Foglight for Infrastructure 5.9.2

This contains platform-specific configuration information for configuring Foglight® for Infrastructure on Windows® when using Windows Management Instrumentation (WMI) or Windows Remote Management (WinRM) for remote monitoring access.


	NOTE: WMI and WinRM are two different mechanisms that monitoring agents can use to establish remote connections. In most scenarios, only one of these mechanisms needs to be configured. The preferred mechanism is WinRM because of WMI scalability limitations.

For more details, see the following topic:

•

Advanced system configuration for WinRM

Even though the local user will now have access to Windows Remote Management (WinRM), not all performance monitoring classes allow non-administrative users to access their instances. Some performance classes will still need advanced configuration for the non-administrative user to be able to perform queries/execute methods on their object instances. To perform the advanced configuration for non-administrative users, make sure to log into the remote machine using the Administrator account.

The advanced configuration for non-administrative users includes the following steps:

Adding a non-administrative user to user groups

Setting WinRM RootSDDL for a non-administrative user

Granting permission to the namespace

Granting permission to the service

Adding a non-administrative user to user groups

The non-administrative users must be added into the Performance Monitor Users group that enables the access to the object instances and the Event Log Readers group that grants the permission for reading event logs.


	NOTE: The non-administrative users should have been added to the Distributed COM Users group by default, which enables the remote connection using Windows Remote Management (WinRM).

To add a non-administrative user to the above user groups:

Run lusrmgr.msc.

From the Local Users and Groups (Local) > Users list, right click the non-administrative user who you want to add, and then click Properties from the context menu.

In the <non-administrative user> Properties dialog box, click Member of.

Click Add.

The Select Groups dialog box appears.

In the Select Groups dialog box, type Performance Monitor Users;Event Log Readers in the Enter the object names to select field, and then click Check Names.

Click OK to return the <non-administrative user> Properties dialog box.

Click OK.

The selected user has been added to both user groups.

Setting WinRM RootSDDL for a non-administrative user

After adding a non-administrative user to the needed user groups, you will see the following result if the user permission is not allowed through SDDL.

winrm enum wmicimv2/Win32_ComputerSystem -u:<non-adminstrtor user>

WSManFault

Message = Access is denied.

Error number: -2147024891 0x80070005

Access is denied.

To grant the WinRM RootSDDL permission to a non-administrative user:

Execute the following command to get the RootSDDL value.

winrm get winrm/config

You will see the following default RootSDDL value.

...

RootSDDL = O:NSG:BAD:P(A;;GA;;;BA)S:P(AU;FA;GA;;;WD)(AU;SA;GWGX;;;WD)

Execute the following command, in order to modify the SDDL permission in DACL Entries and to allow the full control access to the Performance Monitor Users group (which SID is S-1-5-32-558).


	NOTE: The SID of the Performance Monitor Users group will be varied. Change the SID to the actual SID used in your environment, as needed.

winrm set winrm/config/service @{RootSDDL="O:NSG:BAD:P(A;;GA;;;BA)(A;;GA;;;S-1-5-32-558)S:P(AU;FA;GA;;;WD)(AU;SA;GWGX;;;WD)"}

You will see the following RootSDDL value.

RootSDDL = O:NSG:BAD:P(A;;GA;;;BA)(A;;GA;;;S-1-5-32-558)S:P(AU;FA;GA;;;WD)(AU;SA;GWGX;;;WD)

Granting permission to the namespace

After setting WinRM RootSDDL for a non-administrative user, log into the remote machine using the administrative user credentials and execute the following command:

winrm enum wmicimv2/Win32_ComputerSystem -u:<non-adminstrtor user>

You will see the following result, if the non-administrative user does not have the permission to the namespace.

winrm enum wmicimv2/Win32_ComputerSystem -u:<non-adminstrtor user>

Message = The WS-Management service cannot process the request.

The WMI service returned an 'access denied' error.

Error number: -2144108284 0x80338104

The WS-Management service cannot process the request. The WMI service returned an 'access denied' error.

To grant the permission to the namespace for the current non-administrative user:

Run wmimgmt.msc.

The WMI Control (Local) Properties dialog box appears.

Right click WMI Control, and click Properties from the context menu.

Click Security > Root > cimv2, and then click Security.

The Security for ROOT\cimv2 dialog box appears.

Click Add.

The Select Users, Computers, Service Accounts, or Groups dialog box appears.

Type Performance Monitor Users;Event Log Readers in the Enter the object names to select field, and then click Check Names.

Click OK to return the Security for ROOT\cimv2 dialog box.

Selected the added user group, and then grant all permissions for this user group.

Click OK to return the WMI Control (Local) Properties dialog box.

Repeat Step 3 to Step 8 to grant all permissions for Security > Root and Security > Root > mscluster.

Granting permission to the service

Most services data can be collected if the Performance Monitor Users group has been granted the permission to services. If you still fail to collect some service data because of permission issues, on the remote machine, execute the following command where <service_name> is the Service name in the Service Property dialog box:

sc sdshow <service_name>

The permissions of the Built-in Administrator (BA) will appear after executing the above command. Execute the following command to grant the additional permissions, as needed.

sc sdset <service_name>...


	NOTE: Ensure that the Administrators have been granted with sufficient permissions; otherwise you will fail to monitor some services.

The following sample demonstrates how to grant permission to the SCMANAGER service:

Execute the following command:

sc sdshow SCMANAGER

You will see the following result:

D:(A;;CC;;;AU)(A;;CCLCRPRC;;;IU)(A;;CCLCRPRC;;;SU)(A;;CCLCRPWPRC;;;SY)(A;;KA;;;BA)

Add “(A;;CCLCRPRC;;;S-1-5-32-558)” between “D:” and “(A;;CC;;;AU)”, and execute the sc sdset command to grant the permission to the SCMANAGER service. For example, execute the following command:

sc sdset SCMANAGER D:(A;;CCLCRPRC;;;S-1-5-32-558)(A;;CC;;;AU)(A;;CCLCRPRC;;;IU)(A;;CCLCRPRC;;;SU)(A;;CCLCRPWPRC;;;SY)(A;;KA;;;BA)

Reference

Foglight displays monitoring data in views that group, format, and display data. The main types are described below.

Dashboards are top-level views that contain lower-level views. The dashboards supplied with Foglight, as well as those created by users, are accessible from the navigation panel.

Lower-level views in Foglight can be added to dashboards or can be accessed by drilling down from a dashboard. They receive and display data directly from the Management Server or from other views. Some views filter or select data that appears in other views in the same dashboard. Some are tree views with expandable nodes for selecting servers, applications, or data.

For more details, see these topics:

•

Advanced System Configuration

•

Foglight for Infrastructure views

•

Foglight Log Monitor views

•

Rules

•

Metrics

Advanced System Configuration

Even though the local user will now have access to Windows Management Instrumentation (WMI), not all performance monitoring classes allow non-administrative users to access their instances. Some performance classes will still need advanced configuration for the non-administrative user to be able to perform queries/execute methods on their object instances. To perform the advanced configuration for non-administrative users, make sure to log into the remote machine using the Administrator account.

The advanced configuration for non-administrative users includes the following steps:

Adding a non-administrative user to user groups

Setting WinRM RootSDDL for a non-administrative user

Granting permission to the namespace

Granting permission to the service

Adding a non-administrative user to user groups


	NOTE: The non-administrative users should have been added to the Distributed COM Users group by default, which enables the remote connection using Windows Remote Management (WinRM).

To add a non-administrative user to the above user groups:

Run lusrmgr.msc.

From the Local Users and Groups (Local) > Users list, right click the non-administrative user who you want to add, and then click Properties from the context menu.

In the <non-administrative user> Properties dialog box, click Member of.

Click Add.

The Select Groups dialog box appears.

In the Select Groups dialog box, type Performance Monitor Users;Event Log Readers in the Enter the object names to select field, and then click Check Names.

Click OK to return the <non-administrative user> Properties dialog box.

Click OK.

The selected user has been added to both user groups.

Setting WinRM RootSDDL for a non-administrative user

After adding a non-administrative user to the needed user groups, you will see the following result if the user permission is not allowed through SDDL.