Foglight for Infrastructure 5.9.5

On this tab, the Categories pane contains several question groups. Selecting a category shows the questions belonging to that category in the Questions pane. From there, clicking a question shows the answer on the right.

Figure 50. Finding answers

Monitoring a partition or VIOS with Foglight for Infrastructure

If you want to monitor a VIOS or a partition with Foglight for Infrastructure, you can quickly create a Host agent. Foglight for PowerVM allows you to monitor the health of the system infrastructure associated with a monitored VIOS or a partition. For complete information about host agents, see Using Foglight for Infrastructure agents.

To create a Host agent to monitor a VIOS or a partition system infrastructure:

On the Infrastructure Environment dashboard, ensure that the PowerVM service is selected, and open the FAQts tab.

Select a VIOS or a partition that you want to monitor with Foglight for Infrastructure.

•

To select a VIOS:

On the FAQts tab, in the Categories pane, select VIOS or All Questions.

In the Questions pane, select Which VIOS are not monitored by Host Agent.

In the Which VIOS are not monitored by Host Agent pane, select a VIOS, and click Add VIOS Hosts Monitoring.

•

To select a partition:

On the FAQts tab, in the Categories pane, select Partition or All Questions.

In the Questions pane, select Which partitions are not monitored by Host Agent.

In the Which partitions are not monitored by Host Agent pane, select a partition, and click Add Partition Hosts Monitoring.

The Add LPAR Host - List wizard appears.

In the Add LPAR Host - List wizard, on the Agent Manager page, select the Agent Manager that you want to associate with the Host agent you are about to create.

Click Agent Manager and select the Agent Manager host that you want to use to associate with the Host agent. The list includes only the Foglight Agent Managers to which the Foglight for Infrastructure agent package is already deployed.

Ensure that the Virtual / Guest check box is cleared.


	NOTE: Ability to monitor virtual hosts is currently implemented only in Foglight for Virtualization, Enterprise Edition. For information about how to configure a virtual agent, refer to the Foglight for Virtualization, Enterprise Edition documentation.

Click Next.

The Add LPAR Host - List wizard refreshes, showing the Host List page.

In the Add LPAR Host - List wizard, on the Host List page, review the list of VIOS or partition instances that you selected for monitoring.

By default, the VIOS or partition name is used as a host name. If you want to display one or more of these components under a different name in the browser interface and reports, click the Host Name Override column, and type a new name when prompted.

Click Next.

The wizard checks if the Agent Manager has any credentials configured for the selected components, and displays the results on the Credential Verification page.

On the Credentials Verification page, select one of the following options:

•

Do not configure a credential: Select this option if you want to configure the credential for this component at a later time. Click Next and continue to Step 8.

•

Add host(s) to a new credential: Select this option if you want to create a new credential for this component. This option is suitable if none of the existing credentials have the connection details needed to access the new host. Click Next and continue to Step 6.

•

Add host(s) to an existing credential: Select this option if you want the Host agent to use an existing credential to access this component. This option is suitable if an existing credential has the security data needed to access this component (such as user name and password), but you need to edit its resource mappings to include this component. Click Next and continue to Step 7.

•

For complete information about Foglight credentials, see the Administration and Configuration Help.

Create a new credential.

On the Credential Type page that appears, select the desired credential type.

On the Credential Type page, click Next.

The Credential Properties page appears.

On the Credential Properties page, provide the required information. The level of required data depends on the selected credential type. For example, a User Name and Password credential needs a user name and a password, while a Challenge Response credential requires a user name along with a question/response pair.

On the Credential Properties page, click Next.

The Credential Name and Lockbox page appears.

On the Credential Name and Lockbox page, provide a name to identify the credential, and select a lockbox in which you want to keep the credential. A lockbox can be used to group credentials for access and/or security. The default System lockbox is sufficient for smaller installations.


	NOTE: If a lockbox is password protected and is not released to the Agent Manager, you can provide the lockbox password on the last page of the wizard.

On the Credential Name and Lockbox page, click Next.

The Resource Mapping page appears.

On the Resource Mapping page, ensure that the VIOS or partition components that you want to associate with this credential are selected.

On the Resource Mapping page, click Next.

The Policies page appears.

Optional—On the Policies page, define one or more policies for this credential. A policy defines the number of times a credential can be used, the number of allowed authentication failures, the time range during which the credential is valid, or the length of time the credential data can be cached on the client. For example, you can specify the number of times the credential can be used, or the time period during which it can be used. For complete information about the available credential policies, see the Administration and Configuration Help.

On the Policies page, click Next. Continue to Step 8.

Select an existing credential.

On the Credential page that appears, select an existing credential that you want the Host agent to use to access this component.

On the Credential page, click Next.

The Resource Mapping page appears.

On the Resource Mapping page, ensure that the VIOS or partition components that you want to associate with this credential are selected.

On the Resource Mapping page, click Next. Continue to Step 8.

On the Summary page that appears, review the information about the monitored component, selected Agent Manager, and the credential.

Click Finish.

After a few moments, a new host appears on the Hosts dashboard and a new instance of the monitoring Host agent is created. The Agent Creation Successful dialog box appears. Review the information in this dialog box.

Advanced system configuration and troubleshooting

This contains platform-specific configuration information for configuring Foglight® for Infrastructure on Windows® when using Windows Management Instrumentation (WMI) or Windows Remote Management (WinRM) for remote monitoring access.


	NOTE: WMI and WinRM are two different mechanisms that monitoring agents can use to establish remote connections. In most scenarios, only one of these mechanisms needs to be configured. The preferred mechanism is WinRM because of WMI scalability limitations.

For more details, see the following topic:

•

Advanced system configuration for WinRM

Even though the local user will now have access to Windows Remote Management (WinRM), not all performance monitoring classes allow non-administrative users to access their instances. Some performance classes will still need advanced configuration for the non-administrative user to be able to perform queries/execute methods on their object instances. To perform the advanced configuration for non-administrative users, make sure to log into the remote machine using the Administrator account.

The advanced configuration for non-administrative users includes the following steps:

Adding a non-administrative user to user groups

Setting WinRM RootSDDL for a non-administrative user

Granting permission to the namespace

Granting permission to the service

Adding a non-administrative user to user groups

The non-administrative users must be added into the Performance Monitor Users group that enables the access to the object instances and the Event Log Readers group that grants the permission for reading event logs.


	NOTE: The non-administrative users should have been added to the Distributed COM Users group by default, which enables the remote connection using Windows Remote Management (WinRM).

To add a non-administrative user to the above user groups:

Run lusrmgr.msc.

From the Local Users and Groups (Local) > Users list, right click the non-administrative user who you want to add, and then click Properties from the context menu.

In the <non-administrative user> Properties dialog box, click Member of.

Click Add.

The Select Groups dialog box appears.

In the Select Groups dialog box, type Performance Monitor Users;Event Log Readers in the Enter the object names to select field, and then click Check Names.

Click OK to return the <non-administrative user> Properties dialog box.

Click OK.

The selected user has been added to both user groups.

Setting WinRM RootSDDL for a non-administrative user

After adding a non-administrative user to the needed user groups, you will see the following result if the user permission is not allowed through SDDL.

winrm enum wmicimv2/Win32_ComputerSystem -u:<non-adminstrtor user>

WSManFault

Message = Access is denied.

Error number: -2147024891 0x80070005

Access is denied.

To grant the WinRM RootSDDL permission to a non-administrative user:

Execute the following command to get the RootSDDL value.

winrm get winrm/config

You will see the following default RootSDDL value.

...

RootSDDL = O:NSG:BAD:P(A;;GA;;;BA)S:P(AU;FA;GA;;;WD)(AU;SA;GWGX;;;WD)

Execute the following command, in order to modify the SDDL permission in DACL Entries and to allow the full control access to the Performance Monitor Users group (which SID is S-1-5-32-558).


	NOTE: The SID of the Performance Monitor Users group will be varied. Change the SID to the actual SID used in your environment, as needed.

winrm set winrm/config/service @{RootSDDL="O:NSG:BAD:P(A;;GA;;;BA)(A;;GA;;;S-1-5-32-558)S:P(AU;FA;GA;;;WD)(AU;SA;GWGX;;;WD)"}

You will see the following RootSDDL value.

RootSDDL = O:NSG:BAD:P(A;;GA;;;BA)(A;;GA;;;S-1-5-32-558)S:P(AU;FA;GA;;;WD)(AU;SA;GWGX;;;WD)

Granting permission to the namespace

After setting WinRM RootSDDL for a non-administrative user, log into the remote machine using the administrative user credentials and execute the following command:

winrm enum wmicimv2/Win32_ComputerSystem -u:<non-adminstrtor user>

You will see the following result, if the non-administrative user does not have the permission to the namespace.

winrm enum wmicimv2/Win32_ComputerSystem -u:<non-adminstrtor user>

Message = The WS-Management service cannot process the request.

The WMI service returned an 'access denied' error.

Error number: -2144108284 0x80338104

The WS-Management service cannot process the request. The WMI service returned an 'access denied' error.

To grant the permission to the namespace for the current non-administrative user:

Run wmimgmt.msc.

The WMI Control (Local) Properties dialog box appears.

Right click WMI Control, and click Properties from the context menu.

Click Security > Root > cimv2, and then click Security.

The Security for ROOT\cimv2 dialog box appears.

Click Add.

The Select Users, Computers, Service Accounts, or Groups dialog box appears.

Type Performance Monitor Users;Event Log Readers in the Enter the object names to select field, and then click Check Names.

Click OK to return the Security for ROOT\cimv2 dialog box.

Selected the added user group, and then grant all permissions for this user group.

Click OK to return the WMI Control (Local) Properties dialog box.

Repeat Step 3 to Step 8 to grant all permissions for Security > Root and Security > Root > mscluster.

Granting permission to the service

Most services data can be collected if the Performance Monitor Users group has been granted the permission to services. If you still fail to collect some service data because of permission issues, on the remote machine, execute the following command where <service_name> is the Service name in the Service Property dialog box:

sc sdshow <service_name>

The permissions of the Built-in Administrator (BA) will appear after executing the above command. Execute the following command to grant the additional permissions, as needed.

sc sdset <service_name>...


	NOTE: Ensure that the Administrators have been granted with sufficient permissions; otherwise you will fail to monitor some services.

The following sample demonstrates how to grant permission to the SCMANAGER service:

Execute the following command:

sc sdshow SCMANAGER

You will see the following result:

D:(A;;CC;;;AU)(A;;CCLCRPRC;;;IU)(A;;CCLCRPRC;;;SU)(A;;CCLCRPWPRC;;;SY)(A;;KA;;;BA)

Add “(A;;CCLCRPRC;;;S-1-5-32-558)” between “D:” and “(A;;CC;;;AU)”, and execute the sc sdset command to grant the permission to the SCMANAGER service. For example, execute the following command:

sc sdset SCMANAGER D:(A;;CCLCRPRC;;;S-1-5-32-558)(A;;CC;;;AU)(A;;CCLCRPRC;;;IU)(A;;CCLCRPRC;;;SU)(A;;CCLCRPWPRC;;;SY)(A;;KA;;;BA)

Please select your product:

To serve you better, please complete the Purpose of your Chat:

Recommended Solutions for Your Problem

Foglight for Infrastructure 5.9.5 - User Guide

Reviewing frequently asked questions

Monitoring a partition or VIOS with Foglight for Infrastructure

Advanced system configuration and troubleshooting

Advanced system configuration for WinRM