OSEM -> ISEE Client connection

[Marc Schaer_1]

i have the following configuration in place:

RH ES3 host running
- Insight Agents
- ISEE Client

W2k host
- SPOP
- OSEM

now as far as i understand the flow for such a configuration would go like this:
1) IS Agents send snmp traps to OSEM
2) OSEM filters out the relevant events and sends them on to the ISEE Client
3) the ISEE Client sends the incident via the SPOP out to HP

i currently have some issues in getting the thing to work as the SPOP/OSEM and the host running the ISEE Client are in separate DMZs separated by a firewall.

now for 1) and 3) i found in the documentation which ports that are used for the communication (e.g. udp/162 and tcp/80). but for 2) i did not find any indication on how this communication works.
could anyone please explain exactely on how this communication works and what ports are used?

BR,
Marc

[A. van Berk]

OSEM hands over the communication to a transport service called 'WCCproxy'.
WCCproxy uses TCP port 2069

[Liem Nguyen]

Marc,

The other option is using Model 3 configuration where IS sends traps to OSEM then to ISEE already installed on the SPOP.

What you have done is called Model 2 Configuration, where ISEE is installed on each Client.

Model 3 is using Central Management Server CMS), which can be the SPOP in your case.

Regards,

[Marc Schaer_1]

thanks a lot for the replys.

i will have to think about model 3 and wether it makes sense in our organisation as the spop/osem and the monitored hosts are not within the same department:-)

concerning WCCproxy. is it therfore the case that the WCCproxy should be listening on the monitored hosts on port 2069? actually i dont see anything listening there..

[Marc Schaer_1]

i now found out how it works when setting it all up in the LAB (IS Agents -> OSEM -> ISEE Client).

this is how it works:
1) Insight Agent sends an SNMP trap (with the appropriate community string) to OSEM

[root@alt-sSECSMS01 ISEE_Client]# snmptrap -v 1 -c isee_trap 10.40.109.39 1.3.6.1.4.1.232 10.17.100.19 6 11003 ' ' 1.3.6.1.2.1.1.5.0 s "alt-sSECSMS01" 1.3.6.1.4.1.232.11.2.11.1.0 i 0 1.3.6.1.4.1.232.11.2.8.1.0 s "Linux Management Agents Test Trap sent today"

2) Windows SNMP service picks it upand delivers it to OSEM

3) OSEM filters the Traps and forwards them to the ISEE Client installed on the Host where the Trap has initiated

the config that needs to be done on OSEM to make it work is:
Settings -> Internal -> Outbound protocol (if forwarding problem reports to another system or application) = "ISEE&SMSPI"

this will make OSEM to connect to port 7920 (to WCCproxy) on the originating host..
(or whatever is configured under "Settings -> Remote Delivery -> ISEE/WCCPROXY Outbound port")


[root@alt-sSECSMS01 ISEE_Client]# netstat -an |grep 7920
tcp 0 0 0.0.0.0:7920 0.0.0.0:* LISTEN

4) WCCproxy then receives it and sends it on to the ISEE Client


so for model 2 the following is true:
host -> OSEM snmp trap
OSEM -> host tcp/7920 and smnp get
ISEE -> SPOP tcp/80