Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
A Problem is the cause of one or more potential incidents and can generally be identified because one or more incidents have the same symptoms. In GLPI, The Problem allows you to inform, assign and plan, etc., actions or decisions. Problems are accessible in Assistance
> Problems
.
A problem object can be created :
from the ticket form
in the Problem tab
or directly from the Assistance
> Problems
menu.
The problem creation form is very similar to the ticket creation form and shares many of the same concepts: Requestor, Observer, Assigned to, Status, Urgency, Impact, Priority, Category.
No, only tickets can be used by the receiver.
Yes, in the same way as tickets, Problems notifications can be customised. Go to Setup > Notifications > Notification templates
.
In this article, we will discover Management module and the different objects it contains.
GLPI allows you to manage the licenses of your software deployed on your fleet.
The License object is linked to Software object in your inventory. To be able to manage licenses, it is necessary to establish the process of inventory for your fleet.
You can define information related to license, for example:
status
software version
editor
expiration date
on which workstation is it installed
What advantages gives you this feature:
centralisation of information
planning renewals
issue alerts (version changed on a workstation or the number of licenses becomes insufficient)
At time, (GLPI 10.0.10), only software can benefit from the allocation of a license.
In Management > Licences >
Items
tab, you can check on which computer the software requiring a licence is installed.
An automatic action software
can be set so that a notification is sent to you when a licence expires. !!! Info The expiration
field must be filled in for the notification to be sent.
This may be due to 2 parameters:
the expiration
field has not been filled in (Management
> Licenses
, select the licence concerned and check the expiration
field)
the automatic action is not activated or not correctly configured (Setup
> Automatic actions
, check and/or configure the software
action)
GLPI allows the generation of a number of reports related to your equipment, financial data, etc.:
The default report: This report lists the equipment present in the park sorted by operating system for computers and bytype for other equipment.
Equipment under maintenance contract: Equipment under maintenance contract with a third party. It is possible to obtain adetailed report by type of equipment and by date of purchase. Multiple selection is allowed.
Equipment report by year: Information on the purchase date, warranty and associated contracts for one or more years.Multiple selection is allowed.
Hardware Inventory Financial Information Report: Summary financial information for computers, printers, network hardware,monitors and peripherals as well as the total value and net book value of your assets.
Other Financial Information Report: Summary financial information for cartridges, licenses and consumables.
Network Report: Network information by location, network equipment or network outlets.
Loan report: Summary of current, future or past loans for a given user.
Status report: Summary by type of equipment of the different statuses.
You can also use the "more reporting" plugin to obtain additional reports
It's important to understand that these 2 tasks are linked. Network discovery will bring up all the equipment discovered on the network according to its type (computer, printer, switch, etc.) and the business rules established. The SNMP inventory will inject the data authorised by the manufacturer via the SNMP protocol (serial number, OS, cartridges, etc.). A procedure is available here to help you configure these steps. A guide is also available directly from GLPI (Administration > GLPI Inventory > Guide
) A procedure is available
GLPI of course allows you to upload your workstations directly into your instance. You need to install the GLPI agent on the workstations concerned. You can download it here link and enter the address of your instance when installing it. You will find all the necessary documentation here
Via this article, you'll find all the configuration you need to set up your Oauth SMTP. Access to your Azure tenant is required to set up this service. You'll find the procedure
You can refer to the online documentation to configure your agent correctly.
A Change is the establishment of the resolution of a Problem (in GLPI sense or not) or the establishment of a new material / human element or process of your . Change allows you to inform, assign, plan, budget, etc. The Changes are accessible in Assistance
> Changes
.
To create a Change, like any element of GLPI, click on add
. The change form reminds the form of incidents, of which distinguish the concepts:
requesters
observers
assigned
status
urgency
impact
priority
category
Like the Problem, it is possible to attach other elements of GLPI to your Change: Ticket / Problem / Projects / Costs / etc.
A is available to help you implement your change.
A reccurent change is a change that occurs periodically and is planned in order to prepare and plan the possible steps that could be linked to it.
Example : Weekly check that Windows patches have no impact on production performance.
You can link other GLPI projects, problems, items, etc. to it.
In Assistance
> Reccurent changes
click on Add
Add a name and a comment if necessary. Set your change to active and indicate a start date (an end date if necessary). Add the desired periodicity as well as early creation if you want the change to be created before the start date
. All that remains is to save your reccurent change.
Automatic actions
Remember to check that the RecurrentItems
automatic action in setup
> automatic actions
is active and set to the correct run frequency
so that the change creation action can be carried out.
The available statuses are :
Yes. It is possible to link problems, tickets, projects and elements of the fleet to have a complete overview of the progress of the change.
When creating an article, check the box put this item in the FAQ
. If there are no particular restrictions, it will be visible to all profiles in all entities.
In the article concerned, click on Targets
. You can then restrict an article to :
an entity
a group
a profile
a user
For optimum operation of the knowledge base, we advise you to use entity-based restrictions.
You can add a configurable expiry date in the visible until
field directly in the article concerned. The article will be deactivated but not deleted.
You can add a configurable date of appearance in the visible since
field directly in the article concerned. The article will be visible from this date for the targets you have set.
In the revisions
tab of your article, all the versions you have saved are present. You can then show
the article or restore
the version.
It is possible to give access to the FAQ to someone who does not have access to your GLPI. In Setup
> General
, tick the box Allow FAQ anonymous access
.
It is possible to insert an external link when someone clicks on the help
link in the user options.
This help
tab can be configured from Setup
> General
> General setup
in the Simplified interface help link
or Standard interface help link
fields. It is possible to set different links for each.
From Administration
> Profiles
, select the desired profile. From the Tools
tab, uncheck everything related to Knowledgebase
. The tab in the corresponding profile will no longer be visible.
An iframe (short for inline frame) is an HTML element that allows a separate HTML document to be embedded within a web page. In other words, it is a kind of ‘window’ in a web page that displays other content or a website.
Example of iframe syntax
<iframe src=‘https://www.example.com’ width=‘600’ height=‘400’></iframe>
The most commonly used example is dashboards. To generate an iframe for dashboards, go to Assistance
> Dashboards
>. Select the dashboard you want to integrate and click on (at the top right of the screen). In the box that opens, copy the Iframe
part and integrate the code (which should look like the code below) into your site
For security reasons, we do not authorise the default iframe (on the backend) for Cloud versions.
It is perfectly possible to open it, but there are several things you need to know
Danger
This opening concerns the entirety of GLPI
You expose yourself to risks of phishing
We do not guarantee that all GLPI functionalities will work in this context
In an OauthSSO context, the iframe does not work
To limit the risks, we will ask you to provide us with the URLs in which the Frame will be integrated
The use of iframes can expose the site to vulnerabilities if the GLPI content is not properly secured. An attacker could inject malicious code into the iframe, affecting users or compromising data.
<iframe src=‘https://www.myinstance.com/front/central.php?embed&dashboard=central&entities_id=0&is_recursive=1&token=5b04t6hhnbf-4f70-6g12-af13-12gdefdf5v8d’ frameborder=‘0’ width=‘800’ height=‘600’ allowtransparency></iframe>
All elements of the fleet can benefit from financial management. It can be activated by default from Setup
> General
> Assets
> Enable the financial and administrative information by default
Financial management is divided into 3 groups:
The compulsory information is as follows
Value
: Monetary value of the asset
Amortization type
: Linear or decreasing
Amortization duration
(in years)
Amortization coefficient
For a linear asset:
The Net Asset Value is calculated using the following fields:
The value of the asset
Amortization period
The Start date of warranty OR Startup date
The Startup date takes precedence over the Start date of warranty so that both values are met it is the commissioning date that will be taken into account.
For declining balance assets:
The Net Book Value is calculated using the following fields:
The value of the asset
The Amortization period
A Amortization coefficient greater than 1
The start date of warranty
TCO (Total Cost of Ownership) is the overall cost of ownership.
The TCO is the sum of the value of the item and the different tickets linked to this item in which a cost has been set.
The monthly TCO is the TCO divided by the number of months elapsed since the date of purchase (number of months in use).
New
Evaluation
Approval
Accepted
Pending
Testing
Qualification
Applied
Review
Closed
Cancelled
Refused
Contract management in GLPI is designed to provide efficient, centralised management of all aspects of contracts, improving the transparency, traceability and efficiency of IT operations.
For example, contracts can be used to
Cost management: GLPI tracks the costs associated with each contract, including recurring and one-off payments.
Budgeting: financial information from contracts can be used for budgeting and forecasting expenditure.
Linking with other modules: Contracts can be linked to specific assets or equipment, making it easier to monitor equipment coverage and maintenance.
Supplier management: GLPI can be used to manage a directory of suppliers, with detailed information on each one. It is also possible to set up a supplier evaluation system to assess supplier performance in terms of services provided and contracts in force.
You can enter a range of information to help you manage your contracts and related items:
Name
Status
Contract type
Start date
Initial contract period
Notice period
Location
Number
Account number
Contract renewal period
Invoice period
Maximum number of items
Renewal
Email alarms
Support hours (can be set for weekdays, Saturdays, Sundays and holidays)
Available tabs :
Costs
Suppliers
Items
Documents
Links
Notes
Knowledge base
Tickets
History
All
Yes, from Administration
> Entities
> Support
tab. Select the desired contract in Default contract
.
To make contract management easier, notifications can be sent:
End of contract
End of periodicity
Advance notice
Advance notice of period
This may be due to a number of reasons:
Problem configuring the
The contract is not active or no longer active
The contract
is not active or incorrectly configured
Your cron is not active or incorrectly configured
If you don't see your contract in the GLPI object in question, you need to check a few points:
The contract must be active (not expired)
A start date must be entered
A duration must be indicated
Expired contracts are not visible in the various GLPI objects so as not to "pollute" the list of contracts. On the other hand, you can link a GLPI object directly from the contract even if it has expired.
Yes, from Tools
> Reports
, you can select the option By contract
. Select the item type (several items possible) then the year(s).
There are several types of rules in GLPI. Rules are used to automate and simplify certain tasks. It is, for example, possible to assign an item to an entity when an inventory is uploaded, to allocate an authorisation to a user when he/she logs in, or to assign a ticket via a collector.
Rules are based on criteria and actions linked to these criteria
For example
Rules for assigning authorisations to a user
1st criterion
: Type of authentication is external (i.e. other than internal database and LDAP)
2nd criterion
: User ID contains @mondomaine.com
1st action
: assign self-service profile
2nd action
: assign entity A
3rd action
: assign recursiveness Yes
You can also play with operators (is, is not, contains, begins with, etc.) to create rules that match your needs.
Rules for import and link equipments
Rules for assigning an item to an entity
Location rules
Rules for assigning a ticket created through a mails receiver
Authorizations assignment rules
Rules for assigning a category to software
Business rules for tickets
Business rules for assets
Transfer
Blacklists
In GLPI rules, you need to use operators to be able to build your rule. For example, if login contains
@mondoamine.com orif group is
infrastructure. A number of operators are available to create your rules as explicitly and logically aspossible.
is
is not
contains
does not contain
starting with
finished by
regular expression matches
regular expression does not match
exists
does not exist
under
not under
A relational expression is based on RegEx, which allows you to simplify your rules (provided you have some knowledge of RegEx),apply massive modifications, and apply a value via "variables". Rules of this type are already created by default in GLPI. You can see a rule of this type in Administration
> Rules
> Rules for importand link equipments
:
This rule is used to assign a user in the user field of an asset according to the return of the 3rd criterion:
(.*)@
: means any alpha-numeric character that also contains an @.
#0
: means to increment the result of the relational expression
For example, when the inventory is brought up, the rule will check that a user of type [email protected]
is present inthe item record. If this is the case, it will automatically assign this value in the user field of the asset item. You can use the website regex101.com to build your templates with RegEx
Definition: set of rights.
A profile is a list of rights. Profiles are built on the basis of an interface:
Simplified interface : designed for end users
Standard interface: for the rest of the users (admin profiles)
By default 8 profiles are available in GLPI:
Super Admin: this profile has all rights
Admin: ideal for entity administrators (no rights for general configuration)
Technician: has access to the inventory and helpdesk in order to process tickets
Supervisor: can perform as a Technician by adding elements allowing the management of team and its organization (allocationof tickets ...)
Hotliner: it allows you to create tickets and track them, but not to be in charge of them as a technician
Observer: this profile has "read" rights for inventory, management and, perhaps, observer data for a ticket
Self-Service: this profile is limited to the simplified interface
Read-Only: used only for "locked" objects
magenement is done from the Administration> Profiles menu
the rights are divided into different tabs, they correspond to the "modules" of GLPI
we advise to use the existing profiles by default and not to multiply the profiles
An authorization is the "connection" between User, Profile and Entity
A user can be linked to one or more entities and with different rights (several authorizations)
These rights can be passed to the daughter entities (recursive) or no.
A schematic example of delegation of rights:
The authorizations of user are managed in the "Authorizations" tab of the user's file.
These can be added automatically via Authorization Rules (during LDAP synchronization for example).
The profiles in GLPI (8 by default) are of two types, representing two different user interfaces:
The Simplified interface
on a default installation, only for the profile named Self-Service
The Standard interface
on a default installation, for all other profiles: Super-Admin, Admin, Hotliner, Observer, Supervisor, Technician, Read-Only
The Simplified interface contains a very limited menu, giving access by default only to:
Tickets
The reservation of equipment
The consultation of the FAQ
And the access to the forms of your catalog of services.
This interface is used by end-users. These users with a simplified interface are free and unlimited.
The Standard interface contains all GLPI menus (depending on the administrative rights), and is used by:
Technicians
"IT agents"
Helpdesk agents
Or even administrators, fleet managers, etc.
To reopen a ticket, 3 conditions must be met:
You must be able to create follow-ups
The status
of the ticket is closed
To be able to pass
a ticket in new status
or in assigned status
Thanks to these 3 conditions, it is therefore possible to create a profile which would be authorized to reopen a closed ticket.
It is possible to create a dashboard from scratch, or to duplicate a dashboard and modify it later. A is available to help you.
This is not possible. This formatting is necessary to avoid having too large numbers on the dashboards (space issue). However, it is possible to see the "real" value by hovering over the number.
If your counters are not visible, this may be due to your default entity. If this is not configured, the root entity is taken by default. If you do not have access to this entity from your profile, the counters will not be visible. From administration
> users
, set the default entity
for the user concerned.
Depending on your profile permissions, you can share a dashboard. Simply click on the icon. You can then share it with an entity, a group, a user or a profile.
You can share a dashboard with a direct link (public link for monitoring for example) or with a iframe (for integration in document like HTML)
Dashboard filters are used to display specific information about a GLPI object.
Example Your dashboard shows all assigned tickets, but you only want to see tickets assigned to the infrastructure group.
When you edit your dashboard, an option appears add a filter
. Click on this option and select the filter that suits you best
Yes. Thanks to the share
of dashboards, you can copy the iframe which can be inserted into other web pages.
To prevent other technicians or administrators from seeing your dashboard, you can make it private using the icon. This does not prevent you from sharing it with other profiles, entities, etc.
Yes, you can use the icon to display your dashboard full screen.
No. These values are set by default and cannot be changed.
Yes. When you add a new tile, the background colour
field allows you to change it to the colour of your choice.
Yes, using the icon, you can clone and then modify it. The new dashboard will have the same name with the copy
and you will be able to modify it afterwards.
Mini-dashboards are reduced dashboards present in the header of a GLPI object:
Yes, you can enable/disable them from Setup
> General
, tab Default values
. In the dashboards
insert. Select the option that suits you in default for tickets (mini dashboard)
.
Yes. From the user record in question, go to Setup
> Dashboards
> Default for tickets (mini-dashboard)
, enable or disable the mini-dashboards.
A saved search allows you to display the results of a query without having to specify filters for each search.
Example
Display all open tickets for which the has been exceeded
This function is available for tickets, problems, changes, computers, network hardware, etc.
If we want to see, for example, all unresolved tickets whose has expired, we need to start by performing the correspondingsearch. Once you have done this, click on ⭐
A new menu will appear, allowing you to set the various options available:
Do count
: displays the number of items found next to the saved search,
Visibility
: allows you to make a search public or private.
Entity
: defines the entity where the search should appear,
child-entities
: defines the visibility of child entities.
Yes, you just need to define it when you save the search.
The search can only be visible if the authorisations in the corresponding profile have been granted (Administration
> Profiles
. Choose the relevant profile and then the tools tab)
Users with a simplified interface do not have access to saved searches.
You can find them in 2 places:
In the lists
menu of the corresponding item
In Tools
> Saved searches
.
Alerts allow you to send notifications when any of your searches exceed a quota. Alerts can be sent to the administrator, entity administrator, specific profile(s), specific group(s) or group supervisors.
Example
If more than 5 unresolved tickets have exceeded the closing time imposed by a , a notification will be sent.
In the Alerts on saved searches
section of your saved search, click Add an alert
(or Create it now
if the notification doesn't exist). GLPI will create a new notification. All you have to do is set it to Active
, add a Template
and add the Recipients
of the notification.
Tasks in GLPI are used to materialise an action to be carried out or a decision to be made within a Tickets / Problems / Changes. The main idea of this object is therefore planning.
Example
Create a task to schedule the update of the file server in non-production.
When a ticket is open and requires a particular action, you can create a task to plan the action in question. Enter the ticket which requires a task to be created. Click on response > create a task
(or create a task directly, depending on how your interface is set up).
You can define several criteria here:
the content of the task
insert a task template
associate a task category
make it public or private
schedule the task
specify a duration
the technician who will be responsible for carrying out the task (and who will appear in the GLPI calendar)
Create a reminder
To help you set up your task, you can follow this
To ensure that you do not schedule a task outside office hours, it is possible to set availability times. In Setup
> General
> Assistance
set the desired times in Limit of the schedules for planning
. If you schedule a task outside these hours, a message will warn you that it is scheduled for non-working hours.
GLPI allows an external calendar to be displayed in the schedule, via the button located at the top of the list of displayed calendars Assistance
> Planning
. This only displays events from this calendar in the "planning" view (no notifications or modifications are possible from GLPI, etc.).
The fields in the bottom box are linked to the schedule, as it is possible to create a task without scheduling it. These fields are therefore optional. However, if a task is scheduled, the values will be identical.
Do you have customers interested in our GLPI Network Cloud () offer?
Become a partner: find more information on this page.
Or describe your project on this page, we will answer you!
Yes, it is a support/in-service support package (maintenance in operational condition). We fix bugs that you may encounter, we apply security patches, and as planned with you we carry out minor and major updates.
If you wish to benefit from other services (assistance support, advice and assistance with configuration, developments, etc.): this is done under additional estimate/cost (from one of our official partners) after studying your request.
Warning
Cloud services do not include level 1 and level 2. Only level 3 is included in the offer (correction of bugs impacting the code or impacting services linked to access to your Cloud instance). For assistance with configuration, please refer to the list of our partners
If you are already our customer, please, use the “Support” function in your account.
If you are not a customer yet, please, contact us using this page.
You can discover how GLPI works and configure it yourself, then contact an official partner-integrator if you encounter difficulties or if you want to speed up the configuration of your instance by being accompanied by a professional.
Consult our partners on this page
A file patch is a set of changes (+/-) designed to update, fix, improve or remove lines in GLPI source code.
Here is an example of bug-fix.diff
The + informs that we add some code
The - informs that we remove some code
A is available to help you apply your patch
You can find the list of supported plugins on
preferences
tab?This option is displayed or not at the discretion of the GLPI manager. It is a right that must be granted from the profile (Administration
> Profiles
select the relevant profile then tick/untick the Personalization
options in the Setup
tab).
In my settings
(top right), go to personalization
. In the 1st personalization section, change the timeline order
.
Natural order (old items on top, recent entries on bottom),
Reverse order (old items on bottom, recent on top).
In My settings > Personalization
(top right), you can select the rich text filed layout
option:
Classic (toolbar at top): the bar is fixed above the text area
Inline (no toolbar): right-click to bring up the toolbar
In My settings > Personalization
(top right), select the action button layout
option in the Assistance
section.
Split: all buttons are visible (answer, task, solution, etc.)
Merged: single response button allowing multiple actions (response, task, solution, etc.)
In your profile (top right) scroll down the list containing the current language and select the one that suits you.
In Setup > General > Defaults values
, select Horizontal (menu in header)
in the personalization section
The display of columns in the various menus (tickets, computers, users, etc.) can be customised. A distinction must be madebetween the global view and the personal view:
The global view applies to all profiles having access to a part of the inventory: the modification of this part willtherefore be visible by all users
The personal view applies only to the logged-in user and overrides the global view settings. This view is only available ifyou have the User view
right regarding the Search result display
. To change the way the columns are displayed, click on in the menu where you are. Select global or personal view asrequired and add/delete/move the columns as you wish
Yes, in Setup > General in GLPI, there is an option: “Display authentication sources list on login page.”
By unchecking this option, the LDAP connection dropdown will be hidden from the login page. Users can still log in properly:
if a user is linked to a specific LDAP directory, it will be tested first,
otherwise, LDAP directories will be tested one by one according to their ID order.
Note: this may slightly increase login time.
Toolbox is for advanced use only. To inventory your printers and network hardware, please use this
The agent is available via this
You can refer to the to configure your agent correctly.
Windows
MacOSX (Intel and Apple Silicon)
GNU/Linux (main distributions and distributions based on RPM and DEB or if they support Snap packaging)
Here is the for installing the agent on your various OS.
A script is available to deploy your
Glpi-Agent Monitor allows you to have a graphical interface of your agent in order to be able to carry out actions like forcing an inventory, consulting the log of the agent, opening a ticket. You can download it here
To help you install the GLPI agent on MacOSX, you can refer to the
To help you install the GLPI agent on GNU/Linux, please refer to the
Under GNU/Linux : /etc/glpi-agent/agent.cfg
Under MacOSX : /Applications/GLPI-Agent/etc/agent.cfg
Under Windows, it can be found from registry there: HKEY_LOCAL_MACHINE\SOFTWARE\GLPI-Agent
The GLPI agent includes many parameters such as the installation of particular tasks, the activation of SSL, the use of passwords for HTTP authentication on the server, etc. You'll find the full list
Windows :
If the agent is installed as a service, you can go to http://hostname:62354
and force an inventory
If is installed, you can launch the inventory directly from the monitoring interface.
By CLI
:
MacOSX :
sudo /Applications/GLPI-Agent.app/bin/glpi-agent --force
GNU/Linux and others
sudo glpi-agent --force
The agent supports a certain number of tasks, some of which can be configured from GlpiInventory plugin available in MarketPlace:
Netinventory and NetDiscovery: network discovery and inventory with SNMP support
Deploy
Collect
ESX
RemoteInventory (only with a or with the )
From the agent configuration folder, identify the basic-authentication-server-plugin.cfg
file. Copy this file and rename the extension .local
. On the renamed file, uncomment the line disabled = no
. More information in the
Toolbox
?The ToolBox is a simple web interface built into the GLPI Agent that allows users to configure certain features when there is no GLPI server available.
Toolbox
?Here are the main features provided by ToolBox
:
Manage inventory tasks (available since GLPI Agent 1.6)
Manage authentication information definitions
Manage IP range definitions
Manage scheduling definitions (available from GLPI Agent 1.6)
Display light inventory results and modify custom fields if required
Manage remotes definition (obsolete since GLPI Agent 1.6)
Manage mib support rules to adjust results for SNMP network devices
ToolBox
?The GLPI Agent Toolbox is a module within the GLPI Agent that may be enabled using .
The first thing to check is that you are using a URL starting with https://. If your GLPI server is correctly configured and has a certificate signed by a public certification authority, you won't need to do anything more. The second thing to check is that your network is not blocking requests to port 443 of your GLPI server from the workstation where the agent is to be run. Finally, you can check the agent's log or check that the error output from a command-line run reports an error like this:
The error keyword here is certificate verify failed. In this case, the SSL support configuration of the GLPI server may use a private certification authority. This is the case, for example, if your GLPI is configured with a self-signed certificate. In this case, the agent has several options for configuring SSL support and each of these options can be chosen according to the context of use.But before going any further, you should also check that an anti-virus is not configured on the computer to intercept SSL network flows. In this case, the anti-virus generally presents a self-signed privatecertificate, which is responsible for the error. You will need to check your anti-virus documentation to find out how to resolve this problem, perhaps by including the GLPI server URL in a white list. The first option you can use is the no-ssl-check option. This option should be used to check that SSL support is actually working. However, this option should never be used in production as it does not authenticate your GLPI server. The no-ssl-check option will also allow the agent to indicate the value that you can use for another option available since version 1.3 of the GLPI agent: the ssl-fingerprint option. Here is an example of the information the agent can report with the no-ssl-check option enabled:
In this example, the line SSL server certificate fingerprint: indicates that you can set the ssl-fingerprint option to the value sha256$bae02f72f312d6bc4e6f358181a7beb319224e242b8e370d49a60f659c4a589f
. This value can then be configured on all your agents so that they recognise your GLPI server. Note that your agents will have to be reconfigured with a new SSL certificate fingerprint if the certificate presented by the server is updated. Alternatively, the historical way of configuring recognition of the SSL certificate presented by the GLPI server is to configure the ca-cert-file option with the path to a file in PEM format containing either the public certificate presented by the server or the public certificate of the authority that signed the certificate presented by the server.The disadvantage of this option is that you will have to create or copy this file on all the machines that need it. The ca-cert-dir option can also be used, but its implementation is more complex because it is not easy to determine the filename of the certificates that the configured folder should contain. Since version 1.3 of the GLPI agent on Windows and MacOSX, the agent will also try to check whether it finds the server certificate in the system certificate shop or keystore on Windows or in the keychain on MacOSX. As requested by the community, since agent 1.5, the agent recognises several other sections of the certificate shop on Windows. This feature can allow you to simplify SSL authentication of the GLPI server on a large estate, as you will just have to resort to automatic deployment of the certificate shop without having to use any specific option in the agent. What's more, if the GLPI server certificate is updated, all you have to do is deploy the new certificate and the agentswill end up using it without you having to intervene.
If you are unable to configure the server's SSL authentication, you can use the --debug
option twice in combination with the --logger=stderr
option when running the agent from a command line to get a more complete diagnosis of SSL support. This will probably help you identify a particular problem and you will always be asked for theoutput if you request support.
You need to run the command from an administrative console and it's best to use options that will force execution and limit the tasks to a single one, in this case the Collect task. The sole aim is to diagnose an SSL communication problem with the GLPI server: glpi-agent --logger=stderr --debug --debug --tasks=collect --force
This is what the output might look like:
Here we find a line containing ok=0 [0] /CN=debian-hosting/CN=debian-hosting
which shows that the server certificate is a self-signed certificate with a debian-hosting host name and a fatal SSL error which indicates certificate verify failed. In conclusion, the agent refuses the connection because it is unable to authenticate the server it isaccessing. And this is normal when using a url containing an ip. This type of error can be resolved by using one of the agent's configuration options. However, other errors may come up indicating, for example, that the server's SSL support is out of date or that the negotiation to determine which exchange protocol to use has not been successful. This type of error may indicate a problem to be resolved on the server side.
By default, the agent status is displayed as unknown
. You can click on to :
view the status
launch an inventory
It may happen that the server does not have access to the agent's port, in which case this functionality will not be available:
either in the case of an agent behind a firewall
or the routing does not allow it
if the port is filtered by the machine's firewall
This feature is not available in Cloud
collect
and deploy
tasks via a VBS script?Announced with the release of agent 1.8, the deploy and collect tasks are no longer installed by default. They must be added to your scripts if you wish to install them. Here is the syntax to follow:
SetupOptions = "/quiet RUNNOW=1 ADDLOCAL=feat_DEPLOY,feat_COLLECT SERVER='
' TASKS='Deploy,Collect,Inventory,...
A partial inventory only includes information that has been modified during the previous inventory or that has been requested by configuration or option.
This reduces the load on the GLPI server and the network when importing the inventory.
The GLPI agent (since version 1.8) will, by default, generate a partial inventory after an initial complete inventory. We have added a function to postpone the complete inventory in order to reduce the load on the GLPI server and the network. In this case, if it is not time to generate a full inventory, the GLPI agent will delete the inventory categories that have not changed since the last inventory and will add a "partial": true
field in the JSON inventory.
And in this case, at the end of 14 (by default the value of full-inventory-postpone
) partial inventories sent, the GLPI agent will end up sending a full inventory.
This can happen if the transfer of equipment is authorised from one entity to another (Administration > Entity > my_entity > Assets> Transfer) and the GLPI agent generates a partial inventory.
During a partial inventory, it is possible that the information required by your rules is not included in the inventory, particularly if you need IP and network mask (CIDR) information (in a partial inventory, the absence of a section indicates that nothing has changed since the previous inventory).
This may therefore have an influence if you have rules for assigning equipment to an entity by IP and/or CIDR and the entity transfer is authorised. The equipment concerned could be transferred to the root entity, bypassing the equipment assignment rules.
There are 2 ways of correcting this problem: Force the agent to generate complete inventories, or continue with partial inventories but force the network part to be transferred.
Force the inventory to be complete:
in the , specify :
full-inventory-postpone=0
Partial inventory with network feedback :
in the , specify :
required-category=network
full-inventory-postpone=14
(default value)
You can also test the options by adding :
glpi-agent --full-inventory-postpone=14 --required-category=network
Warning
Depending on the size of your fleet, this may increase the network load and that of the GLPI server.
In the , specify :
full-inventory-postpone=0
In order to automatically synchronise your users from an LDAP, you can add a line to your crontab (the one for the user who reads the web files, Apache, www-data, etc.)
0 * * * * www-data cd /var/www/glpi/ && /usr/bin/php bin/console glpi:ldap:synchronize_users --no-interaction >/dev/null 2>&1
You can add options to this command to synchronise disabled accounts as well, for example:
0 * * * * www-data cd /var/www/glpi/ && /usr/bin/php bin/console glpi:ldap:synchronize_users --no-interaction -d 3 >/dev/null 2>&1
If you want to perform several actions, we advise you to add as many LDAP commands to your cron as you need (one command for synchronising accounts, another for deactivating accounts, etc.).
You can adapt your LDAP search in Setup
> Authentication
> Setup
> Action when a user is deleted from the LDAP directory
:
- 0: Preserve - 1: Put in trashbin - 2: Withdraw dynamic authorizations and groups - 3: Disable - 4: Disable + Withdraw dynamic authorizations and groups - 5: Disable + Withdaw groups
Yes, if you don't specify --ldap-filter
in your command line, GLPI takes the sync field + the condition indicated in the connection filter to perform the search.
Example:
Synchronisation field configured = entryuuid
.
Connection filter configured = (objectClass=inetOrgPerson)
Resulting LDAP filter on command line = & (entryuuid=*) (objectClass=inetOrgPerson))
Also check that the execution mode
is set to CLI
from setup
> automatic actions
for the action in question.
If you are in the Cloud, you can contact support so that the checks can be made on the server side:
If you are on-premise, check that your cron is active and correctly configured:
In addition to the above checks :
Empty the _cache
and _sessions
folders
Check file and folder permissions:
find glpi/ -type d -exec chmod 0755 {} \;
find glpi/ -type f -exec chmod 0644 {} \;
Restart the cron
For an automatic action to work, it must be set up correctly. From setup
> automatic actions
, select the action concerned. Check that it is scheduled
in CLI
mode.
GLPI: based on PHP (automatic actions are only triggered when you are logged in)
CLI: cron-based
Click execute
if you want to run the action now
Logs
, PurgeLogs
and Circularlogs
actions?Circularlogs
: Removes entries in logs in the files/_log folder that are older than a certain number of days which is configurable within the action form itself.
logs
: Cleans old automatic action log entries. The amount of time to keep log entries can be changed for each automatic action.
PurgeLogs
: Deletes historical data entries that are older than a certain amount of time. The amount of time can only be changed globally for all Entities, but some of the types of entries can be configured with different durations.
C:\> cd "C:\Program files\GLPI-Agent" "C:\Program files\GLPI-Agent
C:\Program filesGLPI-Agent > glpi-agent --force
[error] [http client] internal response: 500 Can't connect to 192.168.2.3:443 (certificate verify failed), SSL connect attempt failed error:0A000086:SSL routines::certificate verify failed
[error] No supported answer from server at https://192.168.2.3
[info] [http client] SSL Client warning: Peer certificate not verified
[info] [http client] SSL Client info: Cert-Issuer: '/CN=debian-hosting', Cert-Subject: '/CN=debian-hosting', Version: 'TLSv1_3', Cipher: 'TLS_AES_256_GCM_SHA384'
[info] [http client] SSL server certificate fingerprint: sha256$bae02f72f312d6bc4e6f358181a7beb319224e242b8e370d49a60f659c4a589f
[info] [http client] You can set it in conf as 'ssl-fingerprint' and disable 'no-ssl-check' option to trust that server certificate
DEBUG: .../IO/Socket/SSL.pm:846: call Net::SSLeay::connect
DEBUG: .../IO/Socket/SSL.pm:3690: * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8)
DEBUG: .../IO/Socket/SSL.pm:3690: * TLSv1.3 (IN), TLS handshake, Certificate (11)
DEBUG: .../IO/Socket/SSL.pm:2857: ok=0 [0] /CN=debian-hosting/CN=debian-hosting
DEBUG: .../IO/Socket/SSL.pm:3690: * TLSv1.3 (OUT), TLS alert, Unknown alert (560)
DEBUG: .../IO/Socket/SSL.pm:849: done Net::SSLeay::connect -> -1
DEBUG: .../IO/Socket/SSL.pm:852: SSL connect attempt failed
DEBUG: .../IO/Socket/SSL.pm:852: local error: SSL connect attempt failed error:0A000086:SSL routines::certificate verify failed
DEBUG: .../IO/Socket/SSL.pm:855: fatal SSL error: SSL connect attempt failed error:0A000086:SSL routines::certificate verify failed
DEBUG: ...perl/Net/HTTPS.pm:67: ignoring less severe local error 'IO::Socket::IP configuration failed', keep 'SSL connect attempt failed error:0A000086:SSL routines::certificate verify failed'
DEBUG: .../IO/Socket/SSL.pm:3062: free ctx 94133007189808 open=94133007189808
DEBUG: .../IO/Socket/SSL.pm:3066: free ctx 94133007189808 callback
DEBUG: .../IO/Socket/SSL.pm:3073: OK free ctx 94133007189808
[error] [http client] internal response: 500 Can't connect to 192.168.2.3:443 (No such file or directory), SSL connect attempt failed error:0A000086:SSL routines::certificate verify failed
[error] No supported answer from server at https://192.168.2.3
The service level agreement () defines the quality of service between the service provider and the customer. This service level is defined in a contract. It generally includes :
the time taken to handle a ticket (),
The desired resolution time according to the criticality of the request ().
It is also possible to configure s. An is an internal metric used to establish relationships between different IT entities or departments.
You can follow this which shows you, step by step, how to set up s
There are 2 ways of assigning an :
By means of a rule: For example, all tickets from the XX customer entity will be subject to the XX contract SLAs.
Manually: In the ticket, go to "Service Levels" and select the or you are interested in according to the predefined contracts.
Using a ticket template: from Assistance
> Ticket
> Templates
in Predefined fields
you can add an field (and/or ).
In the Statistics
section of a ticket, it is possible to see the different times of the ticket:
handling time (),
waiting time,
resolution time (),
closure time (status after resolution)
Indications in red are those that have not been respecified.
The ends as soon as the ticket is allocated to a group and/or a user.
Yes, when a ticket is put on hold, the is recalculated once the is changed from Pending
to other status, adding the time that it was kept on hold.
You may use to help you with escalation levels on GLPI.
reminders are based on an automatic slaticket
action and a Ticket Recall
notification. Please check that :
the automatic action is programmed in CLI (Setup
> Automatic actions
>slaticket
)
notifications have recipients (Setup
> Notifications
> Notifications
> TicketRecall
)
your cron works official documentation
A user is person having an authorization to connect to GLPI.
In Administration
> Users
, click on the desired user. At the bottom of the screen you will find the option trash users
. For a mass deletion, you can also select all the users concerned (via the check boxes) then click on actions
and trash
. To delete these users permanently, click on Show recycle bin
. Select the users you wish to delete and then in actions
choose delete permanently
.
If you have a Cloud instance, you have several ways of doing this.
You have a local AD that is open on the Internet:
Just enter it in Setup
> Authentication
> LDAP directories
.
You have a local AD that is not open to the Internet:
You will need to use a VPN (only available for private clouds).
You have an Azure or Google LDAPS :
You can connect your LDAPS directly using the procedures available in the
You have an Azure or Google directory without LDAPS:
You can also use the SCIM pplugin. It allows you to integrate users and groups from your directory (available for Azure and Google).
Management is done from the Administration
> Users
menu;
adding / synchronisation of users is recommended from LDAP directory.
In addition to the user information, it is possible to deactivate it if necessary (Active field) and manage an access period in the Valid from and Valid until fields.
The most important tabs:
Authorizations: manage the authorizations available for user
Groups: associate and delete groups from user
Preferences: editing user preferences (which he can change himself)
Materials used: inventory objects assigned to the user (or group)
Materials managed: inventory objects for which he is technical manager (or in technical group)
Tickets / Problems / Changes: objects of which the user was the requester (or the creator)
Synchronization: to manage its authentication mode
The "Synchronization" tab of user allows you to change their authentication mode:
for GLPI database: the password is then stored locally in the GLPI database
for LDAP directory: with choice of the LDAP directory declared in the configuration of GLPI
external authentication: via a CAS server, a MAIL server, or HTTP headers (SSO)
A group of users or assets.
Group users by skills (for example, network technicians, or database administrators)
Groups for organization (for example all the computers in one location, or the accounting service) but also group of people to be notified
Groups are managed in the Administration
> Groups
menu
Groups can be defined in the form of tree structure
The options available in the main form allow you to decide the scope of use of the group
A Delegation is a mechanism that allows user to report incidents for one of the members of this group.
Example
A person from the secretariat who reports incidents for people in management.
A delegation can be added in Administration
> Groups
in tab Users
.
No, the ticket or computer type items will be kept but the user will no longer be present as the ticket requester or computer user.
Only valid for internal accounts
If you use an external provider (Azure, Google, etc.), this procedure does not apply, please contact your administrator or manager.
If you have lost or forgotten your password, simply click on forgot password?
on the GLPI login page.
users
tabWhen you delete a user's authorisation and they only had one, they will automatically be transferred to the root entity. If you do not have access to this entity, contact your administrator to have a new authorisation added to the user concerned.
you don't have the rights to connect to this application
?Several parameters can be linked to this message.
No profile associated with the user: make sure that each user who logs in has a profile. If this is not the case, your profile authorisation rule may be incorrect or missing.
Temporary SQL queries: SQL queries can saturate the temporary folder if they are too voluminous. The method is to automatically kill certain queries that take too long (thus avoiding excessive temporary storage). Please refer to the command pt-kill
Example of command (to kill all "SELECT" requests that last longer than 61s)" perl /usr/bin/pt-kill --busy-time 61 --match-info "SELECT|select" --kill --victims all --daemonize
Problem of rights on GLPI folders: make sure that the owner of the GLPI folders is the user of your Web server (apache, www-data, etc.) and that the permissions are correctly set:
# find -type f -exec chmod 644 {} +
# find -type d -exec chmod 755 {} +
# chown -R
If the timezones are not activated, you will not be able to select the country you are in. Follow the official documentation to activate your timezones.
This operation may affect all your other databases. Check the impact before making any changes.
A link to the SQL server could not be established. Please check your configuration
?This may be due to several parameters:
Check that the mysql service is started and (re)start it if necessary
Check the presence of your database and the rights granted to the user of this database
Check that the GLPI configuration file is present and has sufficient permissions
Check the logs sql-errors.log
in the files
folder
SSL certificate problem: unable to get local issuer certificate
when I try to activate my subscription key in marketpalce?This problem comes, usually on Windows, from a missing configuration. PHP has not been configured to integrate the CA certificate shop and therefore cannot check the chain of our certificate when it tries to connect to it.
To remedy this problem :
Download and extract cacert.pem
following the instructions at https://curl.se/docs/caextract.html
Save it on your server in a location readable by the Web server user
In your php.ini, put the location of the cacert.pem
file in the [curl] and [openssl] section
[curl]
curl.cainfo = "C:\mywebsite\php\extras\ssl\cacert.pem"
[openssl]
openssl.cafile = "C:\mywebsite\php\extras\ssl\cacert.pem"
Restart your web server and your PHP FPM server if necessary
session.save_handler
must be set to redis in php.ini.
session.save_path
must contain a valid configuration such as :
tcp://127.0.0.1:6379?persistent=1&timeout=2.5&read_timeout=2.5&retry_interval=30
Check that Redis is configured on the correct port (default 6379).
Increase the timeout to stabilise the connection.
Enable session locking in 20-redis.ini :
extension=redis.so
redis.session.locking_enabled = 1
redis.session.lock_expire = 60
redis.session.lock_wait_time = 50000
redis.session.lock_retries = 2000
Make sure that the files/
folder is shared between all the front-ends (in the case of a multi-server installation),
Check the permissions of the shared folder.
Check the logs
This error is often caused by an incorrect or incomplete rule that modifies the computer types in GLPI, resulting in an attempt to write an invalid value (for example, -1
) to the computertypes_id column in the database.
/tmp
filling up because of SQL queries?Optimise SQL queries: Examine the default views and searches in GLPI and encourage users not to add too many columns to their queries.
Redirect tmp_dir in MySQL: Configure the MySQL tmp_dir directory outside the /tmp
partition to avoid impact on the system. More information in the official documentation
It is difficult to identify users directly on the basis of the queries that fill /tmp
, as users can add an unlimited number of columns to their searches, thus generating large SQL queries.
The problem comes from MySQL. When queries are too long, it needs to write to temporary tables (https://dev.mysql.com/doc/refman/8.0/en/internal-temporary-tables.html), and by default this happens in the server's /tmp directory.
Examine users who have too many columns in their default views or who add too many columns to their searches (e.g. juan.meneses), as this generates very large queries on the MySQL server, which doesn't seem to be large enough to handle them properly.
Configure MySQL's tmp_dir outside the /tmp file system (in a different folder from the one used by the system itself).
Implement an automated system (such as the Percona pt-kill toolbox https://docs.percona.com/percona-toolkit/pt-kill.html) to automatically kill SELECT queries on MySQL that last longer than X seconds, thus preventing disk space from being saturated by overly large queries.
Via this article, you'll find all the configuration you need to set up your Oauth . Access to your Azure tenant is required to set up this service. You'll find the procedure
You can find out how to configure your server and your notifications in the or the official documentation
Information
We recommend changing the default PHP method, which is not suitable for production use.
To check this information, you need to make sure that the observers are indeed the recipients of the notifications in question. This is checked here: Setup > Notifications > Notifications
, click on the desired notification and go to Recipients.
The use of relays such as Sengrid, SendInBlue, etc. is not recommended with GLPI. We invite you to use servers such as GMAIL, Microsoft, etc. to ensure that the service runs smoothly.
An email may be refused for the following reasons:
the sender's email address is identical to the collector's email address (to avoid loops)
The email contains headers refused by GLPI (X-Auto-Response-Suppress, Auto-Submitted)
The ticket allocation rules do not define a destination entity
You can check that an auto-submitted or auto-reply is not present in the orginie mail header, this could be the reason for the import refusal. Remember to check your ticket assignment rules from administration > rules > rules for assigning a ticket created through a mails receiver
.
No. The account used for OAuth authentication must also be the sender of the message. Sending the email will fail if the accounts are not identical.
Microsoft is gradually disabling the protocol. We recommend that you use with Microsoft in order to take full advantage of this service.
This function is possible via the collector. A dedicated mailbox will receive the emails and send them to GLPI. This mailbox must be able to use services. If you use Azure or Google, we advise you to use the plugin Oauth IMAP
. A procedure is available
This may be due to several factors:
Your server has been configured incorrectly. You can refer to this to help you configure it correctly.
Notifications for requesters and/or actors have been deactivated. You can check the settings in Setup
> Notifications
> Notifications
. Select the notification concerned and check in recipients
whether the appropriate people are present.
variables
for customising notifications be used by other GLPI objects?No. It is not possible to use the variables present for personalising notifications anywhere other than in this context. There is another separate system of variables
for followup templates, tasks and solutions (/front/contenttemplates/documentation.php?preset=itilchildtemplate you can also find this page in Setup
> Dropdowns
> Followup templates
, click on available variables
)
Yes, but this has the effect of removing the possibility of replying to the ticket by email. To delete the message go to setup
> Notifications
> Notifications
, select the notification concerned and change the Allow response
option to No
.
Yes, notifications can be customised from Setup
> Notification
> Notification templates
.
From template translation, you can customise the layout of each GLPI notification. You can view the tags
available to add information to your notifications
To change this value :
Go to Administration
> Entities
> Notifications
> Prefix for notifications
535 5.7.3 Authentication unsuccessful
?Check that the is identical to the main email address of the account used to send emails.
Check the Azure :
Permissions granted (SMTP.Send
)
Access logs to confirm that GLPI is authorised.
Ensure that the configuration in GLPI corresponds to the instructions in the
You can create and position your collector rules in this way:
If you encounter an error when sending an email followup in GLPI, you need to enable debug mode to diagnose the issue.
Steps to follow:
Enable debug mode in GLPI: go to My Preferences, then click Debug Mode: Disabled to activate it.
Perform a first followup send test from GLPI. This step creates the mail-debug.log
file, which does not exist by default.
Connect to your server via SSH.
Run the following command to read the logs:
tail -f /path/to/glpi/files/_log/mail-debug.log
Perform a second followup send test.
Check the mail-debug.log
file for error details.
In most cases, the error is due to an SMTP connection issue, typically caused by a misconfiguration (port, authentication, security settings...).
To connect an , you must make sure you have a sufficient license allowing you to create an LDAPS. The domain services service is required to create your . Please refer to Microsoft's official documentation. Once your LDAPS has been created, simply follow the instructions from Setup
> Authentication
> LDAP directory
.
This happens when the authorisation rules have not been set up. In fact, once authentication has been successful, GLPI checks that you have an assigned authorisation. GLPI also checks that a rule has been set up to assign you one automatically. If this is not the case, access to GLPI will be denied. To set up these authorisation rules, go to this for help with setup.
From Setup
> Authentication
> Setup
you can choose the GLPI behaviour when a user is deactivated from your LDAP(s)
Preserve
Disable
Disable + withdraw groups
Disable + withdraw dynamic authorisations and groups
Put in trashbin
Withdraw dynamic authorisations and groups
For on-premise instances, you can check in files/_log
(or wherever you have stored your logs) You can also download the LDAP Tools plugin to help you understand what the problem is.
You can manage the information retrieved by your LDAP(s) from Setup
> Authentication
> LDAP directory
, Users
tab
From Setup
> Authentication
> LDAP directory
, tab Groups
, you can choose how GLPI will behave when synchronising your groups.
GLPI can :
Check the groups belonging to the user (user search)
Check the users present in the groups (group search)
The 2
Remember to indicate the user attribute (usually memberof
) so that GLPI can use this attribute to synchronise the groups belonging to the user. Remember to indicate the groups attribute (usually member
) so that GLPI can use this attribute to synchronise the users in the groups.
The filter allows you to find only certain groups, based on their name for example. If you only wanted to find the accounting group, for example, you could have a syntax such as (&(objectCategory=group)(SAMAcCOUNTNAME=*accounting*))
. You can use this documentation to help you build your filter.
On-premise :
Import your certificate into your GLPI server (they must be readable by the user using the web server)
Cloud instance:
use the form to send you your certificate
On-premise and instance Cloud :
From Setup
> Authentication
> LDAP directory
, Advanced information
tab, enter the path to your certificate in the TLS certfile
and TLS Keyfile
tabs. For Cloud instances, this will be communicated to you by return of your ticket.
From Setup
> Authentication
> LDAP directory
, tab Replicates
, enter the information required for replicates.
Check that your LDAP(s) can be reached and is correctly configured on the GLPI side. If your is correctly set up on the GLPI side, check that the automatically add users from an external authentication source
option has been selected. Check that automatic authorisations have been set up. If you do not have automatic authorisation, check that the otpion add a user without accreditation from a LDAP directory
(from Setup
> Authentication
> Setup
) is set to Yes
.
In order to automatically synchronise your users from an , you can add a line to your crontab (the one for the user who reads the web files, Apache, www-data, etc.)
0 * * * * www-data cd /var/www/glpi/ && /usr/bin/php bin/console glpi:ldap:synchronize_users --no-interaction >/dev/null 2>&1
You can add options to this command to synchronise disabled accounts as well, for example:
0 * * * * www-data cd /var/www/glpi/ && /usr/bin/php bin/console glpi:ldap:synchronize_users --no-interaction -d 3 >/dev/null 2>&1
If you want to perform several actions, we advise you to add as many LDAP commands to your cron as you need (one command for synchronising accounts, another for deactivating accounts, etc.).
php /var/www/html/glpi/bin/console glpi:ldap:synchronize_users
, set up in the cron, make the LDAP connection filter set up in Setup
> Authentication
> LDAP directories
?Yes, if you don't specify --ldap-filter
in your command line, GLPI takes the sync field + the condition specified in the connection filter to perform the search.
Example
Synchronisation field configured = entryuuid
Connection filter configured = (objectClass=inetOrgPerson)
Resulting LDAP filter on command line = (& (entryuuid=*) (objectClass=inetOrgPerson))
From Setup
> Authentication
> Setup
you can choose the behaviour of the Action when a user is restored in the LDAP directory
. You can choose to :
Enable
Do nothing
Restore (move out of trashbin)
TLS Certfile
and TLS Keyfile
fields be filled in?The TLS Certfile
and TLS Keyfile
fields must be populated when authentication (Bind) (Setup
> Authentication
> LDAP directory
> Use Bind
) is activated via a certificate and its private key (like LDAPS on Google Worspace, for example): it therefore replaces (or complements) a user/password.
Certificates
If you are using LDAPS, the certificates must be stored on your server so that GLPI can access them (in the GLPI config folder, for example).
Yes, GLPI can handle nested groups.
You need to synchronize the groups in GLPI:
In Setup
> Authentication
> LDAP directories
> Directory concerned :
Main tab:
Connection filter : Use Active Directory preconfiguration "(&(objectClass=user)(objectCategory=person)( !(userAccountControl:1.2.840.113556.1.4.803:=2)))"
Base DN : must be a subtree containing AD users and groups
Group tab:
Search type : 'In groups' or 'Users and groups' (both work)
User attribute indicating groups: memberof
Filter to search in groups: Empty
Group attribute containing its users: member:1.2.840.113556.1.4.1941:
Use DN in the search: Yes
Next, we need to import the groups into GLPI (groups on which authorization rules will be based).
Administration
> Groups
> LDAP directory link
Finally, adapt the authorization rules to use the Group - is
criterion rather than MemberOf - contains
.
Then force the synchronization of a user so that GLPI links the imported groups to the user and gives the correct authorizations based on these groups.
Caution Managing authorization rules on the user's memberOf
field is not a good practice, as this field does not contain nested groups.
Make a backup
Before any manipulation on your database or on your GLPI instance, we strongly advise you to make a backup of your database as well as of the GLPI folder.
GLPI is an open source ITSM tool that can be used in a variety of operational systems, since it is a web application running on a web server with a PHP compiler and a MySQL database. GLPI is executed in a three thier architecture which consists in a presentation tier, an application tier and a data tier.
It is the layer which is in charge of displaying the information to and interacting with the user. The GLPI application generates HTML codes, so for these codes to make sense to the user, we need a web server to “translate” it to them. Some of the most known web servers are Apache and NGINX, for example.
This is the business layer of the application. It is responsible for processing operations that GLPI performs on the data according to user requests. For GLPI this logic is coded in PHP
The data tier is the one that deals with acces and storage of data. On GLPI this tier is managed by a System of Data Base Management based on MySQL or its fork MariaDB. You will find the complete list of prerequisites to install and use GLPI can be found here
Yes, you can. And should in the case of complex and bigger environments. , we are working with a simple architecture. But you can create scenarios that fit to bigger companies with or without microservices, separated databases, master and slave databases, NFS sharing for files. The possibilities are enormous, and we could discuss in future posts.
After an update, cached data attempts to be used but is out of date. The recommended method to remedy the problem is to empty the contents of the cache in the files folder rm -rf ../files/_cache/*
!!! Warning "Caution This folder may be in a different location depending on your configuration. You can consult the ../inc/downstream.php
file to find out the exact path if your installation has been customised.
The configuration of the web server root folder is not secure because it allows access to non-public files. Please refer to the installation documentation for more details
?In order to secure your instance and prevent the exposure of non-public files, your vhost must be modified (this applies particularly to instances that are exposed on the Internet). You can follow the official documentation to set up this configuration available here
PHP 7.4 is currently no longer supported. You can check PHP support via this link
In the user options, (top right), a field about
is available. If you click on this field, a message will alert you if you have any overdue updates
You can also go to Setup > General > System
. click on Check if a new version is available
. A message at the bottom right will tell you if a new version is available
If you encounter errors during the prcess of updates, several commands are possible in order to guide you. These commands should be entered in the GLPI folder:
php bin/console database:check_schema_integrity
: display inconsistencies found in the database
php bin/console database:check_schema_integrity -p formcreator
: displays inconsistencies in the database linked to Formcreator
php bin/console system:check_requirements
: check the system requirements requested by GLPI.
php bin/console migration:migrate_all
: useful for migrating from 9.5 to 10. Allows you to migrate (convert "datetime" fields to "timestamp" for use in time zones, migrate main/foreign keys to unsigned integers, convert the database character set from "utf8" to "utf8mb4").
php bin/console system:list_services
: list system services
php bin/console system:status
: list system status If you need more information, please refer to the official documentation
To install GLPI, we recommend using :
Apache
Nginx
Lighttpd
IIS
To make sure you have the right version of GLPI, you can download it from Github
You need to create a downstream.php
file in the inc
folder. Depending on the desired configuration, you can relocate several GLPI folders. In this example, the configuration
folder will be located in /var/www/glpi_config
and the files
folder in /var/www/glpi_files
.
define('GLPI_CONFIG_DIR', '/var/www/glpi_config');
define('GLPI_VAR_DIR', '/var/www/glpi_files');
This allows you to segment each folder in the files folder (_log
, _pictures
, _lock
, etc.). Pay particular attention to the permissions of these folders, which must be read/write accessible by the web service user. More information here
From the root of the GLPI folder, enter php bin/console
, this command will display all the commands available in CLI.
GLPI includes an encryption system via the glpicrypt.key
. If this key is not migrated with the rest of the data, some of your data may no longer be readable. You just need to migrate the glpicrypt.key
to the config
folder to get back to normal use of your GLPI.
When you migrate a GLPI instance from one server to another, you must also migrate the plugin
and/or marketplace
folder so that all plugin data is also transferred.
This directive denies access to the session cookie from JavaScript and prevents cookies retrieved by a JavaScript injection. It can be defined in
This directive authorises access to the cookie only when the HTTPS protocol is enabled. If you are using HTTP, we recommend that you disable this option or switch your instance to HTTPS in order to regain access to your instance.
The _tmp
folder in GLPI is a temporary storage space used for various operations. In particular, it is used as a place of transit for files before their final destination, such as when importing or downloading files, as well as for one-off operations such as updates or generating reports.
For example, the DataInjection plugin creates temporary files in this folder to store import results or any errors encountered. Although some files are automatically deleted at the end of operations, this is not always the case.
This folder can be emptied manually if necessary.
It's important to determine several criteria before installing a GLPI server. Some of these may have an impact on the load on the server(s), others on the network load. The right questions to ask yourself before setting up your server are :
▶️ How many users will be able to connect at the same time? :symbo
▶️ Will there be automatic inventories?
If so, estimate the number of assets (computers, monitors, applications, etc.) that will be brought up.
▶️ Will a backup system be set up?
If so, estimate the resources required to launch backups.
▶️ Do potential IS security layers consume resources, or can they create latencies?
▶️ What system resources are available to you?
if hosting on-premise :
Rack availability
Which hardware to order
Budget constraints
Hosting with a provider ( available)
▶️ Are there any recovery constraints (implementation of clusters, load balancing, HA, etc.)?
▶️ Are there any short/medium/long-term business growth forecasts?
Depending on the answers, a simple or improved architecture could be considered.
The more traffic there is to/from your GLPI, the more resources you'll need.
If you assume a large number of users and/or assets to be inventoried, you should consider at least an enhanced archtecture :
Type of enhanced architecture
For high-traffic architecture, we strongly suggest :
▶️ Separate web front-ends :
one for users
one for inventory
▶️ Evaluate APACHE resources correctly
8-core CPU minimum per machine
Calibrate configuration for simultaneous task management (connections, worker, etc.)
▶️ Ensure sufficient bandwidth
▶️ Deport SQL layer to a dedicated server
▶️ Associate a second server for SQL replication (necessary for disaster recovery)
▶️ Associated resources for the SQL layer :
RAM: 16 or 32 GB
Coniguring 2 GB RAM to the InnoDB buffer pool
Remember to increase values for temporary table management
Disk: Nvme -> indispensable for fast database writes
▶️ WEB connection <-> SQL :
Sufficient bandwidth
Minimize latency between machines
If you're using a provider, we strongly encourage you to ensure that the machines are on the same physical site
▶️ Add an NFS share to share files
between upstream WEB servers (sessions, attachments, XML inventories, etc...).
Type of enhanced architecture
Yes, this type of architecture is perfectly feasible with GLP. It's part of a high-availability, disaster recovery mode, in the event of the failure of one of the servers.
For example, you can :
add a reverse-proxy server upstream of the 2 WEB servers
add a 3rd WEB server and better distribute the load (manage fault tolerance)
replace simple MASTER / SLAVE
replication with a database cluster, requiring at least 3 DB nodes
Mandatory flows
Optional Flows - LDAP/CAS connection
Optional flows - MAIL connection
Optional flows - GLPI Inventory Basic module (inventory)
Optional flows - GLPI Inventory Advanced modules
User
GLPI
HTTP(S)
80 (443)
http(s) : //glpi/
GLPI
Databases
MySQL
3306
Another port can be configured
GLPI
LDAP directory
LDAP(S)
389 (636)
Synchronization and user authentication
GLPI
Mail server
SMTP(S)
25 (465), 587
Send email notifications
GLPI
Mail server
IMAP(S)
143 (993)
Mail retrieval (receiver) > ticket creation
Agents
Server
HTTP(S)
80 (443)
http(s) : //glpi/plugins/fusioninventory/
GLPI
Agents
HTTP
62354
Remote agent wake-up (from GLPI)
Agents
Equip.
SNMP
161,162
Network inventories
Agents
Equip.
NMAP
ICMP,DNS
Network discovery
Agents
VMWARE
HTTPS
443
VMWare inventory
Several items can be reserved in GLPI (computers, monitors, peripherals, etc.). All you have to do is go to the equipment you want to appear in the reservations and in the Reservations
tab click on Allow reservations
. Each piece of equipment will have a booking schedule that can be consulted.
The right to reserve equipment is granted via the profile. If you wish to authorise or prohibit it, go to Administration > Profiles
. Select the profile you wish to be affected by this change. In the Reservable items
section of the Tools
tab, check or uncheck Read
and/or Make a reservation
.
In the Tools
> Reservations
tab, you can click on View calendar for all items
. This view will show you a list of all reservable items and the dates on which they are reserved.
In the tab Tools
> Reservations
, you can click on Find a free item for a specific period
. A search box will appear so that you can check the availability of equipment during that period. Simply select the equipment you require and click on Reserve
.
The marketplace allows you to access (depending on the GLPI Network licence level) a list of plugins and install them with one click. An shows you how it works.
You can install a plugin that is not present in the marketplace by going to the plugins page. A is available to help you install a plugin outside the marketplace.
To do this, you must first request it from our support service, specifying the name of the desired plugin, its download URL andits version. You cannot deploy this plugin yourself from your customer account, or from your GLPI instance, because we need to validateseveral things:
that the plugin you want is well developed by Teclib´ or by one of our official partners trained for plugin development forGPLI
that it respects the established coding standards;
that it is maintained over time (because it´s GLPI compatibility is not included in our unlimited MOC support/ in-servicesupport package)
and that it does not disturb the performance of the GLPI modules (does not cause a bug). After studying your request, you will receive a confirmation indicating the availability of the plugin on your instance or anexplanation why it has not passed our validation test
In case of refusal, we will offer you an alternative solution to cover your need (another validated plugin, native functionality,additional development, etc.).
Plugins are only available via the marketplace. To do this we advise you to :
Open the Internet for the duration of the download (less than one minute),
Download via an application proxy,
Use a third-party glpi (on another workstation for example) to download.
"You can consult our for plugins"
Maximum number of IT agents supported
Unlimited
Unlimited
Minimum number of IT agents
1
25
Rate per user
19€
21€
Maximum number of assets
Unlimited
Unlimited
Number of end users
Unlimited
Unlimited
Community support
✅
✅
Support Bug fixes/security patches
✅
✅
L2/L3 helpdesk support
Partner
Partner
Community plugins
✅ Secure Marketplace
✅ Secure Marketplace
GLPI Network plugins
✅
✅
Updates
✅ Automatic
✅ On request
Server maintenance
✅
✅
Full database backup
✅ Daily
✅ Daily
Incremental database backups
❌
✅ Hourly
Backup of files
✅ Complete, daily
✅ Incremental, hourly
System Resources
Shared
Dedicated
VPN tunnel
❌
✅
Read-only database connection
❌
✅
Filtering of IPs that can access the instance
❌
✅
Interconnection with the Metabase reporting tool (Metabase plugin)
❌
✅
Database Replication
❌
❌ (tailor-made offer available)
Maximum number of IT agents supported
Unlimited
Up to 10
Up to 50
Unlimited
Maximum number of assets
Unlimited
500
5000
Unlimited
Number of end users
Unlimited
Unlimited
Unlimited
Unlimited
Community support
✅
✅
✅
✅
L2/L3 helpdesk support
❌
Partner
Partner
Partner
Bug fixing/security patch support
❌
✅
✅
✅
Community plugins
✅ Secure Marketplace
✅ Secure Marketplace
✅ Secure Marketplace
✅ Secure Marketplace
Basic plugins
❌
✅
✅
✅
Standard plugins
❌
❌
✅
✅
Advanced plugins
❌
❌
❌
✅
OAuth IMAP
✅
✅
✅
✅
Data Injection
✅
✅
✅
✅
OAuth SSO
❌
✅
✅
✅
SCIM
❌
✅
✅
✅
GLPI AI
❌
✅
✅
✅
Advanced Dashboard
❌
❌
✅
✅
Approval by mail
❌
❌
✅
✅
Special needs If you have requirements that are not covered by one of our offers, please contact our sales department so that we can provide you with a tailor-made offer.
A Follow-up is a text interface allowing you to leave a message in a Tickets / Problems / Changes.
Technically, a public follow-up will be visible to all users (customers, employees, etc. for example) whereas a private follow-up will only be visible to users with the right to see private follow-ups (Technicians, management, etc. for example).
To change the status of a follow-up, click on the
Public =
Private =
Once you have entered your message, you can send it by clicking on the Add button.
Yes, templates for , tasks and are available in GLPI.
From Setup
> Dropdowns
, enter Template
and click on Followup templates
you can create your own templates.
TWIG Variables are also available to get ticket's fields as variables to templates.
In the tab Administration
> Entity
> Assistance
indicate the desired duration in the field Automatic closing of solved tickets after
...
In the simplified interface, requesters have access to the name of the technician who has been assigned to the ticket. They cannot see any other information (telephone, email, etc.).
In the standard interface, both callers and technicians can view certain personal information entered in the user file (telephone number, email address).
No, only automatic solutions after automatic follow-ups are possible.
To remove the ability to reply by email, go to Setup
> Notifications
> Notifications
then select the relevant notification. For the option Allow response
enter no
.
This requires:
creating a new profile ("Manager" for example) on the same basis as the default "Self-Service" profile (always in simplified interface type therefore)
assigning it the right "View group tickets"
create a group that contains the manager + the users for whom he must see the tickets
assign this group as "Requesting group" automatically on all the tickets of these users.
!!! Note "Is such a user billed in Cloud?" No. When you assign a profile of type "Simplified interface" in the authorization of this user, it is not billed.
No, these values are predefined in GLPI and cannot be modified. However, you can customise the matrix of calculus for priority in Setup
> General
> Assistance
.
In Setup
> Dropdowns
, search for ITIL and select ITIL categories
. Then click on add (remember to save when you have finished).
In Setup
> Dropdowns
, search for ITIL and select ITIL categories
. Choose the category you wish to prohibit. Then choose the options that suit you:
The category will be visible to the user but not selectable
Tickets can be validated in several ways:
By a rule. For example, all tickets whose category is "hardware failure" will be submitted to a dedicated group of technicians for validation.
Directly from the ticket. The IT department receives a request that needs to be validated by the RSI. The validation request can be sent directly from the ticket to the user concerned. Refusal to validate requires a comment.
Linked to
, Duplicates
, Child of
and Parent of
?Linked to: only has an administrative value. It allows you to see all tickets with a similar problem.
Duplicates: this is the only status that allows all tickets to be closed at the same time. If one of the tikets is closed, all the duplicated ones will also be closed.
Child of: only has an administrative value. This ticket depends on a parent ticket. This ticket must be closed before the parent in order to ensure the correct procedure for the entire closure chain (all children are closed first before closing the parent).
Parent of: only has an administrative value. This ticket is the parent of one or more children. It must be closed after all the children have been closed.
A reccurent ticket allows you to create a ticket on a regular basis at a given frequency.
Example
Open a ticket every 1st of the month to export current tickets. Open a ticket every Monday morning to check the status of weekend backups.
These tickets are set up using a template and automatic actions.
A pending reason allows you to put a ticket on hold and to automatically send reminders via follow-up templates. The ticket can be resolved after X number of reminders using a solution template. The caller's response ends the on-hold process.
Example
Ticket is put on hold and a reminder is sent every 3 days. The ticket will be resolved after the 3rd reminder if there is no response from the contact person.
There are 4 steps in setting up a pending reason:
choosing the interval between automatic follow-ups
choosing the number of follow-ups before resolution
setting up a monitoring template
setting up a solution template
The pending reasons can be set from Setup
> Dropdowns
, enter Pending reasons
in the search box.
You can follow this to set up a pending reason.
Pending reasons depend on the pendingreason_autobump_autosolve
automatic action.
Check that this is active and correctly set (setup
> automatic actions
)
To do this, you need to create a template. From Assistance
> Tickets
> Templates
click on Add
. In your new template go to Mandatory fields
and define them for the standard and/or simplified interface. The fields you have made compulsory will be preceded by a red star
To do this, you need to create a template. From Assistance
> Tickets
> Templates
click on Add
. In your template, go to Hidden fields
and define the fields that you don't want to be visible from the standard and/or simplified interface.
To do this, you need to create a template (or use an existing template). From Assistance
> Tickets
> Templates
click on Add
. In your template, go to Predefined fields
and define the fields you want to pre-fill for the standard and/or simplified interface
When creating the ticket, it is possible to change the requester (standard interface only). In the Actors
section, select the desired user so that the ticket can be created in his or her name. This ticket will of course be visible from your interface and the corresponding notifications will be sent.
Yes, you can export tickets in PDF or CSV format. When you carry out a search (all unresolved tickets in our example), you can then export the result of the current page or your complete search.
An assignment right must be given to groups for them to appear in the assignment list. This right can be found in Administration
> Groups
. Select the group concerned and check that the Assigned to
option is ticked. If the Escalade
or More ticket
plugins are installed, check that they do not cross-reference with this option.
From Setup
> General
> Default values
, in the Personnalization
insert, choose the way in which the follow-ups should be sorted via the Timeline order
menu.
Yes, it is possible to set up satisfaction surveys from GLPI without adding a plugin.
We invite you to follow this to set up your satisfaction surveys.
Danger
This command should ONLY be used on an empty ticket table.
If you want your tickets to be able to restart at number 1, a command is possible:
ALTER TABLE glpi_tickets AUTO_INCREMENT = 1
In the entity configuration, Support tab, you have the option: “Mark as private the follow-up added by a supplier via an email collector.”
Definition: organisational object used to partition the view and scope of action of users.
Entities are used to :
Partition the view of users who connect to GLPI.
Show each user only the things they need to see.
Manage administration delegations.
Examples of breakdowns
By budget entity: the equipment purchased in each entity is well separated. Most of the time for each IT department, a separate entity.
Important: GLPI can be used with a single entity.
Example of hierarchy
Important to know
GLPI does not limit the creation of entities. The more you increase the number of entities :
The more complex the system becomes (rules, failover, etc).
The longer it takes to execute requests.
Administrators often want entities to meet a need, whereas other concepts requiring less complexity are there to meet it:
Group: to assign equipment/tickets to a department or a team of people.
Location: to determine the geographical position of the equipment/person.
is done from the menu Administration
> Entities
;
the root entity cannot be deleted, only renamed.
Click on the Root Entity (Tree) link:
A menu appears, allowing you to restrict GLPI's view :
either on an entity by clicking on its name.
or a tree structure under this entity by clicking on the double green arrow to the right of the entity name.
As soon as there is at least one entity, GLPI adds a "Sub-entity" field to certain objects.
By using this field, you can choose whether the object has a scope:
Local: it will only be visible in the entity in which it is located.
Global: as Local with visibility in its sub-entities.
Example
Suppliers
An administrator of an entity creates its suppliers (local).
A GLPI administrator creates suppliers common to all entities (global).
Contracts and contacts
A contract is common to all entities (global).
An administrator of an entity creates its own contacts for this contract (local).
When creating an entity, remember to disconnect/reconnect in order to be able to see them in the list.
From Administration
> Entities
, go to the address tab to modify the information specific to your entity.
It is possible, this step requires knowledge of CSS. From Administration
> Entities
, you can activate CSS customisation. Insert the CSS code you need to customise your interface.
If you want your entity to use a particular send and/or reply address, you can change it so that it does not use the default address. From Administration
> Entities
, go to Notifications
and change the desired information to the values of your choice.
From Administration
> Entities
, go to the Assistance
tab. You can change the ticket, change and problem templates to the ones that suit you best. You can always go back by clicking on default
.
From Administration
> Entities
, go to the Rules
tab. You will be able to see all the rules that apply to the entity.
The "LDAP directory information attribute representing the entity" is used in the "Entity based on LDAP information" action within authorization rules. This rule relies on the result of a regular expression (regex) in the criteria to determine entity assignment.
Example: If the "(LDAP) Organization" attribute matches the regex \bTechnician\b
(ensuring the exact word "Technician" is present), the "Entity based on LDAP information" action will assign the entity defined by ID "#0". Using this rule, GLPI will automatically assign users to the entity where the "Entity based on LDAP information" field contains the value "Technician."
The "LDAP directory of an entity" and "LDAP filter associated with the entity (if necessary)" are used in the interface to search for users from an LDAP directory based on the specified entity.
Example: If a default LDAP directory is defined in GLPI but you wish to adjust the filter based on the entity when performing a manual import, this field will be used to refine the search (otherwise, the default filter from the LDAP configuration will be applied).
In GLPI, you can uncheck this option to streamline the login process:
If the user has previously logged in, GLPI will attempt the LDAP connection on the last known server.
If the user is not found or has never logged in, GLPI will try all configured LDAP servers.
It is essential to ensure unique logins for your users. If both LDAP1 and LDAP2 have a user with the login “FooBar,” GLPI will authenticate the user based on the first directory that responds.
To guarantee uniqueness, you should adapt the GLPI configuration by setting the user's email address as the login field. This approach will help avoid conflicts across directories, like this : The user's GLPI login, here must be the email address :
In order to get help on APIs, you can consult the documentation directly from your instance. To do this, in setup
> general
> API
change the option to Yes
to enable API Rest
. The online API documentation
option will appear. If you get an error message when you click on the documentation, click on full access from localhost
and delete the IPs (or enter the IP of the workstation you are on) in the start and end of IPv4 address range fields.
Yes, for internal accounts only. As external accounts (LDAP, SSO, etc.) depend on a dedicated server, this policy cannot be applied to these accounts.
It is possible to request that the password :
requires at least one number,
requires at least one lower case letter,
requires at least one symbol,
be of a minimum length (configurable length),
expires after a set period of time,
is deactivated if the password has not been changed for a certain period of time (configurable time limit),
It is also possible to request that an expiry notification be sent to users.
To disable password reset by e-mail, you need to deactivate the Password forget
notification (Setup
> Notifications
> Notifications
).
When you request a password reset from GLPI, you have 24 hours to carry out the reset. This time cannot be changed. If the 24 hours are exceeded, a new request must be made.
If you have operations to perform that require GLPI to be put into maintenance mode, it is possible to do this in 2 ways:
In CLI (on premise only): in the glpi folder run php bin/console maintenance:enable
(or php bin/console maintenance:disable
to deactivate it)
In WebUI: in the setup
> general
menu system
tab
To override maintenance mode, you can access GLPI by adding ?skipMaintenance=1
(https://myinstance.com/index.php?skipMaintenance=1)
In order not to overload the GLPI database, it is possible to purge the history of certain items:
general
software
financial and administrative information
users
components
all sections (purge all history entries)
By default, the "keep all" option is selected. It is possible to keep the history for between 1 and 120 months, either per section or for the whole.
Locks are used to prevent certain information from being modified.
You don't want the user field to be modified during automatic inventory feedback.
In this case, you need to activate the locks in Setup
> General
> General setup
. Select Use locks
and select the profile to be used when locking items
and the types of object to lock
. To lock a field, simply change it manually. Only the profile you have set up will be able to lock and unlock fields. To unlock them, go to the lock
field of the item in question.
A padlock will appear when information is locked.
Yes, in Setup
> General
tab Assistance
you can set up working days in the Planning work days
field.
There are several ways to change the theme:
For individual use: go to user settings
(top right) then in the personalization
tab you can choose the color palette
that suits you.
For a global setting: go to setup
> general
> default values
. You can choose the colour palette that suits you and will be applied to all users.
You can also modify the CSS by entity. Go to administration
> entities
, select the entity you want, then UI customization
. Indicate Yes
in the enable CSS customization
field and paste your CSS code in the dedicated area.
To change the default language, go to Setup
> General
> Default values
. A default language
field is available in the personalization
section. This change is valid for all users.
Valid for on-premise instances only:
In Setup
> General
click on See what would be sent
. This is the 1st value that will appear:
"glpi": {
"uuid": "hQ6ZuLpydjmaTuUCqnaqE6tTdsksio84sdfV8Kb1",
"version": "10.0.18",
}
In Setup
> General
> General setup
, adjust the Default search results limit (page)
as desired.
In Setup
> General
> General configuration
, put No
to Global search
.
In Setup
> General
> General configuration
, at the bottom of the screen, click on deactivate or indicate in days the possible retention of the identifier.
It is possible to configure closing days (public holidays) from Setup
> Titles
, enter Closing
and click on Closing periods
. A procedure is to help you set them up.
When you request a password reset from GLPI, you have 24 hours to reset your password. This time cannot be changed. If the 24 hours are exceeded, a new request must be made. A procedure is to help you set them up.
GLPI integrates a CalDAV server, which allows sharing of a GLPI calendar externally. It is also possible to modify it from both places. It's native via the link I provided previously.
To do this, go to Assistance
> Planning
Click on
Then click on Copy CalDAV URL to clipboard
Paste this link into your email tool
Copying a link from an external email to GLPI (Outlook calendar type) is not native. You must use a third-party tool (outside the scope of Teclib) such as https://caldavsynchronizer.org.
If you don't want 2 items to have the same serial number, or 2 users to have the same ID, field uniqueness will help you avoid these duplicates. To configure it, you can follow this .
From Setup
> Dropdowns
> Document types
you can manage the types of documents authorised to be uploaded to GLPI:
Add a document type
You can authorise a new document type to be added to GLPI by clicking on Add
To add spaces to your signature, you can add HTML characters as shown below:
<p>
This is the 1st line
<br>
This is the 2nd line
</p>
You can manage, through the assets :
Computers
Monitors
Software
Network devices
Devices
Printers
Cartridges
Consumables
Phones
Racks
Enclosures
PDUs
Passive devices
Unmanaged devices (linked to inventory feedback)
Cables
Simcards
It's important to understand that these 2 tasks are linked. Network discovery will bring up all the equipment discovered on the network according to its type (computer, printer, switch, etc.) and the business rules established. The inventory will inject the data authorised by the manufacturer via the protocol (serial number, , cartridges, etc.). A procedure is available here to help you configure these steps. A guide is also available directly from GLPI (Administration > GLPI Inventory > Guide
) A procedure is available
400 Bad Request, Protocol not supported
error but the inventory is running correctly?The 400 Bad Request, Protocol not supported
error is a normal error because it occurs for the Collect and Deploy tasks. These tasks are active by default when the agent is installed on windows but can only be operated if you use the GlpiInventory plugin.Hence the error in the absence of the plugin. You can therefore ignore these errors as it is the machine inventory that interests us here.
GLPI of course allows you to upload your workstations directly into your instance. You need to install the GLPI agent on the workstations concerned. You can download it here link and enter the address of your instance when installing it. You will find all the necessary documentation here
Since GLPI10, Fusion Inventory is no longer supported by GLPI. Inventory is now native. However, certain tasks (network discovery, collection, application deployment) are handled by the GLPI Inventory plugin available in the marketplace. It is also possible that following a server change, the IP is no longer the same. In this case, the cache may be at fault. If the modifications have been carried out correctly, the agents should gradually return to the new instance.
Computer groups facilitate management in task vectors. There are two types of computer group:
Static groups: a set of computers whose members are added manually. This makes it possible to control the deployment of a particular piece of software.
dynamic groups: these are the result of a search engine query. The machines in the group are calculated and the list varies over time.
Cartridge management is subject to the protocol. It is possible that the printer manufacturer does not allow this type of item. Please check with the manufacturer that is supported by your hardware. If possible, we recommend v3 to encrypt exchanges between GLPI and your hardware. If the settings are correct and the printer supports , you will then be able to view cartridge ink levels in GLPI and manage cartridge stocks. Please refer to the procedure
The Assets allows you to manage your computer racks (front and rear). A wide range of information can be entered, like location, model, manufacturer, etc. You can adjust the number of units, height, wattage, identify where it is located in the server room, etc. When hardware is added to the rack, its position in the rack will also be visible from the hardware itself.
This can be done using blacklists. Simply add a new entry formatted in IPv6 ( Setup
> Dropdowns
> Blacklists
):
Check that the URL of your instance is correctly configured on the workstations concerned.
Check that the workstations have Internet access (or access to the company's internal network)
Check that the inventory is enabled (Administration
> Inventory
> Enable Inventory
)
deploy
, collect
and ESX inventory
tasks no longer work after a migration (9.x to 10.x)?If in the agent logs you see 2 requests with 2 different URLs, it is possible that the problem comes from a configuration from the entities:
[Mon Dec 4 17:57:12 2023][debug2] https://my-server-glpi.mydomain.com/marketplace/glpiinventory/?action=getConfig&task[Deploy]=2.xxxxxxxxxxx-2023-12-04-17-04-44
[Mon Dec 4 17:57:12 2023][debug2] https://other-server-glpi.mydomain.com/marketplace/glpiinventory/b/deploy/?action=getJobs&version=2.xxxxxxxxxxx-2023-12-04-17-04-44
From Administration
> Entities
>Assets
tab, it is possible to define the URL of another GLPI server in the Agent base URL
field. The agent will then retrieve the configuration of the task concerned from the server indicated. If a URL is entered in this field, delete it and run a new test.
URL Base for agent
field in entity administration?This field is used if you have multiple GLPI servers. When this field is set, (Administration
> Entities
, Assets
tab Agent base URL
field) the agent will be able to retrieve the configuration of the deploy
, collect
and ESX inventory
tasks from the specified server. This avoids web server redirects if you don't want to use them.
You can get more information by consulting the logs.
The network discovery task doesn't get enough information to do an import in the Computer section of the assets. You should see your PCs in the unmanaged equipment
section or in the rejected equipment history
section. If it is an ESX, you just need to create an ESX task to inventory this machine.
It allows you to prioritise the elements of your network in order to visualise dependency relationships.
Example: Router --> Switch --> Rack --> Servers
The impact analysis is created from the menu of the same name from any object in the inventory. A is available to help you set up an impact analysis.
Yes, you need to use the task with GlpiInventory for VMWare inventories. For the others, you need to install the GLPI agent directly on the virtual machine. As soon as the agent is supported by the , the inventory will be possible.
GLPI's native inventory is able to reconcile the Alternate username
with the user
if a match is found.
Example
The user is "johndoe@AzureAD". GLPI then tries to find a user with an identifier corresponding to "johndoe" (the domain part is cleaned up).
If, in GLPI, the user does not have the same ID (john.doe for example), the match will not be made. This could be explained by the fact that the Windows session was opened using the UPN Entra and that in GLPI, the user was synchronised via the email address.
There are several solutions:
Create users manually with the as identifier
Synchronize users from Entra by specifying in the configuration that the is used as GLPI identifier (Setup
> Authentication
> LDAP directory
> Login field
= UserPrincipalName
)
Yes, from Administration
> GLPI Inventory
> Deploy
> Mirror servers
you can add a mirror server to deploy your packages. A is available to assist you.
Availability: Ensures that deployments can continue even if the main server fails.
Performance: Improves response times and deployment speed by spreading the load.
Security: Reduces the risk of data loss and ensures that applications are always available for deployment.
Yes, you can use the location to force an agent to retrieve a packet from a server with an identical location. For example, a computer whose location is set to Paris will retrieve packets from the mirror server located in Paris. If the server is not available, the agent will retrieve the packet from the main server (or another mirror server located in Paris, if another exists).
A is available to help you collect data. Specifically for , a special configuration is required.
Example
Our example will rely on the computer's module to know if it is activated and its version
From Administration
> GLPI Inventory
> Computer Information
, click on Add
Indicate a name
,
Select WMI
type
Click on Save
From the collect configuration
tab, enter the necessary information:
Name: informative data
Moniker: winmgmts://./Root/CIMV2/Security/MicrosoftTpm
Class: Win32_Tpm
Properties: IsActivated_InitialValue,SpecVersion
See the Official Microsoft WMI Documentation
The blacklist identifies the information that will not be retrieved when a PC is inventoried or when users are synchronised.
It is possible to prohibit a certain amount of information, such as IP addresses in 0.0.0.0 or a user with an @yopmail.com email address.
You can blacklist the following items:
IP
MAC
Serial number
UUID
Email (for users)
Model
Manufacturer
Manufacturer
Go to Setup
> Dropdowns
> Blacklists
In the first part of the screenshot, the fields
insert shows the locks on the computer fields and also on the connected elements.
If the type of computer or the type of monitor connected to this computer is changed, the changed field will be locked and displayed in this area.
The second part displays the locked connected items. For example, if a network port is deleted, it will disappear from the ‘Network’ tab and appear in this box.
This automatic action does not remove older versions of applications installed from the Microsoft store. In fact, the store leaves older versions still installed for other users of the machine. Windows only updates software from the store for logged-in users.
To interconnect your instance with a third-party provider, you need to authorise the IP address associated with the outgoing flow
16
with16.glpi-network.cloud
57.128.65.116
57.128.65.116
Europe
France
17
with17.glpi-network.cloud
57.128.44.201
57.128.44.201
Europe
France
18
with18.glpi-network.cloud
57.128.45.100
57.128.45.100
Europe
France
19
with19.glpi-network.cloud
162.19.93.212
162.19.93.212
Europe
France
20
with20.glpi-network.cloud
57.128.103.166
57.128.103.166
Europe
France
21
with21.glpi-network.cloud
162.19.93.240
162.19.93.240
Europe
France
22
with22.glpi-network.cloud
141.94.173.236
141.94.173.236
Europe
France
23
with23.glpi-network.cloud
57.128.114.231
57.128.114.231
Europe
France
30
with30.glpi-network.cloud
87.98.178.77
57.128.36.142
Europe
France
31
with31.glpi-network.cloud
46.105.40.189
51.210.127.93
Europe
France
32
with32.glpi-network.cloud
87.98.145.248
57.128.56.229
Europe
France
33
us1.glpi-network.cloud
51.81.90.250
135.148.101.38
America
USA
34
us2.glpi-network.cloud
147.135.100.38
15.204.30.28
America
USA
35
us3.glpi-network.cloud
51.81.125.184
135.148.232.195
America
USA
36
in1.glpi-network.cloud
148.113.24.13
148.113.37.27
Asia
India
37
sg1.glpi-network.cloud
139.99.34.194
51.79.143.19
Asia
Singapore
38
ca1.glpi-network.cloud
54.39.84.121
51.79.28.54
America
Canada
Yes, at the moment you can choose whether your instance is hosted in Europe or the United States. Future deployments will allow you to choose and refine your hosting region even further (Europe/France, for example).
Go to this address: https://myaccount.glpi-network.cloud/ Then follow this
Maximum number of IT agents
Unlimited
Unlimited
Minimum number of IT agents
1
25
Rate per user
19 €
21€
Maximum number of assets
Unlimited
Unlimited
Number of end users
Unlimited
Unlimited
Community support
✅
✅
Support Bug fixes/security patches
✅
✅
L2/L3 helpdesk support
Partner
Partner
Community plugins
✅ Secure Marketplace
✅ Secure Marketplace
GLPI Network plugins
✅
✅
Automatic updates
✅
✅
Server maintenance
✅
✅
Full database backup once a day
✅
✅
Incremental database backups once an hour
❌
✅
Incremental backups of files (GLPI attachments)
❌
✅
Dedicated server
❌
✅
VPN tunnel
❌
✅
A read-only connection to the MySQL database
❌
✅
Filtering of IPs that can access the instance
❌
✅
Interconnection with the Metabase reporting tool (Metabase plugin)
❌
✅
SQL replication
❌
❌ (tailor-made offer available)
Special needs
If you have requirements that are not covered by one of our offers, please contact our sales department so that we can provide you with a tailor-made offer.
Your offer allows you to obtain a pre-production instance to carry out all your tests without compromising the production instance. You can request this at any time.
After the 45-day trial period, if no means of payment has been entered in your customer area, your instance will be automatically suspended. If a payment default is detected, your instance will also be suspended. It will be reactivated as soon as siutation has been re-established.
You have the right to recover your data. All you have to do is request it using the form. Your database and documents will be sent to you by secure link.
TECLIB' works indirectly with customers through a network of partners. These partners provide advice, training, integration, configuration, N1-2 support and specific developments for end customers. For its part, TECLIB provides N3 maintenance (your GLPI Network Cloud offering), product development (R&D or partner subcontracting), ecosystem cohesion and community management. We invite you to visit the following website to find a partner near you who can help you with your GLPI needs: https://glpi-project.org/partners/
To import your GLPI data :
Gather your data in the form of a SQL dump as well as the files (folder files
) in the form of a zip.
Create a ticket with GLPI Network Cloud support specifying :
The type of import required (e.g. data migration from a local instance to the cloud).
Authorisation for Teclib to access your instance.
The secure download link for your data (Wetransfer, Google Drive, etc.).
Support will confirm receipt and integration of your data.
A is available to help you.
Check whether the imported data matches your expectations by connecting to your GLPI Network Cloud instance.
If data is missing :
Make sure that the files sent contain all the necessary data
Contact support to provide them with the missing files or additional information
With a public instance, you can increase your storage capacity by 50GB for €49 per month.
There is no size limit. If your instance exceeds 5 GB for public instances, you can increase it by 50 GB for €49.
If a plugin is not present, you can request its addition directly from the plugin page of your instance. If it passes the various tests, it could be integrated. If, on the other hand, the tests fail, its presence in the marketplace will be compromised.
Accounts billed will be those with a standard interface. An interface is associated with a profile.
The profiles in GLPI (8 by default) are of two types, representing two different user interfaces:
The Simplified interface
on a default installation, only for the profile named Self-Service
The Standard interface
on a default installation, for all other profiles: Super-Admin, Admin, Hotliner, Observer, Supervisor, Technician, Read-Only
The Simplified interface contains a very limited menu, giving access by default only to:
Tickets
The reservation of equipment
The consultation of the FAQ
And the access to the forms of your catalog of services
This interface is used by end-users. These users, with a simplified interface, are free and unlimited.
The Standard interface contains all GLPI menus (depending on the administrative rights), and is used by:
Technicians
"IT agents"
Helpdesk agents
Or even administrators, fleet managers, etc.
These users with a standard interface are billed 19€ (tax excl.) per month.
(If a user has several "standard interface" profiles, he is invoiced only once).
The GLPI Network Cloud plugin (available from the marketplace) will identify paying accounts. A new tab will appear in administration showing you this information.
The GLPI Network Cloud plugin (available from the marketplace) can show you this information from the Administration > GLPI Network Cloud
tab once the plugin is installed.
Cloud instances are updated when a new version is available. You don't have to do anything, updates are automatic.
If you would like to use the URL of your domain (support.mydomain.com) for your cloud instance, you can use this form, observing the following recommendations:
The addition of a CNAME entry must be configured on your DNS server. This must point to the current URL of your cloud instance. Remember to indicate the URL you have chosen in your ticket so that it can be configured.
Your GLPI Network Cloud instance has a static IP. To find out what this is and configure your firewall, for example, run the following command in a terminal:
Linux : dig +short MaSociete.with.glpi-network.cloud
Windows: nslookup MaSociete.with.glpi-network.cloud
After having indicated and validated your personal information (Company, Email, Password, URL) on the registration form or in your customer area, the deployment of your new GLPI Cloud instance takes less than one (1) minute on average. Once your instance is deployed, its activation in paid mode is immediate as soon as you save your payment information (credit card) in your customer area. The first billing is issued at the same time based on current standard users, then monthly on the same date thereafter.
Good to know
You also have the possibility of paying by direct debit.
After deployment of your instance on our GLPI Cloud platform, you have 45 days free trial.
During these 45 days:
Your GLPI Cloud instance is available with all features included;
If you have lost your GLPI access password, do not hesitate to contact us: we will reset it;
Your customer account can be accessed now.
7 days before the end of 45 days free trial:
If you did not enter payment data: you will receive a reminder (to the email address indicated at your registration), inviting you to complete your payment information to keep the access to your instance.
1 day before the end of 45 days free trial:
If you did not enter payment data: you will receive a new reminder.
After 45 days of free trial:
If you did not enter payment data:
Your GLPI Cloud instance will be suspended 2 days after the end of your trial period, you can restore access by entering your payment information;
Your GLPI Cloud instance will be permanently deleted 20 days after the end of your trial period;
Your data will not be recoverable;
Your customer account will remain accessible for new instances.
If you have entered payment data:
You are now switched to the paid offer;
Your platform will remain accessible and will be backed up every night (7 days conservation);
Your customer account can be now accessed.
Even if we are sorry to see you go, you can close your account at any time, for no particular reason. To do this, please, go to your customer account then choose the menu My Account
, then click the link Delete my account
and follow the instructions.
Important
Please, keep in mind that your data will be destroyed!
These forms allow you to create a new password for GLPI Cloud and subscription accounts (GLPI Network) sent to your email:
GLPI Cloud: forgot password?
GLPI Network: forgot password?
GLPI Network Cloud instances are backed up once a day with a 30 day retention.
You can set up a basic authentication to prevent unauthorised agents from sending data to GLPI. This authentication prevents any machine from injecting information into the inventory.
How it works:
When a GLPI agent contacts the server to send an inventory, it transmits a username and password in the HTTP request header. The GLPI server checks this information before authorising the data to be sent.
In the Cloud, these identifiers are generated by support and sent to you by ticket so that you can configure your agents.
Yes, it is possible to embed a GLPI dashboard via iframe, but under certain conditions:
By default, for security reasons, iframe usage is blocked on the backend.
We can lift this restriction, however, please consider the following points:
This opening applies to the entire GLPI application.
You expose yourself to phishing risks.
We do not guarantee that all GLPI functionalities will work properly in this context.
In an OAuth SSO environment, the iframe will not work.
To limit risks, please open a ticket and provide us with the FQDN(s) (fully qualified domain name(s)) of the external site(s) authorized to display the iframe.