Uplivra Administrator Handbook

How to use this handbook

This handbook is for the person who installs and looks after Uplivra: an IT administrator, engineer or MSP technician. It goes through the product in the order you meet it. Each chapter says where to click (menus are written like Settings › Sites and collectors), what you should see, and what to do when it doesn't work. Longer topics link to their own step-by-step guide.

Words used in this handbook

1. Install choices

Pick the install that fits. Most businesses need only the server: it has a collector built in.

Sizes. For up to 250 devices, a server with 4 CPU cores, 8 GB memory and a 100 GB disk (minimum 2 cores, 4 GB, 50 GB). A collector needs 2 cores, 2 GB and 16 GB at least. The documentation page has every role.

Supported systems. Ubuntu Server 22.04, 24.04 or 26.04 LTS (Intel/AMD or ARM). Collectors also run on Debian 12 and on Windows 10, 11 and Windows Server 2016 or later.

What to have ready: a fixed IP address for the server, your Uplivra portal account (portal.uplivra.com), and about 10 minutes of internet access for the install.

2. First setup

Setup is the same on Ubuntu and on the appliance. On Ubuntu you start it with the installer; on the appliance it starts by itself on the console.

1. Download uplivra-linux.tar.gz from the portal's Downloads page and copy it to the server (WinSCP from Windows, or scp).
2. On the server, run these one at a time:

tar xzf uplivra-linux.tar.gz
cd uplivra
sudo bash install.sh

3. Answer the questions. Press Enter to accept a suggestion in [brackets]. The important ones are in the table below.

4. Check the summary and type yes. Setup shows each step (==> Step 1 of 14: …) and takes 2 to 5 minutes.
5. At the end it prints the address to open, for example https://192.168.1.20/.

The first administrator is always created and checked

From release 26.10.32, the step Create your sign-in (you@company.com) always creates the first administrator from your answers (or sets its password again if you run setup a second time), and then proves the password works against the database. If it doesn't, setup stops with "the new sign-in didn't verify" and the reason, instead of finishing with no way in.

Earlier releases could skip this step on a fresh install, leaving no one able to sign in. If that happened to you, upgrade, or create the administrator yourself on the server:

sudo uplivra user add -email you@company.com -name "Your Name" -role admin

It asks for the password twice. Then check it works:

sudo uplivra user list

You should see your email with the role admin.

What you should see

1. Open the address in your browser. The browser warns that the connection isn't private (Uplivra made its own certificate). Click Advanced, then Continue. You can install a proper certificate later (Security settings).
2. Sign in with the email and password from setup.
3. The Overview opens. A new installation shows Get started in three steps: create a site, connect a collector, add devices. Setup already made the first site, Main office, and connected the server's own collector to it.

If setup fails

• Setup stops and says why. Fix the cause (usually internet access or a typo in an address) and run sudo uplivra setup again. Finished steps are skipped or repeated safely.
• The details are in /var/log/uplivra-setup.log.
• To change answers later: sudo uplivra setup on the server, or Settings › Run setup again in the web interface.

3. Signing in and two-step sign-in

Signing in

Open your server's address and sign in with your email (or, with a company directory, your company account). When a directory is connected, the sign-in page offers the company account first, with a switch to a local Uplivra account.

Turn on two-step sign-in for yourself

1. Click your initials (top right) › My settings.
2. Under Two-step sign-in, click Set up two-step sign-in.
3. Install an authenticator app on your phone if you don't have one (Microsoft Authenticator, Google Authenticator, 1Password or Authy).
4. Scan the QR code. Can't scan it? Open Can't scan it? and type the setup key into the app.
5. Type the six-digit code the app shows and click Turn on. Your other signed-in browsers are signed out.
6. Save the recovery codes somewhere safe (a password manager). Each works once if you lose your phone.

From then on, signing in asks for your password, then the code from your phone. My settings also has Make new recovery codes and Turn off (or move to a new phone); both need a current code.

Require two-step for everyone

1. Settings › People and access, then People.
2. Under Two-step sign-in, tick Require two-step sign-in for everyone and click Save.
3. Anyone without it is sent to set it up at their next click, you included.

The Two-step column shows who has it. Reset next to a person turns theirs off (a lost phone).

Locked out?

On the server:

sudo uplivra user reset-password -email you@company.com
sudo uplivra user reset-two-step -email you@company.com

The first sets a new password (and signs the person out everywhere); the second turns off two-step sign-in so they can set it up again.

Sign out when idle

Settings › People and access › People › Sign out when idle: choose Never (stay signed in up to 12 hours) or a number of minutes without activity. Pages that refresh themselves (the Overview, the wall screen) don't count as activity, so a screen left open signs out too. For a display on the wall, use a public status page (Status pages in the menu) instead.

4. People, access profiles, groups and directories

Everything is under Settings › People and access. A person's access is the sum of their own access profile, the local groups they're in, and the directory groups you picked. Full details: People, access and sign-in.

Add a person by hand

1. Settings › People and access › People.
2. Under Add a person, type the Name, Email, pick an Access profile, and type a Password twice (at least 12 characters).
3. Click Add person. Give them the password in person or by phone, not in the same email as their login.

Access profiles

A profile is a list of permissions. Built-in profiles: Administrator, Administrator without purchasing, Administrator without deleting or purchasing, Operator, NOC engineer, Help desk, Auditor and Viewer. Copy one to make your own under Access profiles. Profiles also choose which views people get, so the menu shows only what they can use.

Check someone's access shows exactly what one person may do, and why, before they sign in.

Local groups

For people not in a directory (contractors, a break-glass account): Local groups › create a group, give it a profile, add people.

Active Directory or LDAP

1. Settings › People and access › Directories › Connect a directory.
2. Enter the server (ldaps://dc01.corp.example:636 is best), a read-only service account and its password, and the base DN. Paste your company's CA certificate if needed.
3. Click Test. It checks the connection and the account.
4. Pick groups and people from the directory tree and give each an access profile.

People sign in as name, DOMAIN\name or name@domain. Take someone out of a directory group and the access goes at their next sign-in. Keep at least one local administrator in case the directory can't be reached.

From the server you can test the directory settings in the settings file with sudo uplivra ldap test.

Single sign-on (Entra ID, Google, Okta)

Settings › People and access › Single sign-on. Register a web application at your provider with the redirect address shown on the page (your server's address followed by /login/sso/callback), copy the issuer, client ID and secret, list the allowed email domains, and choose whether unknown people are refused (recommended) or added with a profile. Steps per provider: Single sign-on.

MSP customers: your MSP's access

If an MSP looks after your Uplivra, Settings › Your MSP's access lets your administrator choose Full, Limited or Locked. Monitoring keeps running whatever you choose.

5. Sites, collectors and site servers

Settings › Sites and collectors lists each site and its collectors with their computer, version and Last report.

Add a site and connect a collector

1. Under Add a site, type a name and click Add site.
2. Click Connect a collector at site name. The page shows the server address, a one-time setup code (uv_enr_…, valid 24 hours) with a Copy button, and the server's certificate fingerprint.
3. Install the collector (Linux, Windows or appliance) and give it the address and code. Check the fingerprint matches.
4. Within a minute the collector appears under its site with a recent Last report.

On a Linux collector or appliance with SSH, sudo uplivra join asks for the address and code.

Use the server itself as the collector

A server set up as Uplivra server (with a collector) checks devices itself; no second computer is needed. Setup connects it to the first site. To use it for another site, or if it isn't connected:

1. Settings › Sites and collectors › Connect a collector at site name.
2. Under This Uplivra server, click Use this server as the collector for site name.
3. Within about 30 seconds the server appears under that site as a collector. If it can't connect, Sites and collectors shows why.

If the server already checks another site, the button moves it: that site then needs its own collector. The server only sees devices it can reach, so use it for the site on its own network.

What you can set per site

• Receive syslog here and its port (514, UDP and TCP): for logs.
• Receive SNMP traps here and its port (162/UDP), plus which SNMP logins traps may use.
• Receive traffic flows here with the NetFlow/IPFIX (2055) and sFlow (6343) ports (Network Pro).
• DNS names for logs and traps: every address, private addresses only, or off.

The collector's own page

Click a collector's name. Its Administration section has Fetch checks again, Diagnostics report, Restart, Test from this collector (ping, port, DNS lookup, traceroute), Upgrade this collector and SSH to this computer. See Remote access and collector administration.

Site servers

A site server is a collector the other collectors at its site report through, so it's the only computer there talking to Uplivra. Collectors find it themselves and report directly if it stops answering. Set-up and firewall rules: Site servers.

Old collectors

When collectors haven't reported for over a week (old test machines, replaced computers), the page offers Remove old collectors.

6. Adding devices

You can add devices three ways: one at a time with the wizard, many at once from a CSV file, or by discovery.

The Add a device wizard

1. Devices › Add a device (or Add a device on the Overview).
2. What it is: Name, Address (the IP address or DNS name the collector uses), Site, Kind (router, firewall, switch…), and optionally vendor, model, serial number and Sits behind (if that device is down, alerts for this one are held back).
3. Where it belongs: ownership group (automatic by default), tags, location, role, owner, Lifecycle (In use, Planned, Spare or In the inventory only), warranty and notes.
4. Probes: tick the checks to add (see Checks and probes).
5. Logins: pick saved device logins for SNMP, SSH or Windows checks.
6. Options: whether it counts toward the plan, Don't scan it (discovery sweeps skip fragile, medical or factory equipment), Include in Vulnerability Scanning, and Quiet for the first hour (a maintenance window while it's being installed).
7. Click Add device. Only the first step is required; everything else can be changed later with Edit.

What you should see: the device page, with its checks waiting for their first result. Within a minute or two they turn green (up), amber (warning) or red (down).

Device logins (SNMP, SSH, Windows)

Save each login once under Settings › Device logins › Add a login: SNMP v3 (recommended), SNMP v1/v2c (community), SSH or Windows. Give it a short name, choose Where can it be used? (all sites, or one site only), pick a device under Try it before saving and click Test this login, then Save login. Logins are stored encrypted, never shown again, and each collector receives only the logins its own checks use.

Advanced: a login can also live only on the collector (sudo uplivra vault set-snmp -name office-switches) and be picked as A login saved on the collector itself.

Import from a CSV file

1. Devices › Add a device › Import a CSV (/devices/import).
2. Download the Template CSV (or Today's devices in these columns to start from what you have). Open it in Excel.
3. Fill in one row per device. Only name and address are needed. Useful columns: site, kind, vendor, model, tags (separated by |), group, lifecycle, parent, billable, no_scan, probes.
4. The probes column takes checks separated by ;, for example: ping; tcp:22,443; http:https://intranet/; tls:443; snmp:LOGIN; windows:LOGIN; linux:LOGIN; dns:NAME; ntp; traceroute; config:LOGIN (LOGIN is a saved device login's name).
5. Save as CSV, choose it under CSV file and click Check the file. Up to 2,000 devices and 2 MB.
6. Check before importing lists each line with its problems. Fix the file and upload again, or click Import N devices to add the good ones.

Import only adds devices: existing ones are left alone.

Discovery

1. Discovery in the menu. Under New scan, pick the Site (its collector runs the scan), a name, and Addresses to scan: subnets (192.168.1.0/24), ranges (10.0.0.10-50) or single addresses, up to 4,096 per scan.
2. Tick the SNMP logins to try so switches, routers, printers and UPSs say what they are.
3. Choose Run it (only when you press Run now, or on a schedule) and what to do with New devices it finds: list them for you, add them to the inventory, or add and monitor them.
4. Click Start scan. The status goes from Waiting for the collector to Scanning… to Done · found N.
5. Under What was found, tick devices and choose Add them as monitored devices, Add them to the inventory only (not billed), Ignore or Remove from this list, then Apply.

Discovery recognises a device whose DHCP address changed (by its MAC address) and offers Change it to …, and lists a router that answers on several addresses once.

Cloud resources (AWS, Azure, Microsoft 365)

Cloud monitoring is part of Core; there is no separate cloud module.

1. Cloud in the menu. Under Connect an account, pick Amazon Web Services, Microsoft Azure or Microsoft 365 service health and follow the steps on that page to create a read-only key or app.
2. Paste the IDs and secret and click Connect and test. The first read lists what's in the account within a minute.
3. On the account page, tick the resources to watch and click Monitor the ticked resources. Each becomes a device on the Cloud site and counts as one Core device. Microsoft 365 and provider health don't count.
4. Load balancers and VPN gateways show a Network Pro label when the license has no Network Pro; with it, they can be ticked like anything else.

What you should see: new devices on the Cloud site, turning green within a few minutes. Details: Cloud monitoring.

7. Checks and probes

Add several checks at once

On a device's page, open Add probes. Quick probes adds the simple checks; Health with a login adds SNMP, SSH or Windows health with a saved login. Checks the device already has are left alone.

Change a check

Click the check on the device page. Besides its own settings, every check has:

• How often it runs.
• Alert after N failures in a row: raise this for devices on shaky links.
• Running: untick to pause the check without losing its history.
• Test these settings: runs it once now from the collector, before you save.

8. Alerts, channels, escalation and maintenance

Where alerts go

1. Settings › Where alerts go.
2. Under Add a place to send alerts, choose Email, Microsoft Teams, Slack or Webhook, give it a name, and the address(es) or webhook URL. Email needs a mail server under Settings › Email servers.
3. Click Save, then Send test next to it. Check it arrives.

Delivery history lists every message sent and what the other end answered, and can send failed ones again. Webhook details: Alert webhooks.

Alert rules

Settings › Alert rules raises alerts when a measurement stays past a limit, such as CPU above 90% for 15 minutes. Standard rules (CPU, disks, UPS on battery and others) are added the first time the server starts. Add a rule: pick the Measurement, above or below, the Threshold, For at least (minutes), the Alert level (Warning or Down), and what it Applies to (all devices, a kind, or one device).

The Alerts page

Alerts shows Open alerts with severity, what, since when and who is handling it, and Recently fixed.

• I'm on it tells everyone you're handling it and stops "got worse" messages. You still get the "fixed" message.
• Open a ticket opens one in your ticketing system or the Service Desk.
• Explain opens Uplivra Intelligence's view of the alert: the likely cause and what else happened at the time.

Escalation

On Settings › Where alerts go, Escalation: if an alert is still open and nobody pressed I'm on it after a while, also tell someone else.

1. After (minutes), For (every alert, down alerts only, or warnings only), Send to (a channel), and Then repeat every (minutes, 0 = once).
2. Click Add escalation.
3. Under Places used only for escalations, tick channels (such as an on-call phone or a manager) that should get escalations only, not every alert.

Acknowledging the alert (I'm on it) stops the escalation.

Maintenance windows

While a window is in effect, Uplivra opens no new alerts for what it covers.

1. Settings › Maintenance windows › New maintenance window.
2. What's happening: a title, reason, and Planned, Emergency or Unplanned (already happening).
3. What it covers: a site, devices you pick, a device group, devices with a tag, a service, or everything.
4. Alerts during the window: Hold them back (listed on the window afterwards) or Send them only to a channel (for example the team doing the work).
5. When: start and end, in your computer's time zone. A start in the past means now.
6. Ticket and approval (with ITSM Integration or the Service Desk module): open a change in your ticketing system, and choose who approves: nobody, a manager in Uplivra or by email, or the ticketing system's approval.
7. Click Save maintenance window.

Windows that need approval pause nothing until approved; administrators see a banner "N maintenance windows are waiting for your approval". Repeating maintenance on the same page handles regular work such as Windows updates (scheduled two weeks ahead, no tickets or approval). End now finishes a window early.

Hours in approved planned maintenance are left out of availability reports. Emergency and unplanned maintenance still count.

Ticketing (ITSM)

Settings › Ticketing connects ServiceNow, Jira Service Management, Freshservice, Zendesk or a webhook (ITSM Integration module), and can Open incidents for alerts automatically (critical only, or critical and warning, after a delay you choose) and keep a CMDB up to date. With the Service Desk module, incidents can go to the Uplivra Service Desk instead: see Service Desk.

9. Dashboards and the wall screen

The Overview

The Overview shows total devices and how many are healthy, warning and critical, Network health over the last 24 hours, Top alerts, devices with a problem by site, Collector health and Recently fixed. It updates every 30 seconds. A red banner says when a collector has stopped reporting, because its site's devices are then not being checked.

Make it yours

Click Customize on the Overview (or My settings › My overview page):

1. Tick the sections you want and number them in the order you want them.
2. Under Which sites, tick sites to show only those (none ticked means every site).
3. Options: Only list devices that have a problem, and Compact.
4. Click Save my settings. Each person has their own.

The wall screen

Click Wall screen on the Overview (or My settings › Open wall screen). It opens a full-screen Network status page for a TV in the NOC: counts of down, warning, up and waiting devices, open alerts with who is on it, and each site's devices. It refreshes every 30 seconds.

Status pages

Status pages in the menu makes a simple page for staff or customers showing whether your services work, with 90 days of history and any notices you post. Keep it private (Uplivra sign-in needed) or make it public.

10. Reports, SLA and services

Availability report

1. Reports in the menu opens the Availability report (Devices tab).
2. Pick a Month and click Show. You see the average availability, how many devices met the target, and per device: availability, downtime, what measured it and whether it met the target.
3. Set the Availability target (%) and Save.
4. Download CSV for a spreadsheet.

Availability is measured each hour by each device's most basic check. Hours in approved planned maintenance are left out; emergency and unplanned maintenance still count and are shown separately.

Services and uptime targets (SLOs)

Reports › Services and uptime targets › Add a service: name it, set the target (for example 99.9) and the period (7, 28, 30 or 90 days), choose whether it's up when all or any of its checks are up, and tick its checks. Each service shows its availability, the downtime budget left, the burn rate and daily bars, with warnings when the budget burns fast or runs low. Full guide: Services and uptime targets.

Other reports

• Network › Capacity: 95th percentiles and when links will fill (Network Pro).
• Help desk › Reports: tickets, targets met and time to resolve (Service Desk).
• Upgrades and Compliance have their own exports.

11. Updates and backups

Updates

Your server asks for new versions every 6 hours. Settings › Updates shows what's available with its release notes.

1. Test the new version on a lab installation first.
2. Tick I've tested … in a lab or development environment.
3. Click Upgrade this server to …. The web interface restarts within a minute or two; refresh the page.
4. Tick the box again and click Upgrade collectors to …. Each collector downloads it from your own server.

Uplivra keeps the previous version and goes back to it by itself if the new one doesn't start. Automatic updates (channel, server, collectors, start hour) need you to tick "I understand automatic updates install without testing on my systems first". Servers without internet use an Offline update package. Full guide: Updating Uplivra.

Backups

Uplivra backs itself up every night at about 2:30 to /var/backups/uplivra and keeps the last 14. Each backup is encrypted, and holds the database and the key for your saved device passwords.

1. Save the backup key in your password manager now:

sudo -u uplivra uplivra backup -show-key

2. Take a backup by hand before a big change:

sudo -u uplivra uplivra backup

3. Copy the backup files to another computer or cloud storage. A backup on the same disk doesn't survive a disk failure.
4. To restore (on this server, or a new one after installing Uplivra):

sudo systemctl stop uplivra-server
sudo -u uplivra uplivra restore -from /var/backups/uplivra/uplivra-20260926-023000.uvbak
sudo systemctl start uplivra-server

On a new server, restore asks for the backup key.

Data retention

Settings › Data retention sets how long Uplivra keeps detailed data, 5-minute and hourly averages, resolved alerts, the audit log, log messages, configuration backups and traffic flows, and shows the disk space used. Old data is removed every hour.

12. Licensing and modules

Settings › License and modules shows your plan, devices in use against the plan, who it's licensed to, billing and the last check-in, and each module's status (Active, Free trial, Not purchased or In development).

• Free: without a key, Uplivra monitors up to 15 devices with Core features.
• Cloud monitoring (AWS, Azure, Microsoft 365) is part of Core: each monitored cloud resource is one Core device. Cloud load balancers and VPN gateways need Network Pro (no extra Network Pro charge). Older keys that list a separate "Cloud Monitoring" module keep working; that entry is simply ignored.
• Buy or change a plan on the customer portal, then paste the key (it starts with UPLV1) under Enter a new or renewed key and click Install key. Upgrades also arrive by themselves at the next check-in.
• Check-in: once a month the server sends Uplivra its installation ID, license key and device count (never device names, addresses or monitoring data) and the key is renewed. Check in now does it at once. If it can't reach Uplivra, everything keeps working for 30 days after the renew-by date, with a warning.
• No internet? Click Download check-in file (no internet), upload it on the portal's Offline renewal page, and paste the key you get back. See Air-gapped sites.
• More devices than the plan: the newest devices are paused (not checked) until you add devices to the license or retire some. Nothing is deleted.
• Moving to another server: Remove license here, ask Uplivra to release it, then install it on the new server.
• Licensing revoked: the page shows the reason. Uplivra runs on the free tier until the license is restored; nothing is deleted.
• Uplivra Intelligence is free for the first 6 months of a new installation.

13. Security settings

Device logins, directory passwords, webhook secrets and keys are stored encrypted and never shown again after you save them. The appliance is hardened to CIS Level 1 with SSH off by default.

14. Troubleshooting and the support connection

Quick checks on the server

systemctl status uplivra-server uplivra-collector
sudo journalctl -u uplivra-server -n 50
sudo journalctl -u uplivra-collector -n 50

Both services should say active (running) in green. Press q to get back.

Common problems

Getting help from Uplivra

1. Open a support ticket on the customer portal (Support › Open a ticket). Your licenses and collectors are filled in, and you can attach Uplivra's own recent log lines (never your network's data). See Support tickets.
2. If support needs to look at a collector, an administrator turns on the support connection under Settings › Uplivra support. It's off until you turn it on, and nothing happens until one of your administrators approves each request on that page (diagnostics, a restart, an upgrade, or a support terminal through a collector). You can end a support terminal any time on Remote access.
3. Health reporting to Uplivra on the same page chooses how much your server shares every 5 minutes: Summary (default), Summary and device detail, or Off. See what would be sent now shows exactly what goes.

Email support@uplivra.com with what you see and the output of sudo journalctl -u uplivra-server -n 200 if you can't open a ticket.