Questions/Problems with Evaluation

We are currently evaluating ServersCheck version 6.5.0



1) When adding a rule, why do I need to enter the server on Step 4 when I specified it on step 1? Is there a difference? Do I have to specify both?



2) When defining a TRAFFIC rule, I specify 'Do not perform Alert, but I still progress to the Alerts page. Can I add a traffic rule without having to go to the Alerts page?



3) What is the "standard" method for adding devices and rules?



4) Does the service need to be stopped/restarted when changing/removing rules?



5) Given that the ServersCheck service is running under a Windows Domain account, for a Windows service why do I need to specify a username and password? Also, why is that username and password stored in plaintext in the conf file? Surely, given the privelages such an account would have, it should be encrypted.



6) Can I disable the Availability and/or SLA graphs on a rule-by-rule basis?





Thanks

1) There can be a difference since a device can be a logical entity and not a physical entity



2) You just leave the alerts page empty



3) One by one is standard. Rules can be copied or network can be scanned to do it quicker (only available in Enterprise edition)



4) No



5) Due to WMI technology this is required. See knowledge base on encrypting serverscheck.conf file. If someone has access to the machine (meaning he can read the serverscheck.conf file) then he already has admin rights meaning that your systems are already compromised.



6) No

Quote: Originally posted by Administrator on 11 July 2006

---

5) Due to WMI technology this is required. See knowledge base on encrypting serverscheck.conf file. If someone has access to the machine (meaning he can read the serverscheck.conf file) then he already has admin rights meaning that your systems are already compromised.

---

We have a number of users in the IT support team. Not all of them have admin rights. If we secure the file from them then will they still be able to add/remove rules?



The ServersCheck service is already running with admin rights. Why does the rule require the username and password to be entered again?



After encrypting the serverscheck.conf file I know have -5 rules defined. All previously defined rules no longer show up on the "Dashboard - All Rules View" page.

Also, decrypting the file does not work.



I get the message,

# Tue Jul 11 19:00:21 2006 username and password incorrect => unstealth mode could not be performed



The same username and password do allow me to login and view my -5 rules.

1) As per knwoledge base stealth is in beta



2) You will need multiple user accounts



3) This is due to the very nature of WMI. You need admin rights for a service to have that service run out of its shelf and be allowed network access; then WMI uses the username and password to impersonate (different process) to connect to a remote machine. See Microsoft's website on WMI

After my aborted attempt at encrypting/decrypting the serverscheck.conf file. How can I rebuild the file so i can add checks?

The default serverscheck.conf file is available here:

www.serverscheck.net/files/serverscheck.conf

Ta Muchly

Also, as a side note.



When defining a rule for a windows service check the username is required but the password is not. After the rule has been saved I can remove the username and it functions correctly.



So, if the ServersCheck service is running under a domain account with sufficient privelages, then the username and password on the rule are NOT required.