-
Title
In order for the Windows OS collections to work in the Database Agents, WinRM or WMI is required. -
Description
In order for the OS collections to work in the Database Agents with Windows, Windows Management Instrumentation (WMI) or Windows Remote Management (WinRM) is required for remote monitoring access.
-
Cause
Windows Remote Management (WinRM) is the Microsoft® implementation of the Web Services Management Protocol (WSMAN) which is a Simple Object Access Protocol (SOAP) based protocol over HTTP/HTTPS and is used for system management. For more information, visit the MSDN website.WinRM has two authentication mechanisms that are used by the Agent Manager to establish connections:- Negotiate authentication is based on Kerberos authentication, involving tickets/keys obtained from a Key Distribution Center (KDC).
- Basic authentication uses standard HTTP headers to communicate directly with the remote machine.
When the Agent Manager is installed on AIX, Negotiate authentication is not currently supported. In such cases, only Basic authentication can be used.Windows Management Instrumentation (WMI) resides on the top of DCOM.In order for the Agent OS user to have access to the WMI for questioning the OS and Db system metrics, it needs permissions set on DCOM first.By default, Local user on the Local Admin group of the Monitored Host have the required permissions for both DCOM and WMI components.When the OS user used by the Agent is not a member of the Monitored Host Local Admin group, it will require adjusting the permissions on both DCOM and WMI components.The most common case on this is using a Remote User, as a user from the Active Directory.This user is not a member of any of the Local groups in the Monitored host, and will require special attention when it comes to configuration Windows accordingly.WMI uses a standard Windows security descriptor to control access to WMI namespaces. When you connect to WMI, you connect to a specific namespace.We are using the below two namespaces:- ROOT\CIMV2
- ROOT\MSClUSTER
-
Resolution
IMPORTANT: A single Linux Foglight Agent Manager can handle up to 75 Windows agents (either SQL Server agent or Infrastructure agents) using WMI. As a result, the number of Linux Foglight Agent Managers (FglAMs) is determined by the number of Windows agents divided by 75; for example, monitoring 300 Windows agents requires at least four (4) Linux Foglight Agent Managers.This limitation does not apply to Windows Agent Managers. Quest R&D has successfully tested up to 2000 agents using WMI (i.e. 1000 database agents + 1000 WindowsAgents) using a single Windows Agent Manager.If you are monitoring more than 75 agents using on a Linux FglAM, the monitored hosts should be configured to use WinRM.Please consult the latest version of the Foglight Agent Manager User Guide for more details on configured WMI and WinRM to monitor Windows hosts.Enabling WinRM authentication
*** This is the preferred connection method for monitoring Windows Servers ***
The Agent Manager supports Basic and Negotiate WinRM authentication schemes with Windows credentials. The Negotiate authentication scheme is enabled by default in WinRM and is the recommended way to authenticate in most environments.In order to establish connections over Windows Remote Management (WinRM), you must provide a Windows credential. WinRM setup details are available in the Agent Manager documentation. Further details are also here KB 185163.
Instructions for using a quick configuration to set up WinRM without encryption is available in KB 238657.
Note: If you use WinRM basic authentication a local user account is needed, instead of domain user account. But the database OS credential setup is asking for a domain as the database agent expect a user name in this format: domain\user. As no domain is available, please enter the host name of the monitored host in the domain field when configuring the credential.
Please consult the latest version of the Foglight Agent Manager User Guide (available for download from here) for more details on configuring WinRM to monitor Windows hosts.
Firewall Port Openings
WinRM uses a set of default ports for communication. Depending on the WinRM version, the following port numbers are used:
- WinRM 1.1 and earlier: The default HTTP port is 80, and the default HTTPS port is 443.
- WinRM 2.0 and later: The default HTTP port is 5985, and the default HTTPS port is 5986.
KB 185163 details firewall port requirements for WinRM monitoring.
Enabling WMI Connections
To remotely monitor a Windows machine, some Foglight agents require access to the WMI services, and specifically to the WMIConnectionService.
Best practices would be to have a Local Admin user on the Monitored Host to be used by the Agent as its OS user. If the OS user cannot be a member of the Local Admin group, review KB 102431 for details on setting permissions for the Remote User on both DCOM and WMI components.
NOTE: If agent is not able to collect all metrics even after following the steps in KB 102431, the please add the OS user to the local administrator group. The workaround below does not fit for all environments.
Additional information on configuring WMI is available in the latest version of the Foglight Agent Manager User Guide (available for download from here).
Windows registry changes are often necessary on the monitored Windows server for WMI connections from Linux-based FglAMs to be successful.
Firewall Port OpeningsWMI uses RPC which listens on port 135 but then allocates a dynamic port for further communications. A rule must be configured on the Firewall to always allow the TCP port 135 and either the dynamic or static RPC ports.
KB 185163 details firewall port requirements for WMI monitoring.
KB 114559 includes additional details on configuring Windows to use static port for WMI.