IBM Tivoli Endpoint Manager (TEM) and IBM Tivoli Monitoring Manager (ITM)

Transcription

1 IBM Tivoli Endpoint Manager (TEM) and IBM Tivoli Monitoring Manager (ITM) Document Name Author(s) Contributors Reviewers ICAP TEM for ITM Document Shaker Al-Muaber Andress Georgescu, Shaun Kelley, Lakshmi Turun Version Date Author(s) Revision Notes Shaker Al-Muaber Initial Draft Shaker Al-Muaber System Layout Shaker Al-Muaber Script Files Shaun Kelley TEM Fixlets

2 Table of Contents Executive Summary... 3 Introduction... 3 Overview... 3 Assumptions... 3 System Layout... 3 Fixlet Customization... 4 Fixlet Relevance... 4 Unix... 5 Relevance 1:... 5 Relevance 2 & 3:... 5 Relevance 4:... 5 Relevance 5:... 5 Relevance 6:... 5 Relevance 7:... 5 Linux... 6 Relevance 1:... 6 Relevance 2:... 6 Relevance 3:... 6 Relevance 4:... 6 Relevance 5:... 6 Windows... 7 Relevance 1:... 7 Relevance 2:... 7 Relevance 3:... 7 Relevance 4:... 7 Relevance 5:... 7 Fixlet Actions:... 8 Unix:... 8 Linux:... 8 Windows:... 9 ITM Script Files... 9 Here are the scripts we used for ITM deployment on all the platforms of Linux, Unix and Windows Linux-agent-install.sh... 9 Unix-agent-install.sh Windows-agent-install.bat... 22

3 Executive Summary One of Steve Mills SWG initiatives is monitoring all systems in the labs for the purpose of increased utilization and network optimization and thus reduced expenses. The parameters monitored include disk I/O, CPU, memory, physical disk, and network usage. To monitor our systems, we have turned to IBM Tivoli Monitoring (ITM) software. As the landlord for Austin labs we have to install ITM on all Tivoli systems, as well as Rational, ICS, and AIM systems located on site. During this process, we encountered the following challenges with the ITM deployment: 1. Installing ITM manually, which can only get through 40 systems daily with our limited resources. 2. The amount of time and effort needed to obtain login credential for ITM deployment. 3. Manually tracking systems that are exempted from ITM. 4. Systems get re-imaged frequently. 5. Limited resources for ITM deployment The Tivoli IT team uses TEM to not only apply security patches, but to also quickly deploy software in SWG labs. Using automated scripts created by the ITM deployment team, TDS was able create a Fixlets for the ITM deployment in each lab. With the xlets in place, the TEM team loaded the ITM exemptions into a custom group in the TEM server and proved reliable during testing. Using the TEM solution, we were able to save many person hours by installing hundreds of ITM clients per day using TEM. Introduction Overview Installation of IBM Tivoli Monitoring has become a common requirement for all SWG. With the introduction of Tivoli Endpoint Manager, this is no longer limited to manually installing the agent on the systems. This document will explain all the steps needed to set up such an environment. Assumptions For the purpose of this document, we assume that the reader is familiar with TEM and ITM products. The user can perform a basic installation and conguration of these products, and is familiar with all common commands and utilities contained in these products. System Layout This document will show all the steps needed to customize ITM deployment Fixlets with our scripts and use it for ITM deployment. See the below diagram for the machine and product layout.

4 The above diagram shows the key component for TEM installation. We have the TEM Relay, which communicates with the TEM server and TEM clients. The TEM server will provide the Fixlet needed for the patch and ITM deployment. Fixlet Customization Using the scripts from the following sections we can create simple, scalable TEM xlets to do the heavy lifting for us. These sample Fixlets are created with the premise that the script les are stored on an open httpd server that the TEM server can access without autication. Fixlet Relevance The main challenge when setting up the xlets for the ITM install involved using TEM relevance to determine if the system was already running the ITM agent. This way we could at any time login to the TEM server and get a snapshot of how many systems need the ITM client. The other reason is that with the proper relevance in place, systems automatically disappear from the list of relevant systems after the install has been performed successfully.

5 Unix Relevance 1: (version of client >= " ") AND ((exists true whose (if true (exists (operating system) whose (it as string as lowercase contains "aix" as lowercase)) else false)) OR (exists true whose (if true (exists (operating system) whose (it as string as lowercase contains "sunos" as lowercase)) else false)) OR (exists true whose (if true (exists (operating system) whose (it as string as lowercase contains "HP" as lowercase)) else false))) This relevance clause contains standard code to check the version of the TEM client as well as checking for the proper operating system. In this case, this relevance is for the Unix deployment xlet. So it is looking for Solaris, AIX, or HP operating systems. Relevance 2 & 3: not exists match (regex "(AIX AIX VIOS) (5.1)") of name of operating system not exists match (regex "(AIX AIX VIOS) (4.3)") of name of operating system These relevance statements are excluding versions of AIX and VIOS that are not supported by ITM. Relevance 4: not exists le "/opt/ibm/citm/itm/bin/cinfo" This relevance clause is checking the default install path to see if the ITM agent has been installed. Change this to match if you install ITM in a different directory on Unix. Relevance 5: not exists process whose (name of it as lowercase contains "kuxagent") This relevance expression checks to make sure that the ITM Agent is not installed and running. Since it is possible the ITM Agent is installed in a non-default directory, this prevents those systems from showing as relevant. Relevance 6: not exists le "/opt/ibm/itm/bin/cinfo" This relevance statement is checking a secondary install directory to make sure the ITM agent is not already installed. Relevance 7: (exists true whose (if true (exists (if ( exists true whose (if true ( exists ip interfaces of network) else false) ) addresses whose (it as string!= " ") of ip interfaces whose (not loopback of it) of network as string else nothing) whose (it as string as lowercase contains "9.11." as lowercase)) else false))

6 This relevance statement is checking to see if the subnet the system is located on matches the site which the script is made for. Because each site uses a different ITM server for the agents to connect to, we need to make sure the systems which get the agent are in the same site as the server they are reporting in to. Linux Relevance 1: (version of client >= " ") AND ((exists true whose (if true (exists (operating system) whose (it as string as lowercase contains "red hat" as lowercase)) else false)) OR (exists true whose (if true (exists (operating system) whose (it as string as lowercase contains "suse" as lowercase)) else false))) This relevance clause contains standard code to check the version of the TEM client as well as checking for the proper operating system. In this case, this relevance is for the Linux deployment xlet. So it is looking for SuSE and Red Hat operating systems. Relevance 2: not exists le "/opt/ibm/citm/itm/bin/cinfo" This relevance clause is checking the default install path to see if the ITM agent has been installed. Change this to match if you install ITM in a different directory on Linux. Relevance 3: not exists process whose (name of it as lowercase contains "klzagent") This relevance expression checks to make sure that the ITM Agent is not installed and running. Since it is possible the ITM Agent is installed in a non-default directory, this prevents those systems from showing as relevant. Relevance 4: not exists le "/opt/ibm/itm/bin/cinfo" This relevance statement is checking a secondary install directory to make sure the ITM agent is not already installed. Relevance 5: (exists true whose (if true (exists (if ( exists true whose (if true ( exists ip interfaces of network) else false) ) addresses whose (it as string!= " ") of ip interfaces whose (not loopback of it) of network as string else nothing) whose (it as string as lowercase contains "9.11." as lowercase)) else false)) This relevance statement is checking to see if the subnet the system is located on matches the site which the script is made for. Because each site uses a different ITM server for the agents to

7 connect to, we need to make sure the systems which get the agent are in the same site as the server they are reporting in to. Windows Relevance 1: name of operating system as lowercase starts with "win" This relevance clause contains code to check for the proper operating system. In this case, this relevance is for the Windows deployment xlet. So it is looking for Windows operating systems. Relevance 2: not exists key "HKLM\SOFTWARE\Candle\KNT\Ver610\Primary\Conguration" of registry This relevance clause is checking the default registry key to see if the ITM agent has been installed. Relevance 3: not exists regapp "kntcma.exe" This relevance expression checks to make sure that the ITM Agent is not installed and running. Since it is possible the ITM Agent is installed in a non-default directory, this prevents those systems from showing as relevant. Relevance 4: not exists key "HKLM\SYSTEM\CurrentControlSet\services\KNTCMA_Primary" of registry This relevance statement is checking a secondary registry key to make sure the ITM agent is not already installed. Relevance 5: (exists true whose (if true (exists (if ( exists true whose (if true ( exists ip interfaces of network) else false) ) addresses whose (it as string!= " ") of ip interfaces whose (not loopback of it) of network as string else nothing) whose (it as string as lowercase contains "9.11." as lowercase)) else false)) This relevance statement is checking to see if the subnet the system is located on matches the site which the script is made for. Because each site uses a different ITM server for the agents to connect to, we need to make sure the systems which get the agent are in the same site as the server they are reporting in to.

8 Fixlet Actions: The second part in authoring the ITM installation xlets was creating the actions for each xlet. Again, these xlets rely on the ability of the TEM server to get the scripts from a anonymous ftp server or http server. Unix: Default Action: #!/bin/bash -vx # Enter your action script here cd /tmp ftp -in yourserver<<end_script quote USER anonymous quote PASS cd ITM bin get unix-agent-install_site.sh bye END_SCRIPT chmod u+x unix-agent-install_site.sh./unix-agent-install_site.sh rm unix-agent-install_site.sh This xlet uses shell scripting for the execution of the ITM installation script. Italicized are the parts that you would change to match your deployment. yourserver being the ftp server where you store the scripts and site being the variable for whichever site script you are using if you have a multi-site environment. Linux: Default Action: #!/bin/sh # Enter your action script here cd /tmp wget ftp://anonymous@yourserver/itm/linux-agent-install_site.sh chmod u+x linux-agent-install_site.sh./linux-agent-install_site.sh rm linux-agent-install_site.sh Like the Unix xlet, we use shell as the execution method. Italicized are the parts that you would change to match your deployment. yourserver being the ftp server where you store the scripts and site being the variable for whichever site script you are using if you have a multi-site environment.

9 Windows: Default Action: // downloads ITM Install les and executes install script prefetch windows-agent-install_site.bat sha1:sha1value size:#### wait Download\windows-agent-install_site.bat Unlike the Unix and Linux xlets, we use Bigx Action Script as the execution method. Italicized are the parts that you would change to match your deployment. yourserver being the httpd server where you store the scripts and site being the variable for whichever site script you are using if you have a multi-site environment. Unique to the Windows script are the sha1value and #### variables. The sha1value variable is where you would put the sha1 value for the.bat installer and the #### variable is where you would put the size of the.bat le in bytes. ITM Script Files Here are the scripts we used for ITM deployment on all the platforms of Linux, Unix and Windows. Linux-agent-install.sh Here is the script for Unix install agent: #!/bin/ksh #check if ksh is not installed if [! -x /bin/ksh ]; echo "Requires /bin/ksh. Not found exiting" exit 1 #generate logname and assign OUTPUT_LOG="$(hostname)_$(date +%Y%m%d).txt" #assign and create pipe (if it doesn't exist) for output duplication OUTPUT_PIPE=output.pipe if [! -e $OUTPUT_PIPE ]; mkfo $OUTPUT_PIPE #Remove old log if [ -e $OUTPUT_LOG ]; rm $OUTPUT_LOG #Reassign output to write to log and console

10 exec 3>&1 4>&2 tee $OUTPUT_LOG < $OUTPUT_PIPE >&3 & tpid=$! exec > $OUTPUT_PIPE 2>&1 #Checking if ITM OS Agent is running as process. If the process is running exit from script - itm os agent will not be installed. if [ $(ps -ef grep klzagent grep -v grep awk 'NR==1{print ($8)}' awk '{ print substr( $0, length($0) - 7, length($0) ) }') == "klzagent" ] echo ITM OS Agent is already running. ITM OS Agent for linux will not be installed. #Determine if this agent is already present and its current state if present (cinfo -o doesnt work, -o isnt a valid option) #stop install if linux agent is present if [ '-d /opt/ibm/itm/bin' ]; echo "ITM Unix agent binaries seem to exist, checking to see if product is running" if [ "$(/opt/ibm/itm/bin/cinfo -r grep "lz")" == "" ] echo "The process is not running" echo "Checking if the the itm os agent is installed" if [ "$(/opt/ibm/itm/bin/cinfo -i grep "lz" awk '{print $1}')" == "lz" ] echo "The ITM OS Agent is installed but the process is not running, you may want to start it" echo "ITM OS Agent is not installed, checking if snmp process is running" elif [ "$(/opt/ibm/itm/bin/cinfo -r grep "lz" awk -F. '{print $4}' - )" == "running" ] echo "The process does seem to be running already, check your TEPS and see if you can see the device, if not you may have it pointed to the wrong TEMS/TEPS" #Determine if SNMP process is already present and its current state #stop install if SNMP is running and congured using right community name if [ '-e /etc/snmp/snmpd.conf' ]; if [ "$(netstat -natv grep ':199' awk '{print $6}')" == "LISTEN" ]

11 "linmills2" ] installed." echo "The SNMP process does seem to be running already" echo "checking if snmpd.conf has correct community name set" if [ "$(cat /etc/snmp/snmpd.conf grep 'linmills2' awk 'NR==1{print ($2)}')" == echo "SNMP cong le is set with right community name." echo "ITM OS Agent will not be #temporary set SELINUX to permissive mode if [ $(sestatus grep "Current mode" awk '{print $3}') == "enforcing" ] echo 0 > /selinux/enforce echo "SELINUX has been set to permissive mode temporarily" mkdir -p /opt/ibm/citm/itm #create mountpoints and mount MSA install directory and agent response le directory mkdir -p /agentinstallpoint mkdir -p /agentresponsele mount itmagntls.tivlab.austin.ibm.com:/msa/.projects/p10/ibmpublic /agentinstallpoint mount itmagntls.tivlab.austin.ibm.com:/response_les /agentresponsele #Install the agent using the response les /agentinstallpoint/inst.images/aix/itm/6.2.2/agent/install.sh -q -h /opt/ibm/citm/itm -p \ /agentresponsele/linux_agent_install.rsp #run cong using cong response le /opt/ibm/citm/itm/bin/candlecong -A -p \ /agentresponsele/unix_agent_cong_austin.rsp lz /opt/ibm/citm/itm/bin/itmcmd agent start lz #Secure ITM Executables /opt/ibm/citm/itm/bin/securemain lock #Return output to normal opperation and remove pipe exec 1>&3 3>&- 2>&4 4>&- wait $tpid rm $OUTPUT_PIPE #unmount and remove mountpoint umount /agentinstallpoint umount /agentresponsele rmdir /agentinstallpoint rmdir /agentresponsele

12 #set back SELINUX to enforcing mode if [ $(sestatus grep "Current mode" awk '{print $3}') == "permissive" ] echo 1 > /selinux/enforce echo "SELINUX has been set to enforcing mode" #create log directory and move log mkdir -p /tmp/itm mv $OUTPUT_LOG /tmp/itm echo "your logle is "$OUTPUT_LOG echo "you can locate it in /tmp/itm" Unix-agent-install.sh Here is the script for Unix install agent: #!/bin/ksh #set -x #generate logname and assign OUTPUT_LOG="$(hostname)_$(date +%Y%m%d).txt" os=$(uname -s) ITMHOMEDEFAULT=/opt/IBM/ITM ITMHOME=/opt/IBM/citm/ITM OUTPUT_PIPE=output.pipe tpid=$! #Determine if this is an AIX, HP-UX, or Solaris machine as the commands are not at all similar (Julian Foster 3/25/10) case $os in ' ') echo "No os version retrieved please ensure PATH is set correctly, uname returned no value" ;; AIX) #assign and create pipe (if it doesn't exist) for output duplication if [! -e $OUTPUT_PIPE ]; mkfo $OUTPUT_PIPE #Remove old log if [ -e $OUTPUT_LOG ]; rm $OUTPUT_LOG #Reassign output to write to log and console exec 3>&1 4>&2

13 tee $OUTPUT_LOG < $OUTPUT_PIPE >&3 & exec > $OUTPUT_PIPE 2>&1 #Checking if ITM OS Agent is running as process. If the process is running exit from script - itm os agent will not be installed. if [ $(ps -ef grep kuxagent grep -v grep awk 'NR==1{print ($9)}' awk '{ print substr( $0, length($0) - 7, length($0) ) }') == "kuxagent" ] echo ITM OS Agent is already running. ITM OS Agent for unix will not be installed. if [ $(ps -ef grep kuxagent grep -v grep awk 'NR==1{print ($8)}' awk '{ print substr( $0, length($0) - 7, length($0) ) }') == "kuxagent" ] echo ITM OS Agent is already running. ITM OS Agent for unix will not be installed. #Determine if this agent is already present and its current state if present (cinfo -o doesnt work, -o isnt a valid option) if [ '-d $ITMHOMEDEFAULT/bin' ]; echo "ITM Unix agent binaries seem to exist, checking to see if the process is running" if [ "$($ITMHOMEDEFAULT/bin/cinfo -r grep "ux")" == "" ] echo "The process is not running" echo "Checking if the itm os agent is installed" if [ "$($ITMHOMEDEFAULT/bin/cinfo -i grep "ux" awk '{print $1}')" == "ux" ] echo "The ITM OS Agent is installed but the process is not running, you may want to start it" echo "ITM OS Agent is not installed, checking if snmp process is running" elif [ "$($ITMHOMEDEFAULT/bin/cinfo -r grep "ux" awk -F. '{print $4}' - )" == "running" ] echo "The process does seem to be running already, check your TEPS and see if you can see the device, if not you may have it pointed to the wrong TEMS/TEPS"

14 #Determine if SNMP process is already present and its current state for AIX5.2,AIX5.3,AIX6.1 #stop install if SNMP is running and congured using right community name if [ '-e /etc/snmpdv3.conf' ]; if [ "$(lssrc -s snmpd grep snmpd awk '{print $4}')" == "active" ] echo "The SNMP process does seem to be running already" #echo "checking if snmpd.conf has correct community name set" if [ "$(cat /etc/snmpdv3.conf grep "COMMUNITY" awk 'NR==3{print ($3)}')" == "aixmills3" ] echo "SNMP cong le is set with right community name." echo "ITM OS Agent will not be installed." #Determine if the ITM directory exists if [! -e $ITMHOME ] mkdir -p $ITMHOME #Determine if there is enough space on the disk if [ "$(df -m $ITMHOME awk 'NR==2{print ($3)}')" -lt "300" ] echo "not enough space in the target lesystem" exit 1 #create mountpoint and mount MSA install directory mkdir -p /agentinstallpoint mkdir -p /agentresponsele == 0 ] #checking NFS client reserved port for Linux NFS servers if [ "$(nfso -a grep nfs_use_reserved_ports awk '{print $3}')" nfso -p -o nfs_use_reserved_ports=1 mount itmagntls.tivlab.austin.ibm.com:/msa/.projects/p10/ibmpublic /agentinstallpoint mount itmagntls.tivlab.austin.ibm.com:/response_les /agentresponsele

15 $ITMHOME -p \ #Install the agent using the response les /agentinstallpoint/inst.images/aix/itm/6.2.2/agent/install.sh -q -h /agentresponsele/unix_agent_install.rsp #run cong using cong response le $ITMHOME/bin/CandleCong -A -p \ /agentresponsele/unix_agent_cong_austin.rsp ux $ITMHOME/bin/itmcmd agent start ux #Secure ITM executables /opt/ibm/citm/itm/bin/securemain lock #Return output to normal opperation and remove pipe exec 1>&3 3>&- 2>&4 4>&- wait $tpid rm $OUTPUT_PIPE #unmount and remove mountpoint umount /agentinstallpoint umount /agentresponsele rmdir /agentinstallpoint rmdir /agentresponsele #create log directory and move log mkdir -p /tmp/itm mv $OUTPUT_LOG /tmp/itm SunOS) echo "your logle is "$OUTPUT_LOG echo "you can locate it in /tmp/itm" #End of AIX install ;; #assign and create pipe (if it doesn't exist) for output duplication OUTPUT_PIPE=output.pipe if [! -e $OUTPUT_PIPE ]; mkfo $OUTPUT_PIPE #Remove old log if [ -e $OUTPUT_LOG ]; rm $OUTPUT_LOG #Reassign output to write to log and console exec 3>&1 4>&2 tee $OUTPUT_LOG < $OUTPUT_PIPE >&3 & exec > $OUTPUT_PIPE 2>&1

16 #Checking if ITM OS Agent is running as process. If the process is running exit from script - itm os agent will not be installed. if [ $(ps -ef grep kuxagent grep -v grep awk 'NR==1{print ($9)}' awk '{ print substr( $0, length($0) - 7, length($0) ) }') == "kuxagent" ] echo ITM OS Agent is already running. ITM OS Agent for unix will not be installed. if [ $(ps -ef grep kuxagent grep -v grep awk 'NR==1{print ($8)}' awk '{ print substr( $0, length($0) - 7, length($0) ) }') == "kuxagent" ] echo ITM OS Agent is already running. ITM OS Agent for unix will not be installed. #Determine if this agent is already present and its current state if present (cinfo -o doesnt work, -o isnt a valid option) if [ '-d $ITMHOMEDEFAULT/bin' ]; echo "ITM Unix agent binaries seem to exist, checking to see if the process is running" if [ "$($ITMHOMEDEFAULT/bin/cinfo -r grep "ux")" == "" ] echo "The process is not running" echo "Checking if the itm os agent is installed" if [ "$($ITMHOMEDEFAULT/bin/cinfo -i grep "ux" awk '{print $1}')" == "ux" ] echo "The ITM OS Agent is installed but the process is not running, you may want to start it" echo "ITM OS Agent is not installed, checking if snmp process is running" elif [ "$($ITMHOMEDEFAULT/bin/cinfo -r grep "ux" awk -F. '{print $4}' - )" == "running" ] echo "The process does seem to be running already, check your TEPS and see if you can see the device, if not you may have it pointed to the wrong TEMS/TEPS" #Determine if SNMP process is already present and its current state on Solaris 8 and Solaris 9

17 #stop install if SNMP is running and congured using right community name if [ '-e /etc/snmp/conf/snmpd.conf' ]; if [ "$(netstat -an grep '*.199' awk '{print $7}')" == "LISTEN" ] echo "The SNMP process does seem to be running already" #echo "checking if snmpd.conf has correct community name set" if [ "$(cat /etc/snmp/conf/snmpd.conf grep read-community awk 'NR==2{print ($2)}')" == "solmills4" ] echo "SNMP cong le is set with right community name." echo "ITM OS Agent will not be installed." #Determine if SNMP process is already present and its current state on Solaris 10 #stop install if SNMP is running and congured using right community name if [ '-e /etc/sma/snmp/snmpd.conf' ]; if [ "$(svcs -a grep sma awk '{print $1}')" == "online" ] echo "The SNMP process does seem to be running already on Solaris 10" #echo "checking if snmpd.conf has correct community name set" if [ "$(cat /etc/sma/snmp/snmpd.conf grep read-community awk 'NR==2{print ($2)}')" == "solmills4" ] echo "SNMP cong le is set with right community name." echo "ITM OS Agent will not be installed." #Determine if the ITM directory exists if [! -e $ITMHOME ] mkdir -p $ITMHOME

18 "307200" ] #Determine if there is enough disk space if [ "$(df -b $ITMHOME awk 'NR==2{print ($2)}')" -lt echo "not enough space in the target lesystem" exit 1 #create mountpoint and mount MSA install directory mkdir -p /agentinstallpoint mkdir -p /agentresponsele #Solaris doesnt support NFS vers 3 by default and thats the NFS being used by MSA (which is an Linux machine) mount -o vers=3 itmagntls.tivlab.austin.ibm.com:/msa/.projects/p10/ibmpublic /agentinstallpoint mount -o vers=3 itmagntls.tivlab.austin.ibm.com:/response_les /agentresponsele $ITMHOME -p \ #Install the agent using the response les /agentinstallpoint/inst.images/aix/itm/6.2.2/agent/install.sh -q -h /agentresponsele/unix_agent_install.rsp #run cong using cong response le $ITMHOME/bin/CandleCong -A -p \ /agentresponsele/unix_agent_cong_austin.rsp ux $ITMHOME/bin/itmcmd agent start ux #Secure ITM executables /opt/ibm/citm/itm/bin/securemain lock #Return output to normal opperation and remove pipe exec 1>&3 3>&- 2>&4 4>&- wait $tpid rm $OUTPUT_PIPE #unmount and remove mountpoint umount /agentinstallpoint umount /agentresponsele rmdir /agentinstallpoint rmdir /agentresponsele #create log directory and move log mkdir -p /tmp/itm mv $OUTPUT_LOG /tmp/itm echo "your logle is "$OUTPUT_LOG echo "you can locate it in /tmp/itm" #End of Solaris install ;;

19 HP-UX) #assign and create pipe (if it doesn't exist) for output duplication OUTPUT_PIPE=output.pipe if [! -d $OUTPUT_PIPE ]; mkfo $OUTPUT_PIPE #Remove old log if [ -d $OUTPUT_LOG ]; rm $OUTPUT_LOG #Reassign output to write to log and console exec 3>&1 4>&2 tee $OUTPUT_LOG < $OUTPUT_PIPE >&3 & exec > $OUTPUT_PIPE 2>&1 #Checking if ITM OS Agent is running as process. If the process is running exit from script - itm os agent will not be installed. if [ $(ps -ef grep kuxagent grep -v grep awk 'NR==1{print ($9)}' awk '{ print substr( $0, length($0) - 7, length($0) ) }') == "kuxagent" ] echo ITM OS Agent is already running. ITM OS Agent for unix will not be installed. if [ $(ps -ef grep kuxagent grep -v grep awk 'NR==1{print ($8)}' awk '{ print substr( $0, length($0) - 7, length($0) ) }') == "kuxagent" ] echo ITM OS Agent is already running. ITM OS Agent for unix will not be installed. #Determine if this agent is already present and its current state if present (cinfo -o doesnt work, -o isnt a valid option) if [ '-d $ITMHOMEDEFAULT/bin' ]; echo "ITM Unix agent binaries seem to exist, checking to see if the process is running" if [ "$($ITMHOMEDEFAULT/bin/cinfo -r grep "ux")" == "" ] echo "The process is not running" echo "Checking if the itm os agent is installed" if [ "$($ITMHOMEDEFAULT/bin/cinfo -i grep "ux" awk '{print $1}')" == "ux" ]

20 echo "The ITM OS Agent is installed but the process is not running, you may want to start it" echo "ITM OS Agent is not installed, checking if snmp process is running" elif [ "$($ITMHOMEDEFAULT/bin/cinfo -r grep "ux" awk -F. '{print $4}' - )" == "running" ] echo "The process does seem to be running already, check your TEPS and see if you can see the device, if not you may have it pointed to the wrong TEMS/TEPS" #Determine if SNMP process is already present and its current state on HP-UX #stop install if SNMP is running and congured using right community name if [ '-e /etc/snmpagent.d/snmpd.conf' ]; if [ "$(netstat -an grep tcp grep 161 awk '{print $6}')" = "LISTEN" ] echo "The SNMP process does seem to be running already on HP-UX" #echo "checking if snmpd.conf has correct community name set" if [ "$(cat /etc/snmpagent.d/snmpd.conf grep get-community-name: grep hpuxmills5 awk '{print $2}')" = "hpuxmills5" ] echo "SNMP cong le is set with right community name." echo "ITM OS Agent will not be installed." #Determine if the ITM directory exists if [! -d $ITMHOME ] mkdir -p $ITMHOME "307200" ] #Determine if there is enough space on disk if [ "$(df -k $ITMHOME awk 'NR==2{print ($1)}')" -lt

21 echo "not enough space in the target lesystem" exit 1 #create mountpoint and mount MSA install directory mkdir -p /agentinstallpoint mkdir -p /agentresponsele mount itmagntls.tivlab.austin.ibm.com:/msa/.projects/p10/ibmpublic /agentinstallpoint mount itmagntls.tivlab.austin.ibm.com:/response_les /agentresponsele $ITMHOME -p \ #Install the agent using the response les /agentinstallpoint/inst.images/aix/itm/6.2.2/agent/install.sh -q -h /agentresponsele/unix_agent_install.rsp #run cong using cong response le $ITMHOME/bin/CandleCong -A -p \ /agentresponsele/unix_agent_cong_austin.rsp ux $ITMHOME/bin/itmcmd agent start ux #Secure ITM Files /opt/ibm/citm/itm/bin/securemain lock #Return output to normal opperation and remove pipe exec 1>&3 3>&- 2>&4 4>&- wait $tpid rm $OUTPUT_PIPE #unmount and remove mountpoint umount /agentinstallpoint umount /agentresponsele rmdir /agentinstallpoint rmdir /agentresponsele #create log directory and move log mkdir -p /tmp/itm mv $OUTPUT_LOG /tmp/itm echo "your logle is "$OUTPUT_LOG echo "you can locate it in /tmp/itm" #End of HP-UX install ;; *) echo "This is not a Unix machine, please retry with the appropriate install script for your OS" ;; esac

22 Windows-agent-install.bat Here is the script for Unix install off echo ########## Checking if this system is already monitored through ITM OS Agent ########## reg query hkey_local_machine\system\currentcontrolset\services\kntcma_primary /v DisplayName > nul IF %ERRORLEVEL% NEQ 0 goto check_snmp echo ITM OS Agent has been found. echo ITM OS Agent will not be installed. Exit /b :check_snmp echo. echo ########## Checking if this system is already monitored through ITM Agentless ########## reg query hkey_local_machine\system\currentcontrolset\services\snmp\parameters\validcommunities /v winmills1 > nul IF %ERRORLEVEL% NEQ 0 goto start_installation for /f "usebackq delims=" %%i in (`"reg query hkey_local_machine\system\currentcontrolset\services\snmp\parameters\validcommunities /v winmills1"`) do set comunity_name=%%i set comunity_name=%comunity_name:~0,13% set comunity_name=%comunity_name: =% if %comunity_name% == winmills1 ( echo. echo SNMP Service is already congured and system is monitored through ITM agentless. echo itm os agent will not be installed. Exit /b ) :start_installation echo Creating temp directiory REM clean up failed install if there and make install directory if exist C:\temp\ITM rmdir /s /q C:\temp\ITM mkdir C:\temp\ITM\itm cd C:\temp\ITM echo getting package REM ftp code here echo open >ftp.txt echo anonymous>>ftp.txt echo itm install>>ftp.txt echo cd ITM>>ftp.txt

23 echo binary>>ftp.txt echo get silent_agentw32_austin.txt>>ftp.txt echo get silent_agentw64_austin.txt>>ftp.txt echo get windowspackage.exe>>ftp.txt echo bye>>ftp.txt ftp -s:ftp.txt cacls "C:\temp\ITM\windowspackage.exe" /e /p users:f echo unpacking windowspackage.exe -s REM install move silent_agentw32_austin.txt WINDOWS move silent_agentw64_austin.txt WINDOWS cd WINDOWS cacls "C:\temp\ITM\WINDOWS" /e /t /p users:f :END echo PLEASE WAIT: The Agent will now install. This may take a few minutes and open some windows. IF PROCESSOR_ARCHITECTURE == x86 AND PROCESSOR_ARCHITEW6432 NOT DEFINED (goto b32) else goto (b64) :b32 start /wait./setup /z"/sfc:\temp\itm\windows\silent_agentw32_austin.txt" /s goto END :b64 start /wait./setup /z"/sfc:\temp\itm\windows\silent_agentw64_austin.txt" /s goto END :END echo Removing install source cd C:\temp rmdir /s /q C:\temp\ITM echo Install log can be found at \IBM\citm\ITM\InstallITM echo For a successful install the log will be called "IBM Tivoli Monitoring DATE" echo For a failure it will be "Abort IBM Tiovli Monitoring DATE" echo Running check. If the install worked you should see output like "Hostname NT NT AUTHORITY\SYSTEM 4:43:42 PM Running Primary" C:\IBM\citm\ITM\InstallITM\KinCInfo.exe -r