User s Guide - Beta 1 Draft

Transcription

1 IBM Tioli Composite Application Manager for Microsoft Applications: Microsoft Actie Directory Agent Next User s Guide - Beta 1 Draft SC

2

3 IBM Tioli Composite Application Manager for Microsoft Applications: Microsoft Actie Directory Agent Next User s Guide - Beta 1 Draft SC

4 Note Before using this information and the product it supports, read the information in Notices on page 241 This edition applies to Next of IBM Tioli Composite Application Manager for Microsoft Applications: Microsoft Actie Directory Agent (product number 5724-U17) and to all subsequent releases and modifications until otherwise indicated in new editions. Copyright IBM Corporation 2005, US Goernment Users Restricted Rights Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

5 Contents Tables Chapter 1. Oeriew of the agent IBM Tioli Monitoring New in this release Components of the IBM Tioli Monitoring enironment Agent Management Serices User interface options Features of the Microsoft Actie Directory agent.. 3 Data sources Chapter 2. Agent installation and configuration Requirements Installing language packs Windows systems UNIX or Linux systems Silent installation of language packs on Windows, UNIX, or Linux systems Prerequisites checking Agent-specific installation and configuration Running as a non-administrator user Configuring caching Configuring ping ariables Configuring Actie Directory logical iew Enironment ariables for Eent Log attributes 14 Enironment ariables for LDAP attributes Enironment ariable for Organizational Units attributes Enironment ariable for Replication Conflict Object attributes Enironment ariables for Sysol replication.. 15 Chapter 3. Workspaces reference Predefined workspaces Workspace description Chapter 4. Attributes reference Attributes in each attribute group Address Book attributes Actie Directory Database Information attributes 29 Containers attributes DHCP attributes Directory Serices attributes Distributed File System Replication attributes.. 37 DFS Replication Connections attributes DFS Replication Folders attributes DFS Serice Volumes attributes DNS ADIntegrated attributes DNS ADIntegrated Details attributes DNS attributes Domain Controller Aailability attributes Domain Controller Performance attributes Eent Log attributes Exchange Directory Serices attributes File Replication Serice attributes Forest Topology attributes Group Policy Object attributes Kerberos Key Distribution Center attributes.. 71 Knowledge Consistency Checker attributes Lightweight Directory Access Protocol attributes 73 LDAP attributes Local Security Authority attributes Lost and Found Objects attributes Moed or Deleted Organizational Units attributes 79 Name Serice Proider attributes Netlogon attributes Password Settings Objects attributes Replication attributes Replication Conflict Objects attributes Replication Partner attributes Replication Partner Latency attributes RID Pool Information attributes Root Directory Serer attributes Security Accounts Manager attributes Serices attributes Sysol Replication attributes Trust attributes Trust Topology attributes Disk capacity planning for historical data Chapter 5. Situations reference Predefined situations Situations descriptions Actie Directory Database Information workspace situations DHCP workspace situations Directory System Agent workspace situation Distributed File System Replication workspace situation DNS workspace situations DNS ADIntegrated workspace situations Domain Controller Aailability workspace situations Domain Controller Performance workspace situations File Replication Serice workspace situations 117 Group Policy Objects workspace situations Kerberos Key Distribution Center workspace situations Knowledge Consistency Checker workspace situation Lightweight Directory Access Protocol workspace situation LDAP Attributes workspace situation Name Serice Proider workspace situation Moed or Deleted Organizational Units workspace situation Copyright IBM Corp. 2005, 2013 iii

6 Replication workspace situations Replication Partner workspace situations Replication Partner Latency workspace situations RID Pool Information workspace situations Trust workspace situations Chapter 6. Take Action commands reference Take Action command descriptions Fetch Disabled User Accounts Fetch Expired User Accounts Fetch Expired Password User Accounts Fetch Inactie User Accounts Fetch Inalid Logon Attempts User Accounts 129 Fetch Locked User Accounts Fetch New User Accounts Chapter 7. Policies reference Predefined policies Chapter 8. Tioli Common Reporting for the monitoring agent Cognos-based report packages Prerequisites Importing Cognos report packages Cognos data models and reports Chapter 9. Troubleshooting Gathering product information for IBM Software Support Built-in troubleshooting features Problem classification Trace logging Oeriew of log file management Examples of trace logging Principal trace log files RAS trace parameters Problems and workarounds Installation and configuration troubleshooting 162 Agent troubleshooting Troubleshooting for remote deployment Workspace troubleshooting Situation troubleshooting Tioli Common Reporting troubleshooting Support information Upgrading your warehouse with limited user permissions Appendix B. Eent mapping Appendix C. Discoery Library Adapter for the Microsoft Actie Directory agent DLA data model class types represented in CDM 227 DLA data model classes for Microsoft Actie Directory agent ActieDirectory class SericeAccessPoint class BindAddress class IpAddress class Appendix D. Integration with Tioli Business Serice Manager Components for integrating with Tioli Business Serice Manager Tasks to integrate the agent with Tioli Business Serice Manager Installing the Discoery Library Toolkit on the Tioli Business Serice Manager Configuring the Tioli Eent Integration Facility (EIF) probe to enrich eents Creating a serice in Tioli Business Serice Manager Creating a data source mapping for each data source Configuring additional IBM Tioli Monitoring web serices Viewing data in the Tioli Enterprise Portal Appendix E. Documentation library 237 Prerequisite publications Related publications Other sources of documentation Notices Trademarks Index Appendix A. Upgrading for warehouse summarization Tables in the warehouse Effects on summarized attributes i Microsoft Actie Directory agent: User s Guide

7 Tables 1. Mechanisms used to gather attributes Ping ariables descriptions and default alues Capacity planning for historical data logged by the Microsoft Actie Directory agent Lightweight Directory Access Protocol report Actie Directory Authentication report Flexible Single Master Operation Role Aailability report Replication Failure on Directory Partition report Replication Failure on Partners report Serice Aailability report DNS Performance report Global Catalog Serer Aailability report Trust Aailability report Replication Latency Heat Map report Information to gather before contacting IBM Software Support Trace log files for troubleshooting agents Problems and solutions for installation and configuration General problems and solutions for uninstallation Agent problems and solutions Remote deployment problems and solutions Workspace problems and solutions Specific situation problems and solutions Problems with configuring situations that you sole in the Situation Editor Problems with configuration of situations that you sole in the Workspace area Tioli Common Reporting for Microsoft Actie Directory agent problems and solutions Time periods and suffixes for summary tables and iews Additional columns to report summarization information Oeriew of attribute groups to eent classes and slots Copyright IBM Corp. 2005, 2013

8 i Microsoft Actie Directory agent: User s Guide

9 Chapter 1. Oeriew of the agent IBM Tioli Monitoring New in this release The IBM Tioli Composite Application Manager for Microsoft Applications: Microsoft Actie Directory Agent proides you with the capability to monitor Actie Directory. You can also use the agent to take basic actions with the Actie Directory. IBM Tioli Monitoring is the base software for the Microsoft Actie Directory agent. The Microsoft Actie Directory agent monitors the following functions: Aailability and resources Performance Error and eent log Historical data IBM Tioli Monitoring proides a way to monitor the aailability and performance of all the systems in your enterprise from one or seeral designated workstations. It also proides useful historical data that you can use to track trends and to troubleshoot system problems. You can use IBM Tioli Monitoring to achiee the following tasks: Monitor for alerts on the systems that you are managing by using predefined situations or custom situations. Establish your own performance thresholds. Trace the causes leading to an alert. Gather comprehensie data about system conditions. Use policies to take actions, schedule work, and automate manual tasks. The Tioli Enterprise Portal is the interface for IBM Tioli Monitoring products. You can use the consolidated iew of your enironment as seen in the Tioli Enterprise Portal to monitor and resole performance issues throughout the enterprise. See the IBM Tioli Monitoring publications listed in Prerequisite publications on page 237 for complete information about IBM Tioli Monitoring and the Tioli Enterprise Portal. For the Microsoft Actie Directory agent, the following enhancements hae been made since ersion 6.3, including the fix packs: Modified attribute groups: RID Pool Information Modified workspaces: RID Pool Information New iews: Exhausted RID Status New situations: Copyright IBM Corp. 2005,

10 RID_Consumption_Crit Updated k3z.baroc file to support Tioli Enterprise Console eent mapping Components of the IBM Tioli Monitoring enironment Agent Management Serices User interface options After you install the Microsoft Actie Directory agent (product code k3z or 3z) as directed in the IBM Tioli Monitoring Installation and Setup Guide, you hae an enironment that contains the client, serer, and monitoring agent implementation for IBM Tioli Monitoring. This enironment contains the following components: Tioli Enterprise Portal client with a Jaa-based user interface for iewing and monitoring your enterprise. Tioli Enterprise Portal Serer that is placed between the client and the Tioli Enterprise Monitoring Serer and enables retrieal, manipulation, and analysis of data from the monitoring agents. Tioli Enterprise Monitoring Serer, which acts as a collection and control point for alerts receied from the monitoring agents, and collects their performance and aailability data. Monitoring agent, Microsoft Actie Directory agent, which collects and distributes data to a Tioli Enterprise Monitoring Serer. Operating system agents and application agents installed on the systems or subsystems you want to monitor. These agents collect and distribute data to the Tioli Enterprise Monitoring Serer. Tioli Data Warehouse for storing historical data collected from agents in your enironment. The data warehouse is located on an IBM DB2, Oracle, or Microsoft SQL database. To collect information to store in this database, you must install the Warehouse Proxy agent. To perform aggregation and pruning functions on the data, install the Warehouse Summarization and Pruning agent. IBM Tioli Enterprise Console eent synchronization component for synchronizing the status of situation eents that are forwarded to the eent serer. When the status of an eent is updated because of Tioli Enterprise Console rules or operator actions, the update is sent to the monitoring serer, and the updated status is reflected in both the Situation Eent Console and the Tioli Enterprise Console eent iewer. For more information, see IBM Tioli Monitoring Installation and Setup Guide. You can use IBM Tioli Monitoring Agent Management Serices to manage the Microsoft Actie Directory agent. These serices are aailable in the following IBM Tioli Monitoring OS agents: Windows, Linux, and UNIX. The serices are designed to keep the Microsoft Actie Directory agent aailable, and to proide information about the status of the product to the Tioli Enterprise Portal. IBM Tioli Monitoring V6.2.2, Fix Pack 2 or later proides support for Agent Management Serices. For more information about Agent Management Serices, see the IBM Tioli Monitoring Administrator's Guide, "Agent Management Serices" chapter. Installation of the base Tioli Monitoring software and other integrated applications proides the following interfaces that you can use to work with your resources and data: 2 Microsoft Actie Directory agent: User s Guide

11 Tioli Enterprise Portal browser client interface The client interface is a graphical user interface (GUI) based on Jaa on a Windows or Linux workstation. You can run the Tioli Enterprise Portal as a desktop application or a browser application. The browser application is automatically installed with the Tioli Enterprise Portal Serer. The desktop application is installed using the Tioli Monitoring installation media or with Jaa Web Start. Tioli Enterprise Portal Serer. To start Tioli Enterprise Portal browser client in your Internet browser, enter the URL for a specific Tioli Enterprise Portal browser client installed on your web serer. Command Line Interface You can use IBM Tioli Monitoring commands to manage Tioli Monitoring components and their configuration. There are also commands that you can run at the Tioli Enterprise Console eent serer IBM Tioli Enterprise Console An eent management application that integrates system, network, database, and application management to help ensure optimal aailability of an IT serice for an organization. Manage Tioli Enterprise Monitoring Serices window The window for the Manage Tioli Enterprise Monitoring Serices utility is used for configuring the monitoring agent and starting Tioli serices not designated to start automatically. Features of the Microsoft Actie Directory agent The Microsoft Actie Directory agent proides a central point of management for your Microsoft Actie Directory serice. It proides a comprehensie way for gathering information that is needed to detect problems early and to preent them. You can monitor many serers from a single workstation, and information is standardized across the system. Use the Microsoft Actie Directory agent to easily collect and analyze the following types of Actie Directory-specific information: Sysol replication details Forest-wide trust relationship details Time drift monitoring information Network replication status and performance details Directory system utilization information Local security authority details Name Serice (NS) details Security Account Manager (SAM) details File Replication Serice (FRS) details Distributed File Replication (DFS-R) details Actie Directory network status DNS details releant to Actie Directory DHCP details releant to Actie Directory Physical storage details for Actie Directory Knowledge Consistency Checker details Kerberos Key Distribution Center details Lightweight Directory Access Protocol details Chapter 1. Oeriew of the agent 3

12 Address book performance and utilization details Built-in logon authentication and user authorization information Communication data between the Actie Directory and Exchange Directory Serice (XDS) Actie Directory database and details of log files Eent log entries that are related to the Directory Serices or the Domain Naming System (DNS) Serer of Actie Directory. Conflict objects details Details of organizational units that are moed or deleted RID pool resource aailability Netlogon authentication performance Information about the Actie Directory Password Settings objects The Microsoft Actie Directory agent proides the following benefits: Supports 64-bit operating system Supports dynamic reorganization of the Actie Directory logical iew Proides bind functionality to check serer aailability Proides a graphical representation of the Trust Topology Increases knowledge with extensie reporting capabilities that proide real-time access to reliable, up-to-the-minute data. You can make faster, better-informed operating decisions. Enhances system performance because you can integrate, monitor, and manage your system, enironment, console, and mission-critical applications. For example, the Microsoft Actie Directory agent can alert you when conditions in your enironment meet or exceed the thresholds you set. These alerts notify your system administrator to limit and control system traffic. Simplifies application and system management by managing applications, platforms, and resources across your system. Identifies bottlenecks and performance issues. Aids in capacity planning and analysis. Data sources The Microsoft Actie Directory agent collects data from the following sources: API CL Most of the attributes gathered by the Monitoring agent for Actie Directory come from Application Programming Interfaces (API). When there is no API aailable for a particular function, Command Language (CL) commands hae been used. Table 1. Mechanisms used to gather attributes Collection Attribute group source API/CL names Address Book API Performance Data Helper Containers API Actie Directory Serice Interfaces DNS ADIntegrated API Actie Directory Serice Interfaces Windows API DNS ADIntegrated Details API Actie Directory Serice Interfaces Windows API 4 Microsoft Actie Directory agent: User s Guide

13 Table 1. Mechanisms used to gather attributes (continued) Collection Attribute group source API/CL names DFS Replication Connections API Performance Data Helper DFS Serice Volumes API Performance Data Helper DFS Replication Folders API Performance Data Helper DHCP API Performance Data Helper Directory Serices API Performance Data Helper DNS API Performance Data Helper Domain Controller Aailability API Windows API Actie Directory Serice Interfaces Domain Controller Aailability CL ping Domain Controller API Performance Data Helper Performance Windows API Actie Directory Serice Interfaces Exchange Directory Serices API Performance Data Helper File Replication Serice API Performance Data Helper Forest Topology API Actie Directory Serice Interfaces Kerberos Consistency Checker API Performance Data Helper Kerberos Key Distribution Centre API Performance Data Helper Lightweight Directory Access API Performance Data Helper Protocol Actie Directory Serice Interfaces Lost and Found Objects API Actie Directory Serice Interfaces Local Security Authority API Performance Data Helper Name Serice Proider API Performance Data Helper Replication API Performance Data Helper Windows API Actie Directory Serice Interfaces Replication CL net time Replication Partner API Windows API Actie Directory Serice Interfaces Replication Partner Latency API Windows API Actie Directory Serice Interfaces Root Directory Serer API Actie Directory Serice Interfaces Security Accounts Manager API Performance Data Helper Serices API Serice Control Manager Sysol Replication API Windows API Sysol Replication CL ntfrsutl Trust API Windows API Trust CL netdom erify Trust Topology API Actie Directory Serice Interfaces Chapter 1. Oeriew of the agent 5

14 Table 1. Mechanisms used to gather attributes (continued) Collection Attribute group source API/CL names Eent Logs API Windows Eent Log API Actie Directory Database API Windows API Information Replication Conflict Objects API Actie Directory Serice Interfaces Moed or Deleted API Actie Directory Serice Interfaces Organizational Units RID Pool Information API Actie Directory Serices Interfaces Netlogon Attributes API Performance Data Helper Password Settings Object API Actie Directory Serice Interfaces 6 Microsoft Actie Directory agent: User s Guide

15 Chapter 2. Agent installation and configuration Requirements Installing language packs This chapter contains information about the requirements and configuration for the IBM Tioli Composite Application Manager for Microsoft Applications: Microsoft Actie Directory Agent. With the self-describing agent capability, new or updated IBM Tioli Monitoring agents can become operational after installation without haing to perform additional product support installation steps. To take adantage of this capability, see "Enabling self-describing agent capability at the hub monitoring serer" in the IBM Tioli Monitoring Installation and Setup Guide. Also, see the IBM Tioli Monitoring Administrator's Guide for additional information about using this capability. Before installing and configuring the agent, make sure your enironment meets the requirements for the IBM Tioli Composite Application Manager for Microsoft Applications: Microsoft Actie Directory Agent. For information about requirements, see the Prerequisites topic for the agent in the IBM Tioli Composite Application Manager for Microsoft Applications Information Center tiihelp/24r1/topic/ com.ibm.itcamms.doc_6.3/welcome_msapps63.html). Before you install a language pack for the agent support files on the Tioli Enterprise Monitoring Serer, the Tioli Enterprise Monitoring Agent, and the Tioli Enterprise Portal Serer, ensure that you hae installed the product in English. Perform the following steps depending on the operating system that you are using. Windows systems This section contains the procedure for installing a language pack on a Windows system. Procedure 1. Double-click lpinstaller.bat file in the language pack CD to start the installation program. 2. Select the language of the installer and click OK. 3. Click Next on the Introduction panel. 4. Click Add/Update and click Next. 5. Select the folder in which the National Language Support package (NLSPackage) files are located. Note: Usually the NLSPackage files are located in the nlspackage folder where the executable installer is located. 6. Select the language support for the agent of your choice and click Next. Note: You can select multiple languages by pressing the Ctrl key. Copyright IBM Corp. 2005,

16 7. Select the languages that you want to install and click Next. 8. Examine the installation summary page and click Next to start the installation. 9. Click Finish after the installation completes. 10. Restart the Tioli Enterprise Portal (if on the Tioli Enterprise Portal Serer) or restart the Tioli Enterprise Portal Serer (if on the Tioli Enterprise Portal Serer component). UNIX or Linux systems This section contains the procedure for installing a language pack on a UNIX or Linux system. Procedure 1. Run the following command to create a temporary directory on the computer. Ensure that the full path of the directory does not contain any spaces: mkdir dir_name 2. Mount the language pack CD to the temporary directory that you hae created. 3. Run the following command to start the installation program: cd dir_name lpinstall.sh ITM Home Directory where ITM Home Directory is the location where you hae installed IBM Tioli Monitoring. Usually it is /opt/ibm/itm for AIX and Linux. 4. Select the language of the installer and click OK. 5. Click Next on the Introduction panel. 6. Click Add/Update and click Next. 7. Select the folder in which the National Language Support package (NLSPackage) files are located. Note: Usually, the NLSPackage files are located in the nlspackage folder where the installer executable is located. 8. Select the language support for the agent of your choice and click Next. Note: You can select multiple languages by pressing the Ctrl key. 9. Select the languages that you want to install and click Next. 10. Examine the installation summary page and click Next to start the installation. 11. Click Finish after the installation completes. 12. Restart the Tioli Enterprise Portal (if on the Tioli Enterprise Portal Serer) or restart the Tioli Enterprise Portal Serer (if on the Tioli Enterprise Portal Serer component). Silent installation of language packs on Windows, UNIX, or Linux systems You can use the silent-mode installation method to install the language packs. In silent mode, the installation process obtains the installation settings from a predefined response file. It does not prompt you for any information. Before you begin First, make sure that you installed the product in the English language. 8 Microsoft Actie Directory agent: User s Guide

17 Procedure 1. Copy and paste the ITM_Agent_LP_silent.rsp response file template as shown in Response file example. 2. Change the following parameter settings: NLS_PACKAGE_FOLDER Folder where the National Language Support package (NLSPackage) files are located. Typically, the NLSPackage files are located in the nlspackage folder, for example: NLS_PACKAGE_FOLDER = //tmp//lp//nlspackage. PROD_SELECTION_PKG Name of the language pack to install. Seeral product components can be included in one language package. You might want to install only some of the aailable components in a language pack. BASE_AGENT_FOUND_PKG_LIST Agent for which you are installing language support. This alue is usually the same as PROD_SELECTION_PKG. LANG_SELECTION_LIST Language you want to install. 3. Enter the command to install the language pack with a response file (silent installation): For Windows systems: lpinstaller.bat -f path_to_response_file For UNIX or Linux systems: lpinstaller.sh -c candle_home -f path_to_response_file where candle_home is the IBM Tioli Monitoring base directory. Response file example # IBM Tioli Monitoring Agent Language Pack Silent Installation Operation # #This is a sample response file for silent installation mode for the IBM Tioli #Monitoring Common Language Pack Installer. #. #This file uses the IBM Tioli Monitoring Common Agent Language Pack with the #install package as an example. #Note: #This response file is for the INSTALLATION of language packs only. #This file does not support UNINSTALLATION of language packs in silent mode. # # #To successfully complete a silent installation of the the example of Common Agent #localization pack, complete the following steps: # #1.Copy ITM_Agent_LP_silent.rsp to the directory where lpinstaller.bat or #lpinstaller.sh is located (IBM Tioli Monitoring Agent Language Pack build #location). # #2.Modify the response file so that it is customized correctly and completely for #your site. # Complete all of the following steps in the response file. # #3.After customizing the response file, inoke the silent installation using the #following command: #For Windows: # lpinstaller.bat -f <path_to_response_file> #For UNIX and Linux: # lpinstaller.sh -c <candle_home> -f <path_to_response_file> Chapter 2. Agent installation and configuration 9

18 Prerequisites checking #Note:<candle_home> is the IBM Tioli Monitoring base directory. # # #Force silent install mode. # INSTALLER_UI=silent # #Run add and update actions. # CHOSEN_INSTALL_SET=ADDUPD_SET # #NLS Package Folder, where the NLS Packages exist. #For Windows: # Use the backslash-backslash(\\) as a file separator (for example, #C:\\zosgm\\LCD \\nlspackage). #For UNIX and Linux: # Use the slash-slash (//) as a file separator (for example, #//installtioli//lpsilenttest//nlspackage). # #NLS_PACKAGE_FOLDER=C:\\zosgm\\LCD \\nlspackage NLS_PACKAGE_FOLDER=//tmp//LP//nlspackage # #List the packages to process; both ariables are required. #Each ariable requires that full paths are specified. #Separate multiple entries with a semicolon (;). #For Windows: # Use the backslash-backslash(\\) as a file separator. #For Unix and Linux: # Use the slash-slash (//) as a file separator. # #PROD_SELECTION_PKG=C:\\zosgm\\LCD \\nlspackage\\KIP_NLS.nlspkg #BASE_AGENT_FOUND_PKG_LIST=C:\\zosgm\\LCD \\nlspackage\\KIP_NLS.nlspkg PROD_SELECTION_PKG=//tmp//LP//nlspackage//kex_nls.nlspkg;//tmp//LP//nlspackage// koq_nls.nlspkg BASE_AGENT_FOUND_PKG_LIST=//tmp//LP//nlspackage//kex_nls.nlspkg;// tmp//lp//nlspackage//koq_nls.nlspkg # #List the languages to process. #Separate multiple entries with semicolons. # LANG_SELECTION_LIST=pt_BR;fr;de;it;ja;ko;zh_CN;es;zh_TW The prerequisite checker utility erifies whether all the prerequisites that are required for the agent installation are met. The prerequisite checker creates a log file that contains a report of all the prerequisites checks when the prerequisite checker was run. For the Microsoft Actie Directory agent, the prerequisite checker erifies the following requirements: Memory Disk Operating systems Additionally, the prerequisite checker erifies whether the user, who installs the agent, is a member of the Administrators group. For detailed information about installation prerequisites, see the Prerequisites topic for the agent in the IBM Tioli Composite Application Manager for Microsoft Applications Information Center ( tiihelp/24r1/topic/com.ibm.itcamms.doc_6.3/welcome_msapps63.html). 10 Microsoft Actie Directory agent: User s Guide

19 You can run the prerequisite checker in stand-alone mode or remotely. For more information about the prerequisite checker, see "Prerequisite Checking for IBM Tioli Monitoring Agents" in the IBM Tioli Monitoring Installation and Setup Guide. Agent-specific installation and configuration In addition to the installation and configuration information in the IBM Tioli Monitoring Installation and Setup Guide, use this agent-specific installation and configuration information to install the Microsoft Actie Directory agent. Running as a non-administrator user This section proides information about running the Microsoft Actie Directory agent as a non-administrator user. About this task You can run the monitoring agent for Actie Directory as a non-administrator user; howeer, Trust Topology attributes and Sysol Replication attributes might not be aailable. These attributes are aailable only to domain users. To iew the Trust Topology attributes, a non-administrator user must hae the following registry permissions: Grant full access to the HKEY_LOCAL_MACHINE\SOFTWARE\Candle directory. Grant read access to the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib directory. To iew the Sysol Replication attributes, a non-administrator user must hae full access to the Sysol folder on all domain controllers in a domain. Procedure 1. Click Start > Programs > Administratie Tools > Actie Directory Users and Computers. 2. Expand the domain in which you want to create the user by clicking the plus sign (+) next to the name of a domain. 3. Right-click Users, and then click New > User. 4. Create a new user by using the New Object - User wizard. By default, a new user is a member of the Domain Users group. 5. Right-click the new user that is created in the Domain Users group, and click Properties. The "username Properties" window opens, where username is the name of the new user. Complete the following steps in the "username Properties" window: a. Click the Member of tab. In the Member of area, add the Performance Monitor Users group. b. Click Apply, and then click OK. 6. Naigate to the Candle_Home directory. The default path is C:\IBM\ITM. 7. Right-click the ITM folder and click Properties. The ITM Properties window opens. Complete the following steps in the ITM Properties window: a. On the Security tab, click Edit. b. Click Add to add the new user and grant full access to this user. c. Click Apply, and then click OK. 8. Click Start > Run, and then type serices.msc. The Serices window opens. Complete the following steps in the Serices window: Chapter 2. Agent installation and configuration 11

20 a. Right-click the Monitoring Agent for Actie Directory serice, and click Properties. b. In the Monitoring Agent for Actie Directory Properties window, on the Log On tab, click This Account. Enter the user credentials. c. Click Apply, and then click OK. 9. Restart the agent serice. Configuring caching This section proides information about enabling and configuring or disabling the cache feature for the Microsoft Actie Directory agent. About this task When configuring caching, you can enable or disable caching and set the cache interal by using the ADO_CACHE_INTERVAL enironment ariable in the K3ZENV file. Use the ADO_CACHE_INTERVAL enironment ariable to turn caching ON or OFF and to specify the caching interal in seconds. Caching interal is the time interal between two consecutie data collections. You can turn the caching ON by specifying any positie integer alue. You can turn the caching OFF by specifying the alue 0. With caching OFF, the agent collects data on demand. By default, caching is ON, and the caching interal alue is 240. The following attribute groups hae an option for caching the data they collect for some configurable period: Domain Controller Aailability DNS ADIntegrated Domain Controller Performance Replication Replication Latency Replication Partner Trusts Trust Topology Procedure Complete the following steps to turn caching ON or OFF during run time by using the Manage Tioli Enterprise Monitoring Serices: 1. In Manage Tioli Enterprise Monitoring Serices (kinconfig.exe), select the Monitoring Agent for Actie Directory. 2. Right click and go to Adanced options. 3. Select Edit ENV File from the options. This opens the K3ZENV file for editing. The ADO_CACHE_INTERVAL ariable exists in the K3ZENV file. 4. To turn caching OFF, set the ADO_CACHE_INTERVAL ariable to 0. To turn caching ON, set the ADO_CACHE_INTERVAL to any positie integer alue. This alue forms the caching interal in seconds. For instance, a alue of 180 would mean a 3-minute interal. 5. After editing the K3ZENV file, sae and close the file to implement the new cache interal alue. 6. A message box appears asking if the agent needs to be recycled to include the changes in agent functionality. Clicking Yes recycles the agent with the new 12 Microsoft Actie Directory agent: User s Guide

21 caching interal alue. Clicking No lets the agent continue to run without the changes to the caching interal. When the agent is restarted, the changes are implemented. Note: Negatie or zero alue turns off caching. Non-integers (alphabets, special characters, and alphanumeric characters) are not supported for the cache interal and might result in unexpected behaior of the Microsoft Actie Directory agent. The alue can be raised to a higher interal. Configuring ping ariables This section proides information about the ariables for ping count, ping timeout, and ping size. These ariables can be configured by using enironment ariables when the Microsoft Actie Directory agent is started. About this task The alues for ping count, ping timeout, and ping size are configurable through enironment ariables when the agent is started. The default alues are consistent with the current behaior of the agent. Default alues are used if no alue or an unsupported alue is set in the enironment. The following table lists the ariables with their descriptions and default alues. Table 2. Ping ariables descriptions and default alues Variable Description Default alue Unit ADO_PING_COUNT ADO_PING_ TIMEOUT ADO_PING_SIZE The number of ping requests to make. The time to wait for each ping response. The size of the ping packet to send Milli-seconds 32 Bytes Procedure Complete the following steps to set the ping enironment ariables by using the Manage Tioli Enterprise Monitoring Serices (kinconfig.exe): 1. In Manage Tioli Enterprise Monitoring Serices (kinconfig.exe), select the Monitoring agent for Actie Directory. 2. Right-click and select Adanced options. 3. Select Edit ENV File from the options. This option opens the K3ZENV file for editing. The ADO_PING ariables exists in the K3ZENV file. 4. After editing the K3ZENV file, sae and close the file to implement the new ping behaior. 5. A message is displayed asking if the agent should be recycled to include the changes in agent functionality. Clicking Yes recycles the agent with the new ping alues. Clicking No lets the agent continue to run without the changes to the ping alues. When the agent is restarted, the changes are implemented. Note: Non-integers (alphabetics, special characters, and alphanumerics) are not supported for the ping ariables and might result in unexpected behaior of the Monitoring agent for Actie Directory. Chapter 2. Agent installation and configuration 13

22 Configuring Actie Directory logical iew You can configure the Actie Directory logical iew and assign it to the user. Procedure 1. Open Tioli Enterprise Portal, and log in as a system administrator. 2. In the Tioli Enterprise Portal, open the Administer Users window, and select SYSADMIN. 3. In the Naigator View, click the arrow that assigns the Actie Directory iew to the user. Enironment ariables for Eent Log attributes The following enironment ariables are introduced in the agent to support the Eent Log attributes: EVENT_LOG_LEVEL: This enironment ariable determines the leel of details of the eents that are logged by the Actie Directory Serer. This ariable can hae the following alues: ERROR WARNING AUDIT_FAILURE The default alue of this ariable is ERROR. If the alue of this ariable is WARNING, the warning and error logs that are related to the DNS serer and the Directory serices are displayed in the Eent Logs workspace. If the alue of this ariable is AUDIT_ FAILURE, the audit failure, warning, and error logs that are related to the DNS serer and the Directory serices are displayed in the Eent Logs workspace. EVENT_LOG_DURATION: This enironment ariable determines the number of days for which eent logs are displayed in the Eent Logs workspace. The alue of this ariable must be in the range 1 7.Thedefault alue of this ariable is 1 day. Enironment ariables for LDAP attributes The following enironment ariables are introduced for LDAP attributes: ADO_NUMBEROFOBJECTS_TIMEOUT: This enironment ariable is introduced for LDAP attributes. The default alue of this ariable is 1800 seconds. This ariable helps you to restrict the time taken to collect data for the LDAP Attributes Object in Domain in the LDAP Attributes attribute group on a large network. You can set the alue of this ariable as per your requirement. The minimum alue of this ariable must be 1800 seconds. MAX_PASSWORD_AGE: This enironment ariable determines the number of days after which an account password expires if a user has not changed the password. The default alue is 42 days. If the alue of this ariable is set to 0, it indicates that the password neer expires. USER_INACTIVE_DAYS: This enironment ariable determines the number of days after which a user becomes inactie if the user has not logged in to the system. The alue of this ariable must be more than 15. You can disable this feature by specifying the alue of this ariable as 0. The default alue is 0. If you specify a alue that is more than 0 and less than 15, the alue is automatically set to 15. Enironment ariable for Organizational Units attributes The OU_INFORMATION_DURATION enironment ariable determines the number of days for which information about modified organizational units is displayed on 14 Microsoft Actie Directory agent: User s Guide

23 the Tioli Enterprise Portal. The alue of this ariable must be in the range The default alue of this ariable is 1 day. If the alue of this ariable is 0, information about modified organizational units is not displayed on the Tioli Enterprise Portal. Enironment ariable for Replication Conflict Object attributes The ADO_CNFOBJ_CACHE_INTERVAL enironment ariable determines the duration (in minutes) after which the monitoring agent collects the list of replication conflict objects from the Actie Directory Serice Interfaces (ADSI). The alue of this ariable must be equal to or greater than 0. The alue of this ariable must be greater than or equal to 0. The default alue of this ariable is 30 minutes. If the alue of this ariable is 0, the replication conflict objects are not collected. Enironment ariables for Sysol replication Sysol replication can be performed between domain controllers in the same domain only. The Sysol replication test is supported for the File Replication Serice. The following enironment ariables are introduced in the agent to support Sysol replication: ADO_SYSVOL_FORCE_REPLICATION_FLAG : This enironment ariable determines whether the force replication that is initiated by the agent is enabled or disabled. The default alue of this ariable is TRUE. To disable force replication, change the alue of this ariable to FALSE. ADO_SYSVOL_REPLICATION_TEST_INTERVAL: This enironment ariable determines the time interal between two Sysol replication tests. The Actie Directory agent performs the Sysol replication test at regular interals only when the time interal is a positie integer. ADO_SYSVOL_REPLICATION_TEST_VERIFICATION_INTERVAL: This enironment ariable determines the amount of time that the agent waits to erify the results of Sysol replication after completing the Sysol replication test. The unit of time for the preceding enironment ariables is in minutes. The default alue for both the enironment ariables is 0 minutes. Howeer, if the alue of the ADO_SYSVOL_REPLICATION_TEST_INTERVAL ariable is 0 minutes, the agent cannot complete the Sysol replication test. The alue of the ADO_SYSVOL_REPLICATION_TEST_INTERVAL ariable must be greater than the alue of the ADO_SYSVOL_REPLICATION_TEST_VERIFICATION_INTERVAL ariable. After the two enironment ariables are assigned alid alues, the Actie Directory agent creates one file on the Sysol shared folder of the managed system and initializes forced Sysol replication. This forced replication is initialized from the managed system to the Sysol shared folders of the Sysol replication partners. After erifying the results of the replication test, the agent remoes the files that are created and replicated from the managed system and Sysol replication partners. Chapter 2. Agent installation and configuration 15

24 16 Microsoft Actie Directory agent: User s Guide

25 Chapter 3. Workspaces reference A workspace is the working area of the Tioli Enterprise Portal application window. The Naigator tree contains a list of the workspaces proided by the agent. About workspaces Use the Naigator tree to select the workspace you want to see. As part of the application window, the status bar shows the Tioli Enterprise Portal Serer name and port number to which the displayed information applies and the ID of the current user. When you select an item in the Naigator tree, a default workspace is displayed. When you right-click a Naigator item, a menu that includes a Workspace item is displayed. The Workspace item contains a list of workspaces for that Naigator item. Each workspace has at least one iew. Some iews hae links to other workspaces. You can also use the Workspace Gallery tool as described in the Tioli Enterprise Portal User's Guide to open workspaces. The workspaces in the Naigator are displayed in a Physical iew that shows your enterprise as a physical mapping or a dynamically populated logical iew that is agent-specific. You can also create a Logical iew. The Physical iew is the default iew. To select the dynamically populated logical iew, select ADO from the View list in the Naigator. To iew the dynamically populated ADO logical iew, you must log in to the Tioli Enterprise Portal as a system administrator. This monitoring agent proides predefined workspaces. You cannot modify or delete the predefined workspaces, but you can create new workspaces by editing them and saing the changes with a different name. A table iew within a workspace corresponds to a group of attributes; the columns in the table iew show some or all the attributes aailable in the attribute group. Additional information about workspaces For more information about creating, customizing, and working with workspaces, see "Using workspaces" in the Tioli Enterprise Portal User's Guide. For a list of the predefined workspaces for this monitoring agent and a description of each workspace, see Predefined workspaces on page 18 and the information about each indiidual workspace. Some attribute groups for this monitoring agent might not be represented in the predefined workspaces or iews for this agent. For a full list of the attribute groups, see Attributes in each attribute group on page 27. Copyright IBM Corp. 2005,

26 Predefined workspaces 18 Microsoft Actie Directory agent: User s Guide The Microsoft Actie Directory agent proides the following predefined workspaces, which are organized by Naigator item and are aailable in both Physical as well as Logical Naigator View (Actie Directory View): Actie Directory workspace Address Book workspace DHCP workspace Directory System Agent workspace DNS workspace DNS ADIntegrated DNS ADIntegrated workspace DNS ADIntegrated Details workspace Domain Controller Aailability Actie Directory Database Information workspace Domain Controller Aailability workspace Eent Log workspace Serices workspace RID Pool Information workspace Domain Controller Performance workspace Exchange Directory Serice workspace File Replication Serice Distributed File System Replication workspace Distributed File System Replication Details workspace File Replication Serice workspace Forest Topology Forest Topology workspace Domain Controllers Details workspace Kerberos Key Distribution Center workspace Knowledge Consistency Checker workspace Lightweight Directory Access Protocol workspace LDAP Attributes workspaces LDAP Attributes workspace User History worspace Local Security Authority workspace Lost and Found Objects workspace GPO workspaces Group Policy Object workspace Password Settings Object workspace Name Serice Proider workspace Replication Historical workspace Replication workspace Replication Conflict Objects workspace Replication Latency workspace Replication Partner

27 Replication Partner workspace Sysol Replication workspace Root Directory Serer Root Directory Serer workspace Moed or Deleted Organizational Units workspace Security Accounts Manager workspace Trusts Trust workspace Trust Topology workspace Domain Trusts Details workspace Netlogon Attributes workspace Some predefined workspaces are not aailable from the Naigator tree item, but are accessed by selecting the link indicator next to a row of data in a iew. Left-clicking a link indicator selects the default workspace associated with that link. Right-clicking a link indicator displays all linked workspaces that can be selected. The Microsoft Actie Directory agent proides the following composite workspaces: Actie Directory serer LDAP utilization workspace Actie Directory serer NTDS utilization workspace Actie Directory serer replication utilization workspace Actie Directory serice utilization workspace Actie Directory system utilization workspace Actie Directory time difference workspace Workspace description The remaining sections of this chapter contain descriptions of each of these predefined workspaces. These workspace descriptions are organized alphabetically. Actie Directory workspace The Actie Directory workspace proides a iew of the serers and their aailability and a summary of the replication topology. This workspace includes the following iews: FSMO Role Serers table FSMO Serer Aailability table Replication Partner Details table Note: The default workspace for the Actie Directory agent was modifiable, which was a defect. The workspace is changed to make it non-modifiable. Actie Directory serer LDAP utilization workspace The Actie Directory serer LDAP utilization workspace is a composite workspace that proides details about the LDAP utilization. This workspace includes the following iews: DS Search Sub-Operations/sec chart DC LDAP Utilization chart Chapter 3. Workspaces reference 19