FAQ

This section addresses common questions about PATROL for AIX.

• • PATROL for UNIX and Linux and PATROL for AIX co-existence and attribute mapping
    • Can PATROL for UNIX and Linux and PATROL for AIX co-exist together?
    • Which PATROL for UNIX and Linux attributes are present in PATROL for AIX?
    • In PATROL for AIX, which CPU attributes are active in LPAR and WPAR?
  • User access
    • Why should I add the user in adm group?
  • Device Hierarchy and FQDN
    • Why is the HMC device hierarchy incorrect in TrueSight?
    • How can I provide the FQDN details if the DNS is not configured? 
  • Remote monitoring scalability
    • Linux to AIX remote monitoring of 249 remote hosts
    • Linux to AIX remote monitoring of 325 remote hosts
    • Linux to AIX remote monitoring of 500 remote hosts
    • Microsoft Windows to AIX remote monitoring of 100 remote hosts
    • Microsoft Windows to AIX remote monitoring of 150 remote hosts
  • Remote monitoring FAQs
    • What is the role of iakremotexec.xpc in remote monitoring?
    • Prerequisites and configuration requirements for the remote host 
    • Which authentication mechanisms are used in remote monitoring?
    • How do I create RSA public and private keys?
    • How to use PuTTYgen for key based authentication?
    • Remote monitoring configuration using key-based authentication video
    • Can I use an earlier version of the PATROL Agent?
    • Can I monitor AIX systems from a Microsoft Windows PATROL Agent?
    • Does each collector have its own dedicated SSH session?
    • Is the SSH connection to a remote host persistent?
    • Can I change threshold values for a specific remote host instance?
    • How does TrueSight discover remote hosts?
    • Are workload parameters in logical partition available in remote monitoring? OR Why are the workload parameters not visible in remote monitoring?
    • Which commands are used for monitoring the KM?
  • Debug and log information
    • Where should I look for debug or log monitoring files?
  • Online help
    • Will online help be available for KMs?
      
    • How can I access the online help?
    • What kind of offline documentation can I get?
    • How do I access the documentation PDF?

PATROL for UNIX and Linux and PATROL for AIX co-existence and attribute mapping

Can PATROL for UNIX and Linux and PATROL for AIX co-exist together?

Yes, PATROL for AIX 1.1.20 and PATROL for UNIX and Linux can co-exist together. 

Which PATROL for UNIX and Linux attributes are present in PATROL for AIX?

The following tables list the attribute mapping of PATROL for UNIX and Linux and PATROL for AIX.

In PATROL for AIX, which CPU attributes are active in LPAR and WPAR?

User access

Why should I add the user in adm group?

The KM uses sar command to collect the CPU, Memory and Kernel attribute information. This command must be a part of the adm group. The changes applied in the groups file are not picked dynamically.

After you modify the groups file perform the following:

1. Disconnect and reconnect the host
2. Stop and restart the PATROL Agent

Device Hierarchy and FQDN

Why is the HMC device hierarchy incorrect in TrueSight?

DNS must be enabled to obtain correct hierarchy of HMC, Managed Systems, and Partitions.

The nslookup command must work on Partitions and Managed Systems from the PATROL Agent. nslookup is always performed on the display name or IP address of the Partition that is received from the HMC. If the nslookup fails to get the FQDN, display name is used to form the device. If you want the devices to be identified using a different name, see How can I provide the FQDN details if the DNS is not configured? question.

How can I provide the FQDN details if the DNS is not configured? 

• For Logical Partitions (Lpar) in HMC monitoring:

  Use the /LPARHostFQDN/<lpar display name> pconfig variable to provide the FQDN details. The format of the value is hostname.domain
  Example: For test1 lpar, the value is:
  /LPARHostFQDN/test1 = test1.testdomain.com

• For remote monitoring:

  Enter the FQDN after the hostname while configuring the remote host from TrueSight.

  Example: For testHost1 remote host, use the following value in the Host Name field:

  testHost1;testHost1.testdoamin.com

Remote monitoring scalability

Linux to AIX remote monitoring of 249 remote hosts

Hardware details

Setup details

Configuration details

Performance and Scalability

Attribute and Instance Count

Resource Utilization

Performance data of PATROL Agent, Remote Execution XPC, and network IO.

Linux to AIX remote monitoring of 325 remote hosts

Hardware details

Setup details

Configuration details

Performance and Scalability

Attribute and Instance Count

Instance count for each monitor type per remote host configuration

Resource Utilization

Performance data of PATROL Agent, Remote Execution XPC, and Network IO.

Linux to AIX remote monitoring of 500 remote hosts

Hardware details

Setup details

Configuration details

Performance and Scalability

Attribute and Instance Count

Instance count for each monitor type per remote host configuration

Resource Utilization

Performance data of PATROL Agent, Remote Execution XPC, and Network IO.

Microsoft Windows to AIX remote monitoring of 100 remote hosts

Hardware details

Setup details

Configuration details

Performance and Scalability

Attribute and Instance Count

Resource Utilization

Performance data of PATROL Agent and Remote Execution XPC

Microsoft Windows to AIX remote monitoring of 150 remote hosts

Hardware details

Setup details

Configuration details

Performance and Scalability

Attribute and Instance Count

Resource Utilization

Performance data of PATROL Agent and Remote Execution XPC

Remote monitoring FAQs

What is the role of iakremotexec.xpc in remote monitoring?

PATROL for AIX uses an XPC-based collection mechanism to support monitoring of the remote hosts. The iakremotexec.xpc stand-alone executable communicates with PATROL Agent through standard input (stdin) and output (stdout) channels connected with pipes. The communication between PATROL Agent and the XPC server is handled by the SDK libraries through PSL function calls.

iakremotexec.xpc is an XPC-based SSH2 client that opens sessions with remote hosts, runs commands on those hosts, and returns the output to the PSL collectors. For the PSL collectors, the command execution is transparent and the same PSL collectors work well with the local host and the remote host. The XPC-based SSH2 client has following advantages:

1. 
   
   • A single SSH2 client (process) can handle multiple remote sessions simultaneously.
   • Multiple system commands can be executed over a single remote session simultaneously.

The XPC-based client is responsible for collecting information from the remote host for the application classes.

Prerequisites and configuration requirements for the remote host 

• The SSH2 server must be installed and running.
• The SSH2 server must be configured as follows:
  • To configure the remote host for password-based authentication, add the following entry to the SSH2 server configuration (sshd_config) file, if it is not already present:
    PasswordAuthentication yes
  • To configure the remote host for key-based authentication, add the following entry to the SSH2 server configuration (sshd_config) file, if it is not already present:
    PubkeyAuthentication yes
  • To configure a port number on the remote host, add the following entry to the SSH2 server configuration (sshd_config) file, if it is not already present:
    Port 22

You must restart the SSH2 server after making configuration changes.

The following figure illustrates a configuration with multiple remote hosts.

Monitoring configuration with multiple remote hosts

Which authentication mechanisms are used in remote monitoring?

PATROL fo AIX supports the following types of user authentication mechanisms.

Password-based

When you configure a remote host for monitoring, you must provide a user name and a password to access the remote host. PATROL for AIX stores these login credentials in a secure key store. The SSH2 client submits the credentials to the remote host in order to initiate a remote connection. If the credentials are validated successfully, the SSH2 client starts collecting data for the remote host.

To configure the remote host for password-based authentication, add the following entry to the SSH2 server configuration (sshd_config) file, if it is not already present:

PasswordAuthentication yes

Key-based

When you configure a remote host for monitoring, you must provide the public and private key file paths, and the passphrase (if applicable). The key file paths must be absolute paths (for example, /home/user/id_rsa.pub), and the PATROL user must have read permissions to access the key files. PATROL for AIX stores the key file paths in a secure key store.

To configure the remote host for key-based authentication, add the following entry to the SSH2 server configuration (sshd_config) file, if it is not already present:

PubkeyAuthentication yes

How do I create RSA public and private keys?

An RSA key pair must be generated on the client system. The public portion of this key pair must reside on the servers that the client will access, and the private portion must reside on a secure local area of the client system (by default in the ~/.ssh/id_rsa directory).

The following figure shows the RSA key pair on client and server systems.

RSA key pair on client and server systems

You can generate the keys by using the ssh-keygen utility.

To generate the RSA key pair

1. Enter the following command on the client system to create the ~/.ssh directory:
   mkdir ~/.ssh
2. Enter the following command on the client system to change permissions on the ~/.ssh directory:
   chmod 700 ~/.ssh
3. Enter the following command on the client system:
   ssh-keygen -q -f ~/.ssh/id_rsa -trsa
4. Enter the passphrase if required.
5. Enter the passphrase again.

The file permissions should be locked to prevent other users from being able to read the key pair data. OpenSSH might also refuse to support public key authentication if the file permissions are too open. These fixes should be done on all systems involved.

To lock file permissions

1. Enter the following commands on the client system:

   • chmod go-w ~/

   • chmod 700 ~/.ssh
   • chmod go-rwx ~/.ssh/*

To enable public key authentication

1. Copy the public portion of the RSA key pair to the servers that the client will access.
   The public key information to be copied should be located in the ~/.ssh/id_rsa.pub file on the client.
2. Append the public key information to the ~/.ssh/authorized_keys file on the servers.
   You can use the scp or ssh-copy-id utility for copying the ID on the server.
3. Verify that public key connections to the servers work properly by executing the following commands:
   • client$ ssh -o PreferredAuthentications=publickey sshServerName
   • Enter passphrase for key '/…/.ssh/id_rsa': passphrase
   • passphrase
   • server$

How to use PuTTYgen for key based authentication?

On Microsoft Windows, PuTTYgen tool creates the keys in ssh.com format by default. These keys must be converted to openssh format.

Remote monitoring configuration using key-based authentication video

  https://youtu.be/jD3MzWo9_uU 

Can I use an earlier version of the PATROL Agent?

Yes. You can use any of the earlier PATROL Agent versions supported. BMC recommends you to use the latest version of the PATROL Agent for better performance.

Can I monitor AIX systems from a Microsoft Windows PATROL Agent?

Yes, you can monitor AIX system from a Microsoft Windows computer. 

Does each collector have its own dedicated SSH session?

No, all of the collectors for a remote host use the same SSH session.

Is the SSH connection to a remote host persistent?

Yes, a persistent SSH connection is maintained for each remote host being monitored.

Can I change threshold values for a specific remote host instance?

Yes, you can configure threshold values for a specific remote host.

How does TrueSight discover remote hosts?

TrueSight discovers remote host instances as devices.

Are workload parameters in logical partition available in remote monitoring? OR Why are the workload parameters not visible in remote monitoring?

The KM uses perfstat API to retrieve the performance metrics of Workload partition from Logical partition. This restricts the collection mode of these parameters when the PATROL Agent is installed locally on the LPAR.

Which commands are used for monitoring the KM?

• prtconf
• sar (user must be part of adm group)
• uptime
• lparstat
• vmstat 
• mpstat 
• iostat 
• mpstat 
• df 
• mount
• ipcs 
• getconf PAGE_SIZE
• netstat 
• entstat 
• who
• lsps 

Debug and log information

Where should I look for debug or log monitoring files?

Log location:

• XPC (binaries) - Patrol3/iak/log directory
• Collectors or discovery (PSL processes) - Patrol3/log/trace/<agenthostname>/<port> directory

In Standard Monitoring the KM monitors CPU, Memory, Filesystem, and Network monitor types.

Online help

Will online help be available for KMs?

Online help will not be available from the following Consoles:

• PATROL Central Operator – Microsoft Windows Edition
• PATROL Central Operator – Web Edition
• PATROL Console for Microsoft Windows
• PATROL Console for UNIX.

However, online Help will continue to be available from the TrueSight Operations Management Console and BMC Central Monitoring Administration. 

How can I access the online help?

You can access the online help from the TrueSight Operations Management console and the Central Monitoring Administration. For complete product documentation, refer to the KM documentation on docs.bmc.com.

What kind of offline documentation can I get?

KM documentation is available in PDF format.

How do I access the documentation PDF?

You can access the offline documentation from the following locations:

• Product documentation is available in PDF format along with the installation files on the EPD site.
• PDFs are also available on the PDFs and videos page of the respective KM documentation on docs.bmc.com