Chat now with support
Chat mit Support

Foglight Agent Manager 5.9.5 - Foglight Agent Manager Guide

Configuring the embedded Agent Manager Installing external Agent Managers
Understanding how the Agent Manager communicates with the Management Server Deploying the Agent Manager cartridge Downloading the Agent Manager installer Installing the Agent Manager Starting or stopping the Agent Manager process Frequently asked questions
Configuring the Agent Manager Advanced system configuration and troubleshooting
Configuring Windows Management Instrumentation (WMI) Configuring Windows Remote Management (WinRM) UNIX- and Linux-specific configuration
Monitoring the Agent Manager performance Deploying the Agent Manager to large-scale environments

Configuring the concentrator

This section describes how to configure the concentrator to connect to the upstream target (either the Management Server or another Agent Manager concentrator) and to listen for connections from downstream Agent Manager instances.

A concentrator’s upstream connection is independent of the downstream connections. For example, several Agent Manager instances on a local subnet can communicate to a concentrator using HTTP while the concentrator forwards requests over an non-secure network to the Management Server using HTTPS (or the other way around).

 
* 
CAUTION: Do not set up a concentrator to forward messages to itself or create any kind of loop or cycle. This causes the Agent Manager to indefinitely feeds messages through the loop.
To configure a concentrator to connect to the upstream target:

You can configure the concentrator to connect to the upstream target in different ways:

•
Using HTTP: Set the upstream target of the concentrator in the same way you typically set the Management Server URL:
•
During installation, use the Agent Manager Installation and Configuration interface, command-line interface, or silent installer. See Installing the Agent Manager for more information.
•
After installation, use the Agent Manager configuration interface. See Configuring the Agent Manager for more information.
•
Using HTTPS: To configure a concentrator connection to the Management Server using a secure connection, follow the instructions in Configuring the Agent Manager to use SSL certificates .

Between connections, the Agent Manager collects all upstream and downstream messages in queues. Queuing messages prevents them from getting lost in the event of a disconnection.

When running the Agent Manager as a concentrator, you must increase the default disk cache sizes.

 
* 
CAUTION: Increasing disk cache sizes is an advanced activity that involves custom tuning. The size of cache that you need depends on the number of hosts that connect to the concentrator and the type of load they put on the concentrator. The 1 GB value shown below is an example only.
To configure the size of the disk cache used to store messages:
1
Open the <fglam_home>/state/<state name>/config/fglam.config.xml file for editing.
2
Locate the <queue-sizes> XML element.
3
Edit the <upstream/> and <downstream/> blocks that appear after the <documentation> block:
•
Change the argument for the max-disk-space attribute in both the <upstream/> and <downstream/> blocks to a value larger than the default setting (1024 KB). For example, to change the default disk cache size to 1 GB, set the max-disk-space attribute in both the <upstream/> and <downstream/> blocks as follows:
max-disk-space="1048576"
The max-disk-space argument sets the amount of disk space (in KB) that can be used to store messages.
4
Save your changes to the fglam.config.xml file.
5
Restart the concentrator.
To configure a concentrator to listen for connections from downstream instances:
 
* 
NOTE: If you want to create a secure connection between the concentrator and downstream Agent Manager instances using HTTPS, follow the instructions in Creating a secure connection with downstream instances .
1
Open the <fglam_home>/state/<state name>/config/fglam.config.xml file for editing.
2
Locate the <http-downstreams> XML element.
3
After the <documentation> block, add an <http-downstream/> child element:
<config:http-downstream port="port_number" [address="network_address"]/>
a
Replace port_number with an available port number. This is the port on which the concentrator listens for connections from downstream Agent Manager instances.
b
Optional. If required, you can also bind the concentrator to single network address. To do so, include the attribute address="network_address" in the http-downstream child element (shown as an optional attribute in Step 3), replacing network_address with the network address where you want the concentrator to receive connections from the downstream instances.
The optional address attribute is useful when a machine has two or more network addresses, and you want the connections to the Management Server to go out from one, and the connections from the downstream instances to come in to another.
4
If required, configure the concentrator to listen for connections on multiple different ports by adding additional <http-downstream/> elements and setting the port number (and, optionally, the network address), as described above.
This is useful in situations where the concentrator machine has multiple network connections, and you want the concentrator to listen on different network connections with different ports. For example, the concentrator listens on network connection 1 with port 8081 and listens on network connection 2 with port 8082.
5
Restart the concentrator.

Configuring downstream Instances

This section describes how to configure the downstream Agent Manager instances to connect to the concentrator.

To configure the downstream instances to connect to the concentrator:
1
Configure downstream instances in the same way you configure any Agent Manager:
•
During installation, use the Agent Manager GUI, command-line, or silent installer. See Installing the Agent Manager for more information.
•
After installation, use the Agent Manager configuration interface. See Configuring the Agent Manager for more information.
2
At the step where you set the URL for Management Server, specify the host name and port for the concentrator instead of the Management Server.
3
If you want the downstream instance to connect to the concentrator using a secure connection, follow the instructions in Creating a secure connection with downstream instances .

Creating a secure connection with downstream instances

The following procedure can be used to create a secure connection between the concentrator and downstream Agent Manager instances using HTTPS.

To create a secure connection between the concentrator and downstream instances:
1
Stop the Agent Manager concentrator.
1
Launch a command shell on the Agent Manager machine, and navigate to the <fglam_home>/jre/<jre_version>/<jre>/bin/ directory.
2
If you do not already have an SSL certificate for the concentrator host, you can create a self-signed certificate by executing the following command on the concentrator machine, where <password> is replaced with your desired password:
keytool -genkeypair -alias fglam -keystore </path/to/fglam.kesytore> -storepass <password>
3
Respond to the prompts from keytool. Only the “first and last name” are required, all other fields can be left blank. The “first and last name” form the common name (CN) for this key pair and this needs to be provided to the Management Server (for reverse polling) or downstream Agent Managers (as the ssl-cert-common-name). You can type anything you want into this field, but the host name is the most common choice. The default value, if left blank, is Unknown.
4
Press Enter to set the key password to the same value as the keystore.
5
Open the file <fglam_home>/state/<state name>/config/fglam.config.xml for editing.
6
Between the existing <http-downstreams> and </http-downstreams> tags, add an <https-downstream/> child element:
<https-downstream key-password=<password> keystore=<path_to_keystore> port=<port_number> [address=<network_address>]/>
Where:
•
<password> is the same password you specified in Step 2 for -storepass. The password is saved in an encrypted form in fglam.config.xml when you restart the Agent Manager.
•
<path_to_keystore> is the path to the Agent Manager keystore.
•
<port_number> is the port number on which you want the concentrator to listen for connections from downstream Agent Manager instances.
•
<network_address> is the network address, to which the concentrator is bound when receiving connections from the downstream instances. This argument is optional. It is useful when a machine has two or more network addresses and you want the connections to the Management Server to go out from one, and the connections from the downstream instances to come in to another.
 
* 
IMPORTANT: Other optional attributes are available for the <https-downstreams> element. See the file fglam.config.xml for details.
7
If required, configure the concentrator to listen for connections on multiple different ports by adding additional <https-downstream/> elements and setting the arguments as described above.
This is useful in situations where the machine on which the concentrator runs has multiple network connections and you want the concentrator to listen on different network connections with different ports. For example, the concentrator listens on network connection 1 with port 8081 and listens on network connection 2 with port 8082.
8
Restart the Agent Manager concentrator.
9
Configure each downstream Agent Manager instance that connects to the Agent Manager concentrator using this secure connection so that:
•
It connects using HTTPS.
•
It accepts self-signed certificates.
•
It accepts a certificate with an unexpected common name (host name), and the common name for the certificate is set to Unknown.
See Configuring Management Server URLs using the installer interface or Configuring Management Server URLs from the command line for information about these parameters, which you can set through the Agent Manager installer or configuration interface.

Excluding SSL ciphers from upstream or downstream Connections

You can exclude SSL cipher suites from both upstream Agent Manager connections (to the Management Server or an Agent Manager concentrator), or downstream connections (as a concentrator).

If you need to exclude one or more ciphers from the SSL encryption used for SSL connections, you can do so using one or more excluded-ssl-cipher elements in the fglam.config.xml file. For example, you may want to exclude lower encryption strength ciphers, or ciphers with security vulnerabilities.

To exclude specific SSL ciphers from an upstream connection:
1
Open the <fglam_home>/state/<state name>/config/fglam.config.xml file for editing.
2
Between the existing <http-upstreams> and </http-upstreams> tags, add an <http-upstream/> child element:
<http-upstream url="https://secure_server_URL:port_number">
<excluded-ssl-cipher name="SSL_RSA_WITH_RC4_128_MD5"/>
<excluded-ssl-cipher name="SSL_RSA_EXPORT_WITH_DES40_CBC_SHA"/>
<excluded-ssl-cipher name="SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA"/>
</http-upstream>
3
Save your changes.
4
Restart the Agent Manager.
To exclude specific SSL ciphers from a downstream connection:
1
Open the <fglam_home>/state/<state name>/config/fglam.config.xml file for editing.
2
Between the existing <http-downstreams> and </http-downstreams> tags, add an <https-downstream/> child element:
<https-downstream port="port_number">
<excluded-ssl-cipher name="SSL_RSA_WITH_RC4_128_MD5"/>
<excluded-ssl-cipher name="SSL_RSA_EXPORT_WITH_DES40_CBC_SHA"/>
<excluded-ssl-cipher name="SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA"/>
</http-downstream>
3
Save your changes.
4
Restart the Agent Manager.
 
* 
NOTE: For a complete list of SSL cipher suite names, consult your vendor-specific JRE documentation.
Verwandte Dokumente

The document was helpful.

Bewertung auswählen

I easily found the information I needed.

Bewertung auswählen