Foglight Agent Manager 5.9.5 - Foglight Agent Manager Guide

OS collection fails with a Local_Limit_Exceeded error

The agent uses Windows® authentication to Negotiate the monitored instance. In some cases, the negotiation can fail if there is a mismatch between the authentication types used by the client and the server.

The following symptoms indicate an authentication issue:

To resolve these issues, you may need to disable the NTLMv2 authentication.

Access to DCOM objects and registry is denied

When the agent attempts to access the Windows® registry and enter the Windows Management Instrumentation (WMI) component, the attempt can fail if the agent user does not have the required permissions.

The following symptoms indicate a permissions issue:

IMPORTANT: The difference between these two keys is the bold character.

IMPORTANT: There may be multiple instances of each key, especially for 64-bit versions of Windows Server 2008 R2 and Windows 7. Each instance must be updated.

IMPORTANT: An error indicating insufficient permissions may appear. To resolve, a user with the administrative account intended to use for profiling can change the ownership of the keys to that administrative account, and then set the permissions to Full on the appropriate registry keys.

Configuring registry settings for WinShell access through DCOM

Any WindowsShell connection made to a non-local host requires DCOM access to that machine, regardless of whether the user establishing the connection is a local or third-party user.

Therefore, agents that connect to Windows® machines using the Agent Manager’s WindowsShellService need to make the following specific registry changes to allow the connection.

IMPORTANT: There may be multiple instances of each key, especially for 64-bit versions of Windows Server 2008 R2 and Windows 7. Each instance must be updated.

IMPORTANT: An error indicating insufficient permissions may appear. To resolve, a user with the administrative account intended to use for profiling can change the ownership of the keys to that administrative account, and then set the permissions to Full on the appropriate registry keys.

Permissions on registry keys to configure DCOM command shell connection

A Windows® operating system user needs full control permissions on the following registry keys to monitor the operating system:

According to the COM specification, the full control permission to the registry keys are required to write values to the registry keys. The values written to the registry key are as follows:

For 64-bit Windows operating system, there might be two directories of AppID and CLSID, then the written values are:

value to blank.

NOTE: 1. If the keys under HKEY_CLASSES_ROOT\AppID do not exit, manually add the keys to the written value by default permission. 2. If the keys under HKEY_CLASSES_ROOT\CLSID and HKEY_CLASSES_ROOT\Wow6432Node\CLSID do not exit, and you do not have permission to add a new String Value or edit the Value data, change the Owner from TrustedInstaller to Administrators, then grant the Set Value permission first.

Providing the full control permissions to a Foglight Agent Manager (FglAM) user is the most convenient way to write these values, which will be generated automatically. If you don’t want to provide the full control permissions to the FglAM user, do either of the following:

For FileLogMonitorAgent and WindowsEventLogMonitorAgent:

The key 76A64158-CB41-11D1-8B02-00600806D9B6 is used for the Agent Managers installed on Unix or Linux machine to establish the WMIJavaconnection, which requires the administrator privilege to monitor.