立即与支持人员聊天
与支持团队交流

Foglight Agent Manager 7.3.0 - Foglight Agent Manager Guide

Configuring the embedded Agent Manager Installing external Agent Managers
Understanding how the Agent Manager communicates with the Management Server Deploying the Agent Manager cartridge Downloading the Agent Manager installer Installing the Agent Manager Starting or stopping the Agent Manager process Frequently asked questions
Configuring the Agent Manager Advanced system configuration and troubleshooting
Configuring Windows Management Instrumentation (WMI) Configuring Windows Remote Management (WinRM) UNIX- and Linux-specific configuration
Monitoring the Agent Manager performance Deploying the Agent Manager to large-scale environments

Troubleshooting

If you have verified all of the WinRM configuration information and are still experiencing connection issues, the following techniques may be helpful for diagnosing the problem.

Enabling specific TLS protocols

If an agent could not establish secure connection to a target server, verify if the target server supports TLS protocol version negotiation. To enable specific TLS protocols on the agent manager, run the Agent Manager with the following switch:

-Djdk.tls.client.protocols=TLSv1, TLSv1.1, TLSv1.2

* 
NOTE: To enable specific TLS protocols, specify them in a comma-separated list within quotation marks and all other supported protocols will be disabled. For example, if the value of this property is “TLSv1,TLSv1.1”, then the default protocol settings are only for TLSv1 and TLSv1.1 while other protocols are unavailable.

Verifying setup

To check whether a listener is configured for WinRM, you can issue the following command and observe its output:

$ winrm enum winrm/config/listener
Listener
Address = *
Transport = HTTP
Port = 5985
Hostname
Enabled = true
URLPrefix = wsman
CertificateThumbprint
ListeningOn = 10.4.114.29, 127.0.0.1, ::1, fe80::100:7f:fffe%12, fe80::5efe:
10.4.114.29%14, fe80::38a7:8fc9:3d7d:f4d7%13

The Port and Transport elements contain important information. The above command output identifies an HTTP listener on port 5985.

To see a full list of WinRM configuration values for the WinRM service that the Agent Manager is to use on the remote machine, you can issue the following command and observe its output:

$ winrm get winrm/config/service
Service
RootSDDL = O:NSG:BAD:P(A;;GA;;;BA)S:P(AU;FA;GA;;;WD)(AU;SA;GWGX;;;WD)
MaxConcurrentOperations = 4294967295
MaxConcurrentOperationsPerUser = 15
EnumerationTimeoutms = 60000
MaxConnections = 25
MaxPacketRetrievalTimeSeconds = 120
AllowUnencrypted = true
Auth
Basic = true
Kerberos = true
Negotiate = true
Certificate = true
CredSSP = false
CbtHardeningLevel = Relaxed
DefaultPorts
HTTP = 5985
HTTPS = 5986
IPv4Filter = *
IPv6Filter = *
EnableCompatibilityHttpListener = false
EnableCompatibilityHttpsListener = false
CertificateThumbprint = ce 20 a6 47 d8 0d 71 b3 e2 7c dd f7 70 d9 57 d1 3f a5 65
df

The important properties are AllowUnencrypted (it indicates whether HTTP is allowed or not), and the Auth values that are set to true (enabled), namely Basic and Negotiate. In this example, both authentication types are enabled.

For more information on setting up for HTTPS, see About WinRM authentication and the Agent Manager .

Identifying common causes of WinRM failures

The following conditions can result in a WinRM failure:

•
The WinRM listener is not configured on the remote machine.
•
The AllowUnencrypted WinRM service configuration setting is false, and HTTP is used on the remote machine.
•
The expected authentication type is not enabled for the WinRM service on remote machine. For example, Basic authentication is expected to be used, but it is not enabled.
•
A fully qualified domain name is not specified in the user credential created on the Management Server.
•
An incorrect Kerberos configuration file is used. For example, the file does not exist on a UNIX system, or the realm is not set up for cross-realm authentication.
相关文档

The document was helpful.

选择评级

I easily found the information I needed.

选择评级