# Compaq ACMS for OpenVMS
Remote Systems Management Guide

Previous | Contents | Index

## 3.5.1 Reporting Problems

If the ACMS$MGMT_HMMO process crashes, the following files will contain any error information that was available: SYS$SPECIFIC:[WBEM]ACMS$MGMT_HMMO.LOG;* SYS$SPECIFIC:[WBEM]ACMS$MGMT_HMMO.ERR;*.

If there are any new dump files you may want to examine the file to locate the problem source. SYS$SPECIFIC:[WBEM]*.DMP;*

If the problem is with WBEM$SERVER process, send the dump file to your Compaq support representative. If the problem is with the ACMS HMMO process, please have the following files ready for analysis in addition to a procedure that reproduces the situation:

- SYS$SPECIFIC:[WBEM]ACMS$MGMT_HMMO.LOG;*
- SYS$SPECIFIC:[WBEM]ACMS$MGMT_HMMO.ERR;*
- SYS$SPECIFIC:[WBEM]*.html;*
- SYS$SPECIFIC:[WBEM]*.txt;*
- SYS$SPECIFIC:[WBEM]SYS$OUTPUT.*;
- SYS$SPECIFIC:[WBEM]*.DMP;*

# Chapter 4
Managing the Remote Manager

This chapter describes how to manage the ACMS Remote Manager.

# 4.1 Overview

The ACMS Remote Manager runs on the same node as the ACMS run-time system but runs independently of it. The Remote Manager may be started and stopped at any time without affecting the ACMS run-time system. Similarly, the ACMS system can be started and stopped at any time without affecting the Remote Manager process. Remote management can be performed only on nodes where the Remote Manager has been started.

ACMS system managers configure the Remote Manager process (for example, which interfaces are enabled, what alarms to send) using a combination of the ACMSCFG utility (which provides initial configuration settings at process startup) and the ACMSMGR utility (to change settings once the process has started). Management consoles that support SNMP can also be used to configure and manage the Remote Manager.

Before the Remote Manager process can communicate with external entities, either SNMP or RPC must be configured and running on the appropriate nodes. See the Compaq ACMS for OpenVMS Version 4.4 Installation Guide for information about configuring and starting SNMP and RPC.

# 4.2 Configuring Remote Manager Startup

Before the Remote Manager is started, the configuration file should contain the appropriate settings. Both the ACMS run-time system and the Remote Manager read the configuration file during startup. If the ACMS Central Controller (ACC) process cannot read the configuration file when starting up, it uses default values. If the Remote Manager cannot read the configuration file when starting up, it logs an error and exits.

By default, the configuration file is stored in SYS$SPECIFIC:ACMS$MGMT_CONFIG.ACM. This location can be changed using the systemwide logical ACMS$MGMT_CONFIG. Use the ACMSCFG utility to change values in this file. The ACMSCFG utility allows ACMS system managers to set:

- The interfaces to be started
- Data collection and snapshot options
- Remote Manager run-time parameters
- SNMP traps

The configuration file is created during postinstallation with a set of default values. ACMS system managers should review these settings prior to starting the Remote Manager to determine whether the settings are appropriate for the node on which the process will run. Use the ACMSCFG SHOW commands as follows to display the settings:

    $  ACMSCFG SHOW INTERFACE
    $  ACMSCFG SHOW COLLECTION
    $  ACMSCFG SHOW PARAMETER
    $  ACMSCFG SHOW TRAP

Note Changes made to the ACMSCFG file are not automatically reflected in the running system. The ACMSCFG file is read during Remote Manager and ACMS system startup only. The Remote Manager process must be restarted in order for configuration file changes to the Parameter, Interface, and Trap tables to become active. The ACMS run-time system must be restarted in order for configuration file changes to the Collection table to become active. After the Remote Manager process has been started, you can use the ACMSMGR utility to make dynamic changes to the active system.

## 4.2.1 How to Run the ACMSCFG Utility

The ACMSCFG utility is a DCL command line tool that is invoked using a foreign command. The ACMSCFG utility accepts a number of command line arguments that determine what operations it should perform. The basic syntax for running the ACMSCFG utility is as follows:

    ACMSCFG verb object qualifier

For example, to display the current data collection settings, you would use the following command:

    $ ACMSCFG SHOW COLLECTION

You can get help on the available ACMSCFG commands and their syntax using the following command:

    $ ACMSCFG HELP

You can define your own foreign command by using the following DCL command:

    $ MYCOMMAND :== $SYS$SYSTEM:ACMS$MGMT_CONFIG_CMD

If you do this, you would substitute MYCOMMAND for ACMSCFG in the preceding examples.

When the ACMSCFG utility is started, it attempts to locate the ACMS$MGMT_CONFIG.ACM file by translating the logical name ACMS$MGMT_CONFIG. If that attempt fails, it looks in the default location, SYS$SYSTEM:ACMS$MGMT_CONFIG. If that lookup fails, ACMSCFG asks the user whether to create a new file. New files are created with default values in the directory that the logical name ACMS$MGMT_CONFIG translates to. If the logical name is not defined or does not include a directory specification, the default directory location is the current directory.

## 4.2.2 Displaying Current Values

Current ACMSCFG values can be displayed using the SHOW command, as follows:

    ACMSCFG SHOW object

Valid SHOW objects are:

- Collection
- Control
- Interface
- Parameter
- Trap

The values for each object type correspond directly to fields in management configuration tables. These tables are discussed in Chapter 9.

The following is an example SHOW command and its output:

    SPARKS> ACMSCFG SHOW COLLECTION

    Entity                Collect Collect                      Storage  Storage
    Type    Entity Name   Class   State     Storage Location   State    Interval
    ------- ------------- ------- --------- ------------------ -------- ---------
     *      *             id       enabled  acms$mgmt_snapshot enabled  3600
     *      *             config   enabled  acms$mgmt_snapshot disabled 3600
     *      *             error    enabled  acms$mgmt_snapshot disabled 300

## 4.2.3 Changing Values

ACMSCFG values can be changed using one of three verbs:

- ADD
  The ADD verb is used to add rows for the following objects:
  - Collection
  - Trap
  Example:

       $ ACMSCFG ADD COLLECTION/ENTITY=*/NAME=*/CLASS=RUNTIME

- DELETE
  The DELETE verb is used to delete rows for the following objects:
  - Collection
  - Trap
  Example:

       $ ACMSCFG DELETE COLLECTION/ENTITY=*/NAME=*/CLASS=RUNTIME

- SET
  The SET verb is used to add rows for the following objects:
  - Collection
  - Interface

  - Parameter
  - Trap
  Example:

       $ ACMSCFG SET COLLECTION/ENTITY=*/NAME=*/CLASS=RUNTIME/COLL_STATE=ENABLED

Each object has unique qualifiers that determine which values are to change. Qualifiers are either mandatory or optional. Mandatory qualifiers have no default and must be specified by the user. Optional qualifiers have default values and do not have to be specified. See Chapter 10 for a complete description of the syntax for each command and the qualifiers they support.

# 4.3 Starting and Stopping the Remote Manager

The following information discusses starting and stopping the ACMS Remote Manager.

## 4.3.1 Remote Manager Startup

The Remote Manager is started as a detached process using the command procedure SYS$STARTUP:ACMS$MGMT_STARTUP, as follows:

    $ @SYS$STARTUP:ACMS$MGMT_STARTUP

You should run this file from the SYSTEM account during system startup. You can run the file either before or after the ACMS run-time system has been started. Alternatively, you can run it at any time from a privileged account.

During process startup, the Remote Manager reads the ACMSCFG file (located in SYS$SYSTEM:ACMS$MGMT_CONFIG.ACM or wherever the ACMS$MGMT_CONFIG logical points). If the file cannot be found and opened, the Remote Manager will not start.

The Remote Manager writes errors to the ACMS$MGMT_LOG file. This is a binary file that can be displayed using the ACMSMGR utility, as follows:

    $ ACMSMGR SHOW LOG

The ACMSMGR utility generally performs operations on remote nodes. If the Remote Manager fails to start, it will not be accessible remotely. You will need to log in to the node on which it failed to start, and issue the following command:

    $ ACMSMGR SHOW LOG/LOCAL

This command instructs the ACMSMGR utility to read the log file directly, bypassing the Remote Manager. See Chapter 11 for a complete description of the ACMSMGR utility, commands, and command syntax.

In addition to writing messages to the ACMS$MGMT_LOG file, the Remote Manager writes messages to SYS$OUTPUT if it cannot access the log file. You can have all messages written to SYS$OUTPUT by invoking the startup procedure with the LOG_TO_SYSOUT parameter, as follows:

    $ @SYS$STARTUP:ACMS$MGMT_STARTUP LOG_TO_SYSOUT

The ACMS$MGMT_STARTUP procedure redirects SYS$OUTPUT for the Remote Manager to a file called ACMS$MGMT_SERVER.OUT in the SYS$ERRORLOG directory.

## 4.3.2 Remote Manager Shutdown

The Remote Manager is stopped using the ACMSMGR STOP MANAGER command, which has the following syntax:

    ACMSMGR STOP MANAGER /NODE=node-name

The /NODE qualifier can be omitted if the ACMS$MGMT_SERVER_NODE logical is defined. If the /NODE qualifier is provided, it overrides the ACMS$MGMT_SERVER_NODE logical.

The Remote Manager can be stopped independently of the ACMS run-time system. Stopping the Remote Manager has no effect on the running ACMS system. Note, however, that simply stopping the Remote Manager does not stop any active data collections. Data collections can be stopped only by using ACMSMGR commands or from an SNMP management console that has access to the Remote Manager.

Note also that prior to issuing this command, the user must either have logged in to the Remote Manager, or the user must have a valid proxy (and proxy access must have been enabled). Regardless of how access is gained, the user must hold the ACMS$MGMT_OPER rights identifier on the node the Remote Manager is running in order to stop it. See Section 4.4 for a description of how to log in to the Remote Manager.

The ACMSMGR STOP MANAGER command executes asynchronously of the actual shutdown. That is, the command will complete (control will return to the user) before the shutdown has completed.

If the Remote Manager fails to shut down, it can be stopped by using the DCL command STOP/ID, which has the following syntax:

    STOP/ID=pid

Determine the PID of the Remote Manager using the DCL command SHOW SYSTEM, and then look for the process named ACMS$MGMT_SVR.

# 4.4 Logging In to the Remote Manager

The Remote Manager requires that each client is authenticated and that each access attempt is authorized.

## 4.4.1 Authentication

Authentication can be performed in one of two ways: either through an explicit login (using a valid OpenVMS user name and password) or through a valid ACMS proxy account.

The exception to this rule is SNMP access, which is controlled by the presence of the ACMS$SNMP account in the local rights database. Authentication for external entities that communicate with the Remote Manager through the SNMP protocol is allowed only when a valid OpenVMS account exists for the user ACMS$SNMP. If this account exists and has the appropriate rights identifier, the user ACMS$SNMP is considered to be an authenticated SNMP user. Authorization for SNMP users is treated the same as for any other user --- by OpenVMS rights identifier. See Section 4.4.2 for more information about authorization.

All access for an interface can be disabled by disabling the interface itself, either through the ACMSCFG utility prior to management startup, or through the ACMSMGR utility after Remote Manager startup.

The total number of users that can be simultaneously logged in to the Remote Manager (regardless of authentication mechanism) is controlled by the Remote Manager parameter MAX_LOGINS, which can be modified by the Remote Manager. (This parameter is not the same as the MAX_LOGINS ACMS system parameter in ACMSGEN.) When the number of users currently logged in is equal to the value of this parameter, new logins are rejected until some users have logged out, or until their credentials have expired. You can set the initial value of MAX_LOGINS with the ACMSCFG utility. You can change the value of MAX_LOGINS dynamically (but nondurably) with the ACMSMGR utility.

Attempts to log in to the Remote Manager are recorded in the Remote Manager log file if the SECURITY_AUDIT_LEVEL parameter is set for informational level logging (any odd value, up to and including F). By default, informational messages are not logged. See Section 4.7.1 for more information.

Use the SHOW USER command of the ACMSMGR utility to display a list of users currently logged in to the Remote Manager:

    $ ACMSMGR SHOW USER

Note You must be authenticated in order to issue the SHOW USER command.

### 4.4.1.1 Logging In

Login is performed using the ACMSMGR LOGIN command, which has the following syntax:

    ACMSMGR LOGIN /USER=user-name /PASSWORD=password /NODE=node-name

The /USER qualifier can be omitted if the ACMS$MGMT_USER logical is defined. If the qualifier is provided, it overrides the ACMS$MGMT_USER logical. If neither the logical nor the qualifier is present, the ACMSMGR utility prompts the user for the user name.

If the /PASSWORD qualifier is not present, the ACMSMGR utility prompts the user for the password. There is no logical name for the password.

The /NODE qualifier can be omitted if the ACMS$MGMT_SERVER_NODE logical is defined. If it is provided, it overrides the ACMS$MGMT_SERVER_NODE logical. If neither the qualifier nor the logical name is provided, no login is attempted.

For each node to which a user logs in, a credentials file is created, either in the current directory or in the directory pointed to by the logical name ACMS$MGMT_CREDS_DIR. The credentials file contains encrypted security information (password is not stored in the file) and can be used by subsequent executions of the ACMSMGR utility. Credentials are specific to the process that created them and cannot be used by other processes. Prior to creating a new credentials file, any old credential files for the process are deleted.

Once a user has logged in to the Remote Manager, the user's credentials are valid for the duration of the credentials lifetime period, as specified by the parameter LOGIN_CREDS_LIFETIME. You can set the initial value of LOGIN_CREDS_LIFETIME with the ACMSCFG utility. You can change the value of LOGIN_CREDS_LIFETIME dynamically (but nondurably) with the ACMSMGR utility.

Once a user's credentials have expired, the user must log in to the server again.

### 4.4.1.2 Proxy Accounts

Proxy access to the management server is supported if the logical name ACMS$MGMT_ALLOW_PROXY_ACCESS is defined on the Remote Manager node. The valid values for this logical name are: 1, T, t, Y, y, TRUE, and true. If the name is defined to be any other value or if the logical name is not defined, proxy access is disabled.

When proxy access is allowed, users do not need to explicitly log in to the Remote Manager with a user name and password, and no credentials file is created. See Section 4.4.1.1 for a description of how to log in with user name and password.

In order for a user to be granted proxy access, there must be an entry in the ACMSPROXY.DAT for the combination of node and user attempting access. See Compaq ACMS for OpenVMS Managing Applications for more information. The first time a user attempts to access a management function without having first logged in using user name and password, the Remote Manager looks for a valid ACMS proxy. If one is found, the OpenVMS account specified by the proxy is used for authorization.

The Remote Manager maintains a cache of users who have been logged in by proxy. Records remain in the cache for the duration of the proxy credentials' lifetime, as specified by the PROXY_CREDS_LIFETIME parameter. You can set the initial value of PROXY_CREDS_LIFETIME with the ACMSCFG utility. You can change the value of PROXY_CREDS_LIFETIME dynamically (but nondurably) with the ACMSMGR utility. Proxy credentials are automatically refreshed when they expire.

## 4.4.2 Authorization

Authorization consists of ensuring that the user attempting access holds the appropriate rights identifier on the node they are attempting to access. There are four levels of access, each with its own identifier, as described in the following sections.

### 4.4.2.1 Read Access (ACMS$MGMT_READ)

Read access allows users to perform the following functions:

- Log in
- Log out
- Issue all SHOW commands

### 4.4.2.2 Operate Access (ACMS$MGMT_OPER)

Operate access allows users to issue the following commands:

- ADD TRAP
- DELETE TRAP
- REPLACE SERVER
- SET ACC, EXC, QTI, SERVER, TRAP, TSC
- START EXC, QTI, SYSTEM, TERMINALS, TRACE_MONITOR
- STOP EXC, MANAGER, QTI, SYSTEM, TERMINALS, TRACE_MONITOR

### 4.4.2.3 Write Access (ACMS$MGMT_WRITE)

Write access allows users to issue the following commands:

- ADD COLLECTION, FILTER
- DELETE COLLECTION, FILTER
- RESET ERROR, LOG
- SAVE FILTER
- SET COLLECTION, CP, INTERFACE, PARAMETER

### 4.4.2.4 Update Access (ACMS$MGMT_SYSUPD)

Needed in addition to operate access, update access allows users to update specific OpenVMS system parameters by issuing the following command:

- SET ACC /system-parameter where system-parameter is CHANNELCNT, GBLPAGES, GBLPAGFIL, or GBLSECTIONS.

# 4.5 Starting and Stopping Interfaces

You can control which interfaces are started or stopped by using either the ACMSCFG utility prior to Remote Manager startup or the ACMSMGR utility after Remote Manager startup. The Remote Manager supports two interfaces:

- RPC
  The RPC interface is used by the ACMSMGR utility, Remote Manager web agent, and also by any user-written programs based on the Remote Manager API. Most users will enable the RPC interface.
- SNMP
  The SNMP interface is used by third-party system management packages to access ACMS management information. If no SNMP enabled packages are being used, this interface can be safely disabled.

Note Either the RPC or SNMP interface should always be enabled. If both are disabled, there is no way to communicate with the Remote Manager.

For a more complete discussion of the available interfaces and their attributes, see Section 9.7.

## 4.5.1 Using ACMSCFG to Enable or Disable Interfaces

Use the ACMSCFG utility to configure which interfaces should be enabled or disabled when the Remote Manager starts up.

Use the ACMSCFG SET INTERFACE command to enable or disable an interface. This command has the following syntax:

    ACMSCFG SET INTERFACE /INTERFACE=interface-name /STATE=state

In this format:

- interface-name is one of the supported interfaces (SNMP or RPC).
- state is one of the following states: ENABLED or DISABLED.

Use the ACMSCFG SHOW INTERFACE command to determine the state of an interface in the configuration file:

    $ ACMSCFG SHOW INTERFACE

## 4.5.2 Using ACMSMGR to Start or Stop Interfaces

Use the ACMSMGR utility to dynamically enable or disable an interface after the Remote Manager has already been started. Changes made with the ACMSMGR interface are not stored in the ACMSCFG file and are lost when the Remote Manager is stopped. Use the ACMSCFG utility to save changes to the ACMSCFG file.

An interface cannot disable itself. Since the ACMSMGR utility uses the RPC interface, it cannot be used to disable the RPC interface. To disable the RPC interface, either use the ACMSCFG utility and restart the Remote Manager, or use the SNMP interface.

Use the ACMSMGR SET INTERFACE command to disable the SNMP interface. The command has the following syntax:

    ACMSMGR SET INTERFACE /INTERFACE=interface-name /STATE=state

In this format:

- interface-name must be SNMP.
- state is one of the following states: ENABLED or DISABLED.

Use the ACMSMGR SHOW INTERFACE command to determine the state of an interface:

    $ ACMSMGR SHOW INTERFACE

Previous | Next | Contents | Index