topic OSEM -> ISEE Client connection in Insight Remote Support

OSEM -> ISEE Client connection

Marc Schaer_1 — Wed, 17 May 2006 16:11:39 GMT

i have the following configuration in place:

RH ES3 host running
- Insight Agents
- ISEE Client

W2k host
- SPOP
- OSEM

now as far as i understand the flow for such a configuration would go like this:
1) IS Agents send snmp traps to OSEM
2) OSEM filters out the relevant events and sends them on to the ISEE Client
3) the ISEE Client sends the incident via the SPOP out to HP

i currently have some issues in getting the thing to work as the SPOP/OSEM and the host running the ISEE Client are in separate DMZs separated by a firewall.

now for 1) and 3) i found in the documentation which ports that are used for the communication (e.g. udp/162 and tcp/80). but for 2) i did not find any indication on how this communication works.
could anyone please explain exactely on how this communication works and what ports are used?

BR,
Marc

Re: OSEM -> ISEE Client connection

A. van Berk — Thu, 18 May 2006 03:47:00 GMT

OSEM hands over the communication to a transport service called 'WCCproxy'.
WCCproxy uses TCP port 2069

Re: OSEM -> ISEE Client connection

Liem Nguyen — Thu, 18 May 2006 07:04:12 GMT

Marc,

The other option is using Model 3 configuration where IS sends traps to OSEM then to ISEE already installed on the SPOP.

What you have done is called Model 2 Configuration, where ISEE is installed on each Client.

Model 3 is using Central Management Server CMS), which can be the SPOP in your case.

Regards,

Re: OSEM -> ISEE Client connection

Marc Schaer_1 — Fri, 19 May 2006 08:51:25 GMT

thanks a lot for the replys.

i will have to think about model 3 and wether it makes sense in our organisation as the spop/osem and the monitored hosts are not within the same department:-)

concerning WCCproxy. is it therfore the case that the WCCproxy should be listening on the monitored hosts on port 2069? actually i dont see anything listening there..

Re: OSEM -> ISEE Client connection

Marc Schaer_1 — Wed, 24 May 2006 02:29:45 GMT

i now found out how it works when setting it all up in the LAB (IS Agents -> OSEM -> ISEE Client).

this is how it works:
1) Insight Agent sends an SNMP trap (with the appropriate community string) to OSEM

[root@alt-sSECSMS01 ISEE_Client]# snmptrap -v 1 -c isee_trap 10.40.109.39 1.3.6.1.4.1.232 10.17.100.19 6 11003 ' ' 1.3.6.1.2.1.1.5.0 s "alt-sSECSMS01" 1.3.6.1.4.1.232.11.2.11.1.0 i 0 1.3.6.1.4.1.232.11.2.8.1.0 s "Linux Management Agents Test Trap sent today"

2) Windows SNMP service picks it upand delivers it to OSEM

3) OSEM filters the Traps and forwards them to the ISEE Client installed on the Host where the Trap has initiated

the config that needs to be done on OSEM to make it work is:
Settings -> Internal -> Outbound protocol (if forwarding problem reports to another system or application) = "ISEE&SMSPI"

this will make OSEM to connect to port 7920 (to WCCproxy) on the originating host..
(or whatever is configured under "Settings -> Remote Delivery -> ISEE/WCCPROXY Outbound port")

[root@alt-sSECSMS01 ISEE_Client]# netstat -an |grep 7920
tcp 0 0 0.0.0.0:7920 0.0.0.0:* LISTEN

4) WCCproxy then receives it and sends it on to the ISEE Client

so for model 2 the following is true:
host -> OSEM snmp trap
OSEM -> host tcp/7920 and smnp get
ISEE -> SPOP tcp/80