Foglight 5.9.1 - Administration and Configuration Guide

This dashboard is a starting point when creating credentials. Credentials are stored in lockboxes. Ensure that you have the appropriate lockboxes in place before creating credentials. The dashboard displays a list of all lockboxes that are defined on the server, in addition to the System lockbox that is included with the Management Server. This lockbox is not password-protected. Its contents are accessible to all clients in your system. The System lockbox is only intended for use with some agent types, and it is always available for selection in the flow for adding credentials initiated from the Manage Credentials dashboard. For that reason, any purpose-specific wizards included with cartridges whose agents do not support the System lockbox do not provide this lockbox as an option when creating credentials.

•

Default: This lockbox is password-protected. The default password is foglight. Consider changing this password after the installation to protect its contents.

Use the Manage Lockboxes dashboard to view a list of lockboxes that exist in your system, to create and delete lockboxes, to change their password, and to release them to credential clients.

By default, the following columns are displayed:

•

Selection column: Check boxes for selecting lockboxes. A selected lockbox can be removed by clicking the Delete button.

•

Alarms: The total counts of outstanding credential alarms, broken down by alarm types (Fatal, Critical, and Warning).

•

Name: The lockbox name.

•

Credential Count: The number of credentials contained in the lockbox.

•

Credential Clients: Lists the clients to which this lockbox is released. This column is populated only if the check box Show lockboxes currently assigned to each client is selected on the View Clients dashboard. For more information, see Explore the View Clients dashboard.

•

Actions

•

Add or Remove Password:

Click

to add a password to a lockbox that is not password-protected.

Click

to remove a password associated with a password-protected lockbox.

•

Change Password: Click to change the lockbox’s password. For more information, see Change the password for a lockbox.

•

Release to Credential Clients: Click to release the lockbox. For more information, see Release lockboxes to credential clients.

Use the Add button to add a lockbox to the existing collection.

To delete a lockbox, In the left-most column in the list, select the check boxes for one or more lockboxes, then click Delete.

For more information, see Add or delete lockboxes.

Add or delete lockboxes

A lockbox contains one or more credentials, can be password-protected, and can be released to credential clients. If a lockbox is password-protected, you must know the password in order to release the lockbox to a client.

Typically you need one lockbox per client. In case your business scenario requires different encryption keys for different credentials, or managing user access through password control, it is possible to define multiple lockboxes for an individual client.

Delete lockboxes that are no longer needed. Deleting a lockbox deletes all credentials contained in the lockbox. It causes the clients using these credentials to receive a delete notification and stop using those credentials for authentication.

To add a lockbox:

On the Manage Lockboxes dashboard, click Add.

In the New Lockbox dialog box, in the Name box, type a unique name for the lockbox. For example, My Production Server Access.

Secure the lockbox with a password. Lockboxes that are secured with a password can only be released to clients or have their passwords changed by those users who know the password.

Select the Secure using a password check box.

In the Password and Confirm Password boxes, type the lockbox password.

Click Add.

The New Lockbox dialog box closes and the Manage Lockboxes dashboard refreshes, showing the newly created lockbox in the list.

To delete a lockbox:

On the Manage Lockboxes dashboard, select the check box in the row containing the lockbox that you want to delete.

Click Delete.

In the Confirm Deleting Lockboxes dialog box, click Confirm.

The Confirm Deleting Lockboxes dialog box closes.

Observe the Manage Lockboxes dashboard. The newly deleted lockbox no longer appears in the list.

Add or remove lockbox passwords

Lockboxes can be password-protected. Associating passwords with lockboxes enforces access control, allowing only authorized users to release lockboxes to credential clients. Removing a lockbox password enables any user to access the credentials stored in the lockbox.

To add a password to a lockbox that is not secured:

On the Manage Lockboxes dashboard, in the row containing the lockbox that you want to secure with a password, click

In the Add Password To Lockbox dialog box, type the new password in the New Password and Confirm New Password boxes.

Click Confirm.

The Add Password To Lockbox dialog box closes and the Manage Lockboxes dashboard refreshes, showing the

button in the Add or Remove Password column, indicating that a lockbox password is added and can be removed.

To remove a password from a secured lockbox:

On the Manage Lockboxes dashboard, in the row containing the lockbox whse password you want to remove, click

In the Remove Password of Lockbox dialog box, type the existing lockbox password in the Lockbox Password box.

Click Confirm.

The Remove Password of Lockbox dialog box closes and the Manage Lockboxes dashboard refreshes, showing the

button in the Add or Remove Password column, indicating that a lockbox password no longer exists and can be added.

Change the password for a lockbox

Lockboxes can be password-protected. Associating passwords with lockboxes enforces access control, allowing only authorized users to release lockboxes to respective credential clients.

To change a lockbox password:

On the Manage Lockboxes dashboard, in the row containing the lockbox whose password you want to change, click

In the Change Password of Lockbox dialog box, type the current password in the Old Password box, and the new password in the New Password and Confirm New Password boxes.

Click Confirm.

The Change Password of Lockbox dialog box closes, indicating success.

Release lockboxes to credential clients

A lockbox contains a set of credentials and keys for their encryption and decryption. Credentials are released to credential clients unencrypted. When a lockbox is released to a credential client, the client passes the credential information to its agents. The agents use this information to establish connection with target resources.


	CAUTION: Any agents that have access to a credential client with a released lockbox can potentially query and obtain credential information stored within that lockbox.

To release a lockbox to a credential client:

On the Manage Lockboxes dashboard, in the row containing the lockbox that you want to release to a credential client, click

The Release Lockbox to Credential Clients dialog box opens.

If the lockbox is password-protected, in the Release Lockbox to Credential Clients dialog box, type the lockbox password and select one or more credential clients for lockbox release.


	NOTE: The password box appears only if the selected lockbox is password-protected.

Click Release.

The Release Lockbox to Credential Clients dialog box closes, indicating success.

Optional — Ensure the Credential Clients column is populated.

Using the breadcrumb trail, return to the Credentials home page, and navigate to the View Clients dashboard.

On the View Clients dashboard, ensure that the Show lockboxes currently assigned to each client check box is selected.

Return to the Credentials home page.

Return to the Manage Lockboxes dashboard.

Refresh the web browser.

On the Manage Lockboxes dashboard, observe the Credential Clients column of the newly released lockbox entry. The column lists the credential clients to which the lockbox is assigned.

Manage Credentials

Explore the Manage Credentials dashboard

This dashboard lists the available lockboxes, the credentials associated with them, and the related information. It allows you to add new and edit existing credentials. Credentials are stored in lockboxes. Lockboxes can be created beforehand, or during the process of creating credentials.

Credential information consists of a name, type, policies, and resource mappings. The credential name uniquely identifies the credential. A range of different types allows you to choose a credential type that suits your organization’s security requirements. A credential type can consist of a user name, password, Windows domain, no input, or the available combinations of these parameters.

A credential can have none, one, or multiple policies. A credential policy defines the number of times a credential can be used, the number of allowed authentication failures, the time range during which the credential is valid, or the length of time the credential data can be cached on the client.

Resource mappings identify secured resources. The mappings typically contain a combination of literal expressions, regular expressions, or an IP address range.

By default, the following columns are displayed:

•

Selection column: Check boxes for selecting lockbox entries. The selected lockbox can be removed by clicking the Delete button.

•

Edit: Click to edit a credential’s name, properties, resource mappings, or policies.

For complete information, see the following topics:

•

Edit credential properties

•

Edit credential names

•

Edit credential resource mappings

•

Edit credential policies

•

Lockbox: The name of the lockbox where the credential is defined.

•

Name: The name of the credential.

•

Alarms: The total counts of outstanding credential alarms, broken down by alarm types (Fatal, Critical, and Warning).

•

Valid Until: The date and time at which the credential expires.

•

Relative Order: The order in which credentials are returned to credential clients.

•

Type: Shows the credential type. The following credential types are available:

•

Challenge Response: Uses one or more challenge and response pairs to grant access without requiring any interaction in the browser interface. The answers are sent by the agent and are part of the agent configuration. Use this type for SSH keyboard-interactive credentials.

•

Domain, User Name, and Password (Windows): Requires a user name and password to access a monitored resource. The domain name is optional.

•

DSA Key: Uses the Digital Signature Algorithm (DSA) Key for authentication.

•

RSA Key: Uses the RSA (Rivest, Shamir and Adleman) Key for authentication.

•

Use Client’s Login At Connection Time: Uses the currently logged in user’s account to access secured resources. This is not the user currently logged into the Management Server, but the user under which the credential client is running. For example, a credential provided to a Foglight Agent Manager instance launched by a user on a remote machine, causes the connection to the secured resource to be made using this user’s identity.

•

User Name: Requires a user name to access a monitored resource.

•

User Name and Password: Requires a user name and password to access a monitored resource.

•

Resource Mappings: Lists one or more resource mapping expressions associated with the credential.

To edit the resource mappings, click the icon in this column. For more information, see Edit credential resource mappings.

•

Policies: Lists the policies associated with the credential. Hovering over this column displays a dwell that shows you this information in tabular form.

To edit the policies, click in this column. For more information, see Edit credential policies.

Next Steps:

•

To select the type of the credential you want to add, click Add.

•

To select and delete credential entries, select the check boxes in the Name column. For more information, see Add or delete credentials.

•

To look for specific credentials in your current collection using a set of specific search criteria, click Query Credential.


	TIP: You can only query credentials if there are one or more credentials defined in your system, otherwise the Query Credential button appears disabled.

•

To change the relative order in which credentials are granted to the client, click the Reorder button.


	TIP: You can only reorder credentials if there are two or more credentials defined in your system, otherwise the Reorder button appears disabled.

A lower order value places a credential higher in the list. For example, if you have two credentials, one with operator-level privileges and one with administrative privileges that grants access to a wider range of resources, to retrieve the credential with administrative privileges, ensure that credential has a lower order value than the one with operator-level privileges. For more information, see Change the order of credentials.

Add or delete credentials

Credentials are stored in lockboxes. Lockboxes can be created beforehand, or during the process of creating credentials.

Credentials are released to credential clients unencrypted. If the agent uses a standard connection mechanism supported by the Foglight Agent Manager such as WinShell, WMI, or SSH, when a lockbox is released to the Agent Manager, the Agent Manager establishes a connection with the monitored resource, and passes the connection to the agent. If the agent uses a different connection mechanism, the client passes the credential information to the agent. The agent uses this information to establish a connection with secured resources.


	CAUTION: Any agents that have access to a credential client with a released lockbox can potentially query and obtain credential information stored within that lockbox.

When creating a new credential you have an option to start from a blank credential or copy an existing credential. Credential type, policies, and resource mappings are all preserved and copied over to the new credential. Unlike credential name, policies, and resource mappings, once defined, credential types cannot be changed. Copying an existing credential is useful in situations when you need to quickly create a slightly modified version of the existing credential. For example, if your organization enforces periodic password changes, when this happens, simply copy the credential and change its password.

Credentials that are no longer in use can be deleted.

To create a new credential:

On the Manage Credentials dashboard, click Add.

Select the credential type in the menu.

The following credential types are available:

•

Domain, User Name, and Password (Windows): Requires a user name and password to access a monitored resource. The domain name is optional.

•

DSA Key: Uses the Digital Signature Algorithm (DSA) Key for authentication.

•

RSA Key: Uses the RSA (Rivest, Shamir and Adleman) Key for authentication.

•

User Name: Requires a user name to access a monitored resource.

•

User Name and Password: Requires a user name and password to access a monitored resource.

The credential type depends on the agent that will use the credential to access the monitored resource. For example, some agents support the use of the Use Client’s Login At Connection Time and User Name and Password credential types, while others can only accept the Challenge Response or User Name types. A selected credential type dictates the type and structure of resource mappings associated with a credential. Resource mappings identify the parts of the monitored system that selected agents can access based on their credentials. For example, the User Name and Password credential type, that requires a valid user name and password pair to access a monitored system, can have one or more resource mappings for accessing Unix-based targets based on a condition that evaluates the target port number. Similarly, a credential of the Use Client’s Login At Connection Time type does not require any authentication information, and can have a resource mapping that selects a group of hosts based on their user name. For details about credential types required by specific agents, see the respective cartridge documentation.

The workflow for creating a credential starts in a dialog box that appears. The workflow consists of several pages, each representing a step in the wizard. The workflow allows you to move between the steps using the Previous and Next buttons. The steps are listed on the left, and the current step is highlighted.

For most credential types, the workflow starts with the Credential Properties page open. For other credential types, the workflow can start with a different page.

Click Next.

Editing credential properties. On the Credential Properties page, specify the authentication properties based on the credential type selected in Step 2, and click Next.

The layout of this page depends on the selected credential type. For example, creating a credential of the Domain, User Name, and Password (Windows) type requires the domain name, user name, and password.

If you selected Domain, User Name, and Password (Windows) as the credential type, type the domain name, user name and password that you want to associate with this credential using the Domain, User Name, Password, and Confirm Password boxes.

For more information, see Edit credential policies.

Editing the credential name and lockbox.

On the Credential Name And Lockbox page, provide a unique name for the credential that you are about to create.

Select the lockbox where you want to store the credential from the Select A Lockbox list. Choose from the existing lockboxes (like the System lockbox), or create a new one, if required.


	NOTE: The System lockbox is only intended for use with some agent types, and it is always available for selection in the flow for adding credentials initiated from the Manage Credentials dashboard. For that reason, any purpose-specific wizards included with cartridges whose agents do not support the System lockbox do not provide this lockbox as an option when creating credentials.

To create a new lockbox, click Add. In the New Lockbox dialog box that appears, type the lockbox name and, optionally, secure it with a password, then click Add.

Click Next.

Indicate if you want un-encrypted credential data to be accessible by clients using the Unencrypted Credential Data Accessible to Clients check box.

Mapping monitored resources. On the Resource Mapping page, specify the resources that you want to monitor with the agent that will use this credential.

To add a resource mapping, click Add and specify the resource mapping using the New Resource Mapping Condition dialog box that appears.

For instructions, see Step 3 in To add a resource mapping: .

To copy resource mappings from an existing credential, click Copy.


	NOTE: You can only copy resource mappings from credentials of the same type.

The Select the Credential To Copy Resource Mapping From dialog box opens.

•

If the credential does not have any resource mappings in place, to copy resource mappings from an existing credential, select the credential in the list, and click Add.

•

If the credential already has resource mappings in place, to copy resource mappings from an existing credential without deleting the existing resource mappings in the target credential, select the credential in the list, and click Add.

•

If the credential already has resource mappings in place, to replace them with the resource mappings defined in an existing credential, select the credential in the list, and click Replace.

On the Resource Mapping page, click Next.

Editing policies. On the Policies page, add one or more authentication policies to the credential.

To add a policy, click Add and select a policy type from the menu that appears.


	NOTE: There can only be one policy defined for each policy type.

Provide additional information required by the selected policy type. For instructions, see Step 3 To add a policy: .

For complete instructions, see Edit credential policies .

To copy policies from an existing credential, click Copy.


	NOTE: You can copy policies from any credentials from any credentials that have policies defined regardless of their credential type.

The Select the Credential To Copy Policies From dialog box opens.

•

If the credential does not have any policies in place, to copy policies from an existing credential, select the credential in the list, and click Add.

•

If the credential already has policies in place, to copy policies from an existing credential without deleting the existing policies in the target credential, select the credential in the list, and click Add.

•

If the credential already has policies in place, to replace them with the policies defined in an existing credential, select the credential in the list, and click Replace.

On the Policies page, click Finish.

The Manage Credentials dashboard refreshes, showing the newly-created credential in the list.

To copy an existing credential:

On the Manage Credentials dashboard, locate the lockbox where you want to create a credential and click Add.

A menu appears.

Click Copy From An Existing Credential.

The Select An Existing Credential To Copy From dialog box opens.

Select the credential you want to copy and click Confirm.

The Select An Existing Credential To Copy From dialog box closes and another dialog box opens, allowing you to edit the credential.

Credential type, policies, and resource mappings are all preserved and copied over to the new credential.

Type a unique name for the credential in the Name box.

Select the lockbox where you want to store the credential.

•

To choose from existing lockboxes, click the Lockbox box and select a lockbox from the list that appears.

•

To create a new lockbox, click Add a New Lockbox, and in the New Lockbox dialog box that appears, type the name and password, then click Add.

Indicate if you want un-encrypted credential data to be accessible by clients by using the Unencrypted Credential Data Accessible to Clients check box.

At the bottom of this dialog box, specify the authentication data based on the credential type selected in the original credential. For example, if you selected User Name and Password as the credential type, type the user name and password required to associate with this credential using the User Name, Password, and Confirm Password boxes.

Click Next to specify the credential policies and resource mappings, or click Finish to exit the flow. Add additional information including credentials policies and resource mapping at a later time, if required.

For details about the next steps in the flow, see Edit credential policies and Edit credential resource mappings .

To delete a credential:

On the Manage Credentials dashboard, select the check box in the row containing the credential that you want to delete.

Click Delete.

In the Confirm Deleting Credentials dialog box, click Confirm.

The Confirm Deleting Credentials dialog box closes.

Observe the Manage Credentials dashboard.

The newly deleted credential no longer appears in the list.

Edit credential properties

Credential properties contain authentication data needed to access monitored resources. Each credential type has a unique set of authentication properties.

Table 10. Credential types and their associated properties.
Credential Type	Credential Property	Property Description
Challenge Response	User Name	The user name of the account accessing the monitored resource.
Challenge Response	Challenge/Response pairs	Question/answer pairs that are sent and received by the agent.
Domain, User Name, and Password (Windows)	Domain	The domain the user account belongs to. This property is optional.
	User Name	The user name of the account accessing the monitored resource.
	Password	The password associated with the user account.
DSA Key	Private Key	The private key of the DSA key.
	Pass Phrase	The pass phrase for the DSA key. This property is only requried if the private DSA key is generated using a pass phrase.
	User Name	The user name of the account accessing the monitored resource.
RSA Key	Private Key	The private key of the RSA key.
	Pass Phrase	The pass phrase for the RSA key. This property is only requried if the private RSA key is generated using a pass phrase.
	User Name	The user name of the account accessing the monitored resource.
Use Client's Login At Connection Time	N/A
User Name	User Name	The user name of the account accessing the monitored resource.
User Name and Password	User Name	The user name of the account accessing the monitored resource.
User Name and Password	Password	The password associated with the user account.

To edit credential properties:

On the Manage Credentials dashboard, in the row containing the credential whose name you want to edit, click

A menu appears. The options in the menu represent the components that are defined for the selected credential type. For example, editing a credential of the Domain, User Name, and Password (Windows) type shows Credential Data, Credential Name, Resource Mappings, and Policies in the menu, while a credential of the Use Client’s Login At Connection Time only includes Credential Name, Resource Mappings, and Policies.

Click Credential Properties in the menu.

The Update Credential Properties dialog box opens.

In the Update Credential Properties dialog box, edit the credential properties, as required.

Click Save.

Edit credential names

Credential names are specified during creation. They can be changed at a later time, if required.

To edit a credential name:

On the Manage Credentials dashboard, in the row containing the credential whose name you want to edit, click

Click Credential Name in the menu.

In the Update Credential Name dialog box, in the Name box, type the new name.

Click Save.

Observe the Manage Credentials dashboard.

The Name column of the credential entry shows the newly updated name.

Edit credential policies

A credential can have none, one, or multiple policies. The policy type defines the number of times a credential can be used, the number of allowed authentication failures, the time range during which the credential is valid, or the length of time the credential data can be cached on the client.

Policies can be specified during credential creation or at a later time. You can delete existing policies, add new policies, or edit existing policies. When editing an existing policy, you can only change the settings associated with the policy type, but cannot change the actual type.

To add a policy:

On the Manage Credentials dashboard, in the row containing the credential to which you want to add a new policy, click


	IMPORTANT: There can only be one policy per policy type.

Click Policies in the menu.

The Update Policies of Credential dialog box opens.

Adding new policies.

Click Add in the Update Policies of Credential dialog box.

Select a policy type from the menu.

•

Use Count: The maximum number of times the credential can be used, successfully or unsuccessfully, by a selected client.

•

Failure Rate: The maximum number of authentication failures allowed over a specific time period.

•

Validity Window: The time period during which the credential can or cannot be used.

•

Cache Time: The time period during which the credential data is cached on the credential client, without requesting it from the Management Server.

A dialog box opens. The type and range of the available settings depend on the selected policy type.

Provide additional information required by the selected policy type. For example, if you selected Use Count in Step b, you need to provide the maximum number of times the credential can be used.

Click Add.

The dialog box containing the policy settings closes, and the Update Policies of Credential dialog box refreshes, showing the newly added value in the list.

Copying policies from an existing credential. You can copy credential policies from any credential type.


	IMPORTANT: You can copy policies from any credentials that have policies defined regardless of their credential type. This button appears enabled only if there are credentials with policy types that are different than the ones already defined for this credential.

Click Copy in the Update Policies of Credential dialog box.

The Select the Credential To Copy Policies From dialog box opens.

If the credential does not have any policies in place, to copy policies from an existing credential, select the credential in the list, and click Add.

If the credential already has policies in place, to replace them with the policies defined in an existing credential, select the credential in the list, and click Replace.

The Select the Credential To Copy Policies From dialog box closes and the Update Policies of Credential dialog box refreshes, showing the newly added value in the list.

To delete a policy:

On the Manage Credentials dashboard, in the row containing the credential whose policy you want to delete, click

Click Policies in the menu.

The Update Policies of Credential dialog box opens.

Select a policy in the list and click Delete.

The list of policies refreshes, no longer showing the newly deleted policy.

To edit an existing policy:

On the Manage Credentials dashboard, in the row containing the credential whose policy you want to delete, click

Click Policies in the menu.

The Update Policies of Credential dialog box opens.

In the Update Policies of Credential dialog box, in the row containing the policy that you want to edit, click

A dialog box opens. Its title and layout depend on the policy type selection.

Edit the policy settings as required.

The type and range of the available settings depend on the policy type. For example, if the policy is of the Cache Time type, you need to provide the maximum amount time during which the credential is cached on the Management Server.

More information about each required value is provided in the dialog box.

Click Save.

The dialog box containing the policy settings closes, and the Update Policies of Credential dialog box refreshes, showing the newly edited policy in the Details column.

Edit credential resource mappings

Resource mappings identify the parts of the monitored system that can be accessed using the credentials in which they are defined. A credential can have one or more resource mappings that include or exclude specific sets of targets. Resource mappings are combined using the logical OR operator. A resource mapping can have one or more conditions, combined using the logical AND operator. Each resource mapping uses a set of predefined building blocks to identify the monitored targets. For example, you can have a credential with multiple resource mappings (one for each usage, for example, if multiple usages exist in the credential type), and each resource mapping can have one or more resource mapping conditions to select secured resources. You can further refine the mapping, if required.

Figure 46. Updating the resource mappings for a selected credential.

The type and structure of resource mappings depend on the selected credential type, which in turn depends on the range of installed cartridges. Some cartridges, for example, support the Use Client’s Login At Connection Time and User Name and Password credential types, while others can only accept the Challenge Response or User Name types. A Domain, User Name, and Password (Windows) credential type, for example, that requires a valid domain name, user name, and password to access a monitored system, can have one or more resource mappings for accessing Windows-based systems based on a condition that evaluates the target host name.

•

Usage: Defines the type of the system that is mapped. For example: OS Monitoring by WMI.


	TIP: Different cartridges support different types of credentials, and each credential type can have one or more usage definitions. Depending on the type and range of installed cartridges, you can have different or additional usages available. For more information, see the respective cartridge documentation.

•

Access Resources Using: Identifies the resource component that is evaluated by the resource mapping. For example: Target Host Name, Target Host Address, Target Port, or Is Local Host. Other options may be available.


	TIP: Different cartridge support different types of usages. The usage determines the way the resources are accessed. Depending on the type and range of installed cartridges, you can have different or additional ways for accessing resources. For more information, see the respective cartridge documentation.

•

Equal or Not Equal: Indicates if the targets selected by the matching expression should be included or excluded from the mapping. For example, you can create one resource mapping to select a group of hosts and another to exclude a different set of hosts.

•

Matching Type: Specifies the condition type. For example, conditions can contain regular expressions or domain names.


	TIP: Regular expressions support case insensitive matching when the (?i) flag is used. For example, (?i)host1.example.* returns Host1.example and host1.example.com as matches. Regular expressions run through the JRE Pattern class that supports case insensitivity. For syntax information and usage tips, visit http://rd-www.prod.quest.corp/static/sun_docs/jdk-1_6_0/docs/api/java/util/regex/Pattern.html.

•

Evaluate This Condition: Indicates if the condition is used during the credential matching.

•

Matching Values: One or more expressions that are used to scope on the target resource. For example, you can create an expression that defines a host name. Multiple matched values are combined with the logical OR operator, meaning that if one expression evaluates to True, the resource is mapped even though another expression may evaluate to False.

The selections available with each building block in a resource mapping depend on the resource mapping’s Usage type, which in turn depends on the selected credential type and the range of installed cartridges. The selections mentioned above do not reflect the values available with all of the cartridges that support credentials. For information about the available credential types supported by a specific cartridge and the related resource mappings and their building blocks, refer to the cartridge documentation.

Resource Mapping with IPv6 addresses

When using IPv6 addresses in Credential Mappings it is preferable to use IP Range or CIDR matchers. Since an IPv6 address can have more than one textual representation using String or RegEx matches may lead to confusing server behaviour.

To add a resource mapping:

On the Manage Credentials dashboard, in the row containing the credential where you want to add a new resource mapping, click

Click Resource Mappings in the menu.

The Update Resource Mapping of Credential dialog box opens.

Adding resource mappings.

In the Update Resource Mapping of Credential dialog box, click Add.

The New Resource Mapping Condition dialog box opens.

Select the usage type of this resource mapping.

Click Usage and choose from the available selections. For example, OS Monitoring by WMI. Other options may be available.


	NOTE: Different cartridges support different types of credentials, and each credential type can have one or more usage definitions. Depending on the type and range of installed cartridges, you can have different credential usages available. For more information, see the respective cartridge documentation.

Select the specific resource component that you want to evaluate.

Click Access Resources Using and choose from the available selections. For example, if you selected OS Monitoring by WMI in Step b, you have the option of selecting Target Host Name, Target Host Address, or Is Local Host. Other options may be available for other usage types.


	NOTE: Different cartridges support different types of usages. The usage determines which resource component can be evaluated. Depending on the type and range of installed cartridges, you can have different or additional ways for accessing resources. For more information, see the respective cartridge documentation.

Indicate if the targets selected by the matching expression should be included or excluded from the mapping.

•

equals: Select this option to select the resources the credential can access.

•

does not equal: Use this option to select the resources the credential cannot access.

Select the condition type.

Click Matching Type and choose from the available selections. For example, if you selected Target Host Name in Step c, you have the option of selecting Domain Name or Regular Expression. Other options may be available when evaluating other types of resource components.


	NOTE: The range and type of the matching types depend on the resource component selected for evaluation, which in turn depends on the range of installed cartridges. For additional information about the matching types available with a specific cartridge, see the respective cartridge documentation.

Select or clear Evaluate This Condition.

Click

and write a matching expression in the box that appears available for selection.


	TIP: Regular expressions support case-insensitive matching when the (?i) flag is used. For example, (?i)host1.example.* returns Host1.example and host1.example.com as matches. Regular expressions run through the JRE Pattern class that supports case insensitivity. For syntax information and usage tips, visit http://rd-www.prod.quest.corp/static/sun_docs/jdk-1_6_0/docs/api/java/util/regex/Pattern.html.

You can specify multiple conditions, if requried. During the evaluation, Foglight combines them using the logical OR operator.

Click Add.

The New Resource Mapping Condition dialog box closes and the Update Resource Mapping of Credential dialog box refreshes, showing the newly added mapping condition.

Copying resource mappings from an existing credential.


	NOTE: You can only copy resource mappings from credentials of the same type.

In the Update Resource Mapping of Credential dialog box, click Copy.

The Select the Credential To Copy Resource Mapping From dialog box opens.

If the credential does not have any resource mappings in place, to copy resource mappings from an existing credential, select the credential in the list, and click Add.

If the credential already has resource mappings in place, to replace them with the resource mappings defined in an existing credential, select the credential in the list, and click Replace.

The Select the Credential To Copy Resource Mapping From dialog box closes and the Update Resource Mapping of Credential dialog box refreshes, showing the newly added mapping condition.

To edit a resource mapping:

On the Manage Credentials dashboard, in the row containing the credential whose resource mapping you want to edit, click

Click Resource Mappings in the menu.

The Update Resource Mapping of Credential dialog box opens.

To add a condition to an existing resource mapping, in the row containing the resource mapping, click

and specify the new condition in the New Resource Mapping Condition dialog box that appears.

For detailed instructions, see Step c through Step g in To add a resource mapping:.

To edit an existing resource mapping condition, in the row containing the resource mapping, click

and edit the condition in the Edit Resource Mapping Condition dialog box that appears.

For detailed instructions, see Step c through Step g, starting on page 161.

To delete a resource mapping:

On the Manage Credentials dashboard, in the row containing the credential whose resource mapping you want to delete, click

Click Resource Mappings in the menu.

The Update Resource Mapping of Credential dialog box opens.

To delete a resource mapping, in the row containing the resource mapping, click Remove.

The Confirm Deleting Resource Mapping dialog box opens.

Click Confirm.

The Confirm Deleting Resource Mapping dialog box closes and the Update Resource Mapping of Credential dialog box refreshes, no longer showing the newly deleted entry.

Change the order of credentials

When a credential client retrieves a set credentials, the credentials are listed in their relative order. For example, a credential with the order of 100 has operator-level privileges, while another one with the order of 200 has administrative privileges that grants access to a far wider range of resources. Given the order values, any queries that return both credentials retrieve the operator-level credentials first. If you need to retrieve the credential with administrative access first, you can do so by simply changing the relative order of both credentials.


	TIP: You can only reorder credentials if there are two or more credentials defined in your system, otherwise the Reorder button appears disabled.

To reorder credentials:

On the Manage Credentials dashboard, click Reorder.

The Reorder Credentials dialog box opens.

Change the order of credentials.

•

To move one credential up or down, use the

buttons in the Move Up and Move Down columns, as required.

•

To move multiple credentials, select the rows containing the credentials that you want to move, and use the

buttons in the Move In Front Of and Move Behind columns, as required.

Click Confirm to close the Reorder Credentials dialog box.

The Manage Credentials dashboard refreshes, showing the new order.

Query credentials

Credential queries help you retrieve credentials using different criteria, such as the target host, a host on which a monitoring agent is running, a credential type, lockboxes to which the credentials belong, and custom properties. You can quickly find out if you can associate existing credentials with monitoring agents rather than create new ones.


	TIP: You can only query credentials if there are one or more credentials defined in your system, otherwise the Query Credential button appears disabled.

To test a credential query:

On the Manage Credentials dashboard, click Query Credential.

The Query Credential dialog box opens.

In the Query Credential dialog box, specify the criteria as required.

For example, to look for a credential that can be used to access a specific host using a Domain, User Name, and Password (Windows) credential, in the Query Credential dialog box, type the target host name under Target Host. In the Credential Types table, select Domain, User Name, and Password (Windows).

Click Execute.

The Query Credentials dialog box closes and the query results are displayed.

Monitor Alarms

Explore the Monitor Credential Alarms dashboard

Credential clients generate alarms when certain pre-defined conditions are met. These errors typically happen when a client attempts to access a resource and encounters a policy-related problem. The Monitor Credential Alarms dashboard lists all alarms generated by the existing credential clients and provides additional information about each event. The list includes any alarms generated by the Catalyst Credential Check rule and Credential events generated by the Foglight Agent Manager.

Credential alarms also appear on the main Alarms dashboard, together with other Foglight alarms, while the Monitor Credential Alarms dashboard only lists the alarm generated due to a credential-related condition. Use it to quickly review and manage credential alarms.

For complete information about alarms in Foglight, see the Foglight User Help.

By default, the Monitor Credential Alarms dashboard displays the following columns:

•

Sev: The alarm severity: Warning

, Critical

, or Fatal

•

Time: The date and time at which the alarm is generated.

•

Ack’ed: Indicates whether the alarm was acknowledged by the operator: Yes or No.

To acknowledge the alarms, select one or more alarms in the list and click Acknowledge.


	TIP: Use the Select All or Unselect All buttons to quickly select all alarms, or to clear your selection, as required:

For more information, see Acknowledging credential alarms.

•

Cleared: Indicates whether the alarm was cleared: Yes or No.

Selecting one or more alarms in the list and clicking Clear allows you to clear the selected alarms.

For more information, see Clearing credential alarms.

•

Instance: The topology object instance against which the alarm is raised.

•

Message: The alarm message.

•

Origin: The event that caused the alarm to fire.

To filter the list of alarms, click Alarm Filter in the top right and provide the desired settings.

To view the Credential Alarm dialog box, click any column.

Use this dialog box to find out more about the problem that caused the alarm. From here, click the Diagnostic link to access the part of the browser interface that you can use to further investigate the problem.


	NOTE: When the Catalyst Credential Check rule generates a credential alarm, the Diagnostics link is disabled. This rule is not associated with any of the query parameters; therefore, they are not applicable.

In a federated environment, Federated Child alarms can be viewed on the Federated Child servers using the above approach. While credentials cannot be administered from the Federation Master, it is possible to view Federated Child alarms from the Alarms dashboard on the Federation Master.

Figure 47. Viewing alarms from Federated Children on the Federation Master Alarms dashboard.

The Credential Alarm dialog box that appears shows a smaller subset of information, containing only the alarm message and the name of the Federated Child server. To retrieve complete information about this alarm, log in to the Federated Child server, navigate to the Monitor Credential Alarms dashboard, and drill down on the alarm to display the common version of the Credential Alarm dialog box.

For complete information about alarms in Foglight, see the Foglight User Help.

Credential events generated by the Foglight Agent Manager

Foglight Agent Manager generates credential events based on actions that occur during the processing of credential requests. These events result in the creation of credential alarms of the appropriate severity. The following principles apply:

•

Information events result in the Normal alarm severity, which means that no alarms are generated.

•

Warning events produce Warning alarms.

•

Critical events produce Critical alarms.

•

Error events produce Fatal alarms.

•

If an alarm is related to an unsuccessful connection, if a connection is established, all of the related alarms are cleared.

Table 11. A list of the credential events that are generated by the Agent Manager.
Alarm Severity	Description	Event Code	Event Severity
Normal	A connection to the remote host is established.	connection.success	Information
Normal	NOTE: Information events result in the Normal alarm state which does not result in alarm generation.
(Warning)	The Agent Manager attempts to establish a connection, but no credentials were retrieved by the credential query.	connection.nocredentials	Warning
(Warning)	Attempt is made to authenticate a connection through the CleartextCredentialService with a credential that is not granted direct access rights.	direct.access.not.assigned	Warning
(Warning)	A lockbox that is associated with a credential is not granted to the Agent Manager Host.	lockbox.not.granted	Warning
(Fatal)	The credential used to establish a connection fails to authenticate access to the remote resource.	authentication.failure	Error
(Fatal)	A connection to the remote host cannot be established using the retrieved credential.	connection.failure	Error
(Fatal)	The Agent Manager cannot process the retrieved credential.	creation.failed	Error
(Fatal)	The request to delete an assigned lockbox failed.	lockbox.not.deleted	Error
(Fatal)	A credential cannot be used due to a policy violation.	policy.violation	Error

Acknowledging credential alarms

Acknowledging a credential alarm informs other users looking at credential alarms that the alarm is raised due to a known situation. When an alarm is acknowledged, this setting cannot be reverted.

To acknowledge an alarm:

On the Monitor Credential Alarms dashboard, in the row containing the alarm that you want to acknowledge, select the check box in the left-most column.

Click Acknowledge.

The Acknowledging Alarms progress box appears, indicating that the alarm is being acknowledged.

The Acknowledging Alarms progress box closes, and the Monitor Credential Alarms dashboard refreshes, showing Yes in the Ack’ed column.

Clearing credential alarms

In most cases, Foglight clears alarms when the condition that triggered them changes. You can delete certain types of alarms that do not clear themselves if they are no longer relevant.

If the condition that triggered a credential alarm changes, you can manually clear the alarm. For example, a credential alarm fires when an agent fails to connect to a monitored host due to a wrong password. Creating a new credential with the correct password and releasing the new credential to the appropriate credential client remedies the problem, and you can choose to delete the alarm because it is no longer relevant.

When an alarm is cleared, this setting cannot be reverted. You can see a list of cleared alarms using the alarm filter.

To clear an alarm:

On the Monitor Credential Alarms dashboard, in the row containing the alarm that you want to clear, select the check box in the left-most column.

Click Clear.

The Clearing Alarms progress box appears, indicating that the alarm is being acknowledged.

After a few moments, the Clearing Alarms progress box closes, and the Monitor Credential Alarms dashboard refreshes, no longer showing the newly cleared alarm.

View Clients

Explore the View Clients dashboard

The View Clients dashboard lists all credential clients that are registered with the Management Server and provides additional information about each client.

By default, the following columns are displayed:

•

Alarms: The numbers of Fatal, Critical, and Warning alarms generated against each client, color-coded to indicate the severity.

•

Name: The name of the credential client.

•

Client Type: The credential client type. For example, FglAM (Foglight Agent Manager).

•

Assigned Lockboxes: The name of the lockbox released to the credential client.

•

Host: The name of the monitored host on which the client is running.

Selecting the check box Show lockboxes currently assigned to each client causes the Credential Client column on the Manage Lockboxes dashboard to be populated. For more information about the Manage Lockboxes dashboard, see Explore the Manage Lockboxes dashboard .


	CAUTION: If you have a large number of credential clients, enabling this option causes an increase in resource consumption.

Please select your product:

To serve you better, please complete the Purpose of your Chat:

Recommended Solutions for Your Problem

Foglight 5.9.1 - Administration and Configuration Guide

Manage Lockboxes

Manage Credentials

Monitor Alarms

View Clients