PRTG Network Monitor: Enterprise Monitoring Setup

Introduction

PRTG Network Monitor is a comprehensive monitoring solution widely used in enterprise Windows environments. It monitors everything from SNMP-based network devices to Windows performance counters, HTTP endpoints, and custom sensors. As a junior engineer in an environment using PRTG, you need to understand how to add devices, create sensors, set thresholds, and build useful dashboards. This guide covers the real-world PRTG workflows you'll use daily.

PRTG Architecture Overview

TEXT

┌─────────────────────────────────────┐
│          PRTG Core Server           │
│  ┌─────────────────────────────┐    │
│  │    Web Interface (443)      │    │
│  │    REST API                 │    │
│  │    Notification Engine      │    │
│  └─────────────────────────────┘    │
│  ┌──────────┐  ┌──────────────┐     │
│  │  Probe   │  │ Remote Probe │     │
│  │ (local)  │  │ (remote site)│     │
│  └────┬─────┘  └──────┬───────┘     │
└───────┼────────────────┼────────────┘
        │                │
  ┌─────▼──────┐   ┌─────▼──────┐
  │ Local LAN  │   │ Remote LAN │
  │  Devices   │   │  Devices   │
  └────────────┘   └────────────┘

PRTG uses "probes" — monitoring agents that do the actual polling. The local probe is on the PRTG server itself; remote probes monitor devices at other locations and report back to the core.

Adding Devices and Auto-Discovery

TEXT

# Manual device addition:
1. PRTG Web UI → Devices → Add Device
2. IP Address: 192.168.1.1
3. DNS Name: router.company.com
4. Device Icon: select appropriate type
5. Credentials tab:
   - Windows: DOMAIN\username + password (for WMI)
   - SNMP: v2c, community string "public" (or your string)
   - SSH: username + key/password (for Linux)
6. Click "OK and Run Auto-Discovery"

# Auto-discovery finds common sensors automatically:
# - Ping
# - SNMP Traffic (all interfaces)
# - SNMP Uptime
# - WMI CPU (Windows)
# - WMI Memory (Windows)

Creating Custom SNMP Sensors

PYTHON

# Most network devices support SNMP OIDs
# Common OIDs you'll use:

# Interface traffic
# ifInOctets:  1.3.6.1.2.1.2.2.1.10.<ifIndex>
# ifOutOctets: 1.3.6.1.2.1.2.2.1.16.<ifIndex>

# CPU usage on Cisco
# ciscoAvgBusy5: 1.3.6.1.4.1.9.2.1.58.0

# Temperature on Cisco
# ciscoEnvMonTemperatureStatusValue: 1.3.6.1.4.1.9.9.13.1.3.1.3.<index>

Adding a custom SNMP sensor in PRTG:

TEXT

1. Right-click device → Add Sensor
2. Filter: "SNMP Custom"
3. Select "SNMP Custom Integer"
4. Configure:
   OID: 1.3.6.1.4.1.9.2.1.58.0
   Name: Cisco CPU Load 5min
   Unit: %
   Value Type: Absolute value (not counter)
5. Set limits:
   Warning above: 70%
   Error above: 90%

Windows Monitoring with WMI Sensors

TEXT

# WMI sensors require:
# 1. PRTG service runs as domain account (or local admin)
# 2. Windows Firewall allows WMI (TCP 135 + dynamic ports)
# 3. Target machine: WBEM, DCOM enabled

# Common WMI sensors:
- WMI CPU Load: Shows per-core and total CPU
- WMI Memory: Physical, virtual, page file usage
- WMI Logical Disk: Space used/free, I/O
- WMI Service: Monitor if specific Windows services are running
- WMI Event Log: Alert on specific Windows Event IDs

# Example: Monitor Windows Event ID 4625 (failed logon)
Sensor: WMI Event Log
Log: Security
Event IDs: 4625
Alert when: Count > 10 in 5 minutes → trigger notification

HTTP/API Monitoring

TEXT

# HTTP sensor types:
- HTTP: Simple up/down check (status code)
- HTTP Advanced: Check response content, JSON values
- REST Custom: Parse JSON/XML API responses

# Example: Monitor API endpoint returning JSON
Sensor: REST Custom (XML/JSON)
URL: https://api.company.com/v1/health
Authentication: Bearer token in headers
JSON Path: $.status
Expected: "healthy"
Interval: 60 seconds

# Check specific JSON value
JSON: {"status": "ok", "latency_ms": 45, "queue_size": 1250}
Monitor latency_ms with:
  Warning above: 200
  Error above: 500

Setting Thresholds and Notifications

TEXT

# Sensor states in PRTG:
# 0 = OK (green)
# 1 = Warning (yellow)
# 2 = Error (red)
# 3 = Unknown (gray)

# Example: Disk space thresholds
Warning above: 80% used
Error above: 90% used

# For counter-type sensors (traffic bandwidth):
Unit: Mbit/s
Warning above: 800 Mbit/s (80% of 1 Gbit link)
Error above: 950 Mbit/s (95% of 1 Gbit link)

Notification template (email):

TEXT

Subject: [PRTG] {status} - {name} on {host}

Device: {host}
Sensor: {name}
Status: {status}
Value: {lastvalue}
Date/Time: {datetime}

Message: {message}

Link: {url}

PRTG REST API for Automation

PYTHON

#!/usr/bin/env python3
# prtg_api.py - Automate PRTG tasks
import requests
import urllib3
urllib3.disable_warnings()  # PRTG often uses self-signed cert

PRTG_URL = "https://prtg.company.com"
USERNAME = "api-user"
PASSWORD = "api-password"  # Or use API token

def prtg_get(endpoint, params={}):
    params.update({
        'username': USERNAME,
        'password': PASSWORD,
        'output': 'json'
    })
    resp = requests.get(f"{PRTG_URL}{endpoint}", params=params, verify=False)
    return resp.json()

# Get all sensors in error state
def get_error_sensors():
    data = prtg_get('/api/table.json', {
        'content': 'sensors',
        'columns': 'objid,name,device,status,lastvalue,message',
        'filter_status': 5  # 5=Error
    })
    return data.get('sensors', [])

# Acknowledge alerts programmatically
def acknowledge_sensor(sensor_id, message):
    params = {
        'id': sensor_id,
        'ackmsg': message,
        'username': USERNAME,
        'password': PASSWORD
    }
    resp = requests.get(f"{PRTG_URL}/api/acknowledgealarm.htm",
                       params=params, verify=False)
    return resp.status_code == 200

# Pause a device during maintenance
def pause_device(device_id, duration_minutes=60, message="Maintenance"):
    params = {
        'id': device_id,
        'action': 2,      # 2=pause for duration, 0=resume
        'duration': duration_minutes,
        'pausemsg': message,
        'username': USERNAME,
        'password': PASSWORD
    }
    requests.get(f"{PRTG_URL}/api/pause.htm", params=params, verify=False)

if __name__ == "__main__":
    errors = get_error_sensors()
    print(f"Found {len(errors)} sensors in error state:")
    for s in errors:
        print(f"  {s['device']} - {s['name']}: {s['message']}")

Creating Maps and Dashboards

TEXT

# PRTG Map Designer:
1. Setup → Maps → Add Map
2. Map name: "Network Overview"
3. Set background: upload floor plan image or use grid

# Add objects to map:
- Drag devices from device tree onto map
- Add "Summary Sensor" tiles (shows group status)
- Add traffic flow arrows between devices
- Add text labels for locations

# Map objects update in real-time:
- Green background = device/sensor OK
- Yellow = warning
- Red = error
- Tooltip shows current values

# Share maps:
- Public map URL (no login required) for NOC screens
- Embed in SharePoint/wiki with iframe

PRTG Best Practices

TEXT

1. Organize with Groups:
   Root
   ├── Core Infrastructure
   │   ├── Network (routers, switches)
   │   └── Servers (Windows, Linux)
   ├── Applications
   │   ├── Web Servers
   │   └── Databases
   └── Remote Sites
       ├── Branch Office 1
       └── Branch Office 2

2. Use Inheritance for credentials:
   Set SNMP community at Group level → all devices inherit

3. Pause maintenance windows:
   Right-click device → Pause → "Until [date/time]"
   Add comment explaining why

4. Regular cleanup:
   - Remove sensors that are always in "unknown" state
   - Delete devices that no longer exist
   - Check Sensors by Type for orphaned sensors

5. Backup configuration:
   Setup → System Administration → Backup/Restore Config
   Schedule weekly automated backup to network share

PRTG's strength is its breadth of sensor types and ease of setup in Windows environments. Master the sensor threshold configuration and notification templates first — those skills directly translate to faster incident response times.