CA ehealth. Remote Poller Guide. r6.1

Transcription

1 CA ehealth Remote Poller Guide r6.1

2 This documentation and any related computer software help programs (hereinafter referred to as the Documentation ) is for the end user s informational purposes only and is subject to change or withdrawal by CA at any time. This Documentation may not be copied, transferred, reproduced, disclosed, modified or duplicated, in whole or in part, without the prior written consent of CA. This Documentation is confidential and proprietary information of CA and protected by the copyright laws of the United States and international treaties. Notwithstanding the foregoing, licensed users may print a reasonable number of copies of the Documentation for their own internal use, and may make one copy of the related software as reasonably required for back-up and disaster recovery purposes, provided that all CA copyright notices and legends are affixed to each reproduced copy. Only authorized employees, consultants, or agents of the user who are bound by the provisions of the license for the Product are permitted to have access to such copies. The right to print copies of the Documentation and to make a copy of the related software is limited to the period during which the applicable license for the Product remains in full force and effect. Should the license terminate for any reason, it shall be the user s responsibility to certify in writing to CA that all copies and partial copies of the Documentation have been returned to CA or destroyed. EXCEPT AS OTHERWISE STATED IN THE APPLICABLE LICENSE AGREEMENT, TO THE EXTENT PERMITTED BY APPLICABLE LAW, CA PROVIDES THIS DOCUMENTATION AS IS WITHOUT WARRANTY OF ANY KIND, INCLUDING WITHOUT LIMITATION, ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NONINFRINGEMENT. IN NO EVENT WILL CA BE LIABLE TO THE END USER OR ANY THIRD PARTY FOR ANY LOSS OR DAMAGE, DIRECT OR INDIRECT, FROM THE USE OF THIS DOCUMENTATION, INCLUDING WITHOUT LIMITATION, LOST PROFITS, BUSINESS INTERRUPTION, GOODWILL, OR LOST DATA, EVEN IF CA IS EXPRESSLY ADVISED OF SUCH LOSS OR DAMAGE. The use of any product referenced in the Documentation is governed by the end user s applicable license agreement. The manufacturer of this Documentation is CA. Provided with Restricted Rights. Use, duplication or disclosure by the United States Government is subject to the restrictions set forth in FAR Sections , , and (c)(1) - (2) and DFARS Section (b)(3), as applicable, or their successors. All trademarks, trade names, service marks, and logos referenced herein belong to their respective companies. Copyright 2008 CA. All rights reserved.

3 Contact CA Contact Technical Support For online technical assistance and a complete list of locations, primary service hours, and telephone numbers, contact Technical Support at Provide Feedback If you have comments or questions about CA product documentation, you can send a message to techpubs@ca.com. If you would like to provide feedback about CA product documentation, please complete our short customer survey, which is also available on the CA Support website.

4

5 Contents Chapter 1: About the ehealth Poller 7 Challenges of Large IT Environments... 7 How the Remote Poller Works... 7 Supported Polling Configurations... 9 ehealth Remote Poller Requirements... 9 Remote Polling Configuration Ratings Remote Poller Compared with Distributed ehealth Upgrades to Remote Polling Sites Remote Poller Features Chapter 2: Configuring FTP Connections 15 Configuring Secure FTP Secure FTP Version Requirements Install Secure FTP Configuring the Central Site for Secure FTP Configuring the Remote Sites for Secure FTP Copying Authentication Keys from the Central Site to the Remote Sites Testing the Secure FTP Connection Configuring Standard FTP (Windows Only) FTP Requirements for Windows Systems Verifying the Standard FTP Service on a Remote Site (Windows Only) Testing the Standard FTP Connection Troubleshooting FTP Installation Problems for Windows Advanced Servers Chapter 3: Creating a Remote Polling Environment 29 Setting Up the Remote Polling Site Setting Up and Administering the Central ehealth Site Setting Up the Central Site and Adding Remote Sites to the Collection Set Configuring the Import Parameters for the Remote Polling Sites Administering the Remote Polling Environment Managing Central Sites Changing the Central Site ID Managing Remote Poller Sites Resynchronizing the Central and Remote Sites Saving the Configuration Information Resynchronizing All Remote Sites Contents 5

6 Resynchronizing One Remote Site Resynchronization Messages Changing FTP Information Changing the FTP Password Changing the FTP Directory on a Remote Site Changing the SSH FTP Encryption Keys Changing from Standard FTP to Secure FTP Understanding the Remote Poller Operations Deploying Remote Polling Creating Binary and DCI Files at the Remote Sites Collecting Files from the Remote Sites Deleting Files at the Remote Sites Importing Remote Elements Importing Remote Groups and Group Lists Chapter 4: Upgrading a Remote Polling Environment 53 Verifying System Requirements Disabling Import Polling on the Central Site Removing Obsolete Schedule Jobs Importing Configuration and Statistics Information Upgrading the Remote Sites Enabling Remote Polling Upgrading the Central Site Exporting Remote Configuration Data Synchronizing the Central Site with Remote Configurations Enabling Configuration Import Enabling Import Polling Again on the Central Site Chapter 5: Troubleshooting 61 Best Practice Tips General Troubleshooting Procedure Error Messages Resynchronization Console Messages Recovering from System Crashes Index 67 6 Remote Poller Guide

7 Chapter 1: About the ehealth Poller This chapter provides an overview to the ehealth Remote Poller feature. It describes the benefits for business service managers who must monitor resources which reside in geographically dispersed or otherwise separated regions. This section contains the following topics: Challenges of Large IT Environments (see page 7) How the Remote Poller Works (see page 7) Challenges of Large IT Environments Many IT organizations are challenged with the task of monitoring several thousands of resources, or with monitoring resources that are separated by geographic distances or other business-related barriers. In these large-scale and wide-area environments, one management system may not be enough to monitor all the resources. It could be difficult or impossible to poll all of the resources and collect data within the specified polling interval. Delay problems can result from long distance links; slow, intermittent or dial-up links; large numbers of elements (10,000 or more); or security barriers such as firewalls. For companies such as internet service providers (ISPs), groups of resources may be dedicated to specific customers, and thus require security considerations for polling and data collection. The ehealth remote polling environment contains several ehealth systems that share the polling workload. A central ehealth system (the central site) regularly retrieves data from the polling systems (called remote polling sites or remote pollers). From the central site, users can run reports for any or all of the polled elements, regardless of which ehealth system polled them. You can use remote polling when you want to keep the ehealth poller systems closer to the elements that they are monitoring, or to separate the polling for elements that may be owned by different companies or customers. How the Remote Poller Works To use the ehealth Remote Poller, you install ehealth on each system that will serve as a remote polling site. You must purchase the necessary ehealth licenses for each site in the remote polling environment. For more information about licenses, see the ehealth Installation Guide. Chapter 1: About the ehealth Poller 7

8 How the Remote Poller Works At each remote site, you first configure the ehealth system as a remote polling site by using the nhremotepollersetup command. Then, you discover and poll the resources that the system will monitor. As a best practice, each remote polling site should own a unique set of resources; avoid discovering the same resources from different remote pollers so that you do not have more than one element for the same resource at the central site. The database at each remote site contains the data for the elements that site polls, and the remote sites create binary files that contain the statistics and import polling data, as well as Database Configuration Information (DCI) files that contain the element configuration data. The remote polling sites are typically mid-to-high performance systems capable of discovering and polling their elements and sending the data back to the central site. You usually do not run reports from the remote sites, as they do not retain the long-term, historical data needed for reports or baselines. At the central site, you start by configuring the system as the central site by using the nhremotepollersetup command. You then use the same command to specify all its remote polling sites. The central ehealth site connects to each remote site through an FTP connection, retrieves element information and data files, and imports them into the central site database. The site typically does not poll any elements of its own (though it can); instead, it typically reserves its processing resources for generating reports. It is typically a highperformance system with a large amount of disk space because it contains all of the element information and polled data from each remote polling site. It must support the large database and the processing power to run reports for all of the monitored elements. You must plan carefully for the size and growth of your central database to make sure that it does not outgrow the disks on which it resides. 8 Remote Poller Guide

9 How the Remote Poller Works Supported Polling Configurations ehealth supports Remote Poller configurations in which multiple remote polling sites report to one central site (the standard configuration), as shown in the following figure. A collection set is a group of remote polling sites that send their data to a specific central site. Each remote polling site must exist in a collection set for only one central site. In addition, a remote polling site cannot be a member of a Distributed ehealth cluster. For more information, see Remote Poller Compared with Distributed ehealth (see page 11). ehealth Remote Poller Requirements This section describes restrictions and important information for remote polling environments. ehealth System and Language Requirements The ehealth systems within a remote polling environment can be any combination of supported UNIX or Windows platforms; however, they must all be running the same release of the ehealth software (release and patch level). The ehealth Remote Poller does not support environments in which ehealth systems use different ehealth language versions. The central site and all of the remote polling sites in its collection set must use the same ehealth language version. For example, if the central site uses the English version, all remote polling sites in the collection set must use the English version. Chapter 1: About the ehealth Poller 9

10 How the Remote Poller Works Time Synchronization Central Site Restrictions The output files contain Coordinated Universal Time (UTC) timestamps to make sure that time-zone differences do not affect the synchronization. The system clocks on the central site and all remote sites must be synchronized to within one minute. To establish synchronization, install thirdparty synchronization software on all remote sites and the central site. This is essential for ensuring that the central site does not miss any data. From an ehealth central site, note that you cannot use the Live Health tools or the Business Service Console (BSC) to monitor the status of remotely polled elements. You can use these tools at a central site only to monitor the status of elements that are locally polled by the central site. You cannot use remote polling to import Traffic Accountant conversations data, Live Health data, Application Response data, or Fault Manager (alarms) data to the central site. You can use these features at remote sites, but their data will not be imported to the central site database. If you use the ehealth HP OpenView Integration Module, note that you can create drill-backs and integrations only to elements that are locally polled by the central site. Remote Polling Configuration Ratings The following table provides the minimum and maximum configuration ratings for remote polling environments. Configuration Number of remote systems supported Number of elements supported on the central system Rating 20 maximum 100,000 maximum at 15 minute polling intervals 50,000 maximum at 5 minute polling intervals Element configuration changes per poll 5% maximum of all elements At maximum size of a central site, this results in a change rate of 250 elements across 20 remote systems on each poll, or 5000 elements total. 10 Remote Poller Guide

11 How the Remote Poller Works Configuration Element configuration changes per day Polling period for remote site Import period for central site Link bandwidth between central and remote site Rating 50% maximum of all elements 4 configuration run maximum 5 minutes minimum 15 minute minimum 56 kbits/sec minimum; however, the maximum ratings listed in this table are based on 100 Mbps connections between the systems. At slower connection speeds, the maximum ratings may not be supported. Remote Poller Compared with Distributed ehealth A Distributed ehealth site contains several ehealth systems that are connected in a configuration referred to as a cluster. You would typically choose Distributed ehealth when you want to run reports for more elements than a central site or a standalone ehealth system can support. A Distributed ehealth site can support reports for up to one million elements. In comparison, an ehealth Remote Poller central site is limited to 60,000 elements (at 5-minute data samples) or 100,000 elements (at 15-minute data samples). For a complete description of Distributed ehealth, see the Distributed ehealth Administration Guide. A Remote Poller environment offers the following advantages over Distributed ehealth: Remote polling sites share data only with the central site--not with any other remote pollers. This maintains confidentiality and security among the remote sites. Administration tasks such as managing groups and group lists, and creating custom reports, can be managed from the central site. You can create groups and group lists on the remote sites, and those groups will be imported to the central site. From the central site, you cannot edit or delete any groups created on remote sites. Only groups created on the central site can be edited or deleted on the central site. For more information about the recommended best practices and restrictions on groups and group lists, see Best Practice Tips (see page 61). A central site can be a member of a Distributed ehealth cluster. Remote polling sites cannot be members of cluster. Chapter 1: About the ehealth Poller 11

12 How the Remote Poller Works Upgrades to Remote Polling Sites If you have already set up a remote polling environment by using a previous release of the ehealth software, you must upgrade your remote polling environment. Remote Poller Features The ehealth Remote Poller provides a comprehensive solution for supporting large deployments of remote sites with high data integrity and performance. Import, synchronization, recovery, and logging features make sure that your data is reliable and protected. The ehealth Remote Poller offers these features: Fast configuration retrieval and processing. The central site retrieves and processes remote DCI files in a group by using a single FTP session (rather than one at a time as in prior releases). This streamlined import process significantly reduces the load on the central site. Since data import occurs more frequently, the central and remote sites stay in almost realtime synchronization. Extensive logging of remote poller operations. The central site logs success and failure information for each file that it imports and processes in the ehealth/modules/remotepoller/logs_import/rplog file (where ehealth is the ehealth home directory). This file provides valuable information for troubleshooting your remote poller system. Support for remote groups. The central site imports configuration information for remotely-defined groups. You can discover into groups on the remote site and propagate those groups to the central site. If you are upgrading from a previous version of ehealth, see the chapter, Upgrading a Remote Polling Environment. Recovery of configuration synchronization. A recovery tool, nhrpfinddiffs, checks for configuration inconsistencies between the central and remote sites and corrects them if they exist. This tool protects the integrity of steady state operations against rare inconsistencies, speeds synchronization, and reduces error recover time. Configuration update architecture. The Remote Poller architecture makes sure that the central site imports configuration updates before importing statistics data. This feature improves synchronization between central and remote sites. Filters for Traffic Accountant and Application Response elements. Filters for blocking the import of Traffic Accountant (TA) and Application Response (AR) elements prevent the central site from importing these element types if they are used on the remote sites. 12 Remote Poller Guide

13 How the Remote Poller Works Detection of corrupt data files. The central site detects corrupt statistics and configuration files. If a file is corrupt on the remote polling system, the central site does not import the file. If the file was damaged in transit, the central site retries import until it succeeds. Robust statistics import. The central site detects a failed statistics file import and attempts to re-import the file on the next poll. Ability to change the spool directory on the remote site. The central site is automatically notified when you change the spool directory and is able to download files from the new path on the remote site. Chapter 1: About the ehealth Poller 13

14

15 Chapter 2: Configuring FTP Connections The central site and remote polling sites communicate through File Transfer Protocol (FTP). You must configure your central and remote polling sites for the version of FTP that you want to use before you run the nhremotepollersetup command. SSH is a protocol for securely accessing remote systems. Administrators use SSH to control servers remotely. You can use the commercial Secure Shell (SSH) software, OpenSSH, or standard FTP. If you are using SSH or OpenSSH, you must manage your own encryption keys for each remote poller. If your ehealth systems are UNIX systems, and you plan to use standard FTP, you do not have to perform any configuration steps. Proceed to Testing the Standard FTP Connection (see page 28) and confirm that the FTP connection between the client and each remote site works. This section contains the following topics: Configuring Secure FTP (see page 15) Configuring Standard FTP (Windows Only) (see page 26) Troubleshooting FTP Installation Problems for Windows Advanced Servers (see page 28) Configuring Secure FTP If you want to configure your central and remote polling sites to communicate through secure FTP, you must configure secure FTP as described in the following sections. Secure FTP Version Requirements To use secure FTP for UNIX, you must install and configure one of the following: SunSSH Release Solaris only OpenSSH Release 3.8 SSH Tectia Server Release SSH Tectia Server (formerly SSH Secure Shell) is a product of SSH Communications Security Corp. If you do not have the correct version of SSH, you can obtain it from the SSH Communications Security Web site at Chapter 2: Configuring FTP Connections 15

16 Configuring Secure FTP To use secure FTP for Windows, you must install and configure one of the following versions of SSH on your Windows systems: SSH Secure Shell for Workstations Release SSH Secure Shell for Windows Servers Release OpenSSH Secure Shell for Windows Servers Release 3.8 Install Secure FTP The central site requires the client (workstation) package, and the remote polling sites require the server package. ehealth supports the English version of the client only. If you are running on a non-english ehealth platform, you must install the English version of the client. To determine whether Tectia SSH is installed and licensed on your system, enter the sftp2 command at the command line. To determine whether OpenSSH or SunSSH is installed and licensed, enter sftp at the command line. To install SunSSH on a Solaris system 1. After obtaining the installation package, copy it to \tmp\sunssh. 2. As system root, run the following command: # pkgadd d /tmp/sunssh SUNWsshcu SUNWsshdr SUNWsshdu SUNWsshr SUNWsshu 3. To start or stop SunSSH, run the following command: # /etc/init.d/sshd start # /etc/init.d/sshd stop To install OpenSSH on a UNIX system Visit to obtain the installation packages. 1. Copy the installation package, openssh-4.6p1-sol9-sparc-local and openssl-0.9.8e-sol9-sparc-local to \tmp\openssh 2. As system root, run the following command: # pkgadd d /tmp/openssh/openssl-0.9.8e-sol9-sparc-local # pkgadd d /tmp/openssh/openssh-4.6p1-sol9-sparc-local 3. To start OpenSSH, run the following command: # /usr/local/sbin/sshd 16 Remote Poller Guide

17 Configuring Secure FTP To install SSH Tectia Server on a Solaris UNIX system Visit to obtain the installation package in tar format as well as a valid license. 1. Copy the tar file (ssh-servers-a comm-solaris-8-10.tar for Solaris or ssh-servers-a comm-hpux-11.0.tar for HP) locally and un-tar 2. As system root, copy the license file license_ssh2.dat to /etc/ssh2 3. To install the package, run the following command: # uncompress ssh sparc-solaris8-10.pkg # pkgadd d ssh sparc-solaris8-10.pkg all 4. To start or stop Tectia SSH, run the following command: # /etc/init.d/sshd2 start # /etc/init.d/sshd2 stop For UNIX systems, make sure that the installation directory for the SSH commands exists in your PATH environment variable. If it does not, the sftp or sftp2 command will fail on UNIX systems. To add SSH to the PATH environment variable on UNIX systems 1. Log in to the ehealth system as the ehealth administrator. 2. Change to the ehealth home directory. 3. Using any text editor, edit the nethealthrc.sh.usr file. 4. Copy and paste the PATH definition from the nethealthrc.sh file into this file, and append the SSH installation directory to the path (for example, /usr/local/sbin in the following example), as follows: PATH=${NH_HOME}/bin:${NH_ORACLE_HOME}/bin:${NH_HOME}/tibco/tibrv/bin:/usr/ope nwin/bin:/usr/sbin:/bin:/usr/bin:/etc:/usr/etc:${nhsavepath}:/usr/local/sbin export PATH 5. Save and close the nethealthrc.sh.usr file. 6. Using any text editor, edit the nethealthrc.csh.usr file. 7. Add the following definition, where the text shown in bold (/usr/local/sbin in this example) represents the SSH installation directory: PATH="$PATH:/usr/local/sbin" 8. Save and close the nethealthrc.csh.usr file. If the PATH variable is set in both files and the command returns an error message, you need to install or license the SSH software. Chapter 2: Configuring FTP Connections 17

18 Configuring Secure FTP To install Secure FTP on a Windows system 1. Visit to obtain SSH Secure Shell installation packages and a valid license. 2. Visit to obtain OpenSSH installation packages 3. When install Secure FTP on Windows system, it is suggested to install it to a path that does not have space. For example: C:\OpenSSH Configuring the Central Site for Secure FTP By default, secure FTP uses password authentication. To enable remote polling with secure FTP, you must disable password authentication and generate encryption keys instead. You can use the ssh-keygen2 command to generate a public and private key combination on the central site and then copy the public key to your remote polling sites. The following procedures assume that the secure FTP server is already installed and configured on the remote site and the client on the central site. To generate authentication keys for use with Tectia SSH/SunSSH on a UNIX central site 1. Log in to the central site using the user account created for accessing the remote polling site. 2. Change to the appropriate directory: If you are using SunSSH, enter the following at the command line: cd NH_HOME/.ssh /usr/bin/ssh-keygen -t dsa If you are using Tectia SSH, enter the following at the command line: cd ~/.ssh2 ssh-keygen2 -P 3. At the Passphrase prompt, press Enter to make sure that no passphrase is created. If you are prompted to verify that you want no passphrase, press Enter again. This command generates a private and public key pair in your $HOME/.ssh2 subdirectory. 4. Change to the.ssh2 directory. If you are using Tectia SSH, enter the following at the command line: cd ~/.ssh2 18 Remote Poller Guide

19 Configuring Secure FTP If you are using SunSSH, enter the following at the command line: cd NH_HOME/.ssh 5. List the files in the.ssh2 subdirectory by entering the following: ls -al The system displays two files, one of which has a.pub extension. This is your public key. The other file is your private key. (You must copy the public key to each remote polling site.) 6. Create or edit a file called identification in the.ssh2 subdirectory and copy into the identification file the private key with a prefix of IdKey, as follows: IdKey privatekeyfilename 7. Save the identification file. 8. Copy the public key to all remote poller systems in this collection set. For instructions, see Copying Authentication Keys from the Central Site to the Remote Sites (see page 24). To generate authentication keys for use with Tectia SSH on a Windows central site 1. At the command prompt on the central site, enter the following command: ssh-keygen2 2. At the Passphrase prompt, press Enter to make sure that no passphrase is created. If prompted to verify that you want no passphrase, press Enter again. This command generates a private and public key pair in your Documents and Settings\username\Application Data\SSH\UserKeys directory. Change to the Documents and Settings\username directory, and then create a.ssh2 subdirectory in that directory by entering the following command: mkdir.ssh2 3. Change to the.ssh2 subdirectory by entering the following at the command line: cd.ssh2 4. Copy the encryption keys from your Documents and Settings\username\Application Data\SSH\UserKeys directory to the Documents and Settings\username \.ssh2 directory you created. 5. List the files in the.ssh2 subdirectory by entering the following: dir The system displays two files, one of which has a.pub extension. This is your public key. The other file is your private key. Chapter 2: Configuring FTP Connections 19

20 Configuring Secure FTP 6. Create a file called identification (with no extension) in the.ssh2 subdirectory and copy into the identification file the private key with a prefix of IdKey, as follows: IdKey privatekeyfilename 7. Save the identification file. 8. Copy the public key to all remote poller systems in this collection set. For instructions, see Copying Authentication Keys from the Central Site to the Remote Sites (see page 24). To generate authentication keys for use with OpenSSH on a UNIX central site 1. Log in to the client as nhuser by entering the following: su nhuser 2. Generate a key on the client by entering the following: mkdir -p ~/.ssh If it doesn't already exist chmod 700 ~/.ssh cd ~/.ssh ssh-keygen -t dsa 3. Transfer the id_dsa.pub to any remote pollers in the collection set. For instructions, see Copying Authentication Keys from the Central Site to the Remote Sites (see page 24). To generate authentication keys for use with OpenSSH on a Windows central site 1. Ensure that OpenSSH is installed to a directory that does not have spaces. 2. Open a command prompt window and enter sftp to confirm that the command exists and that the PATH environment variable is configured correctly. 3. Change to the OpenSSH bin directory. 4. Enter the following: mkgroup -l >>..\etc\group mkpasswd -l -u nhuser >>..\etc\passwd 5. Edit the etc\passwd file and change the default shell from /bin/switch to /bin/sh. 6. Start the server by entering the following: net start opensshd 20 Remote Poller Guide

21 Configuring Secure FTP 7. Log in to SFTP using your password. For example: sftp 8. Configure the key authentication by entering the following: ssh-keygen -t dsa Note: Accept the default key location (/cygdrive/c/.ssh/id_dsa) and do not provide a passphrase. The id_dsa and id_dsa.pub keys should appear at the default key locations. 9. Copy id_dsa.pub to the server and place it in the C:\Documents and Settings\nhuser\.ssh directory. Note: OpenSSH should already be installed in the default directory on the OpenSSH server. Configuring the Remote Sites for Secure FTP You must configure your secure FTP server to point to your ehealth installation on Windows systems. You must also make sure that the secure FTP user account is not a domain account. Your secure FTP user account must be a local system account. To configure UNIX systems for secure FTP, you must make sure that the directory in which you installed SSH (for example, /usr/local/bin) exists in the PATH environment variable for ehealth. Check the nethealthrc.sh.usr and the nethealthrc.csh.usr file and modify the files if necessary. To configure Windows remote sites for SSH.COM Secure FTP (Tectia Server) 1. Select Start, Programs, SSH Secure Shell Server, Configuration. The SSH Secure Shell for Windows Servers Configuration dialog appears. 2. Select SFTP Server in the left frame. The SFTP Server screen appears in the right frame. 3. Under Accessible directories, enter NH_HOME=eHealth, where ehealth is the full pathname of your ehealth home directory. For example, if you installed ehealth in D:\eHealth, enter the following: NH_HOME=D:\eHealth 4. Under User home directory, specify the home directory for your ehealth installation. For example, if you installed ehealth in D:\eHealth, enter the following: D:\eHealth 5. Click OK. Chapter 2: Configuring FTP Connections 21

22 Configuring Secure FTP 6. Verify that.ssh2 subdirectory exists in your \Documents and Settings\username directory. If it does not, create it by changing to that directory and entering the following at the command prompt: mkdir.ssh2 To configure a Windows remote site for OpenSSH Secure FTP 1. Ensure that the directory to which OpenSSH is installed does not contain any spaces. 2. Open a command prompt window and enter sftp to confirm that the command exists and that the PATH environment variable is configured correctly. 3. Change to the OpenSSH bin directory, for example: C:\OpenSSH\bin. 4. Enter the following: mkgroup -l >>..\etc\group mkpasswd -l -u nhuser >>..\etc\passwd If you would like to use a domain user account instead, enter the following: mkgroup d >>..\etc\group mkpasswd d [-u <username>] >>..\etc\passwd Example: mkpasswd d u nhuser domainname >>..\etc\passwd 5. Edit the etc\passwd file and change the default shell from /bin/switch to /bin/sh. 6. Start the server by entering the following: net start opensshd 7. Log in to SFTP as nhuser@hostname using your password from the central site or any SFTP client. sftp nhuser@hostname 8. This step assumes that the public key has been copied to the remote site as described in Copying Authentication Keys from the Central Site to the Remote Sites (see page 24). Place the keys in the Authorized Keys file: a. Change to the C:\Documents and Settings\nhuser\.ssh directory. b. Enter the following: copy /b id_dsa.pub authorized_keys2 22 Remote Poller Guide

23 Configuring Secure FTP 9. Copy id_dsa.pub to the server and place it in the C:\Documents and Settings\nhuser\.ssh directory. Note: OpenSSH should already be installed in the default directory on the OpenSSH server. 10. Edit the C:\OpenSSH\etc\sshd_config file: a. Change the value of StrictModes to no. b. Change the value of RSAAuthentication to yes. c. Uncomment PubkeyAuthentication yes. d. Save the file. Note: If you receive an error, remove the C:\OpenSSH\var\log\OpenSSHd.log file. 11. Go to Administrative Tools, Services. Change the value of Log on as for OpenSSH Service from Local System account to nhuser. Specify domain if you are using a domain user. Example: domainname\nhuser 12. Restart the OpenSSH service. Note: If you receive an error, remove the C:\OpenSSH\var\log\OpenSSHd.log file. To configure a UNIX remote site for OpenSSH secure FTP 1. Add the sshd user by entering the following: mkdir /var/empty chown root:sys /var/empty chmod 755 /var/empty groupadd sshd useradd -g sshd -c 'sshd privsep' -d /var/empty -s /bin/false sshd 2. Confirm that you have /usr/local/bin and /usr/local/sbin in your path. 3. Enter the following: # ssh-keygen -t rsa1 -f /usr/local/etc/ssh_host_key -N "" # ssh-keygen -t dsa -f /usr/local/etc/ssh_host_dsa_key -N "" # ssh-keygen -t rsa -f /usr/local/etc/ssh_host_rsa_key -N "" # cd /usr/local/etc # chmod 600 ssh_host_key ssh_host_dsa_key ssh_host_rsa_key Chapter 2: Configuring FTP Connections 23

24 Configuring Secure FTP 4. Configure the SSH server by uncommenting the following strings in /usr/local/etc/sshd_config: Note: On an HP system, the path would be /opt/ssh/etc/sshd_config. RSAAuthentication yes PubkeyAuthentication yes AuthorizedKeysFile.ssh/authorized_keys 5. Start the SSH server by entering the following: #/usr/local/sbin/sshd 6. After the public key has been transferred to the remote poller, add this public key to authorized keys by entering the following: mv id_dsa.pub ~./ssh cd ~/.ssh cat id_dsa.pub >> authorized_keys chmod 700 authorized_keys Copying Authentication Keys from the Central Site to the Remote Sites To make sure that the central site can communicate with the remote polling sites through secure FTP without requiring password authentication, you must copy the public key that you generated on the central site to each remote polling site. To copy the public authentication key to your remote polling sites 1. From the.ssh2 subdirectory you created under your user home directory, FTP from your remote polling site to the central site by entering the following (where hostname is the name of the central site system) at a command prompt: ftp hostname 2. Change to the.ssh2 subdirectory on the central site by entering the following: cd.ssh2 3. List the files in the.ssh2 subdirectory by entering ls -al on UNIX systems, or dir on Windows systems. The system displays two files, one of which has a.pub extension. This is your public key. The other file is your private key. 4. Enter the following (where publickeyfilename is the public key) to copy the file to your remote polling site: get publickeyfilename.pub 24 Remote Poller Guide

25 Configuring Secure FTP 5. Create a file called authorization (with no extension) in the.ssh subdirectory on the remote site and copy the public key into that file with a prefix of Key, as follows: Key publickeyfilename.pub 6. Save the authorization file. 7. Restart the Secure FTP service (win) or process (unix). 8. Repeat this procedure for each remote polling site. Testing the Secure FTP Connection Test the secure FTP connection between the central site and the remote polling sites to make sure that the sites will not prompt you for a user name or password. To test the secure FTP connection 1. From the central site command prompt, do the following: For Tectia SSH, enter the following at the command line: sftp2 nhuser@hostname For SunSSH or OpenSSH, enter the following at the command line: sftp nhuser@hostname where username is your FTP username and hostname is the name of the remote polling site system. The central site connects to the remote polling site without requiring you to enter a user name or password. If you are prompted for a user name or password, the encryption authentication is not set up correctly. Verify that you have correctly completed the steps in the previous sections, Configuring the Remote Sites for Secure FTP (see page 21) and Copying Authentication Keys from the Central SIte to the Remote Sites (see page 24). Do not attempt to run the nhremotepollersetup command until you have verified that you have set up secure FTP correctly for each remote polling site. 2. Repeat Step 1 to test the secure FTP connection for each remote polling site. Chapter 2: Configuring FTP Connections 25

26 Configuring Standard FTP (Windows Only) Configuring Standard FTP (Windows Only) If your central site and remote polling sites communicate through standard FTP, you must perform the configuration steps described in the following sections for Windows systems only. For UNIX systems, you must only verify that the FTP daemon is active on the remote site. For more information, see Testing the Standard FTP Connection (see page 28). FTP Requirements for Windows Systems When you configure a remote poller on a Windows system, you must satisfy the following conditions: The FTP service must use the ehealth home directory as the FTP home directory. Otherwise, nhremotepollersetup cannot locate the remotepoller.init file (in the ehealth/modules/remotepoller directory) on the remote site. You must provide both Read and Write access to the FTP home directory. For instructions on providing Read and Write access, see the next section,verifying the Standard FTP Service on a Remote Site (Windows Only) (see page 26). You must configure the FTP service to use UNIX-style directory listings, otherwise the nhremotepollersetup command will fail when adding remote sites. For instructions, see the next section, Verifying the Standard FTP Service on a Remote Site (Windows Only) (see page 26). Verifying the Standard FTP Service on a Remote Site (Windows Only) If your remote ehealth site is a Windows system, make sure that the FTP Server Service is installed and started. You must configure this service with directory information. You can also create a virtual directory for storing your configuration and statistics files. To verify that the FTP Server service is installed and configured 1. Log in to the ehealth system as the ehealth administrator. 2. Select Start, Settings, Control Panel, Administrative Tools, Internet Services Manager. The Internet Information Services screen appears. 3. Under Internet Information Services in the left frame, select the system for which you are setting up remote polling, and expand the directories under that system. 26 Remote Poller Guide

27 Configuring Standard FTP (Windows Only) Create a Virtual Directory 4. Right-click Default FTP Site under the system for which you are setting up remote polling. A drop-down menu appears. 5. If Default FTP Site does not appear in the list of services, you must install the FTP service from your Windows CD-ROM. For instructions, see your Windows documentation. 6. Select Properties. The Default FTP Site Properties dialog appears. 7. Select the Home Directory tab. 8. Specify the ehealth home directory as the Local Path value. 9. Select UNIX under Directory Listing Style. 10. In the FTP site directory group box, select Read, Write, and Log Visits. 11. Click OK to save your changes and then create a virtual directory, if desired, as described in the next procedure. If you use SSH.COM secure FTP (Tectia Server, you must create a virtual directory for storing your configuration and statistics files. To create a virtual directory for use with (SSH.COM Secure FTP/Tectia Server) 1. Select Default FTP Site under the system for which you are setting up remote polling, and then select Action, New, Virtual Directory. The Virtual Directory Creation Wizard appears. 2. Click Next. The Virtual Directory Alias screen appears. 3. Enter a name for the virtual directory in the Alias field, and click Next. The FTP Site Content Directory screen appears. 4. In the Path field, enter the remote poller spool directory (for example, D:\eHealth\modules\remotePoller\spool), and click Next. The Access Permissions screen appears. 5. Make sure that the ehealth administrator account owns the ehealth/modules/remotepoller directory. 6. Select Read and Write under Access Permissions, click Next, and then click Finish. The virtual directory is created below the currently selected folder level. Chapter 2: Configuring FTP Connections 27

28 Troubleshooting FTP Installation Problems for Windows Advanced Servers Testing the Standard FTP Connection Before you run the nhremotepollersetup command, test the standard FTP connection between the central site and the remote polling sites to make sure that the FTP daemon is active on the remote sites. To test the secure FTP connection 1. From the central site, enter the following at a command prompt, where hostname is the hostname or IP address of the remote system (in either v4 or v6 format): ftp hostname If the central site does not connect to the remote site, verify that FTP is enabled and configured properly on the remote site. 2. Log in to the remote system with your FTP user name and password. If the login is unsuccessful, verify that you are using the correct user name and password. 3. Repeat Steps 1 and 2 for each remote polling site. Troubleshooting FTP Installation Problems for Windows Advanced Servers If you must install and configure FTP services for a Windows 2000/2003 Advanced Server system, the installation could display an error that it was unable to install the file IIS_ftpctrs.h. This file is located within the IIS5_01.CAB file of the W2k /i386 folder of the installation media. You must manually extract the file and save it on the Windows system. You must then point the installation program to its location to complete the FTP configuration. 28 Remote Poller Guide

29 Chapter 3: Creating a Remote Polling Environment This chapter describes how to configure the remote polling environment. You use the nhremotepollersetup command to configure the central site and each remote site. You can also use the command to manage remote polling processes after the initial configuration. Before you begin the setup process, make sure that you have installed ehealth on each system that will be part of the remote polling environment, and make sure that you have configured the FTP connectivity between them as described in the chapter, Configuring FTP Connections. This section contains the following topics: Setting Up the Remote Polling Site (see page 29) Setting Up and Administering the Central ehealth Site (see page 32) Administering the Remote Polling Environment (see page 38) Resynchronizing the Central and Remote Sites (see page 44) Changing FTP Information (see page 46) Understanding the Remote Poller Operations (see page 47) Setting Up the Remote Polling Site After you install ehealth on a remote site, you must run the nhremotepollersetup command to configure the site to be a remote poller. Before you set up a remote polling site, you must start the ehealth servers on that system. Do not discover or import any elements before you run nhremotepollersetup. If setup detects elements in an ehealth system s poller configuration, you cannot change the configured site ID. You must remove all elements from the configuration and rerun setup. If the site ID is in use by any other site (central or remote), you cannot configure it as a remote polling site. The first time you run nhremotepollersetup on any system, you are automatically prompted to set the polling parameters. Every subsequent time you run nhremotepollersetup on that system, the command displays the Remote Polling Site Setup menu, and you can select 1 from that menu to access the configuration questions for setting the polling parameters. Note: Repeat this procedure on each ehealth system that you have designated as a remote polling site. Chapter 3: Creating a Remote Polling Environment 29

30 Setting Up the Remote Polling Site To set up a remote polling site 1. Log in to the remote site as the ehealth user. Make sure that the ehealth servers are started. (To start the servers, enter the nhserver start command.) 2. Enter the following at the command prompt: nhremotepollersetup The following menu appears: Please select the type of setup you wish to perform on this ehealth system. 1. Remote Polling Site Setup 2. Central Site Administration Please choose one of the following (1 2 q) [q]: 3. Enter 1 to display the Remote Polling Site Setup menu. 1. Enter or Update Remote Poller Parameters 2. Enable Remote Polling on this station 3. Disable Remote Polling on this station 4. Dump Configuration (for synchronization with Central Site) q. Quit Setup Please choose one of the following ( q) [q]: 4. Enter 1 to configure this system as a remote polling site. The following prompt appears. Windows may allow you to create a virtual directory which acts as an alias to the directory where configuration data and statistics data are stored. Your FTP service must be configured with a virtual directory for the remote poller spool directory. Do you want to use a virtual directory? Choose n if you want to clear a previously specificed directory. Please choose one of the following: (y/ n) [n]: 5. Do one of the following: If you are using standard FTP, enter n. If you are using secure FTP on Windows, enter y. 30 Remote Poller Guide

31 Setting Up the Remote Polling Site If you enter y, the following prompt appears: Specify the virtual directory that you configured for your FTP service. Please enter a valid directory name: For example: /NH_HOME/modules/remotePoller/spool where NH_HOME is the virtual directory name. Note: For instructions on using a virtual directory for Tectia SSH on Windows, see Create a Virtual Directory on page 14. For OpenSSH Secure FTP on Windows, you do not need to create a virtual directory; however, you do need to specify a directory that includes the cygdrive notation. For example: /cygdrive/c/ehealth/modules/remotepoller/spool where "c/ehealth" is the ehealth home directory. The following prompt appears: Please enter the name of a directory where ehealth can place remote poller statistics and configuration output files. This must be a subdirectory under the FTP root directory or accessible by the FTP alias. The remote poller may require up to 200 Megabytes of disk space on this file system. Please enter a valid directory name [/]: For example: $NH_HOME\modules\remotePoller\spool 6. Enter the full pathname of the FTP home directory (for Windows systems, this must be the ehealth home directory) or the full path name of the virtual directory. The following prompt appears. Setup has detected that the site ID on this site is already configured. The currently configured value of the site ID is 1. Do you wish to change the configured site ID? (y n) [n]: Note: You cannot change this ID unless you delete all the existing elements, losing all the data on that system. If the site ID is 1, you must configure the central site to use a site ID other than the default value of 1. The site ID must be unique for all the sites in the remote polling environment. If you accidentally specify a site ID that is already used for another remote site, run the nhremotepollersetup command again immediately (before you discover elements) to change the site ID. 7. Do one of the following: Enter y at the prompt, specify a new site ID, and restart your ehealth server. Enter n at the prompt to use the existing site ID. Chapter 3: Creating a Remote Polling Environment 31

32 Setting Up and Administering the Central ehealth Site The following prompt appears. 1. Enter or Update Remote Poller Parameters 2. Enable Remote Polling on this station 3. Disable Remote Polling on this station 4. Dump Configuration (for synchronization with Central Site) q. Quit Setup Please choose one of the following ( q) [q]: 8. Enter 2 to enable remote polling. The remote site prepares the files that will be imported by the central site, and stores a record of this setup in the following directory: ehealth/modules/remotepoller/logs_setup/log. 9. Enter q to exit the menu. After you set up the remote site, discover the elements that it will manage and begin polling those elements to collect performance data. After you have set up all your remote sites, proceed to Setting Up and Administering the Central ehealth Site (see page 32) to set up the central site and complete the setup of your remote polling environment. Setting Up and Administering the Central ehealth Site A collection set is a set of remote polling stations from which a central site is configured to import data. After you install ehealth on a central site, you use the nhremotepollersetup command to configure the central site and identify the remote sites from which it will collect data. Setting Up the Central Site and Adding Remote Sites to the Collection Set Use nhremotepollersetup to configure the central site and add remote polling sites to the collection set. A remote polling site can belong to a collection set for only one central site. ehealth does not support configurations where a remote polling site is associated with more than one central site. To add remote polling sites to the central ehealth site 1. Log in as the ehealth user. 32 Remote Poller Guide