Agent Client Collector Monitoring provides various default checks and policies.

Provided checks

The following tables list the default checks. You can edit these checks as needed. For more information about a specific check, see its Check Definitions page, as described in Checks and policies.

Table 1. Linux
Type Name Description
Event os.linux.check-process Counts the number of running processes.

You can block event creation for this check when no process is detected. For details, see Block event creation for non-existent entities.
Event os.linux.check-system-cpu Checks the CPU usage percentage.
Event os.linux.check-system-cpu-load Checks the CPU data load percentage against the configured thresholds.
Event os.linux.metrics-system-disk-usage Checks the file system's mount points and metrics.
Event os.linux.check-system-memory-percentage Checks the memory usage percentage.
Event os.linux.check-system-memory-swap Checks the memory swap usage.
Event os.linux.check-threads-count Counts the number of threads running on the system. Sends an alert if that number is greater than the Warning or Critical threshold values.
Metric os.linux.metrics-memory-vmstat Collects vmstat memory metrics.
Metric os.linux.metrics-process-status Collects process status metrics provided to the metrics parameter.
Metric os.linux.metrics-system-cpu Collects CPU metrics, including cores.
Metric os.linux.metrics-system-cpu-load Uses uptime to collect CPU load metrics.
Metric os.linux.metrics-system-cpu-percentage Collects CPU usage percentage metrics, including average CPU utilization percentage.
Metric os.linux.metrics-system-disk Collects disk metrics.
Metric os.linux.metrics-system-disk-capacity Collects disk capacity metrics.
Metric os.linux.metrics-system-disk-usage Collects disk usage metrics, providing total, used, and available disk memory, as well as the disk's percentage of memory used.
Metric os.linux.metrics-system-memory Collects memory metrics, providing data in KB.
Metric os.linux.metrics-system-memory-percent Collects memory percentage metrics.
Metric os.linux.metrics-system-uptime Collects system uptime in seconds.
Metric os.linux.metrics-reboot-count-today Collects the number of reboots performed today.
Table 2. Linux Log Monitoring
Type Name Description
Event util.check-logs Enables monitoring log files owned by a regular user.

You can block event creation for this check when no process is detected. For details, see Block event creation for non-existent entities.
Event util.check-logs-sudo Enables monitoring log files owned by a root user.

You can block event creation for this check when no process is detected. For details, see Block event creation for non-existent entities.
Table 3. Linux Network Monitoring
Type Name Description
Metric os.linux.metrics-network-interface Retrieves all network interface related metrics for Linux servers.
Metric os.linux.metrics-netstat.tcp Retrieves metrics on TCP socket states from netstat. Useful on high-traffic web or proxy servers with large numbers of short-lived TCP connections coming and going.
Table 4. Windows Log Monitoring
Type Name Description
Event os.windows.check-log Enables monitoring log files on a Windows server.
Table 5. Windows
Type Name Description
Event os.windows.check-disk-name Takes the storage drive name as input and verifies if the drive is present. Returns a CRITICAL\WARNING\OK value based on the parameter provided.
Event os.windows.check-event-log Measures the Windows event log against parameter thresholds and returns a CRITICAL\WARNING\OK event.
Event os.windows.check-event-log-count Measures the Windows event log against parameter thresholds and returns a CRITICAL\WARNING\OK event.

Provides information on the number of events that have occurred within a specified duration for a single log file and a single ID. Also indicates the filters to be applied to retrieve events for a specific single-valued windows event level and provider name.

Retrieving events from multiple log files is not supported. The number of events is provided, without details of each and every event.
Event os.windows.check-event-log-details

Collects and filters Windows event logs based on the duration_hour, event_log_level and log_file values.

Retrieves and filters Windows event logs according to the provided parameters. It returns details about the events with CRITICAL, WARNING, or OK status, based on the specified severity level.

Supported on Windows version 7 and higher.
Event os.windows.check-env-variables Checks the environmental variables using a regular expression and returns either a WARNING or OK value.

If a new system variable is created after agent installation, you must restart the agent. This check can access only those user variables that are associated with the current user (used during agent installation).
Event os.windows.check-file-hashcode-update Takes the file's path and MD5 hashcode as an input and verifies whether file content has been modified. Returns a CRITICAL, WARNING, or OK value.

Read permissions are required on the monitored file.
Event os.windows.check-file-update Takes the file's path and interval as an input and verifies whether file content has been modified. Returns a CRITICAL, WARNING, or OK value.

Read permissions are required on the monitored file.
Event os.windows.check-modules Verifies whether the list of modules is present.
Event os.windows.check-processor-queue-length Checks Processor Queue Length.
Event os.windows.check-system-cpu-load Checks the CPU load by using the typeperf command.
Event os.windows.check-system-disk Checks disk usage under specific parameters.
Event os.windows.check-system-memory Collects RAM usage.
Event os.windows.check-system-patch Verifies system patch installation. Returns either a WARNING or OK value.

If the Windows server in use does not support Windows Management Instrumentation Command-line (WMIC), this check does not run.
Event os.windows.check-system-process Checks the user's task list to find running processes.
Event os.windows.check-user-account Takes the list of user names as an input and verifies whether the user account is active. Returns a CRITICAL, WARNING, or OK value.
Event os.windows.check-windows-directory Checks if a directory exists.
Event os.windows.check-windows-pagefile Collects page file usage and compares it to the Warning and Critical thresholds.

If the Windows server in use does not support Windows Management Instrumentation Command-line (WMIC), this check does not run.
Event os.windows.check-windows-process Checks if a user input process is running.

If the Windows server in use does not support Windows Management Instrumentation Command-line (WMIC), this check does not run.
Event util.check-windows-service Checks if a user-supplied service is running on Windows.

You can block event creation for this check when no process is detected. For details, see Block event creation for non-existent entities.
Metric os.windows.metrics-process-status Retrieves the number of running instances, the percentage of CPU utilization, and the memory usage (in kilobytes) of the specified Windows process.

If the Windows server in use does not support Windows Management Instrumentation Command-line (WMIC), this check does not run.
Metric os.windows.metrics-processor-queue Collects Processor Queue Length.
Metric os.windows.metrics-system-cpu-load Collects the average CPU load per second.
Metric os.windows.metrics-system-disk-usage Collects disk usage metrics.

If the Windows server in use does not support Windows Management Instrumentation Command-line (WMIC), this check does not run.
Metric os.windows.metrics-system-memory-percent Collects RAM usage per second, providing free physical, free virtual, total physical and total virtual memory percentage.

If the Windows server in use does not support Windows Management Instrumentation Command-line (WMIC), this check does not run.
Metric os.windows.metrics-system-network Collects network metrics.
Metric os.windows.metrics-system-uptime Collects system uptime.
Metric util.metrics-windows-perf-counters (No description)
Table 6. MID Server
Type Name Description
Event app.mid.check-active Checks if the MID Server is active, based on the occurrence of LogStatusMonitor in the MID log.
Events app.mid.check-logs-mid Checks the MID logs for errors.
Metric app.mid.metrics-stats Collects MID Server information from the log and returns metrics.
Table 7. HAProxy monitoring
Type Name Description
Event check-haproxy Retrieves the HAProxy load balancer details to determine whether it is running.
Metric metrics-check-haproxy Retrieves the HAProxy load balancer metrics to determine whether it is running.
Table 8. HTTP (to be run in proxy mode)
Type Name Description
Event util.check-http-response Takes a URL or a combination of host/path/port/ssl, and checks for a 200 response that matches a pattern, if provided. Can use client certificates.
Event util.check-http-follow-redirect Checks that the URL doesn't exceed the maximum number of redirects.
Metric util.metrics-http-curl Retrieves HTTP endpoint metrics using curl.
Table 9. Additional HTTP checks (no policy)
Type Name Description
Event util.check-http-response-code Raises a critical event if the URL response code does not match the regex.
Table 10. Active Directory Metrics
Type Check Description Command
Metric metrics.windows.active-directory Collects Active Directory metrics on the Windows host.

Usage: winchecks metric-windows-active-dir -s hostname

 winchecks metric-windows-active-dir {{if .labels.params_scheme}} -S {{.labels.params_scheme}} {{end}}
Table 11. Apache
Type Event/Metric Description Minimum version
Metric app.apache.metrics-apache Retrieves Apache HTTP server metrics. 2.4.x
Table 12. Apache Kafka
Type Event/Metric Description Minimum version
Event kafka.check-zookeeper-status Raises a critical event if the hosted Kafka Zookeeper is down. ZooKeeper 3.1.2
Event kafka.check-topic-replicas Raises a critical event if any topic has partitions with unknown replicas. ZooKeeper 3.1.2
Event kafka.check-topic-replication-factor Raises a critical event if replication factor of at least one topic is above or below provided replication factor parameter. ZooKeeper 3.1.2
Event kafka.check-topic-leader Raises a critical event if any topic has partitions with unknown leaders or unpreferred replica as leader. ZooKeeper 3.1.2
Events kafka.check-topic-partitions Raises a critical event if the number of partitions for a topic is less the min_partitions param. ZooKeeper 3.1.2
Event kafka.check-broker-status Raises a critical event if Kafka Broker on the host is down. Kafka 0.10.1.0
Metric kafka.metrics.broker Collects Kafka Broker Metrics from the host. Kafka 0.10.1.0
Metric kafka.metrics.zookeeper Collects Zookeeper Metrics from the host. ZooKeeper 3.5.0-alpha
Table 13. Azure k8s Metrics
Type Event/Metric Description Command
Metric azure.metrics-k8s-service Provides pod, nodes, and cluster level metrics from all Azure Kubernetes services in metric form.

Usage: metrics-azure-k8s-service.rb

Command example: metrics-azure-k8s-service.rb -S {{.labels.params_subscription_id}} -r westus2

 metrics-azure-k8s-service.rb -r {{.labels.params_ci_region}} {{-s {{if.labels.params_subscription_id}} -S {{.labels.params_subscription_id}} {{end}}
Table 14. Azure VM Metrics
Type Event/Metric Description Command
Metric azure.metrics-vm-cpu Provides CPU-related metrics of each VM instance in the Azure region.

Command example: ./metrics-azure-vm.rb -S {{.labels.params_subscription_id}} -T cpu

 metrics-azure-vm.rb -r {{.labels.params_ci_region}} {{if .labels.params_subscription_id}} -S {{.labels.params_subscription_id}} {{end}} -T {{.labels.params_type}}
Metric azure.metrics-vm-disk Provides disk-related metrics of each VM instance in the Azure region.

Command example: ./metrics-azure-vm.rb -S {{.labels.params_subscription_id}} -T disk

 metrics-azure-vm.rb -r {{.labels.params_ci_region}} {{if .labels.params_subscription_id}} -S {{.labels.params_subscription_id}} {{end}} -T {{.labels.params_type}}
Metric azure.metrics-vm-memory Provides memory-related metrics of each VM instance in the Azure region.

Command example: ./metrics-azure-vm.rb -S {{.labels.params_subscription_id}} -T memory

 metrics-azure-vm.rb -r {{.labels.params_ci_region}} {{if .labels.params_subscription_id}} -S {{.labels.params_subscription_id}} {{end}} -T {{.labels.params_type}}
Metric azure.metrics-vm-network Provides network-related metrics of each VM instance in the Azure region.

Command example: ./metrics-azure-vm.rb -S {{.labels.params_subscription_id}} -T network

 metrics-azure-vm.rb -r {{.labels.params_ci_region}} {{if .labels.params_subscription_id}} -S {{.labels.params_subscription_id}} {{end}} -T {{.labels.params_type}}
Metric azure.metrics-vm-flows Provides flows-related metrics of each VM instance in the Azure region.

Command example: ./metrics-azure-vm.rb -S {{.labels.params_subscription_id}} -T flows

 metrics-azure-vm.rb -r {{.labels.params_ci_region}} {{if .labels.params_subscription_id}} -S {{.labels.params_subscription_id}} {{end}} -T {{.labels.params_type}}
Table 15. GCP GCE metrics
Type Event/Metric Description
Metric gcp.metrics.GCE Retrieves metrics from GCP for Google Compute Engine.
Metric glassfish.metric-server-requests

Provides http-request metrics for all applications deployed on the Glassfish server.
Metric glassfish.metric-server-resources

Provides metrics of the resources deployed on the Glassfish server.
Metric glassfish.metric-transaction-service Provides metrics for all transactions on applications deployed on the Glassfish server.
Metric glassfish.metric-deployed-apps Provides metric output of the applications deployed on the Glassfish server.
Metric glassfish.metric-deployment-lifecycle Provides lifecycle metrics applications deployed on the Glassfish server.
Table 16. Glassfish
Type Name Description
Metric glassfish.metric-jvm-level

Retrieves JVM metrics on the Glassfish server.
Metric glassfish.metric-server-requests

Provides http-request metrics for all applications deployed on the Glassfish server.
Metric glassfish.metric-server-resources

Provides metrics of the resources deployed on the Glassfish server.
Metric glassfish.metric-transaction-service Provides metrics for all transactions on applications deployed on the Glassfish server.
Metric glassfish.metric-deployed-apps Provides metric output of the applications deployed on the Glassfish server.
Metric glassfish.metric-deployment-lifecycle Provides lifecycle metrics applications deployed on the Glassfish server.
Table 17. IBM WebSphere AS
Type Event/Metric Description Minimum version
Metric app.websphere.metrics-websphere Returns IBM WebSphere application server metrics.

Ensure that the user running the agent has sufficient permissions to access the required files in the IBM Websphere AS installation directories.

 9
Table 18. IIS
Type Event/Metric Description Minimum version
Event app.iis.check-iis-alive Checks if IIS is running. -
Event app.iis.check-iis-current-connections Checks the number of current connections to the IIS server and their status, depending on the input. By default, all sites are connected to the IIS server. -
Metric app.iis.metrics-iis Returns IIS metrics. -
Table 19. JBoss/WildFly
Type Event/Metric Description Minimum version
Metric app.jboss.metrics-jboss Retrieves JBoss/WildFly server metrics.

Ensure that the user running the agent has sufficient permissions to access the required files in theJBoss/WildFly installation directories.

 16, 17
Table 20. Kubernetes
Type Event/Metric Description Command
Event k8s.check-kube-apiserver-available Checks if Kubernetes API server is up. check-kube-apiserver-available.rb {{if .labels.params_api_server}} -s {{.labels.params_api_server}} {{end}}
Event k8s.check-kube-nodes-ready Checks whether Kubernetes nodes are in ready-to-use state. check-kube-nodes-ready.rb {{if .labels.params_api_server}} -s {{.labels.params_api_server}} {{end}}
Event k8s.check-kube-pods-pending Measures the threshold by which pods are in the Pending state. Determine the threshold by setting the pending_timeout check parameter value (default = 300 seconds). check-kube-pods-pending.rb {{if .labels.params_api_server}} -s {{.labels.params_api_server}} {{end}}
Event k8s.check-kube-pods-restarting Checks the pods that are restarting. Determine the threshold by setting the check parameter value (default = 10). check-kube-pods-restarting.rb {{if .labels.params_api_server}} -s {{.labels.params_api_server}} {{end}} {{if .labels.params_restart}} -r {{.labels.params_restart}} {{end}}
Event k8s.check-kube-pods-running Checks the pods that are in the running state. Configure the threshold in the not_ready_time check parameter, in seconds (default = 0). check-kube-pods-running.rb {{if .labels.params_api_server}} -s {{.labels.params_api_server}} {{end}} {{if .labels.params_not_ready_time}} -time {{.labels.params_not_ready_time}} {{end}}
Event k8s.check-kube-pods-runtime Checks whether pods are running longer than expected. Configure threshold in the check parameter (in seconds). You can configure both WARNING and CRITICAL thresholds. check-kube-pods-runtime.rb {{if .labels.params_critical}} -c {{.labels.params_critical}} {{end}} {{if .labels.params_warning}} -w {{.labels.params_warning}} {{end}} {{if .labels.params_api_server}} -s {{.labels.params_api_server}} {{end}}
Event k8s.check-kube-service-available Checks whether Kubernetes services are up and running. Add the list of services to be monitored in the services' check_param field as comma-separated values (without spaces).

If you enter services that are not valid, the check fails.

 check-kube-pods-runtime.rb {{if .labels.params_critical}} -c {{.labels.params_critical}} {{end}} {{if .labels.params_warning}} -w {{.labels.params_warning}} {{end}} {{if .labels.params_api_server}} -s {{.labels.params_api_server}} {{end}}
Metric k8s.metrics-pods Provides a pod count from all of the exposed services. metrics-pods.rb {{if .labels.params_api_server}} -s {{.labels.params__api_server }} {{end}}
Table 21. MsSQL
Type Event/Metric Description Minimum version
Metric app.msssql.metrics-mssql Retrieves MSSQL database metrics. 2016
Metric app.metrics-mssql-query Generic MSSQL query class which accepts a query and dumps metrics. 2016
Table 22. MySQL
Type Event/Metric Description Minimum version
Event app.mysql.check-mysql-alive Checks if the MySQL database is running. 5.7, 8
Event app.mysql.check-mysql-threads Checks the number of running threads on the MySQL database. Depending on the input, it determines the status: OK, Warning, or Critical. 5.7, 8
Event util.check-mysql-query Checks the length of a MySQL query result set.

Ensure that you use the native_password authentication method on the MySQL server when utilizing this check.

 5.7, 8
Metric app.mysql.metrics-mysql Returns MySQL database metrics. 5.7, 8
Metric app.mysql.metrics-mysql-processes Returns MySQL database process metrics. 5.7, 8
Metric util.metrics-mysql-query Creates a formatted metric for the length of a MySQL query result set. 5.7, 8
Table 23. MongoDB
Type Event/Metric Description Minimum version
Event app.mongodb.check-mongodb-alive Monitors whether the MongoDB server is alive and creating alerts for the MongoDB server health status.
Event app.mongodb.check-mongodb-metrics Creates alerts for any of the MongoDB metrics, based on the threshold limit.
Metric app.mongodb.metrics-mongodb Returns metrics of the MongoDB server and all databases.
Table 24. Oracle
Type Event/Metric Description Minimum version
Event app.oracle.check-oracle-alive Checks if the Oracle database is running. 12c, 18c
Metric app.oracle.metrics-oracle Returns Oracle database metrics. 12c, 18c
Metric util.metrics-oracle-query Generic Oracle query class that accepts a query and dumps metrics. 12c, 18c
Table 25. Oracle WebLogic AS
Type Event/Metric Description Minimum version
Metric app.weblogic.metrics-weblogic Returns Oracle WebLogic application server metrics.

Ensure that the user running the agent has sufficient permissions to access the required files in the WebLogic installation directories.

 12cR2
Table 26. Tomcat
Type Event/Metric Description Minimum version
Metric app.tomcat.metrics-tomcat Returns Apache Tomcat server metrics. 8.5.27, 9.x
Table 27. App
Type Name Description
Event util.check-snmp SNMP check that compares the metric value to the default. Requires input such as server, port, SNMP community, and limits.
Metric util.metrics-snmp Collects metrics from an SNMP OID value.
Metric util.metrics-snmp-bulk-sn Collects metrics from an SNMP Table OID and returns the result as a table.
Table 28. Service enhancements (can be associated with any policy)
Type Event/Metric Description Command
Metric (Windows) os.windows.metrics-service-status Collects Windows service status, providing metric of number of services running. winchecks metric-windows-service-status -S Wcmsvc --scheme hostname.proc
Table 29. Varnish
Type Name Description
Metric app.varnish.metrics-varnish Collects Varnish metrics from the host.
Table 30. vSphere
Type Name Description
Metric vsphere.metric-VirtualMachine Retrieves metrics for the vSphere Virtual Machine.
Metric vsphere.metric-Datastore Retrieves metrics for the vSphere Datastore.
Metric vsphere.metric-Datacenter Retrieves metrics for the vSphere Datacenter.
Metric vsphere.metric-ESX_Server Retrieves metrics for the vSphere ESX Server or HostSystem
Table 31. Zscaler
Type Name Description
Metric zscaler-monitoring-check Verifies whether the Zscaler app is running properly.
Metric zscaler-remediation-check Shuts down and restarts the Zscaler app, and creates an incident. Runs only when the zscaler-monitoring-check fails.
Table 32. CPU enhancements
Type Event/Metric Description Command
Metric os.windows.metrics-system-cpu Collects CPU core metrics.

If the Windows server in use does not support Windows Management Instrumentation Command-line (WMIC), this check does not run.

 winchecks metric-windows-cpu --scheme hostname.proc
Table 33. Disk enhancements - Linux events (can be associated with any policy)
Event/Metric Description Command
os.linux.check-disk-ioTimeWeighted Measures the disk ioTimeWeighted value, returning a CRITICAL\WARNING\OK message, according to the thresholds specified in the parameters. check-disk-ioTimeWeighted.rb
os.linux.check-disk-sectorsWritten Measures the total number of sectors written successfully, returning a CRITICAL\WARNING\OK message, according to the thresholds specified in the parameters. check-disk-sectorsWritten.rb
os.linux.check-disk-sectorsRead Measures the disk's total number of sectors read successfully, returning a CRITICAL\WARNING\OK message, according to the thresholds specified in the parameters. check-disk-sectorsRead.rb
os.linux.check-disk-readTime Measures the total number of milliseconds spent by all read-against thresholds, returning a CRITICAL\WARNING\OK message, according to the thresholds specified in the parameters. check-disk-readTime.rb
os.linux.check-disk-writes Measures the total number of writes completed successfully, returning a CRITICAL\WARNING\OK message, according to the thresholds specified in the parameters. check-disk-writes.rb
os.linux.check-disk-reads Measures the total number of reads completed successfully, returning a CRITICAL\WARNING\OK message, according to the thresholds specified in the parameters. check-disk-reads.rb
os.linux.check-disk-writesMerged Measures the disk writesMerged value, returning a CRITICAL\WARNING\OK message, according to the thresholds specified in the parameters. check-disk-writesMerged.rb
os.linux.check-disk-readsMerged Measures the disk readsMerged value, returning a CRITICAL\WARNING\OK message, according to the thresholds specified in the parameters. check-disk-readsMerged.rb
os.linux.check-disk-writeTime Measures the total number of milliseconds spent by all write operations, returning a CRITICAL\WARNING\OK message, according to the thresholds specified in the parameters. check-disk-writeTime.rb
os.linux.check-disk-ioInProgress Measures the disk ioInProgress value, returning a CRITICAL\WARNING\OK message, according to the thresholds specified in the parameters. check-disk-ioInProgress.rb
os.linux.check-disk-iotime Measures the disk ioTime value, returning a CRITICAL\WARNING\OK message, according to the thresholds specified in the parameters. check-disk-ioTime.rb
Table 34. Disk enhancements - Windows events (can be associated with any policy)
Event/Metric Description Command
os.windows.check-disk-AvgSecWrite Measures average disk writes per second, returning a CRITICAL\WARNING\OK message, according to the specified in the parameters.

If the Windows server in use does not support Windows Management Instrumentation Command-line (WMIC), this check does not run.

 winchecks check-windows-AvgDisksec-write -w 1 -c 0
os.windows.check-disk-ReadBytes-sec Measures the disk ReadBytes value per second, returning a CRITICAL\WARNING\OK message, according to the thresholds specified in the parameters.

If the Windows server in use does not support Windows Management Instrumentation Command-line (WMIC), this check does not run.

 winchecks check-windows-DiskReadBytes-sec -w 1 -c 0
os.windows.check-disk-WriteBytes-sec Measures the disk WriteBytes value per second, returning a CRITICAL\WARNING\OK message, according to the thresholds specified in the parameters.

If the Windows server in use does not support Windows Management Instrumentation Command-line (WMIC), this check does not run.

 winchecks check-windows-DiskWriteBytes-sec -w 1 -c 0
os.windows.check-disk-AvgSecRead Measures the average disk reads per second, returning a CRITICAL\WARNING\OK message, according to the thresholds specified in the parameters.

If the Windows server in use does not support Windows Management Instrumentation Command-line (WMIC), this check does not run.

 winchecks check-windows-AvgDisksec-read -w 1 -c 0
Table 35. Disk enhancements - Windows metrics (can be associated with any policy)
Event/Metric Description Command
os.windows.metrics-system-disk Collects the following disk metrics:
  • AvgDiskSecPerRead
  • AvgDiskSecPerWrite
  • DiskReadBytesPerSec
  • DiskWriteBytesPerSec

If the Windows server in use does not support Windows Management Instrumentation Command-line (WMIC), this check does not run.

 winchecks metric-windows-disk
Table 36. Memory enhancements (can be associated with any policy)
Type Event/Metric Description Command
Event (Linux) os.linux.check-free-physical-memory Measures the free physical memory percentage of the Linux system, returning a CRITICAL\WARNING\OK event message, according to the thresholds specified in the parameters. check-free-physical-memory -w 10 -c 5
Event (Linux) os.linux.check-free-virtual-memory Measures the free virtual memory percentage of the Linux system, returning a CRITICAL\WARNING\OK event message, according to the thresholds specified in the parameters. check-free-virtual-memory -w 10 -c 5
Event (Windows) os.windows.check-free-physical-memory Measures the free physical memory percentage of the Windows system, returning a CRITICAL\WARNING\OK event message, according to the thresholds specified in the parameters.

If the Windows server in use does not support Windows Management Instrumentation Command-line (WMIC), this check does not run.

 winchecks check-windows-free-physfical-memory -w 10 -c 5
Event (Windows) os.windows.check-free-virtual-memory Measures the free virtual memory percentage of the Windows system, returning a CRITICAL\WARNING\OK event message, according to the thresholds specified in the parameters.

If the Windows server in use does not support Windows Management Instrumentation Command-line (WMIC), this check does not run.

 winchecks check-windows-free-physical-memory -w 10 -c 5
Metric (Windows) os.windows.metrics-system-memory Collects the following memory metrics:
  • FreePhysicalMemory
  • TotalPhysicalMemory
  • FreeVirtualMemory
  • TotalVirtualMemorySize
  • AvailableMemory
  • TotalVisibleMemorySize
 winchecks metric-windows-memory --scheme hostname.proc
Table 37. Process enhancements (can be associated with any policy)
Type Event/Metric Description Command
Event (Linux) os.linux.check-process-cpu Measures the Linux process CPU usage, returning a CRITICAL\WARNING\OK message, according to the thresholds specified in the parameters. check-process-cpu.rb -p acc -c 95 -w 85
Event (Linux) os.linux.check-process-memory Measures the Linux process memory usage, returning a CRITICAL\WARNING\OK message, according to the thresholds specified in the parameters. check-process-memory.rb -p acc -c 95 -w 85
Metric (Linux) os.linux.metrics-process-usage Collects the Linux process status, including the CPU and memory data used by the process. metrics-process-usage.rb -p acc -s hostname.proc
Event (Windows) os.windows.check-process-cpu Measures the Windows process CPU usage, returning a CRITICAL\WARNING\OK message according to the thresholds specified in the parameters.

If the Windows server in use does not support Windows Management Instrumentation Command-line (WMIC), this check does not run.

 winchecks check-windows-process-cpu-p acc -c 95 -w 85
Event (Windows) os.windows.check-process-memory Measures the Windows process memory usage, returning a CRITICAL\WARNING\OK message according to the thresholds specified in the parameters.

If the Windows server in use does not support Windows Management Instrumentation Command-line (WMIC), this check does not run.

 winchecks check-windows-process-memory-p acc -c 95 -w 85
Metric (Windows) os.windows.metrics-process-usage Collects the Windows process status, including the CPU and memory data used by the process. winchecks metric-windows-process-status -n Svchost -s hostname.proc

Supported Agent policies

This table lists the supported Agent Client Collector for Monitoring policies that the check definitions are associated with. The policies consist of the monitored CIs and the checks that run on them.

Name Description Checks
Apache Events Monitors operational Apache HTTP web servers.
To enable monitoring if the process is alive, activate the relevant check:
  • For Linux: os.linux.check-process
  • For Windows: os.windows.check-windows-process

On the Credentials tab, specify Basic Auth Credentials.
  • os.linux.check-process
  • os.windows.check-windows-process
Apache Metrics Monitors operational Apache HTTP web servers.

On the Credentials tab, specify Basic Auth Credentials.

app.apache.metrics-apache
Apache Kafka Events Monitors the status of Kafka Broker, Kafka topics, partictions, replicas and Zookeeper.
Apache Kafka Metrics Monitors and collects metrics from Kafka Broker and Kafka Zookeeper.
Azure DB Metrics Monitors Azure databases on an Azure datacenter.

To enable the policy's checks:

  • Configure a proxy agent.
  • Add the following Azure service principal credentials:
    • Tenant ID
    • Client ID
    • Secret Key
  • Configure the Authentication Method as Client secret.
  • Add Azure credentials in the policy.
  • Provide the subscription_id value in each check instance.

The default monitored CI Type is cmdb_ci_azure_datacenter, but the binding occurs on the Cloud Database (cmdb_ci_cloud_database).

For details on configuring a policy, see Create a new Agent Client Collector policy.
Azure k8s Service Metrics Monitors the Azure CI, cmdb_ci_azure_datacenter. Binds with the Kubernetes data cluster, cmdb_ci_kubernetes_cluster.

azure.metrics-k8s-service

For details, see Azure Health Monitoring default checks and policies.
Azure VM Metrics Monitors the Azure CI, cmdb_ci_azure_datacenter. Binds with the virtual machine instance, cmdb_ci_vm_instance.
  • azure.metrics-vm-cpu
  • azure.metrics-vm-disk
  • azure.metrics-vm-memory
  • azure.metrics-vm-network
  • azure.metrics-vm-flows

For details, see Azure Health Monitoring default checks and policies.
Basic Discovery Runs basic ServiceNow Discovery on all agents, every 12 hours.

This check extracts basic information about the host and its running processes. The host information is used to create the corresponding host in the CMDB, while the running processes create the classified application CIs.

You need advanced OS privileges to use the Net stat command to discover ports. The command that you run depends on your OS, as follows:

  • Linux: sudo -n netstat -antp
  • Windows: netstat -anop TCP

check-discovery-basic
Docker Container Metrics

Collects performance metrics for Docker containers.

Provide the credentials of users who are Docker user group members or have sudo rights. Provide these credentials on the Credentials tab of the policy form.

container.docker.metrics-docker
Docker Engine Metrics Collects general metrics for the Docker engine.

Provides the credentials of a user which is either a member of the Docker user group or has been assigned sudo rights on the Credentials tab.

To enable running checks through this policy, add the servicenow user to the Docker user group on the machine where the agent is running.

container.docker.metrics-docker-info
F5 SNMP Events Example for using SNMP checks.
Because the Agent doesn't run on SNMP devices, provide the following to complete this policy:
  • A Proxy Agent and credentials.
  • The host of the Proxy Agent. On the Credentials tab, specify the SNMP Community Credentials for connecting to the server.

util.check-snmp
F5 SNMP Metrics Example for using SNMP metrics.
Because the Agent doesn't run on SNMP devices, provide the following to complete this policy:
  • Proxy Agent and credentials.
  • The host of the Proxy Agent. On theCredentials tab, specify the SNMP Community Credentials for connecting to the server.
  • util.metrics-snmp
  • util.metrics-snmp-bulk-sn
Glassfish Metrics Runs metric checks on the Glassfish server.

Glassfish metrics are supported in ITOM Agent Client Collector version 2.3.0 - August 2022, available from the ServiceNow Store.
HAProxy Events Retrieves the HAProxy load balancer details to determine whether it is running.

HAProxy events are supported in ITOM Agent Client Collector version 2.3.0 - August 2022, available from the ServiceNow Store.
HAProxy Metrics Retrieves the HAProxy load balancer metrics to determine whether it is running.

HAProxy metrics are supported in ITOM Agent Client Collector version 2.3.0 - August 2022, available from the ServiceNow Store.
HTTP Entry Points Events Runs the util.check-http-follow-redirect check on all HTTP entry points that belong to application business services. The policy filter chooses the services. The services define the entry points.
  • To enable this check, there is a new database view which combines the application services table with the entry points table.
  • You can filter the services and receive the entry points.
  • When you receive an alert, it is automatically bound to the entry points. This alert affects the impact calculation, because entry points are considered.
  • This policy requires a Proxy Agent.

util.check-http-follow-redirect
HTTP Entry Points Metrics For example, when the alert is bound to the entry point, the service map identifies an entry point problem.
  • The metric binds to the entry point CI. In previous releases, the metric was bound to the service and the entry point was the resource.
  • This policy requires a Proxy Agent.

util.metrics-http-curl
IIS Events Monitors operational IIS servers.
  • app.iis.check-iis-alive
  • app.iis.check-iis-current-connections
IIS Metrics Monitors operational IIS servers.

app.iis.metrics-iis
JBoss/WildFly Application Server Events Monitoring operational JBoss/WildFly application servers.

To enable monitoring if the JBoss process is alive, activate os.linux.check-process.

The jboss_home parameter in the check instance is specified as the location where JBoss is installed.

os.linux.check-process
JBoss/WildFly Application Server Metrics Monitors operational JBoss/WildFly application servers.

app.jboss.metrics-jboss
Kubernetes Monitors health of Kubernetes infrastructure, such as clusters, nodes, pod status, API, and service availability.

When running Kubernetes checks:

  • Proxy agent must be enabled.
  • Enter Kubernetes credentials, either a username/password combination or a bearer token (but not both).
  • To activate and publish the policy, configure the api_server value in the check parameter definitions of each check, as one of the following:
    • https://127.0.0.1:<portnumber>/api (If the API server and agent are running on the same server)
    • https://<api_server_url>/api (Whether the API server and agent are running on the same or different servers).
    To use the localhost as your api_server, run the following command: "kubectl proxy -port=8081 &"
  • Run Discovery to discover all Kubernetes CIs. For details, see Kubernetes discovery.
  • k8s.check-kube-apiserver-available
  • k8s.check-kube-nodes-ready
  • k8s.check-kube-pods-pending
  • k8s.check-kube-pods-restarting
  • k8s.check-kube-pods-running
  • k8s.check-kube-pods-runtime
  • k8s.check-kube-service-available
  • k8s.metrics-pods
Linux log monitoring Monitors logs on operational Linux servers.
  • util.check-logs
  • util.check-logs-sudo
Linux OS Events Runs Linux checks on operational Linux servers.
  • os.linux.check-process
  • os.linux.check-system-cpu
  • os.linux.check-system-cpu-load
  • os.linux.check-system-disk-usage
  • os.linux.check-system-memory-percentage
  • os.linux.check-system-memory-swap
  • os.linux.check-threads-count
Linux OS Metrics Collects Linux metrics on operational Linux servers.
  • os.linux.metrics-memory-vmstat
  • os.linux.metrics-process-status
  • os.linux.metrics-system-cpu
  • os.linux.metrics-system-cpu-load
  • os.linux.metrics-system-disk
  • os.linux.metrics-system-disk-capacity
  • os.linux.metrics-system-disk-usage
  • os.linux.metrics-system-memory
  • os.linux.metrics-system-memory-percentage
  • os.linux.metrics.reboot_count_today
MSSQL Events Monitors the operational MSSQL server process. Runs os.windows.check-windows-process to monitor when the server process is alive.

os.windows.check-windows-process
MSSQL Metrics Monitors operational MSSQL server process. Runs app.mssql.metrics-mssql to gather metrics.

app.mssql.metrics-mssql
MySQL DB Events Monitors operational MySQL instances.
On the Credentials tab, specify Basic Auth Credentials for connecting to the database server.
Note: Utility checks, prefixed with util, have required parameters for which you must specify a value. These parameters have no default values.
  • app.mysql.check-mysql-alive
  • app.mysql.check-mysql-threads
  • util.check-mysql-query
MySQL DB Metrics Monitors operational MySQL instances.
On the Credentials tab, specify Basic Auth Credentials for connecting to the database server.
Note: Utility checks, prefixed with util, have required parameters for which you must specify a value. These parameters have no default values.
  • app.mysql.metrics-mysql
  • app.mysql.metrics-mysql-processes
  • util.metrics-mysql-query
Network ping metrics Monitors the ip address discovered in the ServiceNow instance. The cmdb_ci_hardware monitored CI type is bound to the relevant server:

This policy requires a proxy agent.

 util.metrics-ping
Oracle DB Events Monitors operational Oracle Database instances.
On the Credentials tab, specify Basic Auth Credentials for connecting to the database server.
Note: Utility checks, prefixed with util, have required parameters for which you must specify a value. These parameters have no default values.

app.oracle.check-oracle-alive
Oracle DB Metrics Monitors operational Oracle Database instances.
On the Credentials tab, specify Basic Auth Credentials for connecting to the database server.
Note: Utility checks, prefixed with util, have required parameters for which you must specify a value. These parameters have no default values.
  • app.oracle.metrics-oracle
  • util.metrics-oracle-query
Self-Healing Events Runs a ping command to another host. Ensure that you run this check in proxy mode.

util.check-ping
Tomcat Events Monitors operational Apache Tomcat servers.
To enable monitoring if the Tomcat process is alive, activate the relevant check:
  • For Linux: os.linux.check-process
  • For Windows: util.check-windows-service

If the Tomcat service is running under a different name, update the value of the check instance's service parameter to the correct value.
  • os.linux.check-process
  • util.check-windows-service
Tomcat Metrics Monitors operational Apache Tomcat servers.

If Tomcat Metrics are running on a port other than the default port (9000), update the value of the check instance's port parameter to the correct port value.

app.tomcat.metrics-tomcat
Varnish Metrics Monitors and collects metrics from Varnish.

Varnish metrics are supported in ITOM Agent Client Collector version 2.3.0 - August 2022, available from the ServiceNow Store.

You must perform discovery using application fingerprints before running Varnish checks. For details, see Enable running of Varnish checks.
vSphere Metrics Monitors and collects metrics from vSphere.

vSphere metrics are supported in ITOM Agent Client Collector version 2.3.0 - August 2022, available from the ServiceNow Store.

This policy requires a proxy agent.
WebLogic Application Server Events Monitors operational Oracle WebLogic application servers. This policy monitors if the WebLogic process running on Linux is alive.

On the Credentials tab, specify Basic Auth Credentials for connecting to the application server.

os.linux.check-process
WebLogic Application Server Metrics Monitors operational Oracle WebLogic application servers.

On the Credentials tab, specify Basic Auth Credentials for connecting to the application server.

Ensure that the user running the agent has sufficient permissions to access the required files in the WebLogic installation directories.

app.weblogic.metrics-weblogic
WebSphere Application Server Events Monitors operational IBM WebSphere servers. This policy monitors if the WebSphere process running on Linux is alive.

On the Credentials tab, specify Basic Auth Credentials for connecting to the application server.

os.linux.check-process
WebSphere Application Server Metrics Monitors operational IBM WebSphere servers.

On the Credentials tab, specify Basic Auth Credentials for connecting to the application server.

app.websphere.metrics-websphere
Windows Log Monitoring Monitors logs on operational Windows servers.

os.windows.check-log

You can block event creation for this check when no process is detected. For details, see Block event creation for non-existent entities.
Windows OS Events Runs Windows checks on operational Windows servers.
  • os.windows.check-processor-queue-length
  • os.windows.check-system-cpu-load
  • os.windows.check-system-disk
  • os.windows.check-system-memory
  • os.windows.check-system-process
  • os.windows.check-windows-directory
  • os.windows.check-windows-directory
  • os.windows.check-windows-directory
  • os.windows.check-windows-pagefile
  • os.windows.check-windows-process
Windows OS Events - Extended Runs Windows checks to monitor directories and files on Windows servers.
  • check-directory-file-count
  • check-directory-integrity
  • check-file-age
  • check-file-response-time
  • check-file-size
  • check-file-space
  • os.windows.check-directory-space
Windows OS Metrics Collects Windows metrics on operational Windows servers.
  • os.windows.metrics-processor-queue-len
  • os.windows.metrics-system-cpu-load
  • os.windows.metrics-system-disk-usage
  • os.windows.metrics-system-memory-percent
  • os.windows.metrics-system-network
  • os.windows.metrics-system-uptime
Zscaler Monitoring Policy Executes Zscaler monitoring on all of a machine's CIs.
  • zscaler-monitoring-check
  • zscaler-remediation-check