Foglight for Exchange 5.8.2 - User and Reference Guide


	NOTE: In a federated environment, the administrative tasks and Agents view are available only on the Federated Children and not on the Foglight Federation Master.

Figure 16. Agent Management view

The Agent Management view contains the following information for each configured Exchange agent instance.

Table 10. Agent Management view table
Column	Description
	Use the selection check boxes to select agent instances for activation/deactivation, starting/stopping data collection, editing properties, or removal.
Exchange Server	Displays the name of the servers being monitored by an Exchange agent instance.
Active	Indicates whether the agent instance for an Exchange server is activated. A green check mark in this check box indicates that the agent is active.
Data Collection	Indicates whether the agent instance is currently collecting data. A green check mark in this check box indicates that the agent is collecting data.
Agent Name	Displays the name of the agent instance created for an Exchange server.
Foglight Agent Manager Host	Displays the name of the Foglight Agent Manager Host assigned to each Exchange agent instance.
Alarms	Displays the number of alarms outstanding for a select Exchange agent. Clicking an alarm opens the Alarms for <agent_name> view, which provides more details about these alarms.
Private Properties	Click the Edit icon in this column to update the private agent properties using the Agent Edit wizard. For more information, see Edit private agent properties.
Secondary Properties	Click the Edit icon in this column to open the Shared Properties dialog box and review the properties defined. To enable / disable a powershell cmdlet, select / clear the Monitor check box for that cmdlet.
Download Log	Click the icon in this column to download the agent log.
Agent Version	Displays the agent version. A green check mark icon indicates that the agent version is up to date.

Use the buttons at the top of this list to manage your Exchange agent instances, as described in the following table.

Table 11. Agent Management view toolbar
Button	Description
	Select to launch the Agent Setup wizard to add and configure new Exchange agent instances. For more information, see Add and configure new agents.
	Select to refresh the information displayed in the Agent list. NOTE: Neither the Browser refresh icon nor F5 will refresh the Agent Management list.
	Select to activate the selected agent instance(s).
	Select to deactivate the selected agent instance(s).
	Select to start collecting data on the selected agent instance(s).
	Select to stop collecting data on the selected agent instance(s).
	Select to remove the selected agent instance(s).
	Create and automatically assign credentials for Exchange agents created before version 5.6.6.
	Verify agent configuration. For more information, see Inspect agent prerequisites.
	Search for an Exchange agent using the Search filter.

Add and configure new agents

The Agent Setup wizard guides you through the process of adding and configuring Exchange agent instances on one or more servers.

To add and configure a new agent:

At the top of the Agent Management view, click Add to launch the Agent Setup wizard.

On the Prepare page, carefully read the instructions about the steps that you need to take before proceeding with the wizard.

You can either manually configure your Exchange environment for monitoring, or download and run a script that automatically configures the Exchange servers. To download the script, click Script for configuring the Exchange settings.

When done, click Next.

On the Auto-Discovery or Manual page, indicate if you want to manually configure an agent to monitor a single Exchange server, or search your domain and auto-discover Exchange servers and create one or several agents. Click Next.

•

If you selected Auto-discover, continue with Step 4.

•

If you selected Manual, continue with Step 6.

On the Select the Search Domain page, specify the domain to be used to search for Exchange servers where Exchange agent instances are to be created and activated.

•

Domain: Type the fully qualified name (myDomain.com) of a domain to search for Exchange servers.

•

User Name: Type the user principal name of the account to be used to query Active Directory® on the selected domain.The following formats are accepted for the user principal name: myUser@myDomain.com, myUser, and myDomain.com\myUser.

•

User Password: Enter the password associated with the above user account.

•

Enable SSL For LDAP: Selecting this check box if security LDAP is required.

Click Next.


	NOTE: 1. When selecting Enable SSL For LDAP, import the root certificate of the monitoring domain into both FglAM and Foglight keystore. 2. Ensure that the Subject Alternative Name of the certificate used by LDAP service includes both server FQDN and Domain name. For detailed information on how to import certificate into both FMS and FglAM keystore in FIPS-compliant mode, refer to Managing certificates for FglAM and Managing certificates for FMS in FIPS-compliant mode . For detailed information on how to import certificate into both FMS and FglAM keystore in non-FIPS mode, refer to Managing certificates for FglAM and Managing certificates for FMS in non-FIPS mode .

On the Select Servers page, select one or more Exchange servers that you want to monitor.


	NOTE: All selected servers will use the same user credentials for access.

This page displays the following information about the Exchange servers found on the selected domain:

•

Exchange Server: The name of the Exchange server found on the selected domain.

•

Exchange Agent Exists: Indicates whether an Exchange agent instance has already been created for an Exchange server. A green check mark in this check box indicates that an agent instance is already created to monitor the Exchange server. Servers already monitored by other Exchange agents are unavailable for selection in the list.

Click Next.

On the Configure Agent Properties page, review the Exchange agent properties, and edit them, as necessary.

•

Exchange Server(s): The name of one or more Exchange servers found on the selected domain.

•

Domain Controller: The name of the domain controller found on the selected domain.

•

Communication Protocol: Selects to run the WMI query through DCOM or WinRM.

•

WinRM Port: The WinRM port number on the monitored server. This property only appears if the Communication Protocol is set to WinRM through HTTP or WinRM through HTTPS.


	NOTE: 1. When setting Communication Protocol as WinRM through HTTPs, import the root certificate of the monitoring domain into FglAM keystore. 2. Ensure that the Subject Alternative Name of the certificate used by LDAP service includes both server FQDN and Domain name. For detailed information on how to import certificate into FglAM keystore, refer to Managing certificates for FglAM .

•

LDAP Authentication Mechanism: The authentication scheme used to connect to the LDAP server: Simple (default) or Kerberos.

•

Enable SSL For LDAP: Indicates if the LDAP connection is secure or not (default).


	NOTE: 1. When selecting Enable SSL For LDAP, import the root certificate of the monitoring domain into both FglAM and Foglight keystore. 2. Ensure that the Subject Alternative Name of the certificate used by LDAP service includes both server FQDN and Domain name. For detailed information on how to import certificate into both FMS and FglAM keystore in FIPS-compliant mode, refer to Managing certificates for FglAM and Managing certificates for FMS in FIPS-compliant mode . For detailed information on how to import certificate into both FMS and FglAM keystore in non-FIPS mode, refer to Managing certificates for FglAM and Managing certificates for FMS in non-FIPS mode .

•

Is a Virtual Host?: Indicates if the selected Exchange server runs on a virtual host. If it runs on a physical host, by default the Windows Agent is delegated to collect host metrics

•

Virtual Environment: The type of the virtual environment: VMware or Hyper-V. This property only appears if the selected Exchange server runs on a virtual host.

•

Enable ActiveSync Collection: Indicates if the collection of ActiveSync Top N users is disabled or enabled.

•

IIS Log Folder: The file path to the IIS log on the Exchange Client Access Server.

•

ActiveSync Collection Time: The time when the ActiveSync collection task starts.

•

Top N Users: The number of top N users for which data is submitted to the Management Server.

Click Next.

On the Select the Agent Manager Host page, select the Foglight Agent Manager host to be used for the new Exchange agent instances.

The table displays the following Foglight Agent Manager information (the same information is displayed on the Administration > Agents > Agent Hosts dashboard):

•

Host Name

•

Agent Manager Version

•

OS Type

•

OS Architecture

•

The Exchange Agent Package Deployed column indicates whether the Exchange agent package is already deployed to the Agent Manager host(s). A green check in this column indicates that the Exchange agent package has been deployed.


	NOTE: This value is not aware of a package’s version. Therefore, if you have upgraded the cartridge, you must deploy the new agent package even if this column indicates that the FglAM host already has an agent package.

•

The Windows Agent Package Deployed column indicates whether the Windows agent package is already deployed to the Agent Manager host(s). A green check in this column indicates that the Windows agent package has been deployed. This column is displayed only if the Exchange server runs on a physical host.

Click Next.

On the Assign and Validate Credentials page, review the available credentials, and edit them, as necessary.

•

To create a new credential, click Add host(s) to a new credential.

•

In the Create New Credential and Assign dialog box, create a credential that you want to use to access the monitored resource. Type a new credential name, domain, user name, password, and lockbox, and click Submit.

•

To select an existing credential, click Add host(s) to an existing credential.

•

In the Select Existing Credential dialog box, select an existing credential, and click Submit.

•

To bypass the prerequisites verification, select the Do not check for prerequisites check box.

Click Next.

On the Summary page, review the configuration settings chosen for the new agent, and its prerequisite diagnostics, including:

•

Exchange Agent: The name of the selected Exchange agent instance.

•

Windows Agent: The name of the selected Windows agent instance.

•

Diagnostic Result:


	NOTE: This information is displayed only when the prerequisites are checked in Step 8.

•

Success: The agent instance can connect to the monitored Exchange server and collect data.

•

Error: The agent instance cannot connect to the monitored Exchange server instance and collect data. Click this link to find out what causes this error. Carefully review the information in the popup that appears in order address the problem.

Click Finish.

The Agent Setup wizard closes. The Exchange agent is now added and configured, and appears in the Agent Management view, on the Administration tab.

Edit private agent properties

The Agent Edit wizard guides you through the process of editing private agent properties.

To edit private agent properties:

In the Agent Management view, in the row containing the agent whose properties you want to edit, click the Private Properties column.

In the Agent Edit wizard, on the Configure Agent Properties page, review the Exchange agent properties, and edit them, as necessary.

•

Exchange Server(s): The name of one or more Exchange servers found on the selected domain.

•

Domain Controller: The name of the domain controller found on the selected domain.

•

Communication Protocol: Selects to run the WMI query through DCOM or WinRM.

•

WinRM Port: The WinRM port number on the monitored server. This property only appears if the Communication Protocol is set to WinRM through HTTP or WinRM through HTTPS.


	NOTE: 1. When setting Communication Protocol as WinRM through HTTPs, import the root certificate of the monitoring domain into FglAM keystore. 2. Ensure that the Subject Alternative Name of the certificate used by LDAP service includes both server FQDN and Domain name. For detailed information on how to import certificate into FglAM keystore, refer to Managing certificates for FglAM .

•

LDAP Authentication Mechanism: The authentication scheme used to connect to the LDAP server: Simple (default) or Kerberos.

•

Enable SSL For LDAP: Indicates if the LDAP connection is secure or not (default).


	NOTE: 1. When selecting Enable SSL For LDAP, import the root certificate of the monitoring domain into both FglAM and Foglight keystore. 2. Ensure that the Subject Alternative Name of the certificate used by LDAP service includes both server FQDN and Domain name. For detailed information on how to import certificate into both FMS and FglAM keystore in FIPS-compliant mode, refer to Managing certificates for FglAM and Managing certificates for FMS in FIPS-compliant mode . For detailed information on how to import certificate into both FMS and FglAM keystore in non-FIPS mode, refer to Managing certificates for FglAM and Managing certificates for FMS in non-FIPS mode .

•

Is a Virtual Host?: Indicates if the selected Exchange server runs on a virtual host.

•

Virtual Environment: The type of the virtual environment: VMware or Hyper-V. This property only appears if the selected Exchange server runs on a virtual host.

•

Host Info Provider: Indicates the host metrics collected by the Windows agent or the Exchange agent.

•

Enable ActiveSync Collection: Indicates if the collection of ActiveSync Top N users is disabled or enabled.

•

IIS Log Folder: The file path to the IIS log on the Exchange Client Access Server.

•

ActiveSync Collection Time: The time when the ActiveSync collection task starts.

•

Top N Users: The number of top N users for which data is submitted to the Management Server.

Click Next.

On the Assign and Validate Credentials page, review the available credentials, and edit them, as necessary.

•

To create a new credential, click Add host(s) to a new credential.

•

To select an existing credential, click Add host(s) to an existing credential.

•

In the Select Existing Credential dialog box, select an existing credential, and click Submit.

Click Next.

On the Summary page, review the newly updated configuration settings, then click Finish.

The Agent Edit wizard closes. The private properties are now updated.

Inspect agent prerequisites

If any monitoring agents are unable to collect data or connect to the monitored Exchange servers, you can inspect the underlying cause using the Prerequisites Diagnostic button on the Agent Management toolbar.

To examine agent prerequisites:

In the Agent Management view, select the row containing the agent whose prerequisites you want to examine, and click Prerequisites Diagnostic on the toolbar.

Review the results in the Prerequisites Diagnostic dialog box.

•

Agent Name: The name of the selected Exchange agent instance.

•

Monitored Host: The name of the host on which the monitored Exchange server is running.

•

Diagnostic Result:

•

Success: The agent instance can connect to the monitored Exchange server and collect data.

•

Managing certificates

Syntax Conventions

In order to successfully make use of the Foglight commands in your monitoring environment, review the syntax conventions before getting started. The syntax conventions are as follows:

•

Generic examples follow the UNIX path structure that uses forward slashes '/' to separate directories.

•

Platform-specific examples follow standard platform conventions. For example, UNIX-specific examples use forward slashes ‘/’ as directory delimiters, while Windows examples use backslashes ‘\’.

•

<foglight_home> is a placeholder that represents the path to the Foglight Management Server installation.

•

<foglight_agent_mgr_home> is a placeholder that represents the path to the Foglight Agent Manager installation. This can be the location of the Foglight Agent Manager installation on a monitored host, or the home directory of the Foglight Agent Manager that comes embedded with the Foglight Management Server. For example:

Path to the Foglight Agent Manager installation on a monitored host (Windows):

C:\Quest\Foglight_Agent_Manager

Path to the embedded Foglight Agent Manager installation (Windows):

C:\Quest\Foglight\fglam

•

Unless otherwise specified, Foglight commands are case-sensitive.

Managing certificates for FglAM

Foglight Evolve agents use Foglight Agent Manager (FglAM) to manage certificates for SSL encryption connection.

Prerequisite

All the certificate-related command line options require that FglAM be up and running.

Add a certificate

bin/fglam --add-certificate "user alias 1"=/path/to/certificate/file

•

Validate the certificate and ensure the following:

•

It is not expired.

•

It is an X.509 format.

•

FglAM requires the Base64 format. To verify if the certificate file is encoded with Base64, open the certificate with a notepad and the certificate should be similar to the following example:
-----BEGIN CERTIFICATE-----
XXXXXXXX=
-----END CERTIFICATE-----


	NOTE: If the certificate is not Base64 format, use openssl command to convert the certificate file into a Base64 file. Use either of the following commands depending on the source form: openssl x509 -inform DER -in xxx.cer -out xxx.crt or openssl x509 -inform PEM -in xxx.cer -out xxx.crt

•

The alias is required and is used in the list and delete operations to refer to the certificate. It can be anything.

List installed certificates

bin/fglam --list-certificates

Print out a list of certificates and the aliases that refer to them.

Refer to the example output below:

List of installed certificates:

Alias Certificate Info

----- ----------------

user alias 1 XXXX

Delete a certificate

Remove a certificate referred to by an alias.

bin/fglam --delete-certificate "user alias 1"

A full example for managing certificate for FglAM

•

Add an example certificate into FglAM certificate store

C:\Quest\Foglight\fglam\bin>fglam.exe --add-certificate "Evolve-test"="D:/Evolve-test.crt"

…

2020-02-27 16:31:01.000 INFO [native] Certificate added: Certificate from

D:\Evolve-test.crt added as Evolve-test

•

List the example certificate in the FglAM certificate store

C:\Quest\Foglight\fglam\bin>fglam.exe --list-certificate

•

Delete the example certificate from the FglAM certificate store

C:\Quest\Foglight\fglam\bin>fglam.exe --delete-certificate "Evolve-test"

…

2020-02-27 16:28:21.000 INFO [native] Certificate deleted: Certificate

Evolve-test deleted

Managing certificates for FMS

Use the keytool utility shipped with Foglight to create, import, or export certificates. This utility can be found at: <foglight_home>\jre\bin\keytool.

There are two FMS running modes:

•

None-FIPS (Federal Information Processing Standards) mode

•

FIPS-compliant mode

Managing certificates for FMS in non-FIPS mode

The KeyStore Foglight used under non-FIPS mode is located at: <foglight_home>/jre/lib/security/cacerts (default password: changeit)

Add a certificate

Use the keytool command in FMS JRE located in <foglight>/jre/bin

keytool -import -trustcacerts -alias "<alias>" -file "<certificate path>" -keystore <foglight_home>/jre/lib/security/cacerts -storepass changeit

•

Validate the certificate and ensure the following:

•

It is not expired.

•

It is an X.509 format.

•

Change the following before executing the command:

•

<alias>: The alias is required and is used in the list and delete operations to refer to the certificate. It can be anything.

•

<foglight_home>: The folder path where the Foglight is installed.

•

<certificate path>: Your custom certificate path.

List installed certificates

keytool -list -keystore <foglight_home>/jre/lib/security/cacerts -storepass changeit

Delete a certificate

Remove a certificate referred to by an alias.

keytool -delete -alias <alias> -keystore <foglight_home>/jre/lib/security/cacerts -storepass changeit

A full example for managing certificate for FMS in non-FIPS mode

Add example certificate into FMS Certificate Store in non-FIPS mode

C:\Quest\Foglight\jre\bin> .\keytool.exe -import -trustcacerts -alias fveqaca -file "C:\caca.cer" -keystore C:\Quest\Foglight\jre\lib\security\cacerts -storepass changeit

Owner: CN=CA, DC=ca, DC=local

Issuer: CN=CA, DC=ca, DC=local

Serial number: xxxxxxxxxxx

Valid from: Mon Jun 15 10:56:05 CST 2015 until: Mon Sep 23 14:58:03 CST 2047

Certificate fingerprints:

Trust this certificate? [no]: yes

Certificate was added to keystore

Managing certificates for FMS in FIPS-compliant mode

The KeyStore Foglight used in FIPS-compliant mode is located at: <foglight_home>/config/security/trust.fips.keystore (default password: nitrogen)

Add a certificate in FIPS-compliant mode

Use the keytool command in FMS JRE located in <foglight>/jre/bin.

keytool -import -trustcacerts -alias "<alias>" -file "<certificate path>" -keystore "<Foglight_home>/config/security/trust.fips.keystore" -deststoretype BCFKS -provider org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider -providerpath "<Foglight_home>/server/core/bc-fips.jar" -storepass nitrogen

•

Validate the certificate and ensure the following:

•

It is not expired.

•

It is an X.509 format.

•

Change the following before executing the command

•

<alias>: The alias is required and is used in the list and delete operations to refer to the certificate. It can be anything.

•

<Foglight_home>: The folder path where Foglight is installed.

•

<certificate path>: Your custom certificate path.

List installed certificates

keytool -list -keystore "<Foglight_home>/config/security/trust.fips.keystore" -deststoretype BCFKS -provider org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider -providerpath "<Foglight_home>/server/core/bc-fips.jar" -storepass nitrogen

Prints out a list of certificates and the aliases that refer to them.

Refer to the example output below:

Keystore type: BCFKS

Keystore provider: BCFIPS

Your keystore contains 151 entries

camerfirmachambersignca [jdk], Dec 18, 2019, trustedCertEntry,

Certificate fingerprint (SHA1): 4A:BD:EE:EC:95:0D:35:9C:89:AE:C7:52:A1:2C:5B:29:F6:D6:AA:0C

entrust2048ca [jdk], Dec 18, 2019, trustedCertEntry

…

Delete a certificate

Remove a certificate referred to by an alias.

keytool -delete -alias <alias> -keystore "<Foglight_home>/config/security/trust.fips.keystore" -deststoretype BCFKS -provider org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider -providerpath "<Foglight_home>/server/core/bc-fips.jar" -storepass nitrogen

A full example for managing certificate for FMS in FIPS-compliant mode

Add example certificate into FMS certificate store in FIPS-compliant mode

C:\Quest\Foglight\jre\bin>keytool -import -trustcacerts -alias "Evolve-Test" -file "D:/Evolve-test.crt" -keystore "C:/Quest/Foglight/config/security/trust.fips.keystore" -deststoretype BCFKS -provider org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider -providerpath "C:/Quest/Foglight/server/core/bc-fips.jar" -storepass nitrogen

Owner: CN=CA, DC=ca, DC=local

Issuer: CN=CA, DC=ca, DC=local

Serial number: xxxx

Valid from: Sun Jan 06 23:07:06 CST 2019 until: Wed Apr 06 23:07:06 CST 2022

Certificate fingerprints:

...

Extensions:

...

Trust this certificate? [no]: yes

Certificate was added to keystore

Exchange agent properties

The primary properties for an Exchange agent instance are required to connect to the target server from which data is to be collected. These properties are either specified when the agent instance is configured or they have a pre-defined default value.

To display an agent’s properties page, use one of the following methods:

•

From the navigation panel, navigate to Dashboards > Administration > Agents > Agent Properties. On the Agent Properties dashboard, select an agent. The Properties panel is displayed, showing the current properties for the selected agent instance.

•

From the navigation panel, navigate to Dashboards > Administration > Agents > Agent Status. On the Agent Status dashboard, select an agent from the list and click Edit > Edit Properties. The Agent Status dashboard refreshes, showing the current properties for the selected agent instance.

Figure 17. Exchange agent properties

For more information on using the Agent Status dashboard to edit agent properties, see the Foglight Administration and Configuration Help.

The following tables describe the properties that can be modified for either an individual or all Exchange agent instances, by clicking Modify the private properties for this agent or Modify the properties of all ExchangeAgent agents links, respectively.

•

Configuration

•

Monitor

•

Data Collection Scheduler


	NOTE: It is recommended to configure the agent properties that are to be applied globally to the majority of the Exchange agent instances, then modify the private properties of those individual agents, as required.

Configuration

Use the properties in the Configuration panel to specify the target server from which data is to be collected, to define what cartridge is to be used to collect the host metrics, and specify whether the target server is a virtual machine.


	NOTE: The properties defined here apply to either a single Exchange agent or all agents with the type of ExchangeAgent based on the option selected in the Property Scope area at the top of the Agent Status dashboard.

Table 12. Configuration panel

The fully qualified domain name (myServer.myDomain.com) of the target server from which data is to be collected.

Domain Controller Name

N/A

The fully qualified domain name (myServer.myDomain.com) of a domain controller, in the same domain where the Exchange server(s) reside. This domain controller is used to capture Active Directory® related information which Exchange is dependant upon.

NOTE: This prerequisite must be met on this domain controller not just the Exchange server.

Host Collector

The host metrics (CPU, Memory, Network, Storage) displayed in Foglight for Exchange can be collected by the Foglight for Exchange, Foglight for Hyper-V, Foglight for VMware, or Foglight for Infrastructure cartridge.

NOTE: If you have Foglight for Hyper-V or Foglight for VMware cartridge installed, it is best to select the corresponding option and use the metrics collected by that cartridge.
If you are collecting host metrics on a virtual machine using the Exchange cartridge, performance counters may be subject to known inconsistencies because in-guest performance counters can be skewed by virtualization. To collect the most accurate host metrics on a virtual machine, use the Foglight for VMware or Foglight for Hyper-V cartridge to collect these metrics.

Select the host collector to be used to collect host metrics:

•

Exchange (included) - if selected, all host collections are collected based on the interval set in the collection schedule.

•

Hyper-V (must be installed) - if selected, the logical disk space metrics are collected based on the interval set in the collection schedule; all other host metrics are collected based on the settings in the Foglight for Hyper-V cartridge. The “Memory In Use” is not available and will be blank in this configuration.

•

VMware (must be installed) - if selected, the host collections are skipped regardless of the value in the collection schedule. That is, all host collections are collected based on the settings in the Foglight for VMware cartridge.

•

Infrastructure (must be installed) - if selected, the host collections are skipped regardless of the value in the collection schedule. That is, all host collections are collected based on the settings in the Foglight for Infrastructure cartridge.

Communication Protocol

DCOM

Selects to run the WMI query through DCOM, WinRM Through HTTP, or WinRM Through HTTPS.

WinRM Port

5985

Determines the WinRM port number in the monitored server.

Enable SSL For LDAP

False

Enables/ disables security LDAP connection.

LDAP Authentication Scheme

Basic

Supports both Basic and Kerberos authentication schemes, when connected to LDAP server.