v14.

7 Database Activity Monitoring User Guide

v14.7 Database Activity Monitoring User

Guide

v14.7 Database Activity Monitoring User Guide 1

 Contents

Contents
System Monitoring. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
Working with Alarms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
Understanding the Alarm Details Window. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Working with the Alarms History Window. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Understanding Alarms Configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Configuring Alarm Notifications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Acknowledging Alarms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Adding a Note to an Alarm. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

v14.7 Database Activity Monitoring User Guide

 v14.7 Database Activity Monitoring User Guide

System Monitoring
SecureSphere's System Monitoring displays provide you with real-time awareness of the health of all the
SecureSphere elements in your deployment, by displaying the alarms that are currently triggered.

To view System Monitoring, in the Main workspace, select Monitor > Monitor System.

The System Monitoring system contains the following types of display:

System Monitoring Displays

Display Type Description For more information, see

Displays a list of currently active alarms in the

Alarms entire deployment. Can be used to get a simple Understanding Alarms
list of all outstanding issues across the estate.

Displays a list of all alarms that occurred in the

Understanding the Alarms History
History entire deployment. Allows for historical analysis
Window
and for periodical health reporting.

Displays a list of all the available alarm types.

Allows you to configure what happens when the
Configuration Understanding Alarms Configuration
event occurs, threshold values (if applicable) and
the level of severity of this alarm type.

• Working with Alarms

• Working with the Alarms History Window
• Understanding Alarms Configuration
• Acknowledging Alarms
• Adding a Note to an Alarm

v14.7 Database Activity Monitoring User Guide 3

 v14.7 Database Activity Monitoring User Guide

Working with Alarms

To access the Alarms list:

• In the Main workspace, select Monitor > Monitor System > Alarms.

The alarms list has the following components:

• Current Deployment: Displays the title of the Current deployment. Enter part of the name of a deployment you
are seeking, and a drop down list of deployments appears. Select the one you want.
• Actions bar: Enables the following actions:
• Refresh: Refreshes the list.
• Clear filter: Clears all filters and ensures that all alarms in the currently selected deployment are
displayed.
• Activate Auto-Refresh: Toggles the auto-refresh so that the alarms list is always up-to-date.
• Filters: You can filter by the following parameters:
• Ack: Whether or not the alarm has been acknowledge. You can toggle the button to note whether or not
you have acknowledged an alarm.
• Severity: The severity for the alarm. You can define an alarm's severity in the configuration window.
For more information, see Understanding Alarms Configuration.
• Title: The title of the alarm.
• Since: The time the alarm was triggered.
• Element Type: The type of element on which the alarm was triggered.
• Element Name: The name of the element on which the alarm was triggered.
• IP Address: The IP address of the element on which the alarm was triggered.
• Note: You can type any text in this field.

v14.7 Database Activity Monitoring User Guide 4

 v14.7 Database Activity Monitoring User Guide

• Results: The list of alarms. Clicking on any place on an alarm displays the alarm details window. For more
information, see Understanding the Alarm Details Window....

• Understanding the Alarm Details Window

v14.7 Database Activity Monitoring User Guide 5

 v14.7 Database Activity Monitoring User Guide

Understanding the Alarm Details Window

You access the Alarm Details window for an alarm by clicking on that alarm in the Alarms list.

The alarm details window has the following components:

• Summary bar: Displays the alarm's severity, a general description, and how long ago the alarm was triggered.
• Description: Displays a detailed description of the alarm, including possible causes.
• Notes: Displays text that you have added to help you with this alarm. For more information, see Adding a Note
to an Alarm.
• Element: Displays the following details of the element for which the alarm is triggered:
• Alarms: The severity of the element's most severe alarm and the number of alarms.
• Name: the title of the element.
• Type: The type of element displayed.

v14.7 Database Activity Monitoring User Guide 6

 v14.7 Database Activity Monitoring User Guide

• IP Address: The IP address of the displayed element.

• Software Version: The version of the software running on the element.
• Appliance Model: The appliance model of the element.

You can also view the element in the Deployment Overview, view more details, or view the parent element.

• Notes: Displays the notes that you added in the deployment overview for the alarm's deployment.
• Recommendations: Displays instructions on how to solve the problem represented by the alarm. Includes a
link to more detailed documentation about the alarm on the Imperva Technical Support site. Should this be
insufficient, there is also a link to open a case with Imperva support.
• Recent Alarm History: Displays all recent occurrences of this alarm on this element.

v14.7 Database Activity Monitoring User Guide 7

 v14.7 Database Activity Monitoring User Guide

Working with the Alarms History Window

The Alarms History window displays the log view of the alarm history, and you should use it for historical analysis
and/or reporting.

To access the Alarms History window:

• From the Main workspace, select Monitor > Monitor System > History.

Alarms are maintained in the history for up to 90 days.

The Alarms History window has the following components:

• Context Deployment: Determines the deployment whose alarms are displayed. Enter part of the name of a
deployment you are seeking, and a drop down list of deployments appears. Select the one you want. The
default value is the entire deployment.
• Actions bar: Enables the following actions:
• Refresh: Refreshes the list.

v14.7 Database Activity Monitoring User Guide 8

 v14.7 Database Activity Monitoring User Guide

• Clear filter: Clears all filters and ensures that the element's alarms, and all alarms in the context
deployment are displayed.
• Export to CSV: Exports the current table of alarms to a .csv file.
• Filters: You can filter by the following parameters:
• Severity: The severity of the alarm. You can define an alarm's severity in the configuration window. For
more information, see Understanding Alarms Configuration.
• Title: The title of the alarm.
• Start Time: The time the alarm was triggered.
• End Time: The time the alarm was cleared.
• Element Type: The type of element on which the alarm was triggered.
• Element Name: The name of the element on which the alarm was triggered.
• IP Address: The IP address of the element on which the alarm was triggered.
• Acknowledged: Whether or not the alarm was acknowledged.
• Note: You can enter any text in this field.
• Results: The list of alarms.
• Showing: This field shows how many alarms in your system meet the current filter criteria. The Alarms History
window can display up to 1000 alarms. If you see that you have more than 1000 alarms and you want to see
alarms that are lower than #1000 in the list, refine your filter so that less alarms appear in the list.

v14.7 Database Activity Monitoring User Guide 9

 v14.7 Database Activity Monitoring User Guide

Understanding Alarms Configuration

SecureSphere has more than 45 events that could potentially trigger alarms that draw your attention to problems in
the system. You can configure the following for each of the events:

• Whether or not the event triggers an alarm

• The severity of the alarm triggered
• If appropriate, a threshold value that causes the alarm to be triggered. For example, the parameter could be the
partition's free space, or a machine's CPU utilization.
• The type of notification, if any, that is generated by the alarm - email and/or syslog message.

Note: If the MX is registered to a Management Server Manager (SOM) machine, fields under the
Alarm Settings and Notifications tabs are grayed out (cannot be edited and saved), as you
configure these parameters in the SOM.

The table below summarizes the broad categories of alarms in SecureSphere.

To configure an alarm:

1. In the Main workspace, select Monitor > Monitor System > Configuration.
2. Verify that the Alarm Settings tab is selected.

v14.7 Database Activity Monitoring User Guide 10

 v14.7 Database Activity Monitoring User Guide

3. Select an event Type that you wish to configure as an alarm.

4. In the Display Properties pane on the right, configure the alarm:
1. Toggle Trigger alarm off, if you want this event not to trigger an alarm.
2. Under the Severity drop down list, select the level of severity you want for this alarm. The options are:
▪ Critical: displays in red.
▪ Major: displays in orange.
▪ Minor: displays in yellow.

Note: Consider very carefully if you want to change the default values given by
Imperva.

3. Under Notifications, toggle Send email notification and/or Send syslog notification on, if you want this
alarm to generate an email and/or a syslog message.
5. Click Save.

v14.7 Database Activity Monitoring User Guide 11

 v14.7 Database Activity Monitoring User Guide

Alarms Category Description

Agent monitoring Software incompatibility issues, Cluster incompatibility issues, etc.

Redundancy and High

MX-HA failure, Cluster redundancy failure, Cluster manager HA failure, etc.
Availability

Cluster overload, Gateway overload, CPU %age overload, Agent buffer exhaustion,
Load and Capacity
disk space overuse.

Network connectivity Connection problems between SOM, MXs, Gateways, Agents.

Hardware RAID, Power Supply Unit, VMWare ballooning issues.

Configuration mismatches Mismatches between the SOM and MX, the MX and Gateways, and so on.

• Configuring Alarm Notifications

v14.7 Database Activity Monitoring User Guide 12

 v14.7 Database Activity Monitoring User Guide

Configuring Alarm Notifications

If any of your alarms generate email and/or syslog notifications, you need to configure these notifications.

To configure alarm notifications:

1. In the Main workspace, select Monitor > Monitor System > Configuration.

The Alarms Configuration window appears.

2. Select the Notifications tab. The Notifications window appears.

3. For email notifications:

1. In the From email address field, enter the source email address for the email notifications.
2. In the To email addresses field, enter the email address or addresses of the recipients. When entering
multiple email addresses, they must be separated by a semi-colon.
3. In the SMTP server field, enter the host name or IP of the SMTP server.
4. For syslog notifications, in the Primary host/IP field, enter the host name or IP address of the syslog server.
5. Click Save.

v14.7 Database Activity Monitoring User Guide 13

 v14.7 Database Activity Monitoring User Guide

v14.7 Database Activity Monitoring User Guide 14

 v14.7 Database Activity Monitoring User Guide

Acknowledging Alarms
You can mark an alarm as acknowledged.

An alarm's acknowledgment state is a field that can be toggled on or off at any time.

You can filter for alarms using this field. If, say, you want to see only those alarms that you have not acknowledged,
you can filter the display so that only alarms whose acknowledgment state is not set, appear in the display.

To set an alarm's acknowledgment state:

• In the Alarms list, click the Ack button on the alarm whose acknowledgment state you want to change.

• In the Alarm Details window, click the Acknowledge button on the alarm you have selected.

v14.7 Database Activity Monitoring User Guide 15

 v14.7 Database Activity Monitoring User Guide

Adding a Note to an Alarm

You may want to add a note to an alarm so that you can tell others what the remedy plan is, or add a reminder to
yourself to install replacement hardware, or indeed append any useful text regarding that alarm.

To add a note to an alarm:

1. In the Alarms list, click the alarm so that its Alarm Details window opens.
2. If a note has not been added to the alarm, the text Add a note regarding this alarm... appears in the Notes
section. Click anywhere on this text.

If a note has been added to the alarm, either click the Edit button in the Notes section,or just click
anywhere on the existing text in the Notes section.

A text box appears.

3. Type in the text of your note.

4. Click Save.

v14.7 Database Activity Monitoring User Guide 16