| Q1. |
What ports does Insight Manager 7 use? |
| A1. |
Here is a list of the important ports used by Insight Manager 7:
- 7 for ping
- 161 and 162 for SNMP
- 2301 (HTTP) and 2381 (SSL) to talk to web-enabled devices
- 280 (HTTP) and 50000 (SSL) for Insight Manager 7 itself.
- 80 (HTTP) and 443 (SSL) to communicate with web servers of all types, including those in the Remote Insight Board and the Integrated Lights-Out product.
The packets are TCP and UDP-based. The exact udp/tcp ports used by DMI are dynamic and vary from system to system, but tend to be around 32780 and higher. |
|
| Q2. |
Can I use Insight Manager 7 to manage the systems on the outside of my firewall - systems that are either directly connected to the Internet or in my DMZ? |
| A2. |
While technically possible, this isn't recommended. Running the various management protocols (SNMP, etc.) on the Internet (even in a DMZ) is a security risk. |
|
| Q3. |
Can I change the ports used by Insight Manager 7 or the web-based agents? |
| A3. |
No, the solution does not currently allow the ports to be changed. HP has registered all of the ports that it uses with the Internet Assigned Numbers Authority (IANA, at www.iana.org) and thus there should not be a port conflict with other software. |
|
| Q4. |
Why are my servers listed as Unknown devices? |
| A4. |
There are many possible answers:
- You must be able to ping the device from the server where Insight Manager 7 is running.
- Community strings must match - make sure Insight Manager 7 & devices are using the same one. Note that community strings are case sensitive.
- Under Microsoft Windows NT and Windows 2000, one community on the device must be set to READ CREATE. Note that you do not have to use this community string in Insight Manager 7 (a community string set to READ is all that is required.) The Management Agents connect to themselves using SNMP and require one string set to READ CREATE.
- The Insight Manager 7 system must be allowed to make SNMP requests to the device - make sure the SNMP security settings aren't preventing this. Under Microsoft Windows NT and Windows 2000, either the "Allow SNMP packets from any host" must be selected or the address of the Insight Manager 7 server must be in the list of allowed hosts.
- If you are using IP-specific security (as in the second part of d above) localhost (127.0.0.1) must also be allowed to make SNMP requests to the host. The Management Agents connect to themselves using SNMP and thus need to be able to get in.
- The Management Agents must be installed and running properly on the servers you are trying to manage. For Windows systems, check the Event Log to make absolutely sure they are running (you should see a few 'Agents started' messages and no errors.)
- Routers/Switches in the network must pass SNMP traffic on ports 161/162 and 7.
|
|
| Q5. |
I am having trouble installing Insight Manager 7. Why can't the installer locate my SQL database? |
| A5. |
The first item to check is to make sure the MSSQL service is started and running. In addition, Insight Manager 7 uses SQL Server-based user accounts. A SQL2000 server must be set to allow SQL accounts in addition to ActiveDirectory accounts. Additionally, you're going to want to make sure that you have the latest MDAC (ODBC driver package) installed. You can get this package at http://www.microsoft.com/odbc. |
|
| Q6. |
Why am I getting all of these Authentication Failure events? |
| A6. |
AuthFailure traps are a feature of SNMP designed to alert you to the possibility that an unauthorized tool is making SNMP requests to a platform with an incorrect community string. The most likely cause is that you have misconfigured the community string in Insight Manager 7 and the status polling task is hitting the devices every time with the wrong community string and generating this trap. If you get a flurry of these traps at regular intervals, this is the likely cause (5 minutes is the default SNMP polling frequency, for example, so a set of traps every 5 minutes would result if the wrong community string was being used.) It is also possible that Insight Manager 7 isn't the one causing these requests - it might in fact be an unauthorized tool. To determine this, you will need to use a network sniffer to determine what tool is making these invalid requests.
However, if you don't care about these traps and simply wish to ignore them there are 2 options. First, you can prevent the devices from sending this trap. In Windows NT / 2000 the SNMP control panel contains an option for disabling the SNMP authentication failure traps. In most UNIX systems this is a config file change for snmpd. For NetWare, you can change this on the SNMP configuration screen. Second, if you don't want to visit each device, you can tell Insight Manager 7 to ignore this individual trap. Go to the MIB Registration feature in the Tools section of Insight Manager 7. Select RFC1215 and then the Edit Registered MIB button. Select authenticationFailure from the list and deselect the Enable Trap Handling checkbox, then click Apply. Reverse these procedures to restore processing of this trap.
NOTE: This trap is disabled by default in new installations of Insight Manager 7. |
|
| Q7. |
Why does Insight Manager 7 discover devices outside of the subnet range I specified? |
| A7. |
HTTP auto-discovery can find devices outside of the specified subnets. If you don't want this behavior you can turn this feature off in the discovery settings section of Insight Manager 7, or enter an exclusion IP address range to eliminate certain address ranges. However, if you've done this once the devices will remember the Insight Manager 7 server and continue to tell it about other devices even if you turn the feature off in Insight Manager 7. The only way to stop this behavior is to turn HTTP auto-discovery off at the devices. Note that this feature has been removed from version 5.3 of the Management Agents and is now disabled by default in new installations of Insight Manager 7. |
|
| Q8. |
I've messed up my Insight Manager 7 server (deleted default queries or tasks, etc.) - is there some way to restore the default database without reinstalling? |
| A8. |
Yes, re-run the installer but select the option to only install the database. Please note that this will remove all devices and configuration changes you have made - it will be as it is right after initial installation. |
|
| Q9. |
Although I have several servers, they aren't showing up in Insight Manager 7. Instead, I have several Orphan_X devices and one server which Insight Manager 7 thinks has all the IP addresses of my many physical servers. What is going on? |
| A9. |
This is a symptom of deploying the servers using some sort of imaging technology (Altiris eXpress, Symantec Ghost, or simply breaking a mirrored drive pair.) This results in the agents on those servers all having the same GUID, or Globablly Unique IDentifier. To reset the servers GUID (to ensure uniqueness) perform the following steps. For Windows based systems, stop the Foundation Agent service on the server. Delete the GUID registry key "HKLM\Software\Compaq Insight Agent. " Restart the Foundation Agent service. Once this is done, the agent will generate a unique identifier for that server. Finally, have Insight Manager 7 rediscover the server and delete the Orphan_X listings.
To prevent this problem from occurring, delete the GUID from the source system prior to taking the image or breaking the mirrored pair.
Note that this GUID is a special one used and controlled by the agents and is not the same as the GUID used by Microsoft Windows 2000 and reset by the sysPrep utility. Also note that this behavior has been modified starting with version 5.2 of the Management Agents. When coupled with the latest server hardware the agents will read the GUID from the protected area of the ROM and thus this problem will not occur. |
|
| Q10. |
How can I assess the network impact of Insight Manager 7? |
| A10. |
This is a pretty complicated question because it will be different for each environment. Refer to the Insight Manager 7 Configuration Guidelines document for more information on how to tune Insight Manager 7.
With servers, Insight Manager 7 makes 3 SNMP requests per server per polling interval. The second two are combined into one packet and of course we have the responses, so that's a total of 4 packets per device (2 requests + 2 responses.) If you have 300 servers, that's 1200 packets every polling interval. With a default polling interval of 5 minutes for SNMP we generate 1200 packets every 5 minutes. If we assume the total size of the 4 packets is 512 bytes (the numbers work well, but normally this is closer to 380 bytes) we'll make a total of 300K bytes worth of requests every 5 minutes. The total bandwidth of 10Mb Ethernet is 1MB/s or 300MB for our 5 minutes. Thus, our 300K bytes come in at 0.1% of total network bandwidth for 300 servers on a 10Mb/s Ethernet. On a 100Mb/s Ethernet the we'll use 0.01% of the total bandwidth and if you're using gigabit Ethernet you probably don't care about the slight 0.001% of the total bandwidth (at this point, people are probably more interested in the total number of packets than the bytes used as the latency from framing the packets is more costly than the bandwidth itself.)
To non-Compaq SNMP devices, we generate 1 ICMP echo request and 1 SNMP request per interval. We still have 4 packets, but now we only use about 200 bytes so the total bandwidth is much less.
To DMI-based devices (desktops or non-Compaq servers) we have to use RPCs and this is much more costly. For a single DMI-based desktop (and this is likely to be the same for non-Compaq servers) we make 29 requests (so that's 58 total packets) and they consume a total of around 14KB. If we poll 300 desktops, that will generate 17,400 packets and consume 4.3MB. The default polling interval for DMI is once per day. This is a negligible amount when averaged over a days worth of bandwidth but while it is running this is a little more bandwidth intensive than the other polling methods. As a result of this, we recommend polling no more than 1000 DMI-based systems per hour.
Using these formulae you can enter the number of devices you have into the form below and it will calculate the network traffic generated by Insight Manager 7 over a 5 minute interval assuming the default polling intervals are used (or at least the shortest polling interval is 5 minutes) and the daily DMI status polling occurs during the window sampled.
|
|
| Q11. |
How can I deploy the Version Control Agent and trust relationships with Insight Manager 7 out to a large group of servers? |
| A11. |
With the Support Paq for Microsoft Windows 2000 version 5.14A or later, the Support PAQ for Windows NT 4.0 version 1.10A or later, or the Support Paq for Windows Server .NET version 1.00A, there is a file called CPCONFIG.EXE. This creates a configuration file with trust information, etc. that you can set up once. Then you can use Insight Manager 7's Application Launch task and SETUPC.EXE included in the Support Paq to deploy the Support Paq (containing the Version Control Agent and a configured trust relationship) out to any number of servers. For additional information, please see the Software Maintenance Overview white paper available on the Management CD v5.30 or from the Insight Manager 7 web site at http://www.compaq.com/manage. |
|
| Q12. |
Why is my software status icon always Unknown (blue)? |
| A12. |
There are a few reasons why the status may be unknown.
- You do not have the Version Control Agent installed on the system or the agent is not running properly. Deploy the Support Paq for Microsoft Windows 2000 version 5.14A or later, the Support PAQ for Windows NT 4.0 version 1.10A or later, or the Support Paq for Windows Server .NET version 1.00A
- The trust relationship is not set up between the managed device and the Insight Manager 7 server. Browse to the machines device page http://devicename:2301, log in as an administrator, click on the Options page, and establish a trust by importing the Insight Manager 7 certificate.
- Once a trust relationship is set up between the managed device and Insight Manager 7, the Identification task must run in order for Insight Manager 7 to properly categorize the device. Run the Daily Identification task (manually or wait till the next run time) for Insight Manager 7 to correctly identify the device. Then run the Software Status Polling task to retrieve the software status (default is to run once per week).
- The Version Control Repository Manager service must be running properly. Check the eventlog for any error messages and make sure the service is started.
|
|
| Q13. |
When I drill down to a device home page or to a specific agent; I am not automatically logged in as an administrator. Why is this? |
| A13. |
You need to make sure you have the Management Agents for Windows version 5.30 or later installed on devices in order for servers to participate in SSL communications, single login, software update, and group configuration. Make sure you have the 5.30 agents installed, and the trust relationship is setup with Insight Manager 7. The Device Identification task must have run against the device following any agent upgrades to fully identify its capabilities. When you hover over links on the device page in Insight Manager 7, they should be of the form https://abcdefg:50000/. In addition, you need to make sure that the Windows account that you are logging into Insight Manager 7 with has the "Automatic Device Authentication" set to User or greater in Insight Manager 7 under Settings/Accounts.
 |
|
| Q14. |
What agents participate in Group Configuration capabilities in Insight Manager 7? |
| A14. |
At this time, there are two agents that participate in Group Configuration - the Web Agent version 5.30 for servers and the Version Control Agent. The Web Agent (bundled as part of the Foundation Agent for Windows version 5.30) contains the ability to group configure all the various agent SNMP settings, plus SNMP service attributes like Community String, IP address restrictions, etc. The Version Control Agent contains the ability to group configure which repository the Version Control Agent will use for software updates and which or customer-defined Support Paq will serve as the version control baseline. |
|
| Q15. |
Why does the desktop I installed Insight Manager 7 on get identified as a server? |
| A15. |
You did not have the desktop agents installed prior to installing Insight Manager 7. This is a prerequisite for desktops. To resolve the issue, install the latest Management Agents for Desktops. You do not have to reinstall Insight Manager 7. |
Printable version
