Tivoli Application Dependency Discovery Manager Discovery Scan Report and Remediation for Computer Systems v2.0 Eduardo Tanaka and Scott Graham Tivoli Application Dependency Discovery Manager Solutions Team Copyright International Business Machines Corporation 2011. US Government Users Restricted Rights Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp. 1
Table of Contents 1. Introduction...3 2. Who should read this document...3 3. Process...3 Looking at the Linked Reports...8 Discovery History...11 4. Example of Remediation...11 5. Reports Installation...12 6. Notices...13 2
1.Introduction This document shows how a discovery scan of computer systems can be evaluated and remediated in TADDM 7.2.1. NOTE: IBM recommends that the discovery of the computer systems and network devices be done separately and so this document will only cover the computer systems part of it. This will make the discovery report and remediation simpler and more accurate to implement. For this, a level 2 or level 3 discovery could be used. But as only level 2 information will be considered, it will save discovery time running only a level 2 scan. To avoid letting TADDM discover computer systems using SNMP, a discovery profile can be created (based in level 2 or 3 discovery profiles) and the SNMP sensor can be disabled, if desired. For information on how to do this, refer to the following document: http://publib.boulder.ibm.com/infocenter/tivihelp/v46r1/topic/com.ibm.taddm.doc_ 721/UserGuide/c_cmdb_discoverprofiles.html Tivoli Application Dependency Discovery Manager Version 7 Release 2.1- section: Chapter 1. Discovery Management Console-> Managing discoveries-> Using discovery profiles. 2.Who should read this document This document is useful for all people responsible for running TADDM discoveries and remediating them. This usually includes TADDM administrators. 3.Process TADDM has a sequence in which the various sensors are started to perform discovery. The following figure shows the order the sensors run: Ping Sensor Session Sensor Specific Computer System Sensor Port Sensor Generic Computer System Sensor Many sensors are used in TADDM but those are the ones that are of interest for this verification and remediation process. The Specific Computer System Sensor represents sensors like: AIX, HPUX, 3
Solaris, Linux, Windows, etc. A set of BIRT reports have been installed to support this process. The information on how to install these reports is at the end of this document. Using the Verification and Remediation Process Go to the BIRT reports(data Management Portal Analytics Birt Reports) and run the Discovery Scan Remediation Report as shown in Illustration 1: Selecting the Discovery_Scan_Remediation Report. Illustration 1: Selecting the Discovery_Scan_Remediation Report This report will give the summary of what happened in a given scan. When you start the report you need to select which scan you are interested. In order to select the scan in which you are interested, you will have to select the Discovery Server and the Run ID. Run ID's for TADDM Discoveries look like 20110062715111878 and represent the date and time the discovery was run. The ID is in the format: YYYYMMDDHHMMSSMS. Illustration 2: Discovery Scan Report Parameters shows an example: 4
Illustration 2: Discovery Scan Report Parameters Pressing OK will run the 'TADDM Discovery Scan Remediation Report' shown in Illustration 3: TADDM Discovery Scan Remediation Report. This report has four sections: 1. Run ID This section shows the run ID that was passed to run the report, the Discovery Server used for the discovery and the Start and End time of the discovery. 2. Discovery Summary This section shows the summary of the Level 2 Discovery sensors run. The result s are categorized as follows: Completely Discovered Systems Systems successfully discovered with a ComputerSystem sensor. Failed Discovered System - Systems where a ComputerSystem sensor started but failed. Any failures here should be addressed. Detailed Discovery Started Systems where the GenericComputerSystem sensor started. No Detail Discovery Started Systems where the SessionSensor 5
ran, but the GenericComputerSystem sensor did not start. Successfully Accessed Systems Systems where the SessionSensor ran successfully and we therefore have correct credentials. Access Failures - Systems where the SessionSensor failed. A system cannot be discovered if the SessionSensor fails. These are the primary issues to be remediated. Systems with Correct Prerequisites- this is the number of IPs that have the correct prerequisites; meaning they have at least SSH or WMI active. Systems Missing Prerequisites Systems that were unable to be discovered because they do not have SSH or WMI enabled. Number of Active Systems this is the number of IPs that TADDM could at least successfully ping and is the maximum possible computer systems that could be 'Completely Discovered Systems'. 3. Level 3 (Application) Sensor Summary This section shows the number of Level 3 sensors that ran and the success rate (Normal or Error) 4. Scope Elements for this Discovery Run -- This section lists the scope elements that were used for this discovery run. 6
Illustration 3: TADDM Discovery Scan Remediation Report Starting from the bottom of the Discovery Summary Section, the Number of Active Systems Found is the maximum possible number for the remaining sections. If we were not able to ping the machine and run the PortSensor we will not be able to run any other sensors on it either. 7
Looking at the Linked Reports All of the failures noted above that should be remediated have a hyper-link to another report. Starting with the Systems Missing Prerequistes hyper-link, you will see a list of machines that do not have SSH or WMI enabled similar to Error: Reference source not found. Illustration 4: TADDM Discover Scan Missing Prerequisites Report Each entry in this list shows machines that TADDM did not find SSH(port 22) or WMI(port 135) and therefore could not run the SessionSensor. These may support running the SNMP Sensor on, but they cannot be discovered using ComputerSystem credentials without SSH or WMI. Remember that it could be for some machines in that list, some network devices were included by accident. In this case, remove those devices from the computer system's scope. After fixing the machines, the scan can be run again. See a sample report above. You can see in the description that they do not have port 22 (SSH) or 135 (WMI) open. Adding those capabilities will fix this problem. Successfully Accessed Systems- these are the machines where TADDM could successfully login to. If this number is different than the Systems with Correct Prerequisites, it could be a credentials problem, WMI is inactive, a privilege issue, etc. To know the list of machines that failed and exactly what 8
the problem is you can click on the Access Failures link which will run a report showing the reasons the SessionSensor failed. Illustration 5: Access Failures shows an example of the report. Illustration 5: Access Failures The column Sensor Details shows the ports that were opened so the user can have a good idea if the access is through WMI or SSH. The Description column on that report will tell you the problem. If the information is not enough, you can go to the $COLLATON_HOME/log/sensors/<run ID> and look for the specific sensor log. If you have any questions or if the information there is not enough because the logs are in INFO mode, look in the TADDM Troubleshooting Guide for the answers and how to change the logs to DEBUG mode. The primary goal here would be to get the number of Successfully Accessed Systems as close as possible to the number of Systems with Correct Prerequisites. After a machine has been Successfully Accessed a higher level Computer System sensor should run. Now TADDM is ready to start collection of the internal information on the machines. Detailed Discovery Started- these are the machines that TADDM could successfully access and was able to start collecting internal detailed information. This number could be different than the previous one because TADDM knows which interfaces belong to the same machine and only starts 9
one sensor per machine and not one per interface. No Detail Discovery Started - This list does not mean that a detail discovery did not start but that it did not start for the IP Addresses in question. For the most part, this list can be ignored because TADDM knows which interfaces belong to the same machine and only starts one sensor per machine and not one per interface. Once Detailed Discovery starts, it is expected that the systems should be discovered completely by the Level 2 Computer System sensors. Completely Discovered Systems- these are the machines that TADDM was able to get complete level 2 information ( Operating System, machine data, installed packages, services, etc). If this number is different than the previous one then look into the Failed Discovered Systems Report for the machines that failed this step. The reason for the failure should be in the report. If more information is needed, follow the instructions in the previous step. 10
Discovery History In all of the error reports, it is possible to click through on the hostname/ip field and pull up the history of discovery for that IP address. This is particularly useful in confirming if a particular failure is persistent or a one time only event. Illustration 6: Discovery History Report Shows the discovery history for 'data.tivlab.sanjose.ibm.com' Illustration 6: Discovery History Report In the above report, it is obvious that 'data.tivlab.sanjose.ibm.com' has not been successfully discovered ever due to SSH Authorization issues. 4.Example of Remediation In the TADDM Discovery Scan Failed Access Report, it is very likely that the problems are related to credentials. For example, the machine 'dogbert.tivlab.sanjose.ibm.com' in the Illustration 5: Access Failures failed with error The server did not complete the authorization process. This is a typical 11
credentials problem. By the information in the report, this was a failed SSH access. If more confirmation is needed, the logs can be examined. Look in the $COLLATION_HOME/log/sensor/<runid> directory for the SessionSensor- <machine IP+Port>.log file. Start from the end and if the logs are in DEBUG mode, a Permission Denied error might be found. In this case, the password for Unix machines can be fixed in TADDM Access Lists or the public key in the target machine might not be correct or is not in the right directory. 5.Reports Installation To run the reports described in the previous section follow the steps: Download the zip file with the reports from https://www.ibm.com/developerworks/mydeveloperworks/groups/service/html/ communityview?communityuuid=7d5ebce8-2dd8-449c-a58e- 4676134e3eb8#fullpageWidgetId=Wea1cb2531f10_4ccd_99d7_6ab0334cb21 f&file=76030445-e638-420a-8664-7a2b7f6900c3 to the machine where you are running the TADDM Data Management Portal. (local machine) Unzip the file. This will create the following files: Discovery_Scan_Remediation_by_Server.rptdesign DiscoverySubReports_2.0.zip In the TADDM Data Management Portal, go to Analytics-> BIRT Reports and click New. The Add Report window will show up. Fill out the information in Name and Description and browse to the respective report file and click OK. Repeat this for each of the reports. You can put any information in the Name and Description fields that you like, here are a few suggestions: Name Description File Name Discovery_Scan_Remediati on Discovery Scan Remediation <directory>/discovery_scan_remediat ion_by_server.rptdesign This will make the main remediation report show up in the BIRT Report Interface. 12
To enable all of the Click-through reports you need to upload the DiscoverySubReports_2.0.zip file to your TADDM Primary Storage Server. This file contains: Discovery_Scan_Failed_Access.rptdesign Discovery_Scan_History_IP.rptdesign Discovery_Scan_L3.rptdesign Discovery_Scan_Missing_Prerequisites.rptdesign Discovery_Scan_No_Generic_Sensor.rptdesign Discovery_Scan_System_Information_Error.rptdesign Discovery_Scan_Missing_Prerequisites.rptdesign Discovery_Scan_Failed_Access.rptdesign Discovery_Scan_System_Information_Error.rptdesign On the TADDM Primary Storage Server Change directory to the $COLLATION_HOME/dist/deploy-tomcat/birtviewer/WEB-INF/report Unzip the file. You can replace any files that are already present. Now you should see the report in the BIRT Reports list in the Data Management Portal and all of the click-throughs should work. 6.Notices This information was developed for products and services offered in the U.S.A. IBM may not offer the products, services, or features discussed in this document in other countries. Consult your local IBM representative for information on the products and services currently available in your area. Any reference to an IBM product, program, or service is not intended to state or imply that only that IBM product, program, or service may be used. Any functionally equivalent product, program, or service that does not infringe any IBM intellectual property right may be used instead. However, it is the user's responsibility to evaluate and verify the operation of any non-ibm product, program, or service. IBM may have patents or pending patent applications covering subject matter described in this document. The furnishing of this document does not give you any license to these patents. You can send license inquiries, in writing, to: IBM Director of Licensing IBM Corporation North Castle Drive Armonk, NY 10504-1785 U.S.A. For license inquiries regarding double-byte (DBCS) information, contact the IBM Intellectual Property Department in your country or send inquiries, in writing, to: Intellectual Property Licensing 13
Legal and Intellectual Property Law IBM Japan, Ltd. 1623-14, Shimotsuruma, Yamato-shi Kanagawa 242-8502 Japan The following paragraph does not apply to the United Kingdom or any other country where such provisions are inconsistent with local law: INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Some states do not allow disclaimer of express or implied warranties in certain transactions, therefore, this statement might not apply to you. This information could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein; these changes will be incorporated in new editions of the publication. IBM may make improvements and/or changes in the product(s) and/or the program(s) described in this publication at any time without notice. Any references in this information to non-ibm websites are provided for convenience only and do not in any manner serve as an endorsement of those websites. The materials at those websites are not part of the materials for this IBM product and use of those websites is at your own risk. IBM may use or distribute any of the information you supply in any way it believes appropriate without incurring any obligation to you. Licensees of this program who wish to have information about it for the purpose of enabling: (i) the exchange of information between independently created programs and other programs (including this one) and (ii) the mutual use of the information which has been exchanged, should contact: IBM Corporation 2Z4A/101 11400 Burnet Road Austin, TX 78758 U.S.A. Such information may be available, subject to appropriate terms and conditions, including in some cases payment of a fee. The licensed program described in this document and all licensed material available for it are provided by IBM under terms of the IBM Customer Agreement, IBM International Program License Agreement or any equivalent agreement between us. Any performance data contained herein was determined in a controlled environment. Therefore, the results obtained in other operating environments may vary significantly. Some measurements may have been made on development-level systems and there is no guarantee that these measurements will be the same on generally available systems. Furthermore, some measurement may have been estimated through extrapolation. Actual results may vary. Users of this document should verify the applicable data for their specific environment. Information concerning non-ibm products was obtained from the suppliers of those products, their published announcements or other publicly available sources. IBM has not tested those products and cannot confirm the accuracy of performance, compatibility or any other claims related to non-ibm products. Questions on the capabilities of non-ibm products should be addressed to the suppliers of those products. All statements regarding IBM's future direction or intent are subject to change or withdrawal without notice, and represent goals and objectives only. This information is for planning purposes only. The information herein is subject to change before the products described become available. 14
This information contains examples of data and reports used in daily business operations. To illustrate them as completely as possible, the examples include the names of individuals, companies, brands, and products. All of these names are fictitious and any similarity to the names and addresses used by an actual business enterprise is entirely coincidental. COPYRIGHT LICENSE: This information contains sample application programs in source language, which illustrate programming techniques on various operating platforms. You may copy, modify, and distribute these sample programs in any form without payment to IBM, for the purposes of developing, using, marketing or distributing application programs conforming to the application programming interface for the operating platform for which the sample programs are written. These examples have not been thoroughly tested under all conditions. IBM, therefore, cannot guarantee or imply reliability, serviceability, or function of these programs. You may copy, modify, and distribute these sample programs in any form without payment to IBM for the purposes of developing, using, marketing, or distributing application programs conforming to IBM s application programming interfaces. Each copy or any portion of these sample programs or any derivative work, must include a copyright notice as follows: (your company name) (year). Portions of this code are derived from IBM Corp. Sample Programs. Copyright IBM Corp. _enter the year or years_. All rights reserved. If you are viewing this information in softcopy form, the photographs and color illustrations might not be displayed. 1. Trademarks IBM, the IBM logo, and ibm.com are trademarks or registered trademarks of International Business Machines Corporation in the United States, other countries, or both. If these and other IBM trademarked terms are marked on their first occurrence in this information with a trademark symbol ( or ), these symbols indicate U.S. registered or common law trademarks owned by IBM at the time this information was published. Such trademarks may also be registered or common law trademarks in other countries. A current list of IBM trademarks is available on the web at "Copyright and trademark information" at http://www.ibm.com/legal/copytrade.shtml. Other company, product, or service names may be trademarks or service marks of others. 15