CrossCheck & Service Level reports

The CrossCheck and Service Level Reports located in the Status tab provide important roles in Scrutinizer’s architecture. CrossCheck provides the overall status of a device across multiple applications including 3rd parties. The Service Level Report (SLR) provides availability and response time reports using data collected by the poller.

CrossCheck logic

Each 3rd Party Method in CrossCheck queries the related application (e.g. Flow, Poller, Denika, WhatsUp, etc.) for the devices in its database and finds or adds the device to the CrossCheck list. Duplicate IP addresses are removed. Each 3rd Party Method applies a weight of importance to the device depending on any problems found. The Fault Index (FI) is the total value across all 3rd Party Methods. All 3rd Party Methods are open source and can be modified.

After each 3rd Party Method completes, CrossCheck (i.e. mapping.cgi) updates the FI for each device. It queries the above list for any device that has violated theconfigurable FI threshold. For each device that exceeded the threshold,CrossCheck sends a syslog to the alarm server which will violate the “Exceeded CrossCheck Fault Index” policy. Any hosts that are up are removed from the xcheck_notifications table (see below).

Fault Index

The “Exceeded CrossCheck Fault Index” (Policy) in the Alarms tab, performs the following when a CrossCheck syslog comes in:

  • The syslog comes into the alarm process and violates the “Exceeded CrossCheck Fault Index” policy which triggers the notification profile “XC Notification” (XC).

  • XC looks to see if an entry exists in the table called xcheck_notifications.

  • If an entry exists for the device (i.e. IP address), this means a notification already went out. The time stamp is then updated.

  • Else if, notification hasn’t already gone out. The IP address of the device is inserted into the xcheck_notifications table. The configured notification profile for the host is then executed.

  • Else, if the configured notification profile in mapping for the host isn’t configured: nothing happens.

CrossCheck table

The main CrossCheck table displays an inventory of all hosts being monitored as well as their status in each of the applications that are monitoring the device. The overall Fault Index (FI) on the far right provides the status of devices in the Scrutinizer maps and all of the 3rd party applications monitoring them. Click on the headings to sort. The query time frame is the last 1 minute by default. The buttons are explained below.

  • CrossCheck Summary: Explained below.

  • Thresholds: This sets the threshold at which the sub icon on a device changes color. Color thresholds are based on a percentage of the Fault Index threshold.

  • 3rd Party Methods: Data collected from other applications that will impact the Fault Index (FI) for a device.

CrossCheck action:

  • Device Overview

  • Edit: Polling and Appearance: This launches the modify object view in the mapping utility.

  • Run Report: Flow Report: This runs the flow volume report for the device.

  • Host: List the IP address or DNS host name for the device. Mouse over for tool tip.

  • Flow: Method used to determine if a device is sending flows.

  • Poller: Method used to determine if the poller can ping the device.

  • Optional Third Party Methods: Contact your vendor to create new methods (e.g PRTG, Solarwinds, etc.). When active, a new column appears.

  • Fault Index (FI): The FI provides the overall status of a device across all 3rd Party Methods.

CrossCheck summary

The CrossCheck summary is an bar chart of the CrossCheck list. It displays the number of unique hosts found across all 3rd Party Methods as well as the Fault Index.

  • Refresh: Set the interval. The default is every 5 minutes.

  • Thresholds: This sets the threshold at which the sub icon on a device changes color. Color thresholds are based on percentage of the Fault Index threshold.

  • Define Networks: Specify a subnet to group IP addresses found across all 3rd Party Methods.

  • Overview: Provides a small window with the number of devices discovered in each 3rd Party Method as well as the overall total FI for the devices in the application.

Service Level Report

The Service Level Report is a dual purpose report listing device availability and response time. In the Service Level Report:

  • Click on the headings to sort.

  • The number to display (e.g. 25) followed by pagination.

  • Click on the Poller to run a trend across all devices.

  • Click on the Device to run an availability or response time report on the selected device.

  • Click on the round trip time column value or the availability percent value to run a report.

Note

To remove a device that was imported from CrossCheck, it must be removed from the 3rd Party Method script or removed from the 3rd party application (e.g. PRTG™, WhatsUp Gold™, Solarwinds Orion™, etc.).