<%NUMBERING1%>.<%NUMBERING2%>.<%NUMBERING3%> PRTG Manual: Remote Probes and Multiple Probes

Upon installation, PRTG automatically creates the first probe, the local probe in PRTG on premises, and the hosted probe in PRTG hosted by Paessler. They run on the PRTG core server system and monitor all reachable devices, servers, and services from this system, using the sensors you configured.

Working only with a local probe should suffice for LAN monitoring with PRTG on premises and if you want to monitor one location only. For LAN monitoring with PRTG hosted by Paessler, at least one remote probe is required because the hosted probe can only reach targets that are publicly available via the internet.

Scenarios Requiring Remote Probes

There are several situations that make it necessary to work with remote probes in the same LAN or in remote locations. Among these situations are the following:

You run a PRTG hosted by Paessler instance and want to monitor your local network.
You have more than one location and you need to make sure that services are available from all locations.
Your network is divided into several LANs by firewalls, and the local probe cannot monitor specific services across these firewalls.
You want to monitor systems in a secure network and you need a secure connection between the PRTG core server and this network.
You want to sniff packets on a different computer.
You want to monitor NetFlow data on a different computer.
You experience performance issues with CPU-intensive sensors like Packet Sniffer or NetFlow sensors and need to distribute the load among more than one PC.

The following chart shows an example for a remote probe scenario.

Monitoring a Distributed Network with PRTG

The PRTG core server inside the corporate LAN (top left) can monitor:

Services inside the corporate LAN using the local probe.
Services behind a firewall in the corporate LAN using remote probe 1.
Secured services inside the branch office (bottom right) using remote probe 2.
Secured services on mail server and web server using remote probe 3 and remote probe 4 installed directly on these servers.
Public services on the internet using any of the probes.

How Probes Work

As soon as a probe starts, it automatically connects to the PRTG core server, downloads the sensor configuration, and begins its monitoring tasks. The PRTG core server sends new configuration data to a probe as soon as the user changes the monitoring configuration. Probes monitor autonomously and send the monitoring results back to the PRTG core server for each check they have performed.

If the connections between the PRTG core server and a probe fail for any reason (for example, restarting the PRTG core server system), the probe continues to monitor and stores the results. During a connection loss, a buffer stores a maximum of 500,000 sensor results in the RAM of the remote probe system (up to 50 - 200 MB). This means that for 100 sensors with a 1-minute scanning interval, the monitoring results of up to 3 days can be buffered (or 52 minutes for 10,000 sensors with a 1-minute scanning interval). The probe automatically reconnects to the PRTG core server as soon as it is available again and transmits all monitoring results gathered during the connection loss.

The connection between a probe and the PRTG core server is initiated by the probe and is secured using Transport Layer Security (TLS). This means that the data sent back and forth between the PRTG core server and the probe is not visible to someone capturing data packets. The PRTG core server provides an open TCP/IP port and waits for connection attempts from probes. If a new probe connects for the first time, you receive a ToDo ticket and then see the new probe in the device tree.

As a security precaution, you must manually approve the probe in the device tree before you can create any sensors. You can also deny a probe. It is then disconnected. PRTG accepts no further connection attempts and it adds the probe IP to the Deny IPs list in the probe's system settings (see section System Administration—Core & Probes). This ensures that unauthorized probes cannot connect to a PRTG core server.

Because the probe initiates the connection, you must ensure that a connection to your PRTG core server from the outside can be established. For example, you might need to open any necessary ports in your firewall and you might need to specify a network address translation (NAT) rule for your network. The process is the same as if you wanted to allow access to the web server provided by the PRTG core server via port 443, for example. Make sure that you have the Transmission Control Protocol (TCP) port 23560 open or forwarded on both your PRTG core server side and probe side.

If you run PRTG in a cluster, remote probes also connect to all cluster nodes and send monitoring data. This works as described above for a single PRTG core server. If the master node fails, you can still see monitoring data on the failover nodes. You can define the Cluster Connectivity of each probe in the probe's settings, section Administrative Probe Settings.

Automatic Probe Update

Whenever you install a new version of PRTG on the PRTG core server, all remote probes automatically download and install the updated version as soon as they reconnect to the updated PRTG core server.

The local probe is updated when you update the PRTG core server. All remote probes automatically download the new binaries using the TLS-secured probe or PRTG core server connection. Downloading the 4-MB file takes anywhere from a few seconds (in LANs) up to a few minutes (via internet connections), depending on the available bandwidth. As soon as the update has been downloaded, the remote probe disconnects, installs the update, and reconnects to the PRTG core server. This takes between 20 and 100 seconds. Note that during the update phase, monitoring by the local probe can be affected because of the bandwidth required for the downloads.

If a remote probe keeps being disconnected after an update, check if the server with the remote probe has two network connections with different IP addresses. Make sure these addresses are in the list of allowed IPs in the System Administration—Core & Probes settings.

Delete Remote Probe

Deleting a connected remote probe via the device tree stops the PRTG probe service on the remote probe system and sets the startup type to manual. We recommend that you additionally uninstall the remote probe on the remote probe system.

Deleting a disconnected remote probe does not stop the PRTG probe service on the remote probe system and does not affect the startup type. The remote probe will continue to try to reconnect to the PRTG core server until you manually stop the PRTG probe service or uninstall the remote probe on the remote probe system.

PRTG MANUAL

PAESSLER WEBSITE

How to connect PRTG through a firewall in 4 steps

https://www.paessler.com/support/how-to/firewall

VIDEO TUTORIAL

Distributed Monitoring with PRTG

https://www.paessler.com/learn/videos/distributed_monitoring

Add Remote Probe—Topics

Advanced Topics