Understanding Agents

Agents are part of the Business Logic layer. An agent is a service that runs on every computer that you want to monitor. Agents are automatically installed on computers managed by Agent Managers.

When an agent is first installed on a computer, it collects Windows 2000 events from at least the previous two hours. Then the agent collects events and other monitored information as they become available. An agent can capture the following types of information from the computer on which it is running:

• Events from Windows 2000 event logs
• Events from third-party application event logs
• Performance data such as thresholds and capacity planning data
• Missing events
• Timed events
• WMI information, including changes to the system services list and SNMP traps
• Events created by scripts

The agent applies processing rules to the collected information and performs actions as stipulated by the processing rules. By applying processing rules to collected information, the agent can perform any of the following actions and responses:

• Filter events
• Consolidate events into one event
• Send data to a Consolidator
• Send an alert when a performance threshold is crossed
• Send an alert based on an event to a Consolidator
• Generate an SNMP trap
• Run a batch or command file
• Change a state variable
• Execute a script

The following figure illustrates agent functions.

The agent temporarily stores information in a buffer before sending it through a guaranteed, encrypted delivery mechanism to a Consolidator. Microsoft Operations Manager 2000 can integrate with enterprise management frameworks by sending high-priority events as SNMP traps from each agent.

The agent uses a guaranteed delivery mechanism to ensure that each item of data is sent. Agents continue to collect data even through lengthy network outages by batching and sending data in a controlled fashion when network connectivity resumes.

Encrypted, compressed communications between agents and Consolidators provides increased data security, and prevents network eavesdropping and protocol spoofing attacks. Compression reduces network bandwidth usage, providing performance over slow links. Encrypted and compressed communications are enabled by default.

At regular intervals, the agent initiates communications with a Consolidator. You can configure the amount of data sent at each interval. You can also configure whether the communications are encrypted, and set the encrypted communications port.

Agents send a periodic heartbeat to a Consolidator that helps ensure the agent is operating properly. In response to the heartbeat, the Consolidator lets the agent know if the agent's rules need to be updated. When an agent begins to use updated rules, it generates an event with an event ID of 21240.