Frequently Asked Technical Questions

If you don't find the answers you need here, send your questions to support@paglo.com. To ensure that our responses do not get blocked by your spam filter, add support@paglo.com to your address book.

Getting Started FAQs

What if I never received a registration email and am unable to log on to my Paglo website?

Let us know at support@paglo.com. To ensure that you continue to receive all emails from us, add support@paglo.com to your address book.

Search FAQs

Why don't I see information from devices that are not on my local subnet?

By design, the Crawler scans only devices in the network on which its host computer resides. But you can add more subnets for your Crawler to scan by setting the Networks tab in the Crawler configuration dialog.

Why doesn't Paglo recognize my network adapter or IP address during installation?

Try rebooting your computer. The Paglo software installs winpcap to be able to capture packets, and it is possible that this portion of the installation did not finish properly. Rebooting will allow the winpcap installation to complete, and when the Crawler is installed again, it should detect your adapters.

If this doesn't work, check to see that your adapter works with Winpcap. Check the list for adapters reported to work with Winpcap. You can also download windump.exe and run windump -D. The output of this command will list the supported cards in your system. If your network adapter is not recognized by Winpcap, then you will need to acquire a new adapter, or run the Crawler on a different computer.

How can I test that WMI information is retrievable from my Windows computers?

Microsoft has a utility called wbemtest that you can use to test whether WMI information is available from a specific computer. It is included on Windows XP, Vista, and 2003 Server operating systems, and maybe others. You can use this tool against your computers to verify that WMI information is retrievable. To use wbemtest:
1. Click Start => Run.
2. Enter wbemtest in the field, and click OK to start the Window Management Instrumentation Tester.
3. Click the Connect... button.
4. In the top box, enter root\cimv2 to test the local machine.
5. If you want to test a remote system, enter \\10.10.10.10\root\cimv2, replacing 10.10.10.10 with the IP address of the system you're testing.
6. Click the Connect button.
7. Click the Query button to open the Query box.
8. Enter a test query, such as SELECT * FROM win32_logicaldisk and then click Apply.
9. If the system is responding correctly to WMI queries, results will be returned. Note that the time it takes to run a query depends on the amount of information being returned.
You can see what types of WMI information that your Crawler has retrieved on the Ontology page:
1. Log in to your Paglo account, and click the Developers link at the bottom of any page.
2. On the Developers page, select the Ontology tab.
3. In the Filter field, type wmi and click the button to see a list of every type of data under /network/device/wmi that your Crawler has discovered on your network. You should be able to search that data from your Paglo account.

Dashboard FAQs

On my dashboard, I noticed a graph called Temperature that shows work, desk, and rack but I don't have any of those. Where did they come from? Am I seeing data that belongs to another user? This scares me. Does it mean other users are seeing MY data?

No, other users cannot see your data. The Temperature graph is based on artificial data that we add to every first-time user's database so you can see a working graph even before the Crawler has collected all your data. You are not seeing someone else's data, and no one else can see yours. Each company database is distinct and separate.

If you'd like to read more about your Search Index and how we keep it separate, see Your Search Index.

Crawler FAQs

How much bandwidth does the Crawler use when it probes the network?

The Crawler has its bandwidth usage capped at 1Mbps, but in practice, the actual bandwidth usage is much less than this. The traffic tends to be bursty but when averaged over time, it is a negligible load on a typical WAN.

How much of a device's system resources does the Crawler use when gathering data from it?

Very little. The Crawler issues a number of requests to each device, but typically each request only takes a fraction of a second to respond to. It is unlikely that any user would notice a performance impact as their computer is probed.

Can I keep the data collected by the Crawler on a system locally, rather than upload it to your servers?

No, the information in your Search Index can only be searched at Paglo.com.

Does the Crawler support Linux?

We currently have only a Windows version of the Paglo Crawler. The windows Crawler will still gather information from Linux machines if provided the proper SSH credentials. It is likely that in the future we will offer a linux version of the Crawler as well. This is still several months away however.

I never added SNMP credentials to my Crawler, yet I see statistics from one of my switches. Why?

By default, the Crawler automatically attempts to use public for an SNMP read community string. In this case, that string successfully retrieved data from one of your switches.

I added SNMP credentials to my Crawler, now how can I verify that it's working?

To test your SNMP credentials, run a query against the SNMP-enabled device as follows:
1. Download NetSNMP for Windows.
2. Install to C:\Program Files\NetSNMP.
3. Open a command prompt, and run the following (including quotes):
```
"c:\Program Files\NetSNMP\bin\snmpwalk.exe" -v 2c -c <community string> <ip address> 
```
4. View the results:

How can I get the SNMP data from my switches updated more frequently?

The data from certain devices is most meaningful if there are frequent updates on their status. Switch Traffic is a great example of this. To get regular updates from your switches, add their IP addresses to the SNMP Interface Statistics plugin as follows:
1. Double-click the Paglo icon in your status bar to open the Crawler dialog box.
2. In the Paglo Crawler Status dialog, click Configure.
3. In the Paglo Crawler Configure dialog, select the Plugins tab.
4. Under Available Plugins, highlight the SNMP Interface Statistics plugin.
5. In the Hosts field, enter the IP addresses of your switches, separated by commas.
6. Clicking OK to save the changes.
Note: As the name implies, only SNMP data is collected using this method. Only SNMP enabled devices should be placed in this list!

What is the scanning interval for devices entered into the SNMP Interface Statistics Plugin?

The scanning interval for the SNMP Interface Statistics Plugin is five minutes. This value is fixed and cannot be set by the user.

How do I give my Crawler access to the Windows computers on my network?

Provide a Windows username and password with administrative permissions to your Crawler (see Reconfiguring your Crawler). The computer running the Crawler must not be blocked by firewalls on the systems being scanned. If your workstations are joined to a Windows Domain, you can set a group policy by following the instructions below. If you are not running a Windows Domain, make sure the Crawler has access to ports 135 and 445 on the systems you want scanned.
1. On your Windows Domain Controller, open the Active Directory Users and Computers utility.
2. Select or create the Organizational unit to which you want your policy assigned.
3. Right click the unit, open Properties, and select the Group Policy tab.
4. Add a remote WMI policy object, or select an existing object, and click Edit.
5. Double-click Administrative Templates > Network > Network Connections > Windows Firewall.
6. If the computer is in the domain, then double-click Domain Profile. Otherwise, double-click Standard Profile.
7. Click Windows Firewall: Allow remote administration exception.
8. On the Action menu, select Properties.
9. Click Enable, and then click OK and close out of the Group Policy Editor.
10. Now place the computers that should have Remote Administration enabled on their firewalls into the entity with the new Group Policy.
11. The next time the client computers are restarted, the Crawler will have access to them.
To test whether the computer adopted the policy, click Start > Run, and launch rsop.msc. Open the location referenced in step 5, and verify Windows Firewall: Allow remote administration exception with the value of enabled. Your Crawler should now be able to gather WMI information from your Windows computers. If you are unfamiliar with Group Policy, much more detailed information can be found on the web. This link is one place to start: Connecting Through Windows Firewall.

Do I need to restart the Crawler for configuration changes to take effect?

Most changes take effect without restarting the Crawler, but you can't always see them right away:
- Network Credentials — Changes take effect without restarting the Crawler, as the Crawler is refreshed by the RefreshAdapters scheduled task. This occurs every minute.
- Networks — Changes take effect without restarting the Crawler. The newly added networks are included in the next scheduled network scan. You can trigger a network scan at any time by restarting the Crawler.
- Windows Credentials — Changes take effect the next time a specific plugin requests these credentials.
- SNMP, Telnet, SSH Credentials — Changes take effect the next time a specific plugin requests these credentials.
- Ignored Devices — Changes take effect without restarting the Crawler. However, if a scan is in progress against those devices, then that scan completes, and the change takes effect on the next scan.
- Plugins — Changes take effect without restarting the Crawler, but there may be a slight lag time depending on when the plugin reads in the config variable.
- Company data key — Changes take effect immediately without restarting the Crawler.

Why doesn't my Crawler configuration ever reach 100%?

If your Crawler has not reached 100%, it means it is not configured for one or more of the areas listed in the following table. Follow the configuration hints to configure for what's missing. Paglo evaluates the configuration status of your Crawler by the following criteria:

Crawler runs and gathers any information at all	40%
Crawler gathers WMI information	20%
Crawler gathers Directory information	20%
Crawler gathers bridging table information	20%

If your Crawler has not reached 100%, follow the configuration hints to bring it up to full capacity.

Why is the install wizard too small to display all the information, and is not resizeable?

This may happen if your computer's Display Properties are set to 120 DPI. This DPI setting makes items 1.25 times bigger than their normal size, preventing the items in the install wizard from fitting within the Window constraints of the installation software.

To check your DPI setting:
1. Right-click on your desktop, and select Properties.
2. On the Settings tab, click Advanced.
3. On the General tab, see your DPI settings.
4. Set it at 96 DPI for the duration of the wizard, and finish installation.

How do I add the Crawler plugins?

You don't need to, because the plugins section of the Crawler is populated automatically. To verify your plugin files, look in the Paglo installation directory. By default, this is at: C:\Program Files\Paglo\Paglo Crawler\Plugins. You should find nine Ruby plugin files in this location, with an extension of *.rb. If you find files, stop and restart your Crawler, and then wait a few minutes before configuring the plugins. If you do not find these files, reinstall the Crawler, and then look again. They should download with the software.

Does Paglo have a function that shows me shared network drives on every workstation or server over my network?

Yes, Paglo is capable of doing this. Copy the following query into your search box to gather a list of Windows shares on your network:
```
 SELECT ../win32_computersystem/name as "System", 
   name as "Share Name", 
   path as "Path", 
   description as "Description", 
   type as "Type", 
   caption as "Share Type", 
   status as "Status" 
 FROM /network/device/wmi/win32_share order by 1, 2
```
You might also try some of the searches saved by other people. You can access these by clicking on the down triangle to the left of your search bar and selecting View Saved Searches. You may need to substitute your server names or IP addresses in some of them so they are relevant in your environment.

When I installed the Crawler in Vista 32 bit, why does the Npptools.dll fail?

You have an old version of the Crawler that was not designed for Windows Vista. To upgrade, go to the Get Started page, and click Download Now.

When installing the Crawler, I get an "Error opening file for writing" message on wanpacket.dll and packet.dll. Why does this happen?

Wanpacket.dll and packet.dll are part of Winpcap, which the Crawler uses for some packet analysis. This error occurs when you have packet analysis software already installed that is actively running on your server at the same time as the Crawler installation. To avoid the error message, stop the packet analysis software, and then install the Crawler.

Why are Crawler finds sometimes different from UI finds?

Sometimes there appears to be a difference between what your Crawler finds, and what your search UI finds. For example, your Crawler might say Devices Found: 6, and IT Information Indexed: 20, but when you click on Devices Found in your search UI, it says your Search Index has 14 Directory Items and 3 Systems.

There are two reasons for this:
- The Crawler and the search UI are not counting the same things. The Crawler counts every hint of a device as a Device. For example, each unique MAC address on the network counts as a device. In the search UI, a device qualifies as a System only if we can discover more about it, such as its DNS name.
- Also, sometimes there is a time lag between the Crawler's discoveries, and those discoveries showing up in your Index, as this data goes through the indexing process. Check your search UI a little later to see if the count is closer to what you expected.
See also Is a Device the same as a System? Is IT Information Indexed the same as a Directory Item?

Is a Device the same as a System? Is IT Information Indexed the same as a Directory Item?

No, these are each different.

The Crawler counts every hint of a device as a Device. For example, the Crawler counts each unique MAC address on the network as a Device. On the other hand, the search UI counts a device as a System only if it has more information about it, such as its DNS name.

Likewise, IT Information Indexed is not the same as a Directory Item. The Crawler adds each piece of data to the IT Information Indexed count. So installed software, MAC addresses, and so on, are individual pieces of data that each add to the IT Information Indexed total. As you can see, when the Crawler scans a device, that can generate multiple pieces of individual IT data. On the other hand, each Directory Item is counted only once. See also Why are Crawler finds sometimes different from UI finds?

PQL FAQs

In PQL, where is case sensitivity important, and where is it not?

Paglo and PQL are case-insensitive, with the following exceptions:
- Strings are case-sensitive, and will not work if written with the wrong case. Use the following workaround if you are not sure which case a string should be, such as:
  WHERE upper (mac_address) = upper ('00:0a:0b:0c:0d')
- Reserved words are not case-sensitive, but you must write the entire word in one case. So SELECT and select work, but Select or sELEct fails.

Why do I get this error message: “Syntax error in line 4 at character 30, didn't expect ‘index’ here”?

When your ontology contains paths that use the same name as PQL reserved words, PQL sends syntax errors. In this case, index is a reserved word so PQL thinks you want to create an index. To avoid this problem, write reserved words in double quotes, such as:
```
 SELECT win32_networkadapter["index" = '7'] 
 FROM /network/device/wmi
```
Here's another example:
```
 SELECT win32_networkadapter/"index"  
 FROM /network/device/wmi
```

How do I combine multiple sets of data onto one graph?

You can generate complex charts that track multiple sets of related data on a single chart by simply listing multiple series data in the SELECT clause of a PQL query.

For example, if you have a couple of queries that find related information — such as the temperature at your desk, in the server room, and outdoors — you can combine them into a single query by listing both series data, separated by commas, in the SELECT clause of the PQL query. This enables you to display multiple columns of data in a single table or chart, like this:
```
 SELECT history(outside, desk, rack, 
 from_time => '1 day ago') 
 FROM /sample/temperatures
```
You can now view the temperatures indoors (at both your desk and the server rack) and those outdoors, side-by-side. Putting all three in the SELECT clause results in multiple columns if displayed as a table, or multiple lines if displayed as a line graph. Note that the data sets must exist under the same parent node.

See also Displaying related data together.