Return
-
Title
Cannot access db2diag.log, SQL Server error log, or Oracle listener or alert log on Windows (A command shell connection could not be established) -
Description
The DB2 db2diag.log, Oracle alert log, or SQL Server error log cannot be accessed on Windows servers.
The following error appears in the database agent log files when trying to do OS collections:
ECHO ERROR [MyAgent-lowPriorityPool-4-[DBO_Usability]] com.quest.qsi.fason.oracle.collection.processor.DBOInstanceProcessor - Failed to run DBOListenerControlProcessor processor of DBO_Usability collection of MyAgent instance.java.lang.RuntimeException: Failed to execute collection [DBO_Usability], reason=A command shell connection could not be established- Profile:FglAM Connection Profile {Host = MyHost, Agent = MyAgent}"or:ECHO ERROR [MyAgent-lowPriorityPool-2-[DBO_Alert_Log]] com.quest.qsi.fason.oracle.collection.processor.DBOInstanceProcessor - Failed to run DBOReadAlertLogProcessor processor of DBO_Alert_Log collection of MyAgent instance.java.lang.RuntimeException: Failed to execute collection [DBO_Alert_Log], reason=A command shell connection could not be established- Profile:FglAM Connection Profile {Host = MyHost, Agent = MyAgent} -
Cause
A WMI or WinRM connection requires additional permissions on a Windows Operating System (OS) to be able to read Oracle Alert Log, SQL Server error log (using an OS connection) or a DB2 db2diag.log log file. -
Resolution
Please see update at the end of the resolution before making changes.
The Operating System (OS) user needs FULL CONTROL privileges on the following registry keys to access the db2diag.log on Windows.- 76A6415B-CB41-11d1-8B02-00600806D9B6
- 76a64158-cb41-11d1-8b02-00600806d9b6
- 72C24DD5-D70A-438B-8A42-98424B88AFB8
- 0D43FE01-F093-11CF-8940-00A0C9054228
Please follow the steps in this document or KB 4229811 for steps on setting permissions on the Windows registry for Winshell access.
UPDATE
Microsoft disabled SMBv1 by default since Windows Server 2019 which disallows our agents to configure WinShell. WinShell over DCOM can still be used if permissions are setup manually or through a script run locally on the monitored server.
More details and script can be found on KB article WMI over DCOM on servers with SMB 1.0 disabled (4294210).