Foglight Agent Manager 5.9.3 - Foglight Agent Manager Guide


	NOTE: All of the command-line options that you can specify when starting the Agent Manager installer also work with the --configure option that is used to launch the Agent Manager Installation and Configuration interface.

To launch the Agent Manager Installation and Configuration interface:

If you are running multiple instances of the Agent Manager from one installation directory, ensure that no other instances are running from the same directory as the instance you want to configure.

Stop the Agent Manager instance you want to configure.

Run the Agent Manager from the command-line with the --configure option:

<fglam_home>/bin/fglam --configure


	IMPORTANT: On Windows 7 and Vista, it is recommended to run the command fglam ‑‑configure from an administrator version of cmd.exe or PowerShell (not just logged in as administrator) if you installed the Agent Manager as administrator.

The Agent Manager Installation and Configuration dialog box appears.

Review the information in the Introduction step, and click Next.

The Host Display Name step appears. For more information, see Installing the Agent Manager using the installer interface.

In the Host Display Name step, set the desired options, if applicable, and click Next.

The Update Client ID step appears. This step allows you to reset the unique identifier assigned to this Agent Manager. Change the Agent Manager ID if you discover that its ID is the same as another Agent Manager’s ID.


	IMPORTANT: Do not reset the Agent manager ID unless Quest Support instructs you to do that.

If Quest Support instructs you to reset the unique ID assigned to this Agent Manager instance, select the Yes, reset this client’s ID check box. Otherwise, ensure that the check box is clear.

Click Next.

The Server URLs step appears.

Continue to navigate through the remaining steps and set the desired options, as prompted. Use the Next and Previous buttons to navigate through the steps. The remaining steps are the same as in the Agent Manager installer interface. For more information, see Installing the Agent Manager using the installer interface.

When you navigate to the Summary step, click Finish.

Restart the Agent Manager instance in the desired mode. For information about the available modes, see Starting or stopping the Agent Manager process .

Configuring the Agent Manager from the command line

If you are running multiple instances of the Agent Manager from one installation directory, before you begin, ensure that no other instances are running from the same directory as the instance that you want to configure.

To launch the Agent Manager configuration command-line interface:

Stop the Agent Manager instance that you want to configure.

Launch a command shell on the Agent Manager machine, and navigate to the <fglam_home>/bin directory.

Issue the following command:

fglam --configure ‑‑headless


	NOTE: If you want to install Agent Manager as a Windows service, or as a Unix deamon, the configuration interface appears with pre-selected options, indicating that the Agent Manager will start immediately after the installation. You can force these options to appear disabled by default (and enable them, if required, during the installation), if you start the fglam command with the --no-start-on-exit option: fglam --configure ‑‑headless --no-start-on-exit For more information about these options in the installation interface, see Step 7: Install init.d Script (Unix) and Step 9: Windows Service .

The AuthToken step appears.

Review the information provided in this step. If you do not want to make any changes to the auth-token, press Enter.

A message appears while the configuration interface starts. When the configuration interface finishes loading, the Introduction step appears.

Review the information in the Introduction step, and press Enter.

The Host Display Name step appears. For more information, see Installing the Agent Manager from the command line.

In the Host Display Name step, set the desired options, if applicable, and press Enter.

The Update Client ID step appears. This step allows you to reset the unique identifier assigned to this Agent Manager if you discover that this Agent Manager is using the same identifier as another Agent Manager.


	IMPORTANT: Do not reset the Agent manager ID unless Quest Support instructs you to do that.

If Quest Support instructs you to reset the unique ID assigned to this Agent Manager instance, type Y at the prompt and press Enter.

Otherwise, accept the default option (N), and press Enter.

The Server URLs step appears.

Continue to navigate through the remaining steps and set the desired options, as prompted. The steps are the same as in the Agent Manager installer interface. For more information, see Installing the Agent Manager from the command line.

When you navigate to the Summary step, press Enter.

Restart the Agent Manager instance in the desired mode. See Starting or stopping the Agent Manager process for information about the different modes in which you can run the Agent Manager.

Configuring the Agent Manager to use SSL certificates

You can configure the Agent Manager to communicate with the Management Server using an HTTPS connection.

You can set this option either while installing the Agent Manager, or after installation. See Installing the Agent Manager , or Configuring the Agent Manager , for more information about configuring the Agent Manager to connect to the Management Server using HTTPS.

By default, Foglight® ships with a self-signed SSL certificate. If you configure the Management Server to use an SSL certificate signed by a third-party Certificate Authority (CA), whose root certificate is already included in the JRE used by the Agent Manager, you do not need to add a new CA to the Agent Manager keystore. Instead, ensure that the Agent Manager connects to the Management Server using HTTPS.


	NOTE: If the root certificate for the third-party CA is not included in the JRE, follow the instructions in To add a new CA to the Agent Manager certificate store: .

You must add a new CA to the JRE used by the Agent Manager if:

•

You want the Agent Manager to communicate with the Management Server using an HTTPS connection.

and

•

The Management Server uses an SSL certificate signed by a private CA. This certificate must be checked for a valid signer.

The Agent Manager includes command-line options for managing certificates in the Agent Manager keystore.

You add a new CA by importing a new root certificate for the CA into the certificate store used by the Agent Manager, as described below.

To check if a third-party CA is included in the JRE:

Launch a command shell on the Agent Manager machine, and navigate to the <fglam_home>/jre/1.8.0.72/jre/bin directory.

Issue the following command:

keytool --keystore ..\path\cacerts -storepass changeit -list | findstr

<3rd_party_signer>

For example:

keytool --keystore ..\lib\security\cacerts -storepass changeit -list | findstr

godaddy

godaddyclass2ca, Jan 20, 2005, trustedCertEntry,

godaddyrootg2ca, Jul 18, 2014, trustedCertEntry,

To add a new CA to the Agent Manager certificate store:

Launch a command shell on the Agent Manager machine, and navigate to the <fglam_home>/bin directory.

Import a new root certificate for a CA that you want to add. To do that, issue the following command:

fglam --add-certificate <alias=/path/to/certificate>


	IMPORTANT: The certificate file that you import should be the public certificate for the CA that signed the SSL certificate, not the SSL certificate itself.

Stop the Agent Manager.

Configure the Agent Manager to connect to the Management Server using HTTPS without allowing self-signed certificates (since the certificate from the server is no longer considered signed by a private CA).

Run the Agent Manager configuration interface. See Configuring the Agent Manager , Configuring Management Server URLs using the installer interface , or Configuring Management Server URLs from the command line .

Configure the Agent Manager to connect to the Management Server using HTTPS.

If you are using the Agent Manager Installation and Configuration interface, select the Connect using HTTPS check box.

If you are using the command-line version of the configuration interface, set the start of the url parameter to https (for example, url=https://server1.example.com:8443).

Change the setting for self-signed certificates so that they are not allowed.

If you are using the Agent Manager Installation and Configuration interface, clear the Allow self-signed certificates check box.

If you are using the command-line version of the configuration interface, set ssl-allow-self-signed to false.

Restart the Agent Manager.

If this Agent Manager is a concentrator and you want the Agent Manager instances that connect to it to use HTTPS, follow the instructions in To create a secure connection between the concentrator and downstream instances: .

Configuring an Agent Manager instance as a Concentrator

A concentrator is an Agent Manager instance that functions similarly to an HTTP proxy. Configure it to accept connections from other Agent Manager instances (called downstream instances) and forward these connections to an upstream target, either the Management Server or another Agent Manager concentrator.


	NOTE: Concentrator ports can also be configured to optimize transmission of control messages from the Management Server to the Agent Manager. For more information, see Understanding how the Agent Manager communicates with the Management Server..

Figure 1. A simple Agent Manager concentrator configuration

You can configure one or more Agent Manager instances to act as a concentrator in situations where:

•

You do not want the Agent Manager instances on your monitored hosts to connect directly to the Management Server—for example, if you have a large number of Agent Manager instances running in your monitored environment and you want to reduce the number of connections to the Management Server.


	IMPORTANT: Using a concentrator reduces the number of connections to the Management Server, not the volume of data sent to the Management Server.

•

The Management Server is not co-located with the monitored hosts and you want to make only a single connection from the remote hosts to the Management Server—for example, if your Management Server is in Sydney and your monitored hosts are in Vancouver, and you only want to make one transpacific connection.

•

The Agent Manager instances cannot connect directly to the Management Server (as in the example below).

Example:

Your firewall configuration does not allow the Agent Manager instances on your monitored hosts to connect directly to the Management Server (running on ManagementServerHost). However, there is an intermediate host in your environment (IntermediateHost) that can accept connections from your monitored hosts and also communicate with the Management Server.

To allow connections from your monitored hosts to be forwarded to the Management Server, you install an Agent Manager instance on IntermediateHost and configure it as a concentrator:

While installing the instance on IntermediateHost (using the GUI installer), you specify the host name and port (ManagementServerHost and 8080) of the Management Server to which you want this concentrator to connect in the Configure Server URLs step.

When the installation is complete, you ensure that the instance is shut down and configure it as a concentrator by editing its fglam.config.xml file so that it listens for connections from downstream instances on a specified port (8081).

You restart the Agent Manager instance on IntermediateHost. This instance is now configured as a concentrator: it listens for connections from downstream instances on port 8081 and forwards data to the Management Server on port 8080.

Now that the concentrator is set up on IntermediateHost, you configure the Agent Manager instances on the monitored hosts to connect to the concentrator:

After stopping these Agent Manager instances, you run the Agent Manager configuration interface for each instance.

In the configuration interface, you specify the concentrator’s host name and the port on which it is listening (IntermediateHost and 8081) when setting the URL to which the instances connect.

Once the instances are re-configured to connect to the concentrator, you restart them.

The Agent Manager instances on the monitored hosts can now connect to the Management Server through the concentrator. You can also perform agent management tasks from the Management Server, such as deploying agent packages to the monitored hosts and creating new agent instances on them. There is no indication that the downstream instances are not connected directly to the Management Server.