HP Insight Management WBEM Providers for Windows User Guide

Transcription

1 HP Insight Management WBEM Providers for Windows User Guide Part number First edition 02/2008

2 Legal notices 2008 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. The only warranties for HP products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. HP shall not be liable for technical or editorial errors or omissions contained herein. Confidential computer software. Valid license from HP required for possession, use or copying. Consistent with FAR and , Commercial Computer Software, Computer Software Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor s standard commercial license. Microsoft and Windows are U.S. registered trademarks of Microsoft Corporation. Windows Server 2003 and Windows Server 2008 are U.S. trademarks of Microsoft Corporation. February 2008 Part Number

3 Contents Introduction... 5 Overview... 5 Windows Management Instrumentation... 5 Installing the HP Insight Providers... 6 Insight Provider Smart Components... 6 Installing the WBEM Providers with the PSP... 6 Installing the Insight Providers as part of a SmartStart Assisted Path installation... 7 Installing the Insight Providers using HP Systems Insight Manager... 7 Installing the Insight Providers Smart Component... 9 Security requirements for the Insight Providers SNMP Agents compatibility Uninstalling SNMP-Based HP Insight Management Agents Introduction Uninstalling HP Insight Management Agents on a single local server Uninstalling HP Insight Management Agents on a single remote server Uninstalling HP Insight Management Agents on multiple remote servers using HP SIM Scripting commands for uninstalling HP Insight Management Agents Scripting commands for HP Insight Management Agents 6.30 through Scripting commands for HP Insight Management Agents 7.70 or later Using the System Management Homepage with the Insight Providers Security Introduction Implementation Best practices Configuring Insight Provider Security for a User Account using HP SIM Configure and Repair Agents Configuring Insight Provider Security for a User Account via the Windows Command Line Microsoft Windows Server 2008 Firewall configuration Introduction Configuration Insight Providers architecture Architecture overview Data model Insight Provider usage Additional documentation Scripting examples Introduction Microsoft Visual Basic Scripting Edition examples Other examples Scripting references Support information Operating system support Hardware support HP driver and support software prerequisites Contents 3

4 Technical support Reference documentation HP contact information Index Contents 4

5 Introduction Overview This document applies to the HP Insight Management Web-Based Enterprise Management (WBEM) Providers for Windows Server 2003 and Windows Server 2008 on ProLiant servers, version (Insight Providers). This release of the Insight Providers supports ProLiant servers running Windows Server 2003 and Windows Server For details regarding supported servers, options, and operating system versions, see Support information. Many management products have been built on Simple Network Management Protocol (SNMP), a common network management technology. However, SNMP-based management solutions have a simple structure and weak security protocol relative to alternatives. These limitations prevent comprehensive, industry-standard, secure system management. In place of SNMP, Systems Management Architecture for Server Hardware (SMASH) and Storage Management Initiative Specification (SMI-S) are secure, robust standards endorsed by the Distributed Management Task Force (DMTF) and Storage Networking Industry Association (SNIA) that are quickly gaining momentum. These standards will provide the foundation for server management infrastructures in the coming years. The Insight Providers are based on SMASH and SMI-S. The Insight Providers employ the rich set of base-level instrumentation provided by system management controllers and drivers, I/O controllers and drivers, and system firmware interfaces. These components deliver in-depth hardware management, including hardware inventory data, system state, and event notifications. The data model implemented in the Insight Providers provides industry standard compliance by conforming to DMTF, SMASH, and SMI-S profiles. Windows Management Instrumentation Windows Management Instrumentation (WMI) is the Microsoft implementation of WBEM, a set of industry-standard technologies for accessing system information in a distributed management environment. WBEM and WMI use the Common Information Model (CIM) standard to represent systems, networks, applications, devices, and other managed components in an object-oriented fashion. The Insight Providers extend the CIM data model to make ProLiant-specific management data and events available to system administrators. For more information on WBEM and WMI, see the following links: Web-Based Enterprise Management ( Windows Management Instrumentation ( About WMI ( Introduction 5

6 Installing the HP Insight Providers Insight Provider Smart Components The Insight Providers server, storage, network and software inventory are packaged as Smart Components with the Windows ProLiant Support Packs (PSPs). This enables you to install, uninstall, and version-control the Insight Providers as a single entity. Two Smart Components are available for supporting Windows Server 2003 and Windows Server 2008: The cp exe Smart Component supports Windows Server 2003 and Windows Server bit Editions. The cp exe Smart Component supports Windows Server 2003 and Windows Server 2008 x64 Editions. You can install The Insight Provider Smart Components using all methods available to other Smart Components. You can also install the Insight Providers as part of a SmartStart Assisted Path installation of the Windows operating system. Installing the WBEM Providers with the PSP You can install the Insight Providers using the PSP. The Insight Providers are included with PSP v8.00 and later, but are not installed by default. However, SNMP-based Insight Management Agents are installed by default. (To uninstall the Insight Providers, use Add or Remove Programs in Windows Server 2003, or Programs and Features in Windows Server 2008.) To install the Insight Providers: 1. Perform the following tasks: a. Verify that the target server is on the supported hardware list. See Hardware support. b. Verify that the target server has a supported OS installed. See Operating system support. 2. Log in as an administrator on the target server. 3. Begin installing the PSP by running HPSUM.exe. This initiates the HP Smart Update Manager graphical interface. The Inventory Progress Screen appears while the HP Smart Update Manager builds the inventory. After the inventory process is complete, the Select Installation host screen appears. 4. Select the local or remote host for installation, and then click Next. The Select Bundle Filter screen appears, showing defined bundles. 5. Select the bundles to install, and then click Next. The screen displays a list of components to install. 6. Select the components to install: Installing the HP Insight Providers 6

7 For 32-bit Windows environments, under Optional Updates, select HP Insight Management WBEM Providers for Windows Server 2003/2008. For x64 64-bit Windows environments, under Optional Updates, select HP Insight Management WBEM Providers for Windows Server 2003/2008 x64 Editions. 7. To configure the installer to add a low rights user for remote access to the Insight Providers, perform the optional configuration steps below for the Insight Providers Smart Component. This procedure will provide most of the access rights to allow a standard user account to view most of the management information. An administrator account is needed to perform certain management tasks such as rebooting a server. See Best practices for help in deciding whether this is appropriate in your situation. See Security for other methods available for granting remote access to a standard user. a. Locate the component selected for installation in step 6 under Updates to be installed. b. Click Configure Now in the Optional Actions column of the selected component. c. Enter the username of the low rights user in the Windows Account Username text box. For a domain user, use the DOMAIN\USERNAME format. d. Click Save. The previous install screen appears. 8. On the Select Components to Be Installed screen, select the Reboot option. This prompts you to reboot after components are installed. 9. Click Install. Installing the Insight Providers as part of a SmartStart Assisted Path installation You can install the Insight Providers as part of a SmartStart Assisted Path installation using SmartStart (You can uninstall the Insight Providers using the Add or Remove Programs for Windows Server 2003, or Programs and Features for Windows Server 2008.) To install the Insight Providers as part of a SmartStart Assisted Path installation: 1. Perform the following tasks: a. Verify that the target server is on the supported hardware list. See Hardware support. b. Verify that your operating system is supported. See Operating system support. 2. Begin the normal HP SmartStart installation using the SmartStart 8.00 or later CD. For detailed installation instructions, see the HP SmartStart documentation. 3. At the Server Deployment Management Instrumentation screen, select HP Insight Management WBEM Providers for Windows (WMI-based providers). The HP SmartStart installation continues and installs the Insight Providers with the PSP contents. Installing the Insight Providers using HP Systems Insight Manager Installing the HP Insight Providers 7

8 IMPORTANT: You must install PSP 8.00 or later before or with the Insight Providers. You can install the Insight Providers using HP Systems Insight Manager (HP SIM). (You can uninstall the Insight Providers using Add or Remove Programs for Windows Server 2003 or Programs and Features for Windows Server 2008.) To install the Insight Providers using HP SIM: 1. Perform the following tasks: a. Verify that the target servers are on the supported hardware list. See Hardware support. b. Verify that the target servers have a supported OS installed. See Operating system support. 2. From HP SIM, select Configure>Configure or Repair Agents. If the targets are selected, the Step 1: Select Target Systems page appears. 3. Click Next. The Step 2: Enter credentials page appears. The credentials specified on this page are for a privileged account on the target system. 4. On the Step 2: Enter credentials page, complete the following. The credentials you enter must work for all selected target systems. HP recommends using domain administrator credentials. HP SIM does not save credentials entered here, except to run a scheduled task later. a. In the User name field, enter the system administrator name. b. In the Password field, enter the system administrator password. c. In the Password (Verify) field, reenter the system administrator password. d. If you are using a domain account, enter the Windows domain In the Domain field. 5. Click Next. The Step 3: Install Providers and Agents (Optional) page appears. 6. Select the Install WBEM / WMI Provider (HP Insight Management WBEM Provider) for Windows checkbox. 7. Click Next. The Step 4: Configure or Repair Agents page appears. 8. Select from the following options to configure the target system. For more information see the HP SIM User Guide. Configure WBEM / WMI Use an HP SIM WBEM certificate Configure a non-administrative account for HP SIM to access WMI data Configure SNMP Configure secure shell (SSH) access Set Trust relationship to Trust by Certificate Configure Version Control Agent (VCA) Set administrator password for Insight Management Agents version 7.1 or earlier 9. Click Run Now. Installing the HP Insight Providers 8

9 You can also click Schedule and set up a schedule to run this task at a later time. The Task Results page appears, displaying the following information. NOTE: The Configure or Repair Agents tool can update multiple target systems, each of which might have different results. The log results indicate whether the configure/repair attempt was successful. Status Displays the details for each target system in a task instance. Exit Code Represents the success or failure of an executable program, but does not indicate if all attempts succeeded. Some attempts can succeed while some attempts can fail. If the return value is zero or positive, the executable ran successfully. If the return value is negative value, the executable failed. Target Name Displays the name/ip address of the target. The stdout tab Displays the output text information. The stderr tab Displays information if the executable experienced an error. View Printable Report Reports can be printed for the currently selected target system or for all target systems associated with the task instance. To print a report: a. Click View Printable Report. b. From the Options Message box, select the report to display. You can generate a report containing the selected target system or all systems associated with the task instance. c. Click OK to display the report, or click Cancel to return to the View Task Results page. Installing the Insight Providers Smart Component IMPORTANT: You must install PSP 8.00 or later before or with the Insight Providers. You can install the Insight Providers individually using an Insight Providers Smart Component. This is appropriate when you want to install the Insight Providers without doing a full PSP installation or without using SmartStart (you can uninstall the Insight Providers using Add or Remove Programs for Windows Server 2003 or Programs and Features for Windows Server 2008). To install the Insight Providers Smart Component: 1. Perform the following tasks: a. Verify that the target server is on the supported hardware list. See Hardware support. b. Verify that the target server has a supported OS installed. See Operating system support. 2. Log in as an administrator on the target server. 3. Install the Insight Providers Smart Component: For 32-bit Windows environments, execute the cp exe Smart Component by doubleclicking or by invoking in a script. For x64 64-bit Windows environments, execute the cp exe Smart Component by double-clicking or by invoking in a script. Installing the HP Insight Providers 9

10 Security requirements for the Insight Providers IMPORTANT: The standard user accounts that are used to access HP WBEM Providers management information must have access rights and security group memberships to allow remote access by HP SIM or other clients querying WMI data. An administrator account has sufficient rights and security group memberships to access HP WBEM Providers management information. To enable remote access of the Insight Providers via WMI for non-administrator user accounts: 1. Add the standard user account to the Distributed DCOM Users group. 2. For the following namespaces, add the standard user account to namespace security. root\hpq root\hpq\default root\hpq\testevent root\interop root\cimv2 To add the standard user account to namespace security, complete the following steps for each name space. a. Right-click My Computer>Manage>Services and Applications. b. Right-click WMI Control. c. Select Properties. d. Select the Security tab. e. Select the namespace. f. Click the Security button. Verify that permissions are set as follows for the standard user: Execute Methods Full Write Partial Write Provider Write Enable Account Remote Enable Read Security Edit Security SNMP Agents compatibility The Insight Providers are compatible with SNMP-based HP Insight Management Agents for Windows. They can be installed and used on a ProLiant server simultaneously. The Insight Providers do not have dependencies on the HP Insight Management Agents and can be installed on ProLiant servers that do not have SNMP agents installed. The default PSP installation installs SNMP-based HP Insight Management Agents, so if you do not want SNMP agents installed, you must uninstall them. For more information on uninstalling the SNMP agents, see Uninstalling the SNMP-Based HP Insight Management Agents. Installing the HP Insight Providers 10

11 Uninstalling SNMP-Based HP Insight Management Agents Introduction This section provides instructions for uninstalling the SNMP-based HP Insight Management Agents. Uninstalling HP Insight Management Agents on a single local server To uninstall HP Insight Management Agents on a single local server: 1. Open the Windows Add or Remove Programs interface (Windows Server 2003) or the Windows Programs and Features interface (Windows Server 2008). 2. Select HP Insight Management Agents. 3. Click change/remove (Windows Server 2003), or right-click and select Uninstall (Windows Server 2008). 4. At the prompt, click yes to confirm the removal of HP Insight Management Agents from the system. If the HP System Management Homepage is active in a browser window, close and reopen it to ensure that it reflects the change. Uninstalling HP Insight Management Agents on a single remote server To uninstall HP Insight Management Agents on a single remote server: 1. Connect to the remote system: From a Microsoft Windows 2000 system, use the Terminal Services Client to connect to the remote system. From a Microsoft Windows XP or Windows Server 2003/2008 system, use the Windows Remote Desktop to connect to the remote system. 2. On the remote system, open the Windows Add or Remove Programs interface (Windows Server 2003) or Programs and Features (Windows Server 2008). 3. Select HP Insight Management Agents. 4. Click change/remove (Windows Server 2003), or right-click and select Uninstall (Windows Server 2008). 5. At the prompt, click yes to confirm the removal of HP Insight Management Agents from the system. Uninstalling SNMP-Based HP Insight Management Agents 11

12 If the HP System Management Homepage is active in a browser window, close and reopen it to ensure that it reflects the change. Uninstalling HP Insight Management Agents on multiple remote servers using HP SIM You can configure HP SIM to contain a tool that executes a command line program on multiple target servers to uninstall the HP Insight Management Agents for Windows (6.30 or later). To configure HP Systems Insight Manager to contain the Uninstall Agents Tool: 1. Create a folder on the C drive of the Windows server running HP SIM and name it c:\hpagun. If you use a different drive or folder, edit the agents-uninstall.xml file and replace the c:\hpagun in the following line with the drive and folder used: <source>c:\hpagun\uninstallagents.exe</source>. For HP SIM running on an HP-UX or Linux server, create the folder hpagun under /tmp/ (for example, /tmp/hpagun). 2. Copy the following files to the server running HP SIM. These files are located in the \AgentUninstall directory of the Insight Provider documentation. agents-uninstall.xml Contains information that allows HP SIM to add the Uninstall Agents Tool to its menu system. For HP SIM running on a Windows server, copy the agents-uninstall.xml file to the C:\Program Files\HP\Systems Insight Manager\Tools folder. For HP SIM running on an HP-UX or Linux server, copy the agents-uninstall.xml file to the /var/opt/mx/tools folder. Edit the agents-uninstall.xml file and replace the line that reads <source>c:\hpagun\uninstallagents.exe</source> to <source>/tmp/hpagun/uninstallagents.exe</source> UninstallAgents.exe Is used to perform the uninstall of SNMP agents on each target system. Copy UninstallAgents.exe to the c:\hpagun folder (/tmp/hpagun folder on HP-UX or Linux systems). You can place the executable file into a different folder, but you must edit the agents-uninstall.xml file to replace the reference to c:\hpagun with the folder you want to use. 3. From the folder where the agents-uninstall.xml file resides, run the following command: mxtool -a -f agents-uninstall.xml When the Uninstall Agents Tool is added to HP SIM, the following messages appear: Successfully parsed tools file. Successfully added tool named Uninstall HP Insight Management Agents Successfully added 1 tool 4. Verify that the target servers have OpenSSH installed. If not, install OpenSSH on the target servers by completing the following. a. From the HP SIM menu, select Deploy>Deploy Drivers, Firmware, and Agents. b. Select Install OPENSSH. c. Follow the instructions to install OpenSSH on the target servers. 5. After OpenSSH is installed, configure HP SIM to authenticate the managed systems by executing the following command from an HP SIM CLI prompt: mxagentconfig -a [-n hostname] [-u login user name] [-p password] Uninstalling SNMP-Based HP Insight Management Agents 12

13 Alternatively, from the HP Systems Insight Manager menu, select Configure>Configure or Repair Agents to configure the target systems. For more information, use the help system. 6. Execute the Identify Systems task for all nodes by selecting Options>Identify Systems, select the target nodes, and executing the task. To run the Uninstall Agents Tool from HP SIM: 1. Use a web browser to log in to the HP SIM console. 2. From the HP SIM menu, select Deploy>Deploy Drivers, Firmware, and Agents. 3. Select Uninstall HP Insight Management Agents. 4. Select the list of target servers to remove Agents from, and click Apply. 5. Click Next to confirm the list of target servers. 6. Click Run Now to remove Agents from the target servers. The Uninstall Agents Tool displays the task results in the Stdout results area. Scripting commands for uninstalling HP Insight Management Agents Use the following to uninstall HP Insight Management Agents using scripting commands. Scripting commands for HP Insight Management Agents 6.30 through 7.60 To uninstall HP Insight Management Agents, run the following commands from a script or from a Windows command prompt on a target system: $WINDIR\system32\cpqmgmt\aguninst.exe /s $SYSTEMDRIVE\hp\hpsmh\bin\smhreset The $WINDIR environment variable refers to the Windows directory (for example, c:\winnt on Windows 2000 or c:\windows on Windows Server 2003). The $SYSTEMDRIVE environment variable refers to the system drive (for example, c:). The aguninst.exe /s command uninstalls the HP Insight Management Agents. The smhreset command resets the HP System Management Homepage. Scripting commands for HP Insight Management Agents 7.70 or later To uninstall HP Insight Management Agents, run the following Microsoft Visual Basic Scripting Edition (VBScript) code from a Windows command prompt on a target system: strcomputer = "." SW = "HP Insight Management Agents" Set objwmiservice = GetObject("winmgmts:" _ & "{impersonationlevel=impersonate}!\\" _ & strcomputer & "\root\cimv2") Uninstalling SNMP-Based HP Insight Management Agents 13

14 Set colsoftware = objwmiservice.execquery _ ("Select * from Win32_Product") For Each objsoftware in colsoftware If objsoftware.name=sw Then objsoftware.uninstall() End If Next Uninstalling SNMP-Based HP Insight Management Agents 14

15 Using the System Management Homepage with the Insight Providers The System Management Homepage (SMH) now allows data collected from the Insight Providers or SNMP agents. After the Insight Providers are installed, SMH defaults to WBEM. To change this setting: 1. Log into the SMH and click Settings>Select SMH Data Source>Select. 2. Choose the radio button for WBEM or SNMP. 3. Click Select. The layout of the SMH remains the same; however, there are changes on subpages. The content and pertinent information are similar, but the layout has been redesigned to be more user friendly. The Auto Refresh option is a new feature. When the SMH uses the SNMP data source, each page must be refreshed manually to retrieve the latest information. When using WBEM as the data source, the user can manually refresh the information or set an Auto Refresh interval to get updates. To enable WBEM Auto Refresh and to set the Refresh interval, 1. Click Settings>Auto Refresh>Configure Page Refresh Settings. 2. Select a refresh interval between 5 seconds and 30 minutes. 3. Use the radio button to enable Auto Refresh. After WBEM Auto Refresh is enabled, the browser refreshes the pages at the specified interval. Using the System Management Homepage with the Insight Providers 15

16 Security Introduction Security is a major concern and one of the primary reasons to switch from SNMP Agent-based server management to Insight Provider-based server management. The HP Insight Management WBEM Providers for Windows use Windows-based authentication for local and remote access to server management data. Implementation The Insight Providers for Windows are implemented as a set of Windows Management Instrumentation (WMI) providers. The access control is in the form of standard Windows account level access restrictions. An administrator account has sufficient rights and security group memberships to access the Insight Provider management information for both local and remote access. For a standard user account, there are two considerations for configuring security in order to access WMI information from the Insight Providers: WMI namespace security Distributed COM user group membership A standard user account needs security configurations to remotely access the Insight Provider management information on a remote server. See Security Requirements for the Insight Providers for more information. WMI namespace security settings govern access to WMI information. Windows user accounts can be allowed or denied specific privileges per WMI namespace. For more information on namespace security, see Access to WMI Namespaces Only standard users who belong to the Distributed COM Users group can remotely connect to WMI and access management information. Administrators are in this group by default. Non-administrator users must be added to the Distributed COM Users group for remote WMI connectivity. See Connecting to WMI on a Remote Computer for more information on this topic. Best practices According to the principle of least privilege, it is recommended to use a low rights user account (nonadministrator) to perform most read-only management tasks. Use of certain Insight Provider functionality always requires an administrator level account. An example of this is a method to reboot the system. This user does not need to be an administrator of the managed system and does not need logon rights. HP recommends that the domain administrator creates a special purpose domain account. Security 16

17 Configuring Insight Provider Security for a User Account using HP SIM Configure and Repair Agents NOTE: When you must configure a non-administrator account on an x64 target server, verify that the system is identified to HP SIM as a server and that it has the system subtype. For more information, see the HP Systems Insight Manager help file under identification. The following procedure provides access rights to allow a standard user account to view most management information. However, you must use an administrator account to perform some management tasks, such as rebooting a server. To configure a domain or local user (non-administrator) account for remote management: 1. From HP SIM, select Configure > Configure or Repair Agents. If the targets are selected, the Step 1: Select Target Systems page appears. 2. Click Next. The Step 2: Enter credentials page appears. 3. Complete the following. The credentials you specify on this page are for a privileged account on the target system. In addition, the credentials must work for all selected target systems. HP recommends using domain administrator credentials. HP SIM does not save these credentials except to run a scheduled task later. a. In the User name field, enter the system administrator name. b. In the Password field, enter the system administrator password. c. In the Password (Verify) field, re-enter the system administrator password. d. If you are using a domain account, enter the Windows domain in the Domain field. 4. Click Next. The Step 3: Install Providers and Agents (Optional) page appears. 5. Select the Install WBEM / WMI Provider (HP Insight Management WBEM Provider) for Windows box. 6. Click Next. The Step 4: Configure or Repair Agents page appears. 7. (Optional) Select the Configure a non-administrative account for HP SIM to access WMI data option. This option applies to Windows systems with the Insight Providers. The configuration of the managed system is updated to allow the user to access WMI information over the network. This user account is used by HP SIM to read inventory and configuration information from the system, and will be configured as the WBEM user in the System Protocol Settings. This configuration step is not necessary if HP SIM is configured with a user with Windows administrator rights. HP SIM does not create this user. The user must exist as a domain user or one local to the managed system. The user is added to the "DCOM Users group on the managed system and is given read-only access to WMI information, in addition to read-write permissions to the HPQ name space. Security 17

18 This user does not need to be an administrator of the managed system and does not need login rights. A special-purpose domain account is recommended, and should be created by the domain administrator. 8. Enter the credentials for HP SIM to access the managed systems: a. In the User name field, enter a user name. b. In the Password field, enter the password for the user. c. In the Password (Verify) field, re-enter the password. d. If the user account is a domain account, enter the Windows domain in the Domain field. If configuring a nonadministrative user is successful, these credentials are saved as the System Protocol settings for WBEM access in HP SIM. 9. Click Run Now. You can also click Schedule and set up a schedule to run this task at a later time. The Task Results page appears, displaying the following information. NOTE: The Configure or Repair Agents tool can update multiple target systems, each of which might have different results. The log results indicate whether the configure/repair attempt was successful. Status Displays the details for each target system in a task instance. Exit Code Represents the success or failure of an executable program, but does not indicate if all attempts were succeeded. Some can succeed and some can fail. If the return value is zero or positive, the executable ran successfully. If the return value is negative value, the executable failed. Target Name Displays the name/ip address of the target. The stdout tab Displays output text information. The stderr tab Displays information if the executable experienced an error. View Printable Report Enables you to print reports for the selected target system or for all target systems associated with the task instance. To print a report: a. Click View Printable Report. b. From the Options Message box, select the report to display. You can generate a report containing the selected target system or all systems associated with the task instance. c. Click OK to display the report, or click Cancel to return to the View Task Results page. Configuring Insight Provider Security for a User Account via the Windows Command Line The following procedure provides access rights to allow a standard user account to view most management information. However, you must use an administrator account to perform some management tasks, such as rebooting a server. To configure a domain user or local user (non-administrator) account for remote management: 1. Open a Command Prompt window. Security 18

19 2. Change to the \Program Files\HPWBEM\Tools folder of the system drive. 3. Invoke the EnableRWMI.exe program to configure the account security for remote WMI access: EnableRWMI a:localuser Or EnableRWMI a:domain\user Security 19

20 Microsoft Windows Server 2008 Firewall configuration Introduction This section describes a configuration method for enabling direct remote WMI access on a server running the Microsoft Windows Server 2008 Firewall. These configuration steps were derived from testing on RC1 of Microsoft Windows Server 2008, and so might not apply to the latest version of Microsoft Windows Server 2008 Firewall. There are many methods to establish remote communication with WMI. Locally privileged programs can establish communication with WMI locally and serve up a private or standardized remote management interface. The System Management Homepage (SMH) and Windows Remote Management (an implementation of WS Management) are examples. This documentation does not apply to these or other indirect methods of WMI related communication, only to direct remote connections to WMI. Firewall configurations for indirect WMI communication methods are independent of establishing a direct remote connection to WMI. Apart from setting up the firewall, some user privileges are a consideration in allowing direct remote WMI access. For example, when the user is not an Administrator, some privileges might not exist by default. For more information, see Security requirements for the InsightProviders and the MSDN article Securing a Remote WMI Connection at aa aspx. Configuration You can establish direct remote WMI access on a computer running the Windows Server 2008 Firewall, but the default configuration does not allow it. However, by using the built-in firewall rules, you can enable remote WMI access in as little as two commands. You execute the following commands locally on the Windows Server 2008 machine that is providing WMI access (that is, on a computer running the Insight Providers on Windows Server 2008). netsh advfirewall firewall set rule group= Windows Management Instrumentation (WMI) new enable=yes Output: Updated 4 rule(s). Ok. The command enables all firewall rules contained in the specified firewall group. If the command output does not confirm that the rules were updated, check that the group name and each word in the command are correct. The group name with spacing emphasized is below: Windows<SPACE>Management<SPACE>Instrumentation<SPACE>(WMI) Microsoft Windows Server 2008 Firewall configuration 20

21 This first command is equivalent to selecting the Windows Management Instrumentation (WMI) checkbox in the Control Panel>Windows Firewall>Settings>Exceptions tab. An additional firewall rule is needed to allow a remote user to establish a WMI session. It can be enabled with a similar command: netsh advfirewall firewall set rule name= Network Discovery (NB-Name- In) new enable=yes This command updates a portion of a rule group (a single rule). It can also be done in the GUI, as follows: 1. Click Administrative Tools>Windows Firewall with Advanced Security>Inbound Rules. 2. Enable the Network Discovery (NB-Name-In) rule(s). 3. Select the rule, and click Action>Enable Rule. This rule and an equivalent rule appear in the Network Discovery and the File and Printer Sharing firewall rule groups, respectively. If the Windows Firewall has either of these already enabled, this latter command will not affect a change, and only first command is necessary. Similar rules can be created that are more restrictive but that allow remote WMI access in specific circumstances (such as restricting which users, computers, and network addresses can remotely access), depending on the details of your setup. There can be additional configuration and connection requirements on the client-side depending on the client OS and firewall used. For more information, see Connecting to WMI Remotely Starting with Vista Microsoft Windows Server 2008 Firewall configuration 21

22 Insight Providers architecture Architecture overview The following architecture diagram gives an overview of Insight Provider components. The diagram is color-coded to distinguish between Microsoft-provided components, HP components, and ProLiant WMI components. The Insight Providers extend the industry-standard CIM data model to support information that is specific to ProLiant platforms. The Insight Providers collect data from sources such as drivers and system firmware to populate the data model. By using scripting hosts or writing directly to the WMI COM-based client API, you can create custom applications that can access the data model, providing automated administrative tasks. The Insight Providers implement the following instrumentation: Server providers: Processor information and indications Memory information and indications PCI devices and system slots information Insight Providers architecture 22

23 Sensor information and indications, including redundancy, fans, temperature sensors, and power supplies Computer system information, including physical location, unit ID visual indicator, IML, system ROM, and aggregate computer system status (rollup of connected components and devices) Computer system indications, including ASR reboot, POST error, and thermal reboot Network providers Network controller information and indications 10/100 Mb Ethernet Gb Ethernet NIC teaming Storage providers Storage controller information and indications Ultra3 and Ultra320 SCSI SmartArray 5x and 6x SAS/SATA information Other Providers C-Class blade enclosure provider Enclosure information for c-class blades Data model Management processor provider Management processor information Software inventory provider Installed HP software information Indications to event log provider Insight Provider indications that are logged to the Windows system event log The following table lists the set of DMTF profiles included in the data model implemented by this version of the Insight Providers. Table 1 DMTF profiles included in the data model Profile Name Version Link DSP1004 Base Server Profile (specialized) blished_documents/dsp1004.pdf DSP1009 Sensor Profile blished_documents/dsp1009.pdf DSP1010 Record Log Profile blished_documents/dsp1010.pdf DSP1011 Physical Asset Profile blished_documents/dsp1011.pdf DSP1013 Fan Profile blished_documents/dsp1013.pdf DSP1014 Ethernet Port Profile (specialized) blished_documents/dsp1014.pdf DSP1015 Power Supply Profile blished_documents/dsp1015.pdf Insight Providers architecture 23

24 Table 1 DMTF profiles included in the data model Profile Name Version Link DSP1022 CPU Profile blished_documents/dsp1022.pdf DSP Software Inventory Profile blished_documents/dsp1023.pdf DSP1026 System Memory Profile blished_documents/dsp1026.pdf DSP1027 Power State Management Profile DSP1033 Profile Registration Profile DSP1035 Host LAN Network Port Profile blished_documents/dsp1027.pdf blished_documents/dsp1033.pdf blished_documents/dsp1035.pdf DSP1036 IP Interface Profile blished_documents/dsp1036.pdf DSP1052 Computer System Profile blished_documents/dsp1052.pdf The following table lists the set of SMI-S profiles, subprofiles, and packages included in the data model implemented by this version of the Insight Providers. Table 2 SMI-S profiles, subprofiles and packages included in the data model Profile/Subprofile Name Version Host Hardware RAID Controller Profile 1.2 Array Profile 1.2 Block Services Package 1.2 Disk Drive Lite Subprofile 1.2 Multiple Computer System Subprofile 1.2 Disk Sparing Subprofile 1.2 Physical Package 1.2 Location Subprofile 1.2 Extent Mapping Subprofile (deprecated) 1.2 Direct Attach (DA) Ports Profile 1.2 Parallel SCSI (SPI) Initiator Ports Profile 1.2 Software Subprofile 1.2 FC HBA Profile 1.2 Insight Providers architecture 24

25 The following table lists the set of HP profile extensions included in the data model implemented by this version of the Insight Providers. Table 3 HP profile extensions included in the data model Profile Name Version File Name P00100 HP Profile Registration Profile P00101 HP Management Processor Lite Profile 1.0 P00100_-_HP_Profile_Registration Profile.pdf 1.0 P00101_- _HP_Mgmt_Proc_Lite_Profile.pdf P00102 HP Fan Profile 1.0 P00102_-_HP_Fan_Profile.pdf P00103 HP Power Supply Profile 1.0 P00103_- _HP_Power_Supply_Profile.pdf P00104 HP Sensor Profile 1.0 P00104_-_HP_Sensors_Profile.pdf P00105 HP Base Server Profile 1.0 P00105_- _HP_Base_Server_Profile.pdf P00106 HP CPU Profile 1.0 P00106_-_HP_CPU_Profile.pdf P00107 HP CPU Consolidated Status Profile P00108 HP CPU Physical Asset Profile 1.0 P00107_- _HP_CPU_Consolidated_Status_Profi le.pdf 1.0 P00108_- _HP_CPU_Physical_Asset_Profile.pdf P00109 HP Record Log Profile 1.0 P00109_- _HP_Record_Log_Profile.pdf P00110 HP Memory Profile 1.0 P00110_-_HP_Memory_Profile.pdf P00111 HP Memory Physical Asset Profile P00113 HP Consolidated Status Profile P00114 HP Base Server Physical Asset Profile P00115 HP Fan Physical Asset Profile P00116 HP Power Supply Physical Asset Profile P00117 HP Ethernet Teaming Profile P00120 HP Storage Enclosure Profile 1.0 P00111_- _HP_Memory_Physical_Asset_Profile.pdf 1.0 P00113_- _HP_Consolidated_Status_Profile.pd f 1.0 P00114_- _HP_Base_Server_Physical_Asset_Pr ofile.pdf 1.0 P00115_- _HP_Fan_Physical_Asset_Profile.pdf 1.0 P00116_- _HP_Power_Supply_Physical_Asset_ Profile.pdf 1.0 P00117_-_HP_Ethernet_Teaming Profile.pdf 1.0 P00120_- _HP_Storage_Enclosure_Profile.pdf P00121 HP Smart Array Profile 1.0 P00121_- _HP_Smart_Array_Profile.pdf Insight Providers architecture 25

26 Table 3 HP profile extensions included in the data model Profile Name Version File Name P00122 HP SAS HBA Array Profile 1.0 P00122_-_HP_SAS_HBA_Profile.pdf P00123 HP SCSI HBA Profile 1.0 P00123_- _HP_SCSI_HBA_Profile.pdf P00124 HP Location Profile 1.0 P00124_-_HP_Location_Profile.pdf P00125 HP Blade System Lite Profile 1.0 P00125_- _HP_Blade_System_Lite_Profile.pdf Insight Provider usage You access data and events from the Insight Providers using the SMH supplied in the ProLiant Support Packs (PSPs), HP SIM, other client application, or script that supports WMI and SMASH. The SMH provides a web interface for accessing management data locally or remotely. SMH support for the Insight Providers is composed of two parts: The HP System Management Homepage for Windows Smart Component that is included with the ProLiant Support Packs for Windows. This is the SMH framework. The web application plug-in that is installed with the Insight Providers. This provides the web pages that show management data using the Insight Providers. HP SIM 5.2 and later support the Insight Providers. For information on configuring HP SIM for use with the Insight Providers, see Chapters 4 and 12 of the HP Systems Insight Manager 5.2 Technical Reference Guide. Any client application or script that supports WMI and SMASH can also be used to access data and events from the Insight Providers. The Microsoft MSDN website provides information on building WMI clients such as Visual Basic scripts or C++ and C# applications. For more details, see the following WMI references on the MSDN website: Using WMI ( Scripting Access to WMI ( Further Information ( For sample scripts for use with the Insight Providers, see Scripting Examples. Specific information about HP ProLiant WBEM classes and properties for servers, storage controllers, and network controllers can be found in the profiles, MOF files, and data sheet. (See Additional Documentation ). Additional documentation In addition to this User Guide, the following Insight Provider documentation is available at Profiles A separate document exists for each HP profile extension. Provider Data Sheet, HP Insight Management WBEM Provider Data Sheet.pdf This document describes indication details, and class implementations not defined in a MOF or profile. Insight Providers architecture 26

27 SNMP Instrumentation Migration Guide SNMP Instrumentation Migration Guide.pdf This document describes the mapping of SNMP OIDs to WBEM classes and properties, and SNMP traps to WBEM indications. MOFs When the Insight Providers are installed, the MOF files are copied to the HP_Base, Server, Storage, and Network folders in the C:\Program Files\HPWBEM\MOF directory. MOF files are text files that contain definitions of classes and object instances using the MOF language. The CIM data model is represented in MOF files, as are HP ProLiant-specific extensions. Indication Usage Guide, HP Indication Usage Guide.pdf This document is an introduction to indications in the Insight Providers. Insight Providers architecture 27

28 Scripting examples Introduction This section provides examples for accessing data exposed by the Insight Providers using scripting. Microsoft Visual Basic Scripting Edition examples You can write scripts to obtain data from the Insight Providers using Microsoft Visual Basic Scripting Edition (VBScript) or any other scripting language that supports Microsoft ActiveX. Examples for accessing Insight Provider data using VBScript code are described below. The following VBScript code is used to display computer system operational status information: strcomputer = "." strnamespace = "\root\hpq" Set objwmiservice = GetObject("winmgmts:\\" & strcomputer & strnamespace) Set colcomputersystem = objwmiservice.execquery("select * from HP_WinComputerSystem") For Each objcomputersystem in colcomputersystem WScript.Echo "Caption: " & objcomputersystem.caption For Each objstatusdescription in objcomputersystem.statusdescriptions WScript.Echo "Status description: " & objstatusdescription Next For Each objoperationalstatus in objcomputersystem.operationalstatus WScript.Echo "Operational status: " & objoperationalstatus Next Next The following VBScript code is used to display system firmware version: strcomputer = "." strnamespace = "\root\hpq" Set objwmiservice = GetObject("winmgmts:\\" & strcomputer & strnamespace) Scripting examples 28

29 Set colsystemromfirmware = objwmiservice.execquery("select * from HP_SystemROMFirmware") For Each objsystemromfirmware in colsystemromfirmware WScript.Echo "Caption: " & objsystemromfirmware.caption WScript.Echo "Version: " & objsystemromfirmware.versionstring WScript.Echo Next The following VBScript code is used to display computer system chassis model name, serial number and asset tag: strcomputer = "." strnamespace = "\root\hpq" Set objwmiservice = GetObject("winmgmts:\\" & strcomputer & strnamespace) Set colcomputersystemchassis = objwmiservice.execquery("select * from HP_ComputerSystemChassis") For Each objcomputersystemchassis in colcomputersystemchassis WScript.Echo "Model: " & objcomputersystemchassis.model WScript.Echo "Serial number: " & objcomputersystemchassis.serialnumber WScript.Echo "Asset tag: " & objcomputersystemchassis.usertracking Next The following VBScript code is used to list system memory modules and their capacities: strcomputer = "." strnamespace = "\root\hpq" Set objwmiservice = GetObject("winmgmts:\\" & strcomputer & strnamespace) Set colmemorymodule = objwmiservice.execquery("select * from HP_MemoryModule") For Each objmemorymodule in colmemorymodule WScript.Echo "Caption: " & objmemorymodule.caption WScript.Echo "Capacity (bytes): " & objmemorymodule.capacity Scripting examples 29

30 Wscript.Echo Next The following VBScript code is used to list system processors, current clock speed, and the number of enabled cores: strcomputer = "." strnamespace = "\root\hpq" Set objwmiservice = GetObject("winmgmts:\\" & strcomputer & strnamespace) Set colprocessor = objwmiservice.execquery("select * from HP_Processor") For Each objprocessor in colprocessor WScript.Echo "Caption: " & objprocessor.caption WScript.Echo "Description: " & objprocessor.description WScript.Echo "Current clock speed (MHz): " & objprocessor.currentclockspeed WScript.Echo "Number of enabled cores: " & objprocessor.numberofenabledcores Wscript.Echo Next The following VBScript code is used to list fans and operational status information: strcomputer = "." strnamespace = "\root\hpq" Set objwmiservice = GetObject("winmgmts:\\" & strcomputer & strnamespace) Set colfan = objwmiservice.execquery("select * from HP_WinFan") For Each objfan in colfan WScript.Echo "Caption: " & objfan.caption WScript.Echo "Description: " & objfan.description For Each objstatusdescription in objfan.statusdescriptions WScript.Echo "Status description: " & objstatusdescription Next For Each objoperationalstatus in objfan.operationalstatus Scripting examples 30

31 Next WScript.Echo "Operational status: " & objoperationalstatus WScript.Echo Next The following VBScript code is used to clear the record log: strcomputer = "." strnamespace = "\root\hpq" Set objwmiservice = GetObject("winmgmts:\\" & strcomputer & strnamespace) Set colcommonrecordlog = objwmiservice.execquery("select * from HPQ_CommonRecordLog") Wscript.Echo Clearing the record log For Each objcommonrecordlog in colcommonrecordlog objcommonrecordlog.clearlog() Next The following VBScript code is used to receive an alert indication: strcomputer = "." strnamespace = "\root\hpq" Set objwmiservice = GetObject("winmgmts:\\" & strcomputer & strnamespace) Set objindication = objwmiservice.execnotificationquery("select * FROM HP_AlertIndication") Wscript.Echo "Waiting for alert indication..." Set objreceivedindication = objindication.nextevent WScript.Echo "Provider Name = " & objreceivedindication.providername WScript.Echo "Event ID = " & objreceivedindication.eventid WScript.Echo "Severity = " & objreceivedindication.perceivedseverity WScript.Echo "Description = " & objreceivedindication.description Scripting examples 31