Converse agora com nosso suporte
Chat com o suporte

Foglight for Infrastructure 7.1.0 - Foglight for Web Monitor User and Reference Guide

Monitoring Web transactions Exploring your collection of monitored Web sites Investigating the performance of Web transactions and monitoring locations Exploring Web Monitor services Generating reports Configuring Web Monitor agent properties View reference
Web Monitor Performance Browser views Web Monitor Transaction Management views Web Monitor Service Operation Console and Foglight for APM Transactions views

Monitoring HTTPs URLs in FIPS-compliant mode

Foglight Web Monitor agent supports to run in FIPS-compliant mode, depending on the Agent Manager where it is deployed on. That is to say if the Agent Manager runs in FIPS-compliant mode, the Web Monitor agent will be configured to be FIPS-compliant automatically, and vice versa.

When Foglight Web Monitor agent runs in FIPS-compliant mode, and tries to access a Web site with HTTPs connection, the Web Monitor agent requires to authenticate the Web site's certificate. In order to successfully access these URLs and collect response time metrics, you need to import the Web site's certificates to Agent Manager's certificate store.

To import the Web site's certificate to the Agent Manager certificate store:

1
Launch a command shell on the Agent Manager machine, and navigate to the <fglam_home>/bin directory.
2
Import the Web site's certificate with the following command:
fglam --add-certificate <alias=/path/to/certificate>
For example:
fglam --add-certificate your_alias_name=C:\Certificates\test\ServerSSL.cer

Monitoring URLs that require a client certificate

Monitoring URLs that require client authentication requires some additional configuration. To successfully access these URLs with the Web Monitoring Agent and collect response time metrics, you must import the certificates for URLs.

To support the monitoring of URLs that require a client certificate:

1
Deploy the WebMonitor Agent to the Foglight Agent Manager.
2
Open the command line and switch to the following path:
{fglam_home}/agents/WebMonitorAgent/{version}/lib
3
Run this command to import the client certificate for some URLs:
For Windows®:
importKeystore.bat "-keystore {filepath} -pwd {password} -urls {ip}:{port} -createKeyStoreFile true"
For Linux®:
./importKeystore.sh "-keystore {filepath} -pwd {password} -urls {ip}:{port} -createKeyStoreFile true"
For example:
importKeystore.bat "-keystore D:\echen5\issue\ESC\ESC-1784\sha1\Sha1ClientCert.pfx -pwd Test1234 -urls 10.154.10.168:443 10.154.10.168:6443 -createKeyStoreFile true"
 
* 
NOTE: Ensure you have read and write rights for the following path: {fglam_home}/state/default/certificates
NOTE: The tool for importing the client authentication depends on the JRE being used. Ensure that the JRE exists in one of the following locations:
•
When Fglam is external, the JRE should be found in {fglam_home}.
•
When the Fglam is embedded, the JRE should be found in {foglight_home}.
•
When the JRE is neither in {fglam_home} nor {foglight_home}, the path to the JRE should be found in the environment variable JAVA_HOME.

The Microsoft® Internet Information Server (IIS) by default enables the TLSv1 and disables the TLSv1.2 protocols. The JDK 1.7+ (included in Foglight Agent Manager 5.7.4 and later) by default handles handshake with TLSv1.2. If the server side and the client side do not include the same supported TLS version, this causes the HTTPs request to fail. The following workarounds are available in this case:

•
Workaround #1
1
Force the client side to handle handshake with TLSv1, by setting the “Force TLSv1” agent property to “True” (for details, see Settings).
2
Ensure that all the Web server whose URLs your are monitoring support TLSv1.
•
Workaround #2
1
Enable TLSv1.2 for your IIS server. (Refer to the best practice to configure IIS with SSL/TLS.)
2
Set the “Force TLSv1” agent property to “False” (for details, see Settings).
3
If your IIS server enabled TLSv1.2 and disable TLSv1, and you use sha512 certificates, then make sure you applied the following update to your server: https://support.microsoft.com/en-us/kb/2973337.
Documentos relacionados

The document was helpful.

Selecione a classificação

I easily found the information I needed.

Selecione a classificação