HP SIM and WBEM Indications

[Olivier Masse]

I'm one (of the few, I think) that made WBEM indications work as expected with Windows.

Being an HP-UX admin I've never been fond of WBEM. But from what I understand, the newer Insight Agents for Windows and System Management Homepage now set up WBEM by default instead of SNMP... thus the Windows team here started deploying it magically and I had no choice of supporting it with SIM.

Here are the things I had to do to make it work:

1. Reconfigure the WMI proxy on the CMS correctly, as it didn't work initially at my site.

2. Have a locked-down service account created specifically for WBEM authentication on all Windows servers, since I didn't want to have to use an admin account. It needs to be part of a specific group I don't remember; it's documented somewhere by HP.

3. Run this on the managed system: "C:\Program Files\HPWBEM\Tools>enableRWMI.exe -a:MY_DOMAIN\my_wbem_account". This authorizes my_wbem_account to be able to remotely gather WBEM data.

Good luck

Olivier.

[Rob Buxton]

Olivier,
But have you got wbem indications to work? And how did you test?
I can get data via wbem and subscribe to wbem events.
But I've never seen a wbem generated event in the servers I've subscribed to.
On our ESXi servers, when they restart I get an event saying the wbem providers have started. I get nothing similar from a windows server and the Test WMI utility just seems to generate an event in the NT Events log.

[Olivier Masse]

Rob,

I've used WBEM only on HP-UX and Windows so far. Both platforms have a way to send test indications to simulate a hardware failure, and everything works as expected. I couldn't say for ESXi, I only have ESX here and use SNMP on that platform.

Olivier

[Olivier Masse]

Rob, I had a doubt, so I tried it again and was mistaken. It does NOT work completely.

When sending a test indication from SMH, RemoteSupport diagnoses it correctly, opens a service event at HP and logs it in SIM's event viewer. However, SIM by itself doesn't say a word about the event.

So there are still some missing pieces at my site too.

[Rob Buxton]

Olivier,
That's interesting hadn't thought to check at the HP site.
We use the Enterprise variant of the RSP. Tried logging onto the HP site this a.m but it's having problems. Just trying to confirm if anything got through to HP from our set up.

But I would like to see the visibility within HPSIM for this - that's why we have it!
Rob.

[Olivier Masse]

It actually _tries_ to open an event at HP. The event it closed immediately with not ticket number, which is the correct behaviour with test events.

But there is a short message in the event log saying that an event has been opened (screenshot attached). Nothing else in SIM.

Only the WBEM Windows client I tested does this; I have 60+ HP-UX clients that use WBEM and they work fine with complete event reporting in SIM when I send test indications.

[Rob Buxton]

Do you see those events in a Windows Server? Or just the HP-UX.
The only activity I see is in the Windows Event Log, nothing in the HPSIM events.

[Olivier Masse]

My CMS runs on Windows and monitors both Windows and HP-UX servers. The screenshot shows I see in SIM when Windows servers send a test indication (two tests in fact in this screenshot). When HP-UX servers send indications, I get the same output along with another entry from SIM giving a descriptive message of the event.

Time for me to leave the office, but I can provide a comparative screenshot of both platforms tomorrow.

Bye

[Olivier Masse · Accepted solution]

I fixed it. Looks like asking SIM to re-subscribe to WBEM events from managed Windows clients won't do any good if there is already a subscription in place and it happens that it's not correctly set.

To confirm your subscriptions are in order, do this on the CMS: "mxwbemsub -l -n "

This will list current active subscriptions on the managed system. If there are no subscriptions or if the IP addresses in them is incorrect (which was my case), you first need to delete them with "mxwbemsub -r -n ", THEN resubscribe with "mxwbemsub -a -n ".

SIM's "events" log for the Windows system I tested now returns an error event with a proper description, and the RemoteSupport plug-in logs that "A service incident has been reported".

So now I can announce with, say, 85% confidence, that WBEM indications from Windows hosts work as expected.

Olivier

[Rob Buxton]

Olivier,
Interesting - I do not see that behaviour with the testing I'm doing.
I've subscribed a new server and when I use the -l qualifier it shows two indicators. One for HP_AlertIndication and HP_ThresholdIndication.
In both cases the IP listed is the IP address of the CMS.
I then go to the HP WBEM Event test Tool, and generate an "Error" Event. This error shows in the System part of the Windows Events log, but nothing appears in HPSIM.
As part of your RSP installation do you have anything that interprets the Windows Event logs?
Tried this on several servers, including those with the most recent a version of HP PSP.