Foglight Agent Manager 7.3.0 - Foglight Agent Manager Guide

Troubleshooting

If you have verified all of the WinRM configuration information and are still experiencing connection issues, the following techniques may be helpful for diagnosing the problem.

Enabling specific TLS protocols

If an agent could not establish secure connection to a target server, verify if the target server supports TLS protocol version negotiation. To enable specific TLS protocols on the agent manager, run the Agent Manager with the following switch:

-Djdk.tls.client.protocols=TLSv1, TLSv1.1, TLSv1.2


	NOTE: To enable specific TLS protocols, specify them in a comma-separated list within quotation marks and all other supported protocols will be disabled. For example, if the value of this property is “TLSv1,TLSv1.1”, then the default protocol settings are only for TLSv1 and TLSv1.1 while other protocols are unavailable.

Verifying setup

To check whether a listener is configured for WinRM, you can issue the following command and observe its output:

$ winrm enum winrm/config/listener

CertificateThumbprint

ListeningOn = 10.4.114.29, 127.0.0.1, ::1, fe80::100:7f:fffe%12, fe80::5efe:

10.4.114.29%14, fe80::38a7:8fc9:3d7d:f4d7%13

The Port and Transport elements contain important information. The above command output identifies an HTTP listener on port 5985.

To see a full list of WinRM configuration values for the WinRM service that the Agent Manager is to use on the remote machine, you can issue the following command and observe its output:

$ winrm get winrm/config/service

Service

RootSDDL = O:NSG:BAD:P(A;;GA;;;BA)S:P(AU;FA;GA;;;WD)(AU;SA;GWGX;;;WD)

MaxConcurrentOperations = 4294967295

MaxConcurrentOperationsPerUser = 15

EnumerationTimeoutms = 60000

MaxConnections = 25

MaxPacketRetrievalTimeSeconds = 120

AllowUnencrypted = true

CbtHardeningLevel = Relaxed

EnableCompatibilityHttpListener = false

EnableCompatibilityHttpsListener = false

CertificateThumbprint = ce 20 a6 47 d8 0d 71 b3 e2 7c dd f7 70 d9 57 d1 3f a5 65

The important properties are AllowUnencrypted (it indicates whether HTTP is allowed or not), and the Auth values that are set to true (enabled), namely Basic and Negotiate. In this example, both authentication types are enabled.

For more information on setting up for HTTPS, see About WinRM authentication and the Agent Manager .