IBM Tivoli Monitoring for Transaction Performance: z/os Management Agent Addendum

Transcription

1 IBM Tioli Monitoring for Transaction Performance: z/os Management Agent Addendum IBM Tioli Monitoring for Transaction Performance, Version 5.2 with Fix pack 5.2-WTP-FP01 now supports management agents on the z/os operating system. See Program Directory for IBM Tioli Monitoring for Transaction Performance Management Agent for instructions on installing SMP/e. SMP/e is a tool designed to manage the installation of software products on your z/os operating system and to track the modifications you make to those products. After completing the SMP/e installation, you must configure each management agent. This Addendum proides the following configuration information for z/os management agents: Setting up a z/os management agent Installing IBM Tioli Monitoring for Transaction Performance for z/os software in SYSPLEX Starting or stopping a management agent User roles Unregister the management agent Updated problem determination information Setting up a z/os management agent After completing the SMP/e installation, perform the following steps on each management agent in the LPAR enironment: Additional Information: This section assumes IBM Tioli Monitoring for Transaction Performance for z/os was installed using the installation steps as defined in the Program Directory and no installation defaults were changed (such as z/os UNIX System Serices directories). 1. Access the F2 relfile. 2. Copy the BWMSTRT and BWMSTOP JCL jobs to the system PROCLIB concatenation, such as SYS1.PROCLIB. Additional Information: The BWM jobs are proided as sample jobs in the F2 relfile. SYS1.PROCLIB is a PDS dataset. A PROCLIB is a procedure library. 3. Run the following Resource Access Control Facility (RACF ) commands on a Time Sharing Option (TSO): a. Create a new user and group by running the following commands: ADDGROUP TMTPGRP OMVS(GID(<TMTP_GID>)) SUP(SYS1) ADDUSER TMTPAGNT DFLTGRP(TMTPGRP) PASSWORD(<TMTPAGNT_PASSWORD>) + OMVS(UID(<TMTPAGNT_UID>) HOME( /ar/tmtp ) PROGRAM( /bin/sh ) + ASSIZEMAX( ) CPUTIMEMAX( ) THREADSMAX(1000)) SETROPTS GENERIC(STARTED)

2 <TMTP_GID> Specifies any integer selected by the administrator to represent the group ID on the system. <TMTPAGNT_PASSWORD> Specifies any password selected by the administrator. <TMTPAGNT_UID> Specifies any integer selected by the administrator to represent the user ID. b. Add start and stop jobs to the STARTED class by running the following commands: RDEFINE STARTED BWMSTRT.* STDATA(USER(TMTPAGNT) GROUP(TMTPGRP)) RDEFINE STARTED BWMSTOP.* STDATA(USER(TMTPAGNT) GROUP(TMTPGRP)) SETROPTS CLASSACT(STARTED) RACLIST(STARTED) SETROPTS RACLIST(STARTED) REFRESH SETROPTS GRPLIST c. Add TMTPAGNT user to the WebSphere Application Serer default group by running the following command: CONNECT TMTPAGNT GROUP(<WAS_GRP>) GRPACC <WAS_GRP> Specifies the WebSphere Application Serer default group name (typically WSCFG1). This is the group associated with the WebSphere files in the Hierarchical File System (HFS). d. Add WebSphere Application Serer user to the TMTPAGNT default group by running the following command: CONNECT ASSR1 GROUP(TMTPGRP) GRPACC e. (Optional) Perform the following steps if you run J2EE with WebSphere security enabled: 1) Create a RACF key ring containing a certificate authority signed certificate for the TMTPAGNT user by running the following command: RACDCERT ADDRING(WASKeyring) ID(TMTPAGNT) 2) Generate a digital certificate by running the following command: RACDCERT ID (TMTPAGNT) GENCERT SUBJECTSDN(CN( <COMMON_NAME> ) 0( <ORGANIZATION> )) + WITHLABEL( TMTPCert ) SIGNWITH(CERTAUTH LABEL( <LOCAL_CERTIFICATE_AUTHORITY> )) <COMMON_NAME> Specifies the common name, such as John Smith or WTSC57.ITSO.IBM.COM. The (Secure Sockets Layer) SSL conention uses the domain name as the common name. <ORGANIZATION> Specifies the organization name, such as IBM. <LOCAL_CERTIFICATE_AUTHORITY> Specifies the Certificate Authority certificate, which must be the WebSphere Certificate Authority. You must hae the Certificate Authority of the WebSphere serer on the client key ring to alidate the WebSphere Application Serer certificate. You can use different certificate authorities to sign the certificates, but you must connect all certificate authorities to all key rings. Each serer or client key ring must contain the certificate authority of each peer (eeryone it communicates with oer SSL) as well as its own. A client certificate is not required for communication with WebSphere Application Serer. If the <LOCAL_CERTIFICATE_AUTHORITY> that signed the TMTPAGNT personal certificate is not the same as the WebSphere certificate, you must connect your <LOCAL_CERTIFICATE_AUTHORITY> to the WebSphere serer key ring and restart the serer. 2

3 3) Gie the TMTPAGNT user ID the authority to read the key ring and certificates from the IRR.DIGTCERT profiles by running the following commands: PERMIT IRR.DIGTCERT.LIST CLASS(FACILITY) ID(TMTPAGNT) ACC(READ) PERMIT IRR.DIGTCERT.LISTRING CLASS(FACILITY) ID(TMTPAGNT) ACC(READ) SETROPTS RACLSIT(FACILITY) REFRESH 4) Connect the certificate to the key ring by running the following command: RACDCERT ID(TMTPAGNT) CONNECT (CERTAUTH LABEL( <LOCAL_CERTIFICATE_AUTHORITY> ) RING(WASKeyring)) <LOCAL_CERTIFICATE_AUTHORITY> Specifies the Certificate Authority certificate, which must be the WebSphere Certificate Authority. You must hae the Certificate Authority of the WebSphere serer on the client key ring to alidate the WebSphere Application Serer certificate. You can use different certificate authorities to sign the certificates, but you must connect all certificate authorities to all key rings. Each serer or client key ring must contain the certificate authority of each peer (eeryone it communicates with oer SSL) as well as its own. A client certificate is not required for communication with WebSphere Application Serer. If the <LOCAL_CERTIFICATE_AUTHORITY> that signed the TMTPAGNT personal certificate is not the same as the WebSphere certificate, you must connect your <LOCAL_CERTIFICATE_AUTHORITY> to the WebSphere serer key ring and restart the serer. 5) Connect the certificate to the serer key ring by running the following command: RACDCERT CONNECT (CERTAUTH LABEL(<LOCAL_CERTIFICATE_AUTHORITY>) RING(<keyringname>)) <LOCAL_CERTIFICATE_AUTHORITY> Specifies the Certificate authority label. <keyringname> Specifies the name of the key ring. 4. Log in to UNIX System Serices (USS) as user, UID=0. 5. On UNIX System Serices, run the following commands: mkdir /ar/tmtp chown TMTPAGNT:TMTPGRP /ar/tmtp mkdir /etc/tmtp chown TMTPAGNT:TMTPGRP /etc/tmtp Additional Information: The aboe commands create the UNIX System Serices directories, /ar/tmtp and /etc/tmtp, with the user and group, TMTPAGNT:TMTPGRP. 6. Log off of UNIX System Serices. 7. Log in to UNIX System Serices as TMTPAGNT, and change to the /tmp directory. 8. Configure the management agent by performing the following steps: a. Copy the /usr/lpp/tmtp/v5r2m0/ma/config1/prepconfig.sh and setupen.sh files to the /tmp directory. b. Ensure that the /ar/tmtp and /etc/tmtp directories hae minimum permissions of 750. Additional Information: All directories are created with 755 permissions, except for /ar/tmtp/ma/app which has 775 permissions. c. Verify that the setupen.sh command script points to the correct JAVA_DIR and TMTP_DIR directories. d. Run the prepconfig.sh command script. 3

4 e. Change directories to /etc/tmtp/ma/config. f. Open the zos.properties file and customize the following alues so that the configma.sh command script can register the management agent to the management serer: Property file setting zos.mshostname=<mshost> zos.msusername=<user> zos.msuserpassword=<password> zos.sslenabled=false zos.msprotocol=http zos.msport=9081 zos.proxyprotocol=noproxy zos.proxyhostname= zos.proxyportnumber= #zos.epkeystore=<keystore> #zos.epkeypass=<keypass> #zos.mahostname=<mahostname> Description <mshost> is the fully qualified host name for the management serer. <user> is the name of the user that exists in the management serer. <password> is the password for the user name specified aboe. Set this to true if the management serer is secure. Set this to https if the management serer is secure. Set this to the secure port if the management serer is secure. The default is Specify the proxy protocol as one of the following options: noproxy, https, or socks. The default is noproxy. If there is a proxy, specify the host name of the proxy. If there is a proxy, specify the port number used by the proxy. If the management serer is secure, uncomment this setting and set the <keystore> alue to the location of the JKS certificate file. The default key is located in the /etc/tmtp/ma/config/agent.jks. If the management serer is secure, uncomment this setting and set the <keypass> alue to the password of the JKS certificate. The default password for the agent.jks file is changeit. Uncomment this setting and type the fully qualified local host name of the management agent for <mahostname>. If not commented out, this setting is determined automatically. g. Run the configma.sh command script with the argument install such as >>./configma.sh install. h. (Optional) Start the management agent as described in Starting or stopping a management agent on page 5. i. (Optional) Change the zos.properties file permissions to protect the password. j. Enable synchronization between the WebSphere Application Serer Network Deployment Manager, node agent, and the WebSphere Application Serer by performing the following steps: 1) Disable Global Security. 2) Restart the WebSphere Application Serer Network Deployment Manager, the node agent, and the WebSphere Application Serer. 3) Set the WebSphere Application Serer configuration parameter, GlobalSecurity CustomProperties EnableTrustedApplications to true. 4) Reenable WebSphere Application Serer Global Security. 5) Restart the WebSphere Application Serer Network Deployment Manager, node agent, and WebSphere Application Serer. Installing IBM Tioli Monitoring for Transaction Performance for z/os software in a SYSPLEX enironment When installing IBM Tioli Monitoring for Transaction Performance software in a SYSPLEX enironment on the z/os operating system, perform the following steps: 1. On one LPAR in the SYSPLEX enironment, create the zone and complete the SMP/e installation. 2. On each LPAR in the SYSPLEX enironment, perform the following steps: 4

5 a. Run the RACF configuration steps as described in Step 3 on page 1. b. Configure system enironment settings (including semaphores) as described on page 7. c. Configure each management agent indiidually as described in Step 8 on page 3. Starting or stopping a management agent After you configure each management agent, you can start or stop the management agent using one of the following options: As a script from UNIX System Serices: Start the management agent by running the /etc/tmtp/ma/config/start_tmtpd.sh command script while logged in to UNIX System Serices as TMTPAGNT. OR Stop the management agent by running the /etc/tmtp/ma/config/stop_tmtpd.sh command script while logged in to UNIX System Serices as TMTPAGNT. OR As a task from Multiple Virtual Storage (MVS): Start the management agent with the BWMSTRT job. OR Stop the management agent with the BWMSTOP job. Additional Information: When canceling MVS processes, qualify the TMTPAGNT processes with an ASID. The tapmagent and management agent Jaa processes listed in the SDSF console do not hae separate job names. To cancel MVS processes without using BWMSTOP, qualify the cancel command with indiidual ASIDs by running the following command from the MVS console: "C TMTPAGNT,A=<hexasidnumber>" where <hexasidnumber> is the ASID for one of the two processes. You can erify that the management agent is actie by checking the IBM Tioli Monitoring for Transaction Performance UI System Administration Work with Agents iew. User roles Seeral roles are inoled in installing and configuring IBM Tioli Monitoring for Transaction Performance for z/os. Each role can be the responsibility of a different person. The following list describes the typical user roles and their tasks: Network administrator Enables communication between systems, such as opening ports. Understands firewall implications. Tioli administrator Installs and configures the management system. Proides the SSL key database file to the USS administrator. Installs and configures the Tioli Enterprise Console serer, if not already completed. Enables Tioli Enterprise Console by installing the base BAROC files. z/os system programmer Performs SMP/e installation of IBM Tioli Monitoring for Transaction Performance on z/os. SMP/e installation is usually completed under UID=0 (in MVS terms). The same user who performs the SMP/e installation can perform the configuration and operation. To perform the 5

6 configuration and operation, the user must be TMTPAGNT, under group, TMTPGRP. TMTPAGNT does not need to be the same user who performed the SMP/E installation. z/os security (RACF) administrator Defines users and groups. Sets up the system to allow the management agent to be started as a task. z/os USS administrator Defines and sets up file systems (such as run time directory as its own file system, and Tioli common directory as its own file system). Sets up SSL for the management agent. Unregistering the management agent To unregister the management agent from the management serer, perform the following steps: 1. (Optional) Remoe J2EE components from the z/os management agent by performing the following steps: Additional Information: Uninstalling the z/os management agent does not remoe the deployed J2EE components. WebSphere can fail to start if the management agent on z/os is uninstalled without first remoing J2EE components. a. In the UI, click System Administration Work with Agents, and select the agents on which the J2EE component is running. b. Select Remoe component from the drop-down list, and click Go. c. Select the J2EE component for remoal, select Remoe from the drop-down list, and click Go. d. Restart the J2EE-instrumented application serer. 2. On the management agent, change to the following directory: /etc/tmtp/ma/config. 3. Run the following command:./configma.sh uninstall Updated problem determination information This section proides updated information about how to troubleshoot problems that occur when you run IBM Tioli Monitoring for Transaction Performance for z/os software and how to perform recoery actions. Install IBM Tioli Monitoring for Transaction Performance for z/os software in the /usr/lpp/tmtp directory. IBM Tioli Monitoring for Transaction Performance for z/os is only supported when installed in the default path of /usr/lpp/tmtp. Using the BWMMKDIR job to modify the installation directory path is not supported. Trace logging for J2EE has different directory structures for z/os and non-z/os operating systems. J2EE jlog directories on z/os operating systems are created in the following default location on a serant basis only: <management_agent_root>/app/instrument/appserers/<serer_directory>/bwm/logs. This directory contains the following files and directories: Files: LCK_<N>_<PID> Directories: proc<n> <PID> Corresponds to a serant process ID. 6

7 <N> Represents an integer greater than 1. J2EE logs for a serant with the process ID, <PID>, can be found in the directory, proc<n>, when the LCK_<N>_<PID> file and proc<n> directory hae the same alue for N. Serant processes delete the lock file corresponding to its PID when they exit. These processes do not delete the proc<n> directories so that they can be reused as a logging destinations for new serants. If WebSphere Application Serer stops abnormally (such as in a cancel operation), the LCK_<N>_<PID> file and proc<n> directory are not deleted. You can optionally delete the LCK file to make the corresponding proc directory aailable as a logging destination. System enironment settings (including semaphores) require certain alues. To function properly, the system enironment settings in the USER.PARMLIB(BPXPRM01) job or the SYS1.PARMLIB(BPXPRMZZ) job must hae the following minimum settings: IPCSEMNIDS(4096) IPCSEMNOPS(32767) IPCSEMNSEMS(32767) IPCMSGNIDS(4096) IPCMSGQBYTES( ) IPCMSGQMNUM( ) IPCSHMMPAGES(524287) IPCSHMNIDS(4096) IPCSHMNSEGS(1000) IPCSHMSPAGES(786432) MAXFILEPROC(65535) SHRLIBMAXPAGES(5120) MAXASSIZE( ) MAXCPUTIME( ) MAXPROCSYS(4000) You can change these settings from the MVS command line with the following command: "/setoms <system setting>=<alue>" where <system setting> is one of the aboe setting codes and <alue> is the corresponding numeric alue. For example, run "/setoms IPCSEMNSEMS=32767" to set the semaphore option to 32,767 semaphores. You can add additional logging to the semaphore code in z/os CIPCQueue implinitialize. Synchronization fails during serer configuration, such as J2EE deployment. An authentication or synchronization failure error in the MVS console or WebSphere log indicates that the WebSphere Application Serer Network Deployment serer and WebSphere Application Serer were not properly synchronized before the serer configuration (such as installing J2EE). The SECJ0055E error might display when this occurs. To correct synchronization, perform the following steps: 1. Stop the application serer and node agent. 2. On the application serer, run the syncnode.sh command script to synchronize the node with the cell. 3. Restart the node agent and application serer. An unknown operating system warning occurs when the collectmacfg.sh script cannot find Jaa on a z/os operating system. While collecting installation files, an unknown operating system warning occurs if the collectmacfg.sh script cannot locate Jaa. To enable the collectmacfg.sh script to find Jaa, open the collectmacfg.sh script and edit the MAJAVA enironment ariable to list the path to your local z/os Jaa executable. Next, rerun the collectmacfg.sh script. 7

8 First edition (June 2004) This edition applies to 5.2-WTP-FP01 Version of IBM Tioli Monitoring for Transaction Performance and to all subsequent releases and modifications until otherwise indicated in new editions. Copyright International Business Machines Corporation All rights resered. US Goernment Users Restricted Rights Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp. SC