wmi generic thinagents user guide · table of contents © 2013 tango/04 computing group page iv...

WMI Generic AgentUser Guide

1.6VMC-Mxx

VISUAL Message Center WMI Generic Agent

The software described in this book is furnished under a license agreement and may be used only in

accordance with the terms of the agreement.

Copyright Notice

Copyright © 2013 Tango/04 All rights reserved.

Document date: August 2012

Document version: 2.11

Product version: 1.6

No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language or computer language, in any form or by any means, electronic mechani-cal, magnetic, optical, chemical, manual, or otherwise, without the prior written permission of Tango/04.

Trademarks

Any references to trademarked product names are owned by their respective companies.

Technical Support

For technical support visit our web site at www.tango04.com.

Tango/04 Computing Group S.L.

Avda. Meridiana 358, 5 A-B

Barcelona, 08027

Spain

Tel: +34 93 274 0051

http:\\www.tango04.com

http:\\www.tango04.com

Table of Contents

Table of Contents

Table of Contents .............................................................................. iii

How to Use this Guide.........................................................................v

Chapter 1

Introduction ..................................................................................... 11.1. What You Will Find in this Document .............................................................1

Chapter 2

WMI Security Settings ........................................................................ 22.0.1. Windows 2000, XP SP1, and Windows 2003 Server (no Service Pack) ..2

2.0.2. Windows XP SP2, 2003 Server SP1 and Later Versions .........................4

2.0.3. Windows Firewall Configuration................................................................5

2.0.4. WMI Security Recommendations..............................................................6

Chapter 3

Generic WMI Configuration ................................................................ 83.1. General Settings .............................................................................................8

3.2. Data Source Settings ......................................................................................9

3.3. Monitor Settings ............................................................................................10

3.4. Default Health Settings .................................................................................11

3.5. Default Templates ........................................................................................11

3.6. Variables .......................................................................................................11

3.7. Field Map SmartConsole - ThinkServer........................................................11

© 2013 Tango/04 Computing Group Page iii

Table of Contents

Chapter 4

Generic WMI Progressive Configuration ............................................. 124.1. General Settings ...........................................................................................12

4.2. Data source settings .....................................................................................13

4.3. Monitor Settings ............................................................................................14

4.4. Default Health Settings .................................................................................15

4.5. Default Templates ........................................................................................15

4.6. Variables .......................................................................................................15

4.7. Field Map SmartConsole - ThinkServer........................................................16

Appendix

Appendix A: Contacting Tango/04 ..................................................... 17

About Tango/04 Computing Group .................................................... 19

Legal Notice .................................................................................... 20

© 2013 Tango/04 Computing Group Page iv

How to Use this Guide

© 2013 Tango/04 Computing Group Page v

How to Use this Guide

This chapter explains how to use Tango/04 User Guides and understand the typographical conventions

used in all Tango/04 documentation.

Typographical Conventions

The following conventional terms, text formats, and symbols are used throughout Tango/04 printed

documentation:

Convention Description

Boldface Commands, on-screen buttons and menu options.

Blue Italic References and links to other sections in the manual or further documentation containing relevant information.

Italic Text displayed on screen, or variables where the user must substitute their own details.

Monospace Input commands such as System i commands or code, or text that users must type in.

UPPERCASEKeyboard keys, such as CTRL for the Control key and F5 for the function key that is labeled F5.

Notes and useful additional information.

Tips and hints that will improve the users experience of working with this product.

Important additional information that the user is strongly advised to note.

Warning information. Failure to take note of this information could potentially lead to serious problems.

Introduction

© 2013 Tango/04 Computing Group Page 1

Chapter 11 Introduction

Windows Management Instrumentation (WMI) is Microsoft’s method for instrumentation of hardware and

software for the Microsoft Windows operating system, including Microsoft Exchange Server, Content

Management Server, and Host Integration Server. WMI allows us to monitor and control Windows

system components, both locally and remotely.

ThinkServer offers two Generic WMI ThinAgents:

• Generic WMI

• Generic WMI Progressive

With the Generic WMI ThinAgent you can create WMI queries to include in your Monitoring Engine and

immediately inherit the full power of the Health Wizard, actions and event templates.

The WMI Agent is fully configurable and is intended for expert users with a solid knowledge of WMI. A

sample configuration is included which shows the systems process list. If necessary, customers can rely

on Tango/04 Computing Group Professional Services for implementation services.

Generic WMI Progressive ThinAgent can be used for the same purposes as Generic WMI ThinAgent,

but where the configured queries return large amounts of data. Where the Generic WMI ThinAgent first

retrieves all the data before processing it, the Generic WMI Progressive ThinAgent starts processing

data as it is recollected. Configuration of the Generic WMI Progressive ThinAgent is identical to that of

Generic WMI.

1.1 What You Will Find in this Document This document describes the Custom Monitor Extension Pack’s Generic WMI ThinAgents in detail. It first

discusses WMI Security Settings for the different versions of the Windows operating systems and WMI

Security Recommendations.

The following chapters explain the configuration and default settings of the Generic WMI Configuration

ThinAgent and Generic WMI Progressive Configuration ThinAgents.

For further information on how to use the ThinkServer Configurator see the ThinkServer User Guide.

Note

The compatibility with different Windows versions depends on the configuration of the

monitor.

http://customers.tango04.com/content/341

WMI Security Settings

Chapter 2 2 WMI Security Settings

To make WMI connections to a remote system, network access to this system needs to be granted.

Once the connection with remote host is possible we will focus on authorization issues.

WMI uses DCOM to get information from remote hosts. To reach DCOM make sure that TCP ports 135

and 445 are open on the system that you will monitor with ThinkServer. In addition the dynamic ports

used by svchost.exe and winmgmt.exe (for Windows 2000 only) must be open. If a firewall is enabled

on the remote system include these permissions to the list of exceptions. When using the Windows

Firewall please see section 2.0.3 - Windows Firewall Configuration on page 5.

By default, all members of the Administrator group have full control of the WMI services on the computer

that is being managed. All others have read/write/execute permissions on their local computer only. So,

by default, any user can run queries on the localhost and only an administrator of the target host can

perform remote queries. If one of these situations matches your needs there should be no problem.

If your enterprise security policy does not allow the use of administrator accounts, some changes are

needed to give standard users access rights to your systems.

Access to WMI is based on the namespace, where each namespace has its own security settings. The

namespace we use, and where all information related to the operating system can be found, is

root\cimv2.

With new Service Pack releases some changes are required to keep monitoring the same systems with

standard users. This section is intended for first time installations and installations affected by these

changes in operating system security policies.

2.0.1 Windows 2000, XP SP1, and Windows 2003 Server (no Service Pack)On this group of systems, the following user permissions are required to perform WMI queries to the

root\cimv2 namespace on localhost:

• Execute Methods

• Enable Account

The following profile is required to perform WMI queries to the root\cimv2 on a remote host. Note that

this configuration applies to target host.

• Execute Methods

• Enable Account



• Remote Enable

To change these properties you can use wmimgmt.msc (in properties, security tab) in each system.

Step 1. Right-click WMI Control and click properties.

Figure 1 – Windows Management Infrastructure

Step 2. In the security tab, select the CIMV2 namespace and click Security. Click the desired

user and select the permissions Execute Methods, Enable Account and Remote

Enable and then click Add to add the desired user. Click OK.

Figure 2 – WMI Control Properties: Security

The following list shows the permissions available on each WMI namespace for each user or group:

• Execute Methods: Permits methods that are exported from the WMI classes or instances to be

run.

• Full Write: Permits full read, write, and delete access to all WMI objects, classes, and

instances.

• Partial Write: Permits write access to static WMI objects.

• Provider Write: Permits write access to objects that are provided by the provider.

• Enable Account: Permits read access to WMI objects.

• Remote Enable: Permits remote access to the namespace.

• Read Security: Permits read-only access to WMI security information.

• Edit Security: Permits read and write access to WMI security information.



2.0.2 Windows XP SP2, 2003 Server SP1 and Later VersionsOn this group of systems and later versions, the changes applied in the previous section are needed,

but are not sufficient to let a standard user run a query. In addition some changes are required in DCOM

to enable remote launch privilege for WMI service on a target host. With these changes we will authorize

a user to launch the application needed to retrieve the data to populate the query run.

If you do not apply the following settings you will get the error access denied (0x80070005 error code).

The access and launch DCOM privileges determine whether a user can access to one of the DCOM

applications. You can set the default access and launch permissions that will apply to all the DCOM

applications of system, except for the ones which have special requirements and have a particular

configuration.

The changes can be applied to default settings or to Windows Management Instrumentation Application.

Step 1. To set launch permissions we must run dcomcnfg.exe.

Figure 3 – Component services: DCOM Config

Step 2. Right-click My Computer and select Properties.

Step 3. In the COM Security tab, we click Edit Default and add the user we will use to run the

monitors with all the privileges. This defines the default access permission for this user.

Figure 4 – COM Security: Access Permission

Note

To monitor performance counters in Windows 2003 Server, it is necessary to add the user

to the Performance Monitor Users group. However, there are some monitors that can not be

executed without an administrator account.



Step 4. We do the same with launch permissions:

Figure 5 – COM Security: Launch Permission

Step 5. And finally we override default launch permissions:

Figure 6 – COM Security: Launch Permission override

2.0.3 Windows Firewall ConfigurationOn Windows XP SP2 systems with Windows Firewall enabled to allow remote WMI queries the following

changes are required:

Enable Allow Remote Administration for the user account.

You can run either the Group Policy editor (Gpedit.msc) to enable Allow Remote Administration, or use

the netsh firewall command at the command prompt.

You should disable the remote administration feature after you have finished connecting to the remote

computer to raise the security level of Windows Firewall.

The following command enables remote administration of the firewall.

> netsh firewall set service RemoteAdmin enable

Note

Further configuration is needed in order to grant/deny user/built-in group access to specific

Windows Event Log categories. More information is available at the following Microsoft

Windows Web site: http://support.microsoft.com/kb/323076.


http://support.microsoft.com/kb/323076


The following command disables remote administration of the firewall.

> netsh firewall set service RemoteAdmin disable

Use the following steps in the Group Policy editor (Gpedit.msc) to enable Allow Remote Administration.

Step 1. Under the Local Computer Policy heading, open the Computer Configuration folder.

Step 2. Open the Administrative Templates folder.

Step 3. Open the Network folder.

Step 4. Open the Network Connections folder.

Step 5. Open the Windows Firewall folder.

Figure 7 – Windows Firewall: Domain Profile

Step 6. If the computer is in the domain, then open the Domain Profile folder; otherwise, open

the Standard Profile folder.

Step 7. Click Windows Firewall: Allow remote administration exception.

Step 8. On the Action menu, select Properties.

Step 9. Click Enable, and then click OK.

2.0.4 WMI Security RecommendationsThis chapter explained how to allow standard users access to WMI on local and remote machines.

The easiest solution is to create a user of the domain and add it to Domain Admin group. Note that by

default Domain Admin group is member of Administrators group, which provides access to domain

controllers. If you need access only to domain workstations the Domain Admin group does not need to

be a member of the Administrators group.

Note

Remember that firewall configuration is still needed.



The most secure solution is to use a non-administrator user and give permission to the individual

workstations. A standard user with the configuration explained here has enough rights to monitor

anything on a system, but some operations, such as kill a process, can only be executed by an

Administrator account. Moreover, if the workstations are working on a Windows 2003 Server OS with

SP1, the application would need an administrator account to be able to perform some important

monitors of the system, that is, accessing Windows Services information. So we recommend you use an

administrator account on those systems that are running a Windows 2003 Server SP1 and use a lower

user account on those which work with previous Windows versions.


Generic WMI Configuration

Chapter 3 3 Generic WMI Configuration

The Generic WMI monitor configuration consists of three tabs where you can set the general, data

source and monitor settings.

Once you have configured the monitor you can set health conditions, actions and message templates to

suit your specific goals.

The following sections describe how to configure the WMI Monitor and the default configuration that

comes with the ThinAgent.

3.1 General SettingsEnter a name and description for the WMI Monitor so that you can easily identify the monitor in the

monitor panel of the ThinkServer Configurator.

The general settings come pre-configured, but may be changed here to suit your particular needs. As

the WMI Monitor uses a private data source you need not worry about effects on other monitors.

Main information

General settings

Configuration Variables & Values Description

Name WMI General Monitor

Use the default provided or enter a new name for the monitor.

Tip: add the host name you are moni-toring to help quickly identify where problems occur.

Description Enter a description of the monitor.


Refresh time 60 secondsThe data source will be refreshed every 60 seconds.

Number of tries 1If we detect an error we determine that we will retry once...

Interval between tries 10 seconds ...And that we will retry after 10 seconds.



3.2 Data Source SettingsAfter configuring the general settings the next step is to configure the private data source. Start by

entering the Target Host settings for this monitor. Then indicate the namespace where the query is to be

run, then select the query to execute and any conditions to narrow down the retrieval of relevant data.

For example, to retrieve data for the process “explorer.exe” from the process list on your PC, enter the

following details:

Target host settings

Figure 8 illustrates this example:

Error retry time 60 seconds

In the case that errors exceed the number specified in Number of Tries (in this case more than once), we will wait for 60 sec-onds before starting the Windows Pro-cesses check again.



IP / DNS NameYou can enter the IP Address or use the DNS name of the host.

Domain Host domain.

User User to connect to host with.

Password to connectPassword of the user connect-ing to the host.

NameSpace

root\cimv2 This variable identifies the CPU you are interested in. It defines the label by which the statistic or metric is known. When sub-classed, the prop-erty can be overridden to be a Key property.

Queryselect * from

win32_processText of WQL Query to be run.

WhereName = ‘explorer.exe’ Where condition to narrow

down the data retrieval.



Figure 8 – WMI data source configuration

3.3 Monitor SettingsHere you will find a number of variables that you can choose to use in your monitor for setting health

rules, actions and use in your message templates. You can deactivate these variables to reduce the

amount of data retrieved for this monitor. In addition, you can create filter masks to help narrow down the

data that this monitor retrieves.

To create a filter mask click the edit icon at the left of the window. Here you can enter the required filter

mask. You can use the wildcards ? and * to set your filter masks.

Figure 9 – Filter mask



For example, only retrieve data for explorer.exe. Enter explorer.exe in the filter mask field of the

variable caption and make sure that this variable is selected. Figure 9 illustrates this example.

3.4 Default Health SettingsThe default Health settings of the WMI monitor were set up for our example of monitoring Explorer.

Health is set to

• Warning if no data is retrieved,

• Success in all other cases.

We urge you to change the health rules to suit your monitoring needs.

3.5 Default Templates The Success message template displays the handle caption of the monitored object and the number of

threads it is using.

We urge you to change the message templates to suit your monitoring needs.

3.6 VariablesAs the available variables are determined by the query that the user defines no variables are descried

here.

For information about variables available in WMI look up WMI Classes on the Microsoft Web site:

http://msdn.microsoft.com/library/default.asp?url=/library/en‐us/wmisdk/wmi/wmi_classes.asp

3.7 Field Map SmartConsole - ThinkServerAs the available variables depend on the query defined by the user, this monitor does not contain pre-

configured variables to send to SmartConsole. You can define any variables you wish to send to

SmartConsole in the Event Variables tab of the Health Wizard’s Templates.


Generic WMI Progressive Configuration

Chapter 4 4 Generic WMI Progressive Configuration

The Generic WMI Progressive Configuration is intended for use with WMI queries that return large

volumes of data. Where the Generic WMI ThinAgent first retrieves all the data before processing it, the

Generic WMI Progressive ThinAgent starts processing data as it is recollected.

The Generic WMI Progressive monitor configuration consists of three tabs where you can set the

general, data source and monitor settings.

Once you have configured the monitor you can set health conditions, actions and message templates to

suit your specific goals.

The following sections describe how to configure the WMI Monitor and the default configuration that

comes with the ThinAgent.

4.1 General SettingsEnter a name and description for the WMI Monitor so that you can easily identify the monitor in the

monitor panel of the ThinkServer Configurator.

The general settings come pre-configured, but may be changed here to suit your particular needs. As

the WMI Monitor uses a private data source you need not worry about effects on other monitors.

Main information

General settings


NameWMI Fast General Moni‐tor

Use the default provided or enter a new name for the monitor.

Tip: add the host name you are moni-toring to help quickly identify where problems occur.

Description Enter a description of the monitor.


Refresh time 60 secondsThe data source will be refreshed every 60 seconds.



4.2 Data source settingsAfter configuring the general settings the next step is to configure the private data source. Start by

entering the Target Host settings for this monitor. Then indicate the namespace where the query is to be

run, then select the query to execute and any conditions to narrow down the retrieval of relevant data.

For example, to retrieve data for the process explorer.exe from the process list on your PC, enter the

following details:

Target host settings

Figure 10 illustrates this example:

Number of tries 1If we detect an error we determine that we will retry once...

Interval between tries

10 seconds ...And that we will retry after 10 seconds.

Error retry time 60 seconds

In the case that errors exceed the number specified in Number of Tries (in this case more than once), we will wait for 60 seconds before starting the Windows Processes check again.



IP / DNS NameYou can enter the IP Address or use the DNS name of the host.

Domain Host domain.

User User to connect to host with.

Password to connect

Password of the user connecting to the host.

NameSpace root\cimv2

This variable identifies the CPU you are interested in. It defines the label by which the statistic or metric is known. When sub-classed, the property can be overridden to be a Key property.

Queryselect * from win32_process

Text of WQL Query run.

WhereName = ‘explorer.exe’

Where condition to narrow down the data retrieval.



Figure 10 – WMI data source configuration

4.3 Monitor SettingsHere you will find a number of variables that you can choose to use in your monitor for setting health

rules, actions and use in your message templates. You can deactivate these variables to reduce the

amount of data retrieved for this monitor. In addition, you can create filter masks to help narrow down the

data that this monitor retrieves.

To create a filter mask click the edit icon at the left of the window. Here you can enter the required filter

mask. You can use the wildcards ? and * to set your filter masks.

Figure 11 – Filter mask



For example, only retrieve data for explorer.exe. Enter explorer.exe in the filter mask field of the

variable caption and make sure that this variable is selected. Figure 11 illustrates this example.

4.4 Default Health SettingsThe default Health settings of the WMI monitor were set up for our example of monitoring Explorer.

Health is set to

• Critical if the number of files retrieved exceeds 1000,

• Success in all other cases.

We urge you to change the health rules to suit your monitoring needs.

4.5 Default Templates The Critical message template shows the number of files retrieved.

Figure 12 – Default templates

We urge you to change the message templates to suit your monitoring needs.

4.6 VariablesAs the available variables are determined by the query that the user defines no ThinAgent-specific

variables are described here. For information about variables available in WMI look up WMI Classes on

the Microsoft Web site:



http://msdn.microsoft.com/library/default.asp?url=/library/en‐us/wmisdk/wmi/wmi_classes.asp

You will not be able to see variables your query retrieves until the monitor has been run once. The

variables you see before running the monitor are the generic ThinkServer variables. These are

described in the ThinkServer Configurator User Guide.

4.7 Field Map SmartConsole - ThinkServerAs the available variables depend on the query defined by the user, this monitor contains only a few pre-

configured variables to send to the SmartConsole.

You can define the variables you wish to send to the SmartConsole in the Event Variables tab of the

Health Wizard’s Templates.

SmartConsole ThinkServer Description

Var1Set Health wizard

Health wizard name

Var2 Host Server name or IP address

Var3NumberOf‐Files

Number of files retrieved by the query


Appendix A : Contacting Tango/04

Appendix AAppendix A: Contacting Tango/04

North America

Tango/04 North America

PO BOX 3301

NH 03458 Peterborough USA

Phone: 1-800-304-6872 / 603-924-7391

Fax: 858-428-2864

[email protected]

www.tango04.com

EMEA

Tango/04 Computing Group S.L.

Avda. Meridiana 358, 5 A-B

08027 Barcelona Spain

Phone: +34 93 274 0051

Fax: +34 93 345 1329

[email protected]

www.tango04.com

Italy

Tango/04 Italy

Viale Garibaldi 51/53

13100 Vercelli Italy

Phone: +39 0161 56922

Fax: +39 0161 259277

[email protected]

www.tango04.it

Sales Office in France

Tango/04 France

La Grande Arche

Paroi Nord 15ème étage

92044 Paris La Défense France

Phone: +33 01 40 90 34 49

Fax: +33 01 40 90 31 01

[email protected]

www.tango04.fr

Sales Office in Switzerland

Tango/04 Switzerland

18, Avenue Louis Casaï

CH-1209 Genève

Switzerland

Phone: +41 (0)22 747 7866

Fax: +41 (0)22 747 7999

[email protected]

www.tango04.fr

Latin American Headquarters

Barcelona/04 Computing Group SRL (Argentina)

Avda. Federico Lacroze 2252, Piso 6

1426 Buenos Aires Capital Federal

Argentina

Phone: +54 11 4774-0112

Fax: +54 11 4773-9163

[email protected]

www.barcelona04.com


Mailto:[email protected]

www.tango04.com


www.tango04.com


www.tango04.it


www.tango04.fr


www.tango04.fr


www.barcelona04.com

Sales Office in Peru

Barcelona/04 PERÚ

Centro Empresarial Real

Av. Víctor A. Belaúnde 147, Vía Principal 140 Edificio Real Seis, Piso 6

L 27 Lima

Perú

Phone: +51 1 211-2690

Fax: +51 1 211-2526

[email protected]

www.barcelona04.com

Sales Office in Chile

Barcelona/04 Chile

Nueva de Lyon 096 Oficina 702,

Providencia

Santiago

Chile

Phone: +56 2 234-0898

Fax: +56 2 2340865

[email protected]

www.barcelona04.com



www.barcelona04.com


www.barcelona04.com

About Tango/04 Computing Group

Tango/04 Computing Group is one of the leading developers of systems management and automation

software. Tango/04 software helps companies maintain the operating health of all their business

processes, improve service levels, increase productivity, and reduce costs through intelligent

management of their IT infrastructure.

Founded in 1991 in Barcelona, Spain, Tango/04 is an IBM Business Partner and a key member of IBM's

Autonomic Computing initiative. Tango/04 has more than a thousand customers who are served by over

35 authorized Business Partners around the world.

Alliances

Awards

Partnerships IBM Business Partner

IBM Autonomic Computing Business Partner

IBM PartnerWorld for Developers Advanced Membership

IBM ISV Advantage Agreement

IBM Early code release

IBM Direct Technical Liaison

Microsoft Developer Network

Microsoft Early Code Release


Legal Notice

The information in this document was created using certain specific equipment and environments, and it is limited in

application to those specific hardware and software products and version and releases levels.

Any references in this document regarding Tango/04 Computing Group products, software or services do not mean

that Tango/04 Computing Group intends to make these available in all countries in which Tango/04 Computing Group

operates. Any reference to a Tango/04 Computing Group product, software, or service may be used. Any functionally

equivalent product that does not infringe any of Tango/04 Computing Group's intellectual property rights may be used

instead of the Tango/04 Computing Group product, software or service

Tango/04 Computing Group may have patents or pending patent applications covering subject matter in this

document. The furnishing of this document does not give you any license to these patents.

The information contained in this document has not been submitted to any formal Tango/04 Computing Group test

and is distributed AS IS. The use of this information or the implementation of any of these techniques is a customer

responsibility, and depends on the customer's ability to evaluate and integrate them into the customer's operational

environment. Despite the fact that Tango/04 Computing Group could have reviewed each item for accurateness in a

specific situation, there is no guarantee that the same or similar results will be obtained somewhere else. Customers

attempting to adapt these techniques to their own environments do so at their own risk. Tango/04 Computing Group

shall not be liable for any damages arising out of your use of the techniques depicted on this document, even if they

have been advised of the possibility of such damages. This document could contain technical inaccuracies or

typographical errors.

Any pointers in this publication to external web sites are provided for your convenience only and do not, in any

manner, serve as an endorsement of these web sites.

The following terms are trademarks of the International Business Machines Corporation in the United States and/or

other countries: iSeries, iSeriese, iSeries, i5, DB2, e (logo)®Server IBM ®, Operating System/400, OS/400, i5/OS.

Microsoft, SQL Server, Windows, Windows NT, Windows XP and the Windows logo are trademarks of Microsoft

Corporation in the United States and/or other countries. Java and all Java-based trademarks and logos are

trademarks or registered trademarks of Sun Microsystems, Inc. in the United States and/or other countries. UNIX is a

registered trademark in the United States and other countries licensed exclusively through The Open Group. Oracle

is a registered trade mark of Oracle Corporation.

Other company, product, and service names may be trademarks or service marks of other companies.


wmi generic thinagents user guide · table of contents © 2013 tango/04 computing group page iv...

Documents