Chat now with support
Chat with Support

Foglight Agent Manager 7.1.0 - Foglight Agent Manager Guide

Configuring the embedded Agent Manager Installing external Agent Managers
Understanding how the Agent Manager communicates with the Management Server Deploying the Agent Manager cartridge Downloading the Agent Manager installer Installing the Agent Manager Starting or stopping the Agent Manager process Frequently asked questions
Configuring the Agent Manager Advanced system configuration and troubleshooting
Configuring Windows Management Instrumentation (WMI) Configuring Windows Remote Management (WinRM) UNIX- and Linux-specific configuration
Monitoring the Agent Manager performance Deploying the Agent Manager to large-scale environments

Promoting remote users to administrators on local machines through the Domain Controller

The recommended way of making users the administrators of their local machines is through Active Directory on the domain controller. Using the Domain Controller, you can:

•
Set up local administrators for specific machines in the domain
•
Promote local users to administrators for specific machines in the domain
•
Make domain users administrators of all machines in the domain by adding them to the Domain Admins group
•
Make domain users administrators of specific machines in the domain by adding them to the Domain Admins group
To promote a user to an administrator on a local machine using the Domain Controller:
1
Choose Control Panel > Administrative Tools > Active Directory Users and Computers.
2
In the Active Directory Users and Computers window that appears, in the left pane, under the domain node, click Computers.
3
In the right pane, right-click the machine whose local user you want to promote to an administrator, and choose Manage.
4
In the Computer Management window that appears, choose System Tools > Local Users and Groups.
5
You can now do any of the following:
•
Using the Users node in the right pane, make an existing or a new user an Administrator.
•
Using the Groups node, add an existing user to the Administrators group.

Granting required permissions to individual remote users

When making users the administrators of their local machines is not possible, you can grant required permissions to individual remote users using the following procedures.

To grant DCOM permissions to a user:
1
Add the local user to the "Distributed COM Users" group and the "Performance Monitor Users" group.
2
If the Agent Manager is installed on a UNIX® machine:
a
On the monitored host machine, at the Windows® Run prompt, type DCOMCNFG and press Enter.
b
In the Component Services window that appears, navigate to Component Services > Computers > My Computer.
c
Right-click My Computer and click Properties.
d
In the My Computer Properties dialog box that appears, open the COM Security tab.
e
In the Access Permissions area, click Edit Defaults.
f
In the Access Permission dialog box that appears, add the Distributed COM Users group to the list and grant it all permissions.
g
Click OK to save your changes and close the Access Permission dialog box.
h
In the Launch and Activation Permissions area, click Edit Defaults.
i
In the Launch and Activation Permissions dialog box that appears, add the Distributed COM Users group to the list and grant it all permissions
j
Click OK to save your changes and close the Launch and Activation Permissions dialog box.
k
In the My Computer Properties dialog box, click OK to close it.
l
Close the Component Services window.
To grant minimum WMI permissions to a remote user:
1
On the monitored host machine, right-click My Computer, and navigate to Manage > Services and Applications > WMI Control.
2
Right-click WMI Control and click Properties.
3
In the WMI Control Properties dialog box, open the Security tab.
4
Expand the Root node and select CIMV2, then click Security.
5
In the Security for ROOT\CIMV2 dialog box, add the Distributed COM Users group
6
Grant the required permissions to the remote user by enabling the following check boxes in the Allow column:
•
Execute Methods
•
Enable Account
•
Remote Enable
•
Read Security
7
Click Apply and then click OK.

To add subsequent users, they only need to be added to the two groups, Distributed COM Users and Performance Monitor Users, since these groups are already granted the required permissions.

Even though the local user is now granted access to WMI with the above configuration, not all performance monitoring classes allow non-administrative users to access their instances. Some performance classes need special permission to enable non-administrative users to perform queries or execute methods on their object instances. Some of these queries can fail clearly with an error code (for example, by the Agent Manager service throwing a Java exception), but some of them can fail without returning any data or error codes. Therefore, this setup must be used carefully, as query results can be unpredictable. From the system security perspective, there is still only so much a non-administrative user can do.

WMI access violation and OS connectivity verification failure

Access to WMI is required for both OS verification while creating an agent, and for collecting OS metrics from the monitored host. In some cases, an access violation on the WMI namespace (error 0x00000005) may occur when the agent connectivity verification fails. The access violation error can occur when the permissions or credentials used to access WMI, and specifically the root\cimv2 namespace and Root\MSCluster (if the machine is included in a cluster), are changed or invalid.

In order to view and change namespace security, the user must have Read Security and Edit Security permissions. Administrator accounts have these permissions by default, and can assign them to other users if necessary.

To grant namespace permissions to a user:
1
Log in to the monitored host machine.
2
Right-click My Computer and click Manage.
3
In the Computer Management dialog box that appears, expand the Services and Applications node.
4
Right-click WMI Control, and click Properties.
5
In the WMI Control Properties dialog box that appears, open the Security tab.
6
Expand the Root node and select CIMV2, then click Security.
7
In the Security for ROOT\CIMV2 dialog box that appears, modify or assign permissions as necessary.
 
* 
IMPORTANT: If the user accesses the namespace remotely, you must select the Remote Enable permissions check box.
8
Click OK on each of the dialog boxes to close them.
9
If the machine is part of a cluster, repeat the procedure for the ROOT\MSCluster namespace.
 
* 
NOTE: User permissions set on a namespace apply only to the namespace and not to any sub-namespaces. If the user also needs to access sub-namespaces, you can enable access from the Advanced Security Settings dialog box (accessible by clicking Advanced on the Security for [namespace] dialog box).

WMI and Quota Violation error

In some cases, when the agent queries WMI to collect metrics on the monitored host, the host’s performance may be affected. When this occurs, the agent log includes the message: Quota violation [SWbemServicesEx]. This error stems from WMI rather than the agent, and has been identified by Microsoft® as a known issue in Windows® Server 2003.

To correct this error:
1
Ensure that the following hotfix, available from Microsoft in KB 828653, is applied:
http://support.microsoft.com/kb/828653
2
Restart the WMI service on the monitored host.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating