50,000 performance metrics for 75 web application technologies, as well as open source plugin code and a fully-supported plugin API that has been used by third parties to extend the range of technologies monitored by Hyperic.

What’s next for Hyperic?

We’re demonstrating vFabric Hyperic live at VMworld, in the main VMware booth. Come see for yourself how Hyperic adjusts to changes in virtual infrastructure in near real-time. Later this month, we’ll demonstrate Hyperic at Oracle Open World in San Francisco, September 19-23, and after that, we’ll be at Spring One 2GX in Chicago, October 19-22.

We’re committed to making Hyperic the leading choice for monitoring cloud applications, with their inherent dynamicism, scale, and openness, and we’re looking forward to working with you — our open source community, our users, and our customers — to make this happen.

As I tore off the first month of my over-sized school-year calendar I was reminded of my first week at Puppet Labs. I woke up early, made breakfast, and caught a bus into downtown arriving 30 minutes early only to be reminded that I didn’t yet have a key to the office. I plopped down in front of the door to wait for someone else to arrive, and opened my notebook to review the topics for my first official meeting with my new boss. Scrawled in my notebook are limited, and partially illegible jottings I took from our previous conversation. Unfortunately, between his Australian accent, frequently altered speech tempo, and foreign use of commonplace terms, and the fact that my penmanship skills hover around a 3rd grade level, all I could make out is one line: “Puppet Camp-do it.”

With that extravagant amount initial information, the last four weeks, James’ guidance, and the help of our wonderful in-town event planner Julie, I have hobbled together what I think will be a pretty awesome event. So without further ado I give you the top five reasons to attend Puppet Camp:

Reason 1: You Own It

Puppet, and Puppet Camp are user driven. Without the community the product, and the event would fall to pieces. With that in mind Puppet Camp is run as an “unconference” or “open-space” conference. Essentially, while we have some morning lectures planned, they can be influenced by the audience and deviate from their topic or forget about it all together depending on your wants. Similarly our afternoon breakout sessions are completely user generated. During morning break and lunch you have the opportunity to suggest any number of topics for afternoon breakout sessions. Speaking of breaks of course brings us conveniently to…

Reason 2: The Edibles and Drinkables

We’ve got a pretty reasonably sized breakfast of fresh fruit, yogurt, bagels and cream cheese, and muffins to serve along with juice, coffee and tea. Breaks are accompanied by cookies, and soft drinks, and lunch features a soup, salad, roasted veggies, and a sandwich bar buffet with chicken, roast beef, and hummus. While you may be on your own for dinner, we are offering an open bar at Swig on Thursday night which will offer…

Reason 3: Networking Potential

Short of sharing a plate of spaghetti, there really isn’t a better way to forge relationships than over a pint and one of Swig’s 150 whiskeys and whiskies. Whether you want to find your next employer, meet Volcane, or just swap stories with other Puppet users, Puppet Camp provides the opportunity. Because of the events’ flexibility, it caters to novice Puppet users, Puppet Masters, and everything in between, behind, and around. You’ll be amazed by the people you’ll meet, the industries and companies they hail from, and the size of their Puppet implementations. As you converse, hopefully…

Reason 4: You’ll Learn, Learn, Learn

You’ll learn more about Puppet in 2 days that you could have in a month. You’ll learn about our future goals for the product, trade-secret work-arounds, and a whole host of other information. No matter how active you are in the community there is really no equal to learning, face to face, from other users. The exchange of knowledge Puppet Camp induces is by far its most valuable aspect, which leads me to want to end here but…

Reason 5: You Really Ought to Attend Developers Training

If you can stay the weekend you can sign-up to attend Puppet Developers Training starting on Monday, October 11th and ending Wednesday the 13th. Developers training teaches you how to extend Puppet by adding custom facts, types and providers, and more. This class is offered on a limited basis so be sure to sign up if you have the chance.

In addition to all opportunities and benefits listed above, you’ll get some exclusive Puppet Camp swag, and get a well deserved opportunity to visit San Francisco. You can reside with us at the Serrano Hotel using our group discount code or take to the city and explore. I hope you join us for Puppet Camp 2010. We’ve got an awesome line up of presenters and entertainment waiting for you in San Francisco.

VMworld 2010 session offers insight into myriad tools that can help IT managers track performance, storage and more in virtual environments – without spending budget dollars.

By Denise Dubie

VMworld 2010 in San Francisco is flush with sessions on technologies to manage, secure and optimize VMware environments. Yet one session educated conference attendees on tools that could help them do all this – at no cost.

David Davis, vExpert, VCP, CCIE and video training author at TrainSignal and Kendrick Coleman, vExpert and blogger, teamed up to present a list of several free IT tools for vSphere management. The joint presentation offered insight into more than 10 tools and each speaker offered their take on why the free application helped monitor performance, migrations or storage, for instance. The endorsements by Davis and Coleman should cause many IT managers to at least check out the no-cost technology.

Here in no particular order are 10 of the many free tools mentioned during the presentation.

VMware Guest Console

Veeam FastSCP

Trilead VM Explorer

XtraVirt: vSphere Client RDP Plug-in

VKernel Capacity View

vSphere Mini Monitor

RVTools

Vizioncore vFoglight QuickView

Xangati for ESX

SolarWinds VM Monitor

Also for more information on vSphere management and additional detail on free tools, check out Davis’ blog here and catch up with Coleman’s posts here.

What free tools do you depend on to manage your virtual environment? Are there downsides to using no-cost applications? Please leave a comment here or let me know directly via e-mail at Denise.Dubie@ca.com.

Do you Tweet? Follow Denise Dubie on Twitter here.

It has been a while since anyone has written a direct blog entry on event correlation here at Splunk so I thought I would write one today. Event correlation can loosely be defined as a technique to relate any number of events with some identifiable patterns (and optionally act upon the relationship). Security vendors may narrowly claim that event correlation is the ability to correlate security related events and alert upon their existence. This is a subset of what event correlation can be. For instance, in a hypothetical case,  I can correlate that if it rains on a major Monday holiday, end of day total sales are lower than average sales for a brick and mortar retail shop. This case would have nothing to do with security, but it is a form of event correlation, that can be performed in Splunk as soon as the data is indexed. In fact, I would ascertain, that event correlation is an important aspect for use cases that not only involve security, but also, fraud detection, data intelligence, root cause analysis, operations support, and general mean time to resolution.

With Splunk, because of Universal indexing of all the search terms in your data and search time field extraction capabilities, event correlation becomes a natural feature for it. There are multiple ways to achieve different types of event correlation within Splunk. What I will do is provide a non-exhaustive list of some of the methods that can be used to accomplish this.

Manual Event Correlation

Every time a Splunk user performs an ad-hoc search and pivots on results to find what else happened in the same time line, he or she is manually performing event correlation with time being the universal pattern to relate events. For instance, the user can use the Splunk time picker to narrow down a time and then type something as general as “error” into the search bar to search.

After receiving results, the user can then use the histogram to zoom in on a particular event’s time line and then use * as a search term to see what else happened at that particular frame in time.  Events are correlated by search using time as the pivot. This is what I call manual event correlation, which is just as important as automatic event correlation, for troubleshooting. In what follows, I will discuss the various ways Splunk can be used to automate different types of event correlation.

Transaction Search

Splunk has created “Transaction Search.” What this means is that if events have similar values for extracted fields or starting/ending terms, Splunk can automatically correlate these events as a result of a search and group the returned results. Rather than repeat what has already been said about transaction search, I encourage you to read this blog entry by Maverick for an in-depth example. You can also see my SOA article for a real world use case on using transaction search to correlate event activity across application tiers.

On the other hand, as to not to have you leave this post, I’ll provide a small example on using transaction search. On Splunkbase, you can download an app that indexes on a daily basis the world’s most malicious IP source addresses, according to one source. Here’s a gratuitous screenshot.

Needless to say, you would want to know if any of these IP addresses appeared as source IP’s in your own logs. An example search such the as one below would group events that included the offending IP addresses in your own events.

sourcetype="ip_watchlist" OR (sourcetype="sshd" login accepted)|transaction offending_ip,src_ip maxspan=1d connected=f|eval count_sourcetypes=mvcount(sourcetype)|where count_sourcetypes>1

What this search does is say if someone has logged in using SSH and their source IP is one that is in the list of malicious IP addresses (the transaction command does the grouping) within a day’s span, and the number of sourcetypes in the grouping is greater than one so we know both sourcetypes were in in the grouping, then return results. You can save this type of search, schedule it to run on an interval, and then have Splunk automatically create an alert to notify you, if events are matched.

A variant of transaction search is statistical aggregation, where numerical aggregations of different fields are grouped by other fields. Here’s a simple example usage using mail logs that counts the number of bytes coming into each relay.

sourcetype=email|stats count(bytes) as byte_count by relay|sort - byte_count

There are times where you would rather use the Splunk stats command over the transaction command and this is described here.

Sub Searches

Another way to automate event correlation is to use the concept of a sub search. If you like the approach of an outer join in database terms, note that Splunk can perform sub searches to narrow down the criteria for one event and then perform another search on the first set of results. Again, as to not repeat what has already been written, here’s an article describing this feature for Event Correlation.

Although a related feature is not used as much, If you would like to join events stored with Splunk itself, Splunk does have a join search command. There may be use cases where performing the logical union of related events is necessary.

Lookup

Splunk has the capability to correlate with data that is external to Splunk using the lookup command. The most basic use for this is when you have some fields that are in your Splunk event that need to correlate to fields in an external CSV file. At search time, Splunk will perform the look up and introduce new fields from the external CSV file as patterns are matched. In essence, this enriches your existing indexed data with external sources at search time.

If you would like to correlate events with the same field value between external database tables and events within Splunk, Splunk’s lookup command can also be used to accomplish this. The basic idea is that a user written program will be called to perform the SQL to bring in new fields at search time. This is called a dynamic lookup as opposed to the static lookup accomplished by using a CSV file. In fact, because the program is developed by the user to perform the external lookup, you are not limited to CSV files or databases to perform lookups. Anything can be correlated using the lookup command if you have programmatic access to it. Examples could include a call to a web service, an external DNS lookup, or calling whois for an IP address.

Conclusion

In this entry, I have provided a non-exhaustive list of the most common ways event correlations are performed in Splunk. There are more subtle ways to accomplish this, but since this is a blog entry, I decided to start with the most prevalent usages. The main point I want to leave you with is that event correlation and subsequent alerting can be performed on any type of events that you choose to index giving you a powerful technique to analyze, aggrandize, and interpret data.

Science and engineering types like to know things.  Knowing feels good, even when it lacks practical application.  It feels even better when it is practical.  With this axiom in mind, this post will explain Orion APM’s Application Discovery process. 

In the discovery wizard, you select a group of servers first:

Next, you select a set of application templates. 

 

With the servers and application templates chosen, you provide a set of credentials that should work on the target servers.  I guess you could try credentials that you don’t expect to work, but that seems pointless.  Still, to each his own.

 

 

APM takes these three sets of data and conducts its discovery.  It considers each server in turn.  It will take the first server, the first set of credentials and the first application template and test the template against this server to see if there is a match.  What determines whether there is a match?   Under Advanced Scan Settings, there are four settings

Minimal Match = at least 1 component in the template works on the target node

 

Partial Match = at least 35 percent of the components in the templates work on the target node

 

Strong Match = at least 65 percent of the components in the templates work on the target node

 

Exact Match = all of the components in the templates work on the target node

To be complete, we compute percentage as (number of successful components)/(total number of components), where success is a component in the Up, Warning, or Critical states.

 

Here’s the full discovery process as a flowchart:

 

 

So what can you do with this info?  One takeaway is that the discovery process is serial.  If you pick a large number of servers, a larger number of application templates, and a lot of different credentials, the process will take unnecessarily long.  Use Domain Admin credentials, or similarly broad credentials, if you have them.  Furthermore, break your servers into groups such as Windows, Linux, Unix.  Break them down further if you have have naming schemes that tell you which servers are running apps such as Exchange.  There are different Exchange templates for different roles, and the discovery process will automatically sort that out.

That’s a fairly complete explanation of how the application discovery process works, but please post questions if there’s more you want to know.

 

Tenable Network Security recently received a patent for monitoring network traffic and analyzing it to perform discovery of systems, applications and vulnerabilities. This is the core function of Tenable's Passive Vulnerability Scanner and also a core component of our Unified... Ron Gula

Alright, so I don’t mean afraid of the dark meaning no lights on in the room.  What I do mean is being in the dark if the server Orion is on fails due to a hard drive or OS failure (for example) and you have no visibility into monitoring your network.

What do you do if this happens?  Sleep sound, my dear friend, we’ve got your covered with the new SolarWinds Orion Failover Engine.  The Failover Engine -- or FoE for short -- will monitor and protect Orion, including all of the installed modules, additional pollers and even EOC if you have this.  As you can see in the below marketecture graphic, you can monitor and protect all of your Orion machines.

Let me take you on a feature tour of FoE.  The FoE client, which can be run from the Orion server or loaded on your desktop, allows you to configure failover settings and monitor the current status of all your FoE installations.

 

The FoE monitors all of the SolarWinds Orion services, including the IIS web server on both the primary and secondary Orion servers.  Based on your preferences for each service you can define the behavior of what happens if a service stops/fails.  This allows you to define some self-healing behavior into the FoE instead of just doing a flat out failover.  For example, say the Orion Information Service stops.  Since this is the first time, let’s go ahead and re-start the service.  Hmm, nope that didn’t work, it won’t start and stopped again, maybe there is a dependency on one of the Orion services, so let’s go ahead and re-start the entire Orion application.  OK, the service didn’t start that time either, something must be wrong, lets go ahead and initiate a failover to the secondary server.

 

The Orion FoE doesn’t just monitor the services, it also monitors key OS, server and web server statistics and just like above, you can define the behavior on first, second and third event.  For example, if the server hard drive space gets to 15%, then send an email to user A.  If it gets to 10%, then email user B.  If it gets down to 5%, then initiate a failover to the secondary server. 

 

The Orion FoE also has a built in alerting engine, independent of the Orion alerting infrastructure, which will notify you on any key statistic or event occurring with the FoE or the details it is monitoring.

Let’s get into more of the specifics here on some of the details going on in the back end.  The FoE can support multiple hardware deployment configurations:

• Physical to Physical
• Physical to Virtual
• Virtual to Virtual

Once you get Orion installed and setup, the FoE will create a clone of key critical configuration, registry and file system parameters which get restored to the secondary server.  Once that initial setup is complete, a set of real-time file and registry filters as you can see below, replicate any file system and registry changes to the secondary.  This way you secondary Orion server is always up to date with what is going on within the primary Orion server.

 

Let’s walk through the specifics of how it works in a high availability scenario using the below diagram as our guide.

The Orion primary and secondary servers are located within the same subnet and share the same identity including IP Address.  Since two identical IP’s cannot be on the network at the same time, a packet filter is installed on the secondary public NIC so it is not broadcasting or receiving traffic.  A second NIC exists between the two servers which handles the heartbeat and real-time data replication between the primary and secondary. 

When a failover condition occurs the following sequence of events occurs:

• the remaining Orion services on the Primary Orion server that are still running are shut down
• the packet filter is removed off the secondary NIC and the Orion services are started on the secondary server and the secondary server is now the active server
• the primary Orion server which is now down is now the passive server and if the server is still online, a packet filter is placed on its primary NIC

Your downtime is minimized to the time it takes for the server failover to initiate and the services to start on the secondary Orion server.  The other beautiful thing here as well, since both servers have the same IP Address, is you do not have to reconfigure your network to send any Syslog, SNMP Traps or Netflow traffic to a new IP Address.

This is just one specific use case that the Orion Failover Engine can handle.  In another post I will walk through additional use cases and scenarios.

If you need more information, please check out the product page here and you can request a demo from one of our SE’s by emailing your sales rep or clicking here.

VMware announces at VMworld 2010 San Francisco that it plans to acquire management software maker Integrien, with company leaders declaring VMware’s intentions to became an IT automation provider.

By Denise Dubie

Mergers and acquisitions happen often in the high-tech industry, but some stand out more than others either for their huge price tag, their strategic nature or the "game-changing" implications of the deal. VMware’s announcement Tuesday that it entered into an agreement to acquire management software maker Integrien proves the hypervisor vendor wants to make more money with customers by selling them management and automation technology.

Integrien Alive addresses virtual performance

At the opening keynote during VMworld 2010 San Francisco, Stephen Herrod, chief technology officer and senior vice president of R&D at VMware, revealed the hypervisor vendor had entered into agreements to acquire Integrien and separately security vendor TriCipher. Both planned acquisitions seem to address the need to provide management and automation, as well as security for the hybrid cloud environments VMware says it wants to enable.

“We need to innovate in this layer primarily around automation and management. We need to make it cheaper to operate this new infrastructure and automation has to span all of the resources in the data center,” Paul Maritz, president and CEO of VMware, said during the keynote Tuesday, reinforcing the upcoming news. Maritz went on to explain that VMware is talking about delivering “data center management and data center automation."

Puppet Master Curriculum (3 Days)

This training is ideal for those who want a Puppet jumpstart. Newer members at an organization already using Puppet, or experienced sysadmins wanting to bring Puppet into their team will get everything they need to deploy solutions.

Prerequisites:

Attendees should have at least the equivalent experience of a junior Unix/Linux administrator.

Topics covered include:

• Configuring Puppet and Puppetmaster
• Resource Types and the Resource Abstration Layer
• Virtual Resources, Exported Resources and Stored Configs
• Meta-parameters, Dependencies and Events
• Classes, Modules and Definitions
• Tags and Environments
• Puppet Language Patterns and Best Practices

The topics are covered over 3 days. Sessions will mix theory and practice, balancing lectures with hands-on exercises. (Each student should bring a WiFi enabled laptop with VMWare installed to participate in the labs.)

Pricing

• $2,195.00 by September 27, 2010; $2,395.00 on or after September 28, 2010.

Welcome to the Tenable Network Security Podcast - Episode 48 Hosts: Paul Asadoorian, Product Evangelist & Kelly Todd, Compliance Analyst Announcements Several new blog posts have been published this week, including: Tenable Network Security on the Inc 5000 List The... Paul Asadoorian

Reflex Systems survey shows that enterprise IT managers continue to face challenges managing virtual environments.

By Denise Dubie

Virtualization has its benefits, but enterprise IT managers admit without being able to adequately manage virtual environments, those advantages can be more difficult to achieve.

How to use virtualization to leap into the cloud

Reflex Systems this week at VMworld 2010 in San Francisco released the results of a survey of 300 enterprise IT managers. The data showed that many of those polled experienced challenges when approaching traditional IT management practices in the virtual realm. And perhaps part of the reason lies in the fact that many say they have already virtualized or plan to virtualize more of their environment by year-end.

For instance, more than half of the respondents said “at least half of their business critical applications will be virtualized by the end of this year,” according to a Reflex Systems press release. That figure represents a 17% increase from current utilization, the virtual systems management and security vendor reports. Survey respondents said in addition to hypervisors they also plan to invest in virtual storage and virtual management tools in the next six months. Among the reasons cited for investing in additional management tools (above and beyond those provided by the hypervisor vendors) were performance, security and auditing/reporting, Reflex Systems reports.

Don't Fall Off The Stool When I developed the course "Advanced Vulnerability Scanning Techniques Using Nessus", I wanted to mention some of the trade-offs we make when we perform vulnerability scans using different configurations. Nessus creator Renaud Deraison helped point... Paul Asadoorian

OK, so maybe VMWare isn't a technology. VMWare is a company and the technology is virtualization , but I want to be specific. If you're in IT, anywhere on the infrastructure side - network engineer, system administrator, storage administrator...(read more)

Virtualization offers a lot of benefits, one of them being a clear path to developing a private cloud.

By Denise Dubie

Virtualization enthusiasts came out in droves Monday as VMware hosted its annual VMworld 2010 conference in San Francisco’s Moscone Center.

With more than 16,000 reported attendees, VMworld saw many shut out of sessions, due to long lines and a no standing-room only policy (everyone had to be seated). That led to some show goers passing the time with ping pong, air hockey or pool, while others lined up to get a coveted spot in the next session.

The day also featured presentations from folks such as Anil Karmel, solutions architect for the network and infrastructure engineering and production systems group at Los Alamos National Laboratory in northern New Mexico. In 2006, Karmel explained to attendees that his organization began its journey to the cloud by first implementing virtualization. He made it clear that “virtualization is not cloud computing,” but it is a great starting place for those hoping to establish a private cloud.

Other more artistic avenues also explored the “journey to the cloud.” Chalk artists created an image sponsored by CA Technologies that depicted the message “accelerate your journey to the cloud.”

And CA Technologies also drove the point home in its booth. The vendor is campaigning for IT organizations to “quit stalling” with their virtual deployments so they can expand into private clouds. With virtual sprawl comes virtual stall in some cases, but with the right technologies, processes and people, IT organizations can move past the management, security and other hurdles large virtualization deployments can represent, according to CA Technologies. (And with particular booth staff on hand, the ‘booth babe’ debate lives on at VMworld.)

What are you doing at VMworld? Which sessions did you find most interesting? What did you find disappointing? Please leave a comment here or e-mail me directly via e-mail at Denise.Dubie@ca.com.

Do you Tweet? Follow Denise Dubie on Twitter here.

Virtualization offers a lot of benefits, one of them being a clear path to developing a private cloud.

By Denise Dubie

Virtualization enthusiasts came out in droves Monday as VMware hosted its annual VMworld 2010 conference in San Francisco’s Moscone Center.

With more than 16,000 reported attendees, VMworld saw many shut out of sessions, due to long lines and a no standing-room only policy (everyone had to be seated). That led to some show goers passing the time with ping pong, air hockey or pool, while others lined up to get a coveted spot in the next session.

The day also featured presentations from folks such as Anil Karmel, solutions architect for the network and infrastructure engineering and production systems group at Los Alamos National Laboratory in northern New Mexico. In 2006, Karmel explained to attendees that his organization began its journey to the cloud by first implementing virtualization. He made it clear that “virtualization is not cloud computing,” but it is a great starting place for those hoping to establish a private cloud.

Other more artistic avenues also explored the “journey to the cloud.” Chalk artists created an image sponsored by CA Technologies that depicted the message “accelerate your journey to the cloud.”

And CA Technologies also drove the point home in its booth. The vendor is campaigning for IT organizations to “quit stalling” with their virtual deployments so they can expand into private clouds. With virtual sprawl comes virtual stall in some cases, but with the right technologies, processes and people, IT organizations can move past the management, security and other hurdles large virtualization deployments can represent, according to CA Technologies.

What are you doing at VMworld? Which sessions did you find most interesting? What did you find disappointing? Please leave a comment here or e-mail me directly via e-mail at Denise.Dubie@ca.com.

Do you Tweet? Follow Denise Dubie on Twitter here.

As our first monthly apps contest winds down (you have until tomorrow, 8/31, 11:59pm!), I wanted to highlight some of the apps that developers have added this month. This has been the best month ever for community contributions, by far.

Here are some of the greatest hits:

• PCI App (Creative Commons Version) – Peter Bassill (aka BinaryArp) hacked on a newer and much improved version 1.0 of his PCI (Payment Card Industry) app in time for our Users’ Conference that took place earlier this month. And by the end of this month, he had already added 2 more revisions culminating in version 1.2 uploaded on 8/29. If you need to satisfy PCI compliance requirements, you might want to take a look.
• Splunk for Nagios - Luke Harris posted his Splunk for Nagios add-on just as I was thinking about writing one myself. This is something quite a few users have requested, and now we have it, thanks to Luke. With this app, you can search Nagios alerts and notifications and graph problems over time.
• Google Maps for Splunk – This add-on provides a module to display events/results of Splunk searches on a Google map. Thanks to Siegfried Puchbauer for writing up this one.

One of these may win the grand prize… or not! The contest hasn’t ended yet, and we haven’t commenced voting.

Think you have what it takes? Submit your app or add-on to Splunkbase and be eligible to win.

Episode 12 brings us unparalleled agreement between Maverick and Jeff–a first in SplunkTalk history. On today’s show we answer questions about search performance, how to find “light speed” of your Splunk server, some thrilling questions on baselining and statistics, and oh so much more!. News, views, even some metrics on the Podcast–provided by Splunk!. Enjoy this week’s episode.

Episodes are recorded live every Friday at 11AM Central Time – Email us at splunktalk@splunk.com to ask questions and have them answered on air!

Enjoy listening!

I am hoping that my three readers will take the time to complete this short, 10 question survey on how they use OpenNMS. We are trying to get a better idea of our users so that we can tailor our work to more closely meet their needs.

September is going to be pretty busy, but lots of opportunities for you to catch up with NetIQ. For more upcoming event listings, check out NetIQ’s events page.:

Sept 1, 2010, London, UK: IDC's IT Security Conference 2010 enables end user IT professionals to discover what they should be targeting to ensure their organization's safety in a complex environment. We, with one of our customers, will be presenting a case study - more details to follow.

Sept 1-2, 2010, Singapore: We are proud to continue supporting The Future of Banking & Financial Services events organized by FST Media as they consistently provide a strong foundation for the exchange of ideas and information on business-enabled technology amongst CxOs and IT decision makers.

Sept 5-8, 2010, Durban, South Africa: NetIQ is delighted to be an exhibitor again at GovTech, South Africa’s premier conference for all stakeholders involved in public sector ICT.

Sep 7-10, 2010, Staines, UK: In this instructor-lead AppManager 7 Essentials course you will learn how to gain greater control over the IT Environment by using features such as automated detection and deployment, policy exception management, secure delegation and self-maintaining service maps. In addition, you will learn to prioritize problem response and how to map IT resources to business applications and services.

Sep 7-10, 2010, Herndon, VA: This Security Manager 6.x Essentials course is a four-day lecture style class designed to help you understand, deploy, and successfully manage Security Manager. You will learn Security Manager Architecture and how to use it to secure the organization’s computers. Through discussions, examples, and lab exercises with real world content, you will learn to defend both Windows and UNIX systems. In addition, learn how to: Architect, install, and configure Security Manager; install and configure Windows and UNIX agents; configure Change Guardian for Windows, Active Directory and Group Policies; and develop event correlation procedures.

 

Sept 9, 2010, Online: Recent security breaches bring an emerging trend into focus—outsiders gaining insider privileges so they can access sensitive data. Trusted insiders also present a potentially significant threat, particularly when their access rights to corporate data are inadequately controlled. Join Ira Winkler, Vice President of the Information Systems Security Association and author of Spies Among Us, and Todd Tucker of NetIQ, for Combating the Insider Threat: Vulnerabilities and Countermeasures, In this interactive webinar, Winkler will explore the evolving menace of insider threats and the effective countermeasures you can deploy to keep your mission-critical information and data secure. Furthermore, he will draw on his extensive first-hand experience with headline-grabbing security events, including the recent Twitter hacks and the ongoing WikiLeaks investigation, as he explains how outsiders can become insiders, steal information, and get away scot-free. In this webinar, you'll learn:

• How to appreciate insider threats but focus on your underlying vulnerabilities.
• Why technical countermeasures trump security awareness.
• How to see the most common blind spots in information security.
• Best practices for addressing threats to sensitive data.

Sept 14-17, 2010, Herndon, VA: With this instructor-led AppManager 7 Advanced course you can take your implementation of AppManager to the next level . Learn how to maximize your AppManager investment by using several tools in the AppManager Suite including: Control Center, Knowledge Base, SNMP Toolkit, Analysis Center and Diagnostic Console. Topics covered in this course include both advanced monitoring and troubleshooting techniques using the base AppManager application. The class employs a combination of discussion, demonstrations, and hands-on lab exercises.

Sept 21, 2010, Online: Organizations today are expected to be trusted custodians of personally identifiable information - whether portions of such customer and other internal corporate information are being shared internally among corporate users, stored on databases or backup tapes, sent over the internet to partners or customers, or housed on well-used portable devices. Data is the most valuable asset that the majority of organizations have, so guarding it effectively is a top priority. Formulating an effective line of attack for guarding this information is what this online event is all about. Join Louis Klubenspies and Scott Wilson for “NRG Energy Success Story:  Rapid Results and Lessons Learned with Automated User Provisioning” to learn how NRG Energy, a Fortune 300 wholesale power generation company, leverages automated identity management solutions from NetIQ to cost-effectively address these issues. You’ll see how NRG Energy has taken a pragmatic approach to automating user account provisioning and deprovisioning, reducing excessive privileges to their Active Directory environment, managing accounts for temporary workers, and expediting other security-related processes.

Sept 22 - 23, 2010, London, UK: Gartner believes the next 18 months are crucial to the relationships between information security, risk management and the business. As organizations prepare for the return to growth they will continue to face major financial challenges. However, these challenges provide unique opportunities for security, risk and privacy professionals to become key partners in their organizations' strategies for renewed growth. This year's Summit will help you understand what you can do to protect your organization's information resources in the most efficient and effective ways and, by proactively managing risks, to enable new technology and business initiatives. The event will provide the information and networking opportunities to help you do your job better. NetIQ is a silver-level sponsor at this important event.

Sept 27-28, 2010, Baltimore, MD: The 6th Annual IT Security Automation Conference will provide public and private sector executives, security managers and staff, IT professionals, and developers of products and services with a common understanding for using specific open standards and new security technologies across various domains of interest. NetIQ will be showcasing and demoing our new SCAP Editor tool that makes creating, editing and managing XML SCAP files easier! Do stop by the NetIQ booth to find out more.

Sept 28-30, 2010, Houston, TX: NetIQ Aegis Process Automation is a three-day lecture course that will help you understand, install, and successfully use NetIQ Aegis. In this course, you will learn about the Aegis lifecycle, how to use the Workflow Designer, and process revision control. In addition, you will learn how to manage, maintain and make decisions with Aegis. Through discussion, examples, and lab exercises with real world content, you will learn how to: identify and create notification workflow processes; set user and permission sets and handle basic Aegis troubleshooting.

Sept 28-30, 2010, Staines, UK: NetIQ Aegis Process Automation is a three-day lecture course that will help you understand, install, and successfully use NetIQ Aegis. In this course, you will learn about the Aegis lifecycle, how to use the Workflow Designer, and process revision control. In addition, you will learn how to manage, maintain and make decisions with Aegis. Through discussion, examples, and lab exercises with real world content, you will learn how to: identify and create notification workflow processes; set user and permission sets and handle basic Aegis troubleshooting.

A lot of you are asking when Profiler and Orion are going to be integrated, and while I don’t have a date, you can see What We Are Working On.  In the meantime, if you just have to have some Profiler goodness inside Orion, here is a way to do it.   This is several steps long, and we are working to improve this process.  I am assuming you are somewhat familiar with Orion navigation.
 
NOTE:  While this gets Profiler views into Orion, it is far from a perfect user experience.  A few caveats:

• You have to log into Profiler in the same browser as Orion before these views will work
• Occasionally you will break out of the Orion view into a new window or tab
• There is no integrated navigation or breadcrumbs, drill downs in Profiler are generally one way.

Build a View:
In general, any Profiler view (summary, monitor, device) could be imported into Orion.  However,  we would recommend summary or monitor views, as they allow you to drill down to device views.

1. Go to Settings > Views > Manage Views
2. Click Add, then enter a name of the view (ex: Profiler Summary), choose Summary for Type Of View and click Submit.
   
   
   
   
3. Change the number of columns to 1, and width to 1000, click Submit. 
4. Next to the Resources box, click the plus sign to add a new resource.
   
   
   
   
5. In the tree, open Miscellaneous folder and check Custom HTML, press Submit.
6. Press the Preview button at the bottom, this will take you to the view with one resource with no data.
   
   
   
   
7. Press Edit and change the title name to Profiler Main Console. 
   
8. We will be using an iframe to connect show Profiler within a container on the screen.  In this example, the link is to the Profiler Main Console, but at the end of the post I will give you some more sample URLs from Profiler.
   Enter the following into the text Box:
   <iframe src="http://<ProfilerServerNameOrIP>:<ProfilerServerPort>/MainConsole.do?actionName=showConsole" height= 400 width =950  name="text" id="contentFrame"></iframe>
   where:
      src is the URL to Profiler
      ProfilerServerNameOrIP - the Profiler server's DNS name or IP address
      ProfilerServerPort - the port
      height is the height of the iframe
      width is the width of the iframe, generally you want this to be less than the width of the resource defined in Step 3.
      name and id are very important, make sure you copy them in there
9. When you are done, it should look like the image below.  Press Submit.
   
   

If everything is correct, and you have already logged into Profiler in another tab, you should see something like this.  Otherwise, you will see a Profiler login screen.
NOTE: Once you are successful, copy the URL of this page - you need it for the next step.

Add the new View to the list of Available items:
The view you built above is not available to be added to the menu bar until you manually add it.

1. Settings > Customize > Customize Menu Bars
2. Edit any menu bar (ex: Default Menu Bar).
3. Scroll all the way to the bottom of the list of Available items, click Add.
4. Enter a name, paste in the URL from the last step from above, and uncheck "Open a New Window", and press OK.
5. You should see Profiler Summary in the Available Items.

Add the new View to a Menu Bar:
You can now add any of the Profiler view you created to any existing tabs, just like any other view...

1. Settings > Customize > Customize Menu Bars
2. Edit any menu bar (ex: Default Menu Bar).
3. Drag and drop the new View to the menu bar, reorder as you see fit.
   
4. Press Submit under the selected items.
5. Next time the page refreshes, you should see the new View (Profiler Server) in the Tab.
   

Phew… I worked up a sweat, did you?  When integration comes, all the heavy lifting will be done, so you won't have to do it. 

As always, if you have any thoughts or suggestions, please let us know.

Use Cases and sample URL:

• Summarize Profiler Data - show high level view of storage and virtualization
  <iframe src="http://1.2.3.4:9000/MainConsole.do?actionName=showConsole" height= 400 width =950  name="text" id="contentFrame"></iframe>
  
  
• Monitor Profiler events - Show Profiler event monitor in Orion
  <iframe src="http://1.2.3.4:9000/EventMonitor.do?actionName=main" height=700 width =1100  name="text" id="contentFrame"></iframe>
  
  
• Monitor Virtual and Physical server status
  <iframe src="http://1.2.3.4:9000/ServerMonitor.do?actionName=main" height=500 width =1100  name="text" id="contentFrame"></iframe>
  
  
• Run Profiler reports in Orion
  <iframe src="http://1.2.3.4:9000/ReportList.do?actionName=listReports&reportListState=2" height= 400 width =950  name="text" id="contentFrame"></iframe>
  
  
• Summarize your Virtual Infratructure
  <iframe src="http://1.2.3.4:9000/VCConsoleServlet?state=vmware" height=500 width =1100  name="text" id="contentFrame"></iframe>
  
  
• View a particular device - you must know Profiler's internal DeviceId
  <iframe src="http://1.2.3.4:9000/ConsoleHostFrameServlet?DeviceId=1" height=500 width =1100  name="text" id="contentFrame"></iframe>
  

To build more, right click any link in profiler and copy it to a text file for review.

As the CEO and co-founder of Tenable Network Security, I am very proud to announce our inclusion in the 2010 Inc 5000 list of fastest growing companies in the United States. We placed #1369 out of 5000 ranked companies. Tenable... Ron Gula

Wireshark 1.4.0, 1.2.11, and 1.0.16 have been released. Installers for Windows, Mac OS X 10.5.5 and above (Intel and PPC), and source code are now available. New in 1.4.0 The packet list internals have been rewritten and are now more efficient. Columns are easier to use. You can add a protocol field as a column by right-clicking on its packet detail item, and you can adjust some column preferences by right-clicking the column header. Preliminary Python scripting support has been added. Many memory leaks have been fixed. Wireshark 1.4 does not support Windows 2000. Please use Wireshark 1.2 or 1.0 on those systems. Packets can now be ignored (excluded from dissection), similar to the way they can be marked. Manual IP address resolution is now supported. Columns with seconds can now be displayed as hours, minutes and seconds. You can now set the capture buffer size on UNIX and Linux if you have libpcap 1.0.0 or greater. TShark no longer needs elevated privileges on UNIX or Linux to list interfaces. Only dumpcap requires privileges now. Wireshark and TShark can enable 802.11 monitor mode directly if you have libpcap 1.0.0 or greater. You can play RTP streams directly from the RTP Analysis window. Capinfos and editcap now respectively support time order checking and forcing. Wireshark now has a "jump to timestamp" command-line option. You can open JPEG files directly in Wireshark. For a complete list of changes, please refer to the 1.4.0 release notes. In 1.2.11 and 1.0.16 A DLL hijacking bug described in Microsoft Security Advisory 2269637 has been fixed. See the security advisories and release notes for more details. Official releases are available right now from the download page.

Author Profile - My name is Joke (pronounced \yo-kə\ or Joan for those who do not speak Dutch). During the day, I work as a secretary for a non-profit organization providing assisted living for mentally handicapped people in the south of The Netherlands. In my spare time I like to use Wireshark. I find it interesting and necessary to monitor my home network to see what is going on. As a user I like to answer questions at the Wireshark Mailing List. What is in it for me? Well, I learn a great deal whenever I try to solve real-world... Joke Snelders

Thanks to the upcoming World Basketball Festival, we now get a “USA” Air Jordan 2010 Team. It seems as if more people like the Air Jordan 2010 Team than the original Air Jordan 2010 because of the windowless side panels. I’m not one of those people who likes the team better; I think the original
Nike Shoes 2010 Shoes looks much better.Since this jordan Shoes Team is made for the USA team, the colorway should be clear. White can be seen on the side panels, toe, shoe laces, tongue, part of the midsole and the entire outsole. Navy blue covers the toe, heel, inner lining and above the midsole. Red accents appear on the tongue, toe, heel, lace panels and the midsole. The sneaker is constructed of perforated white leather with larger perforations placed on the side panels.

Thanks to the upcoming World Basketball Festival, we now get a “USA” Air Jordan 2010 Team. It seems as if more people like the Air Jordan 2010 Team than the original Air Jordan 2010 because of the windowless side panels. I’m not one of those people who likes the team better; I think the original
Nike Shoes 2010 Shoes looks much better.Since this jordan Shoes Team is made for the USA team, the colorway should be clear. White can be seen on the side panels, toe, shoe laces, tongue, part of the midsole and the entire outsole. Navy blue covers the toe, heel, inner lining and above the midsole. Red accents appear on the tongue, toe, heel, lace panels and the midsole. The sneaker is constructed of perforated white leather with larger perforations placed on the side panels.

Thanks to the upcoming World Basketball Festival, we now get a “USA” Air Jordan 2010 Team. It seems as if more people like the Air Jordan 2010 Team than the original Air Jordan 2010 because of the windowless side panels. I’m not one of those people who likes the team better; I think the original
Nike Shoes 2010 Shoes looks much better.Since this jordan Shoes Team is made for the USA team, the colorway should be clear. White can be seen on the side panels, toe, shoe laces, tongue, part of the midsole and the entire outsole. Navy blue covers the toe, heel, inner lining and above the midsole. Red accents appear on the tongue, toe, heel, lace panels and the midsole. The sneaker is constructed of perforated white leather with larger perforations placed on the side panels.

Thanks to the upcoming World Basketball Festival, we now get a “USA” Air Jordan 2010 Team. It seems as if more people like the Air Jordan 2010 Team than the original Air Jordan 2010 because of the windowless side panels. I’m not one of those people who likes the team better; I think the original
Nike Shoes 2010 Shoes looks much better.Since this jordan Shoes Team is made for the USA team, the colorway should be clear. White can be seen on the side panels, toe, shoe laces, tongue, part of the midsole and the entire outsole. Navy blue covers the toe, heel, inner lining and above the midsole. Red accents appear on the tongue, toe, heel, lace panels and the midsole. The sneaker is constructed of perforated white leather with larger perforations placed on the side panels.

Thanks to the upcoming World Basketball Festival, we now get a “USA” Air Jordan 2010 Team. It seems as if more people like the Air Jordan 2010 Team than the original Air Jordan 2010 because of the windowless side panels. I’m not one of those people who likes the team better; I think the original
Nike Shoes 2010 Shoes looks much better.Since this jordan Shoes Team is made for the USA team, the colorway should be clear. White can be seen on the side panels, toe, shoe laces, tongue, part of the midsole and the entire outsole. Navy blue covers the toe, heel, inner lining and above the midsole. Red accents appear on the tongue, toe, heel, lace panels and the midsole. The sneaker is constructed of perforated white leather with larger perforations placed on the side panels.

Author Profile - Josh Stephens is the Head Geek and VP of technology at SolarWinds, a leading provider of network management software based in Austin Texas. Josh has extensive experience in network management systems, network engineering, and software development. His 15-plus years of experience in technology include designing and deploying advanced networks and network management systems within organizations including the US Air Force, Sprint, MCI/UUNET, and WalMart. He has received several industry certifications including those from Cisco Systems, Microsoft, and HP. Let’s face it. Virtualization, in all its glory, hasn't made managing IT environments any easier. From tracking the up/down... Denny K Miu

A few of us from the Training, Services and Evangelism team will be presenting at VMworld next week.

Automate Application Deployment to vCloud Services
Monday 03:00 PM (Moscone North Room 130)
Adrian Cole

Leveraging an Enterprise-Ready vCloud Service to Regain IT Control Format
Tuesday, 3:30 PM   (Room: Moscone West Room 2006)
Thursday, 12:00 PM   (Room: Moscone West Room 2005)
John Willis

Here is a link to the Conference Catalog…

We will also be hanging around the “VMworld Drinks, Cloud Club Nostalgia Tour Episode #1” meetup before the concert. 

If you want to get together and talk Chef please feel to ping me at @botchagalupe