Friday, January 20, 2012

“Agent and Operating System architecture are the same – Agent” error in SCOM

Hi

As the above error is quite simple to read. It is saying that “Agent and Operating System architecture are the same” but actually meaning of this that  the version of “SCOM Agent” insatlled on the machine is not same. For example you are running 32bit version of AGENT on 64bit Windows Machine.

Error

Agent  

Lets Check the agent.

I logged in to the server and i saw that “SCOM Agent” is installed in “C:\Program Files (x86)” directory. Which mean that our agent is 32 Bit.

Agent_1

Let check the version of windows.

The windows is 64bit.

Agent_2

Lets Un-Install the the Agent manually. Go to Control Panel, “Programs and features”, choose the “System Center Operations Manager R2 Agent” and right click on it and choose uninstall.

Agent_3

Agent “Un-installed”

Agent_4

“System Center Operations manger” directory is removed from “C:\Programs Files (x86)”

Agent_5

Now come back to “SCOM Console” and run the “Discovery Wizard” to install the SCOM agent on the Server.

Go to “administration” pane and right click anywhere and choose “Discovery Wizard”

Agent_6

Choose “Windows Computers”

Agent_7

I choose the “Advanced Discovery” and select “Server Only”

Agent_8

Now i choose to browse, i searched the computer and add it here. Click on NEXT

Agent_9

Provide you account which you want to use for search the server and for install agent in to it {it should be administrator account}. now click on “Discover”

Agent_10

It failed to Discover Server, Discovery failed.. Why????

Agent_11

If you want to re-discover the Server again. Make sure you deleted in “Agent Managed”, if the server name is still in the list then discovery wizard wont search it again.

Click on “Administration” pane and click on “Agent managed” and search for the server on which we just un-installed the agent.

Agent_12

Choose the server, right click on it and choose “Delete”

Agent_13

Click on “YES”

Agent_14

 

now lets run the “Discovery Wizard” again and hopefully this time we will be able to discover it again successfully

yes it discovered :)

Agent_15 .

Provide the the “Action account “ if needed. and click on FINISH.

Agent_16

Agent installation task started.

Agent_17

Task finished successfully.

Agent_18

lets login to server again and see if it is installed properly this time.

and you can see it installed on “C:\Program Files”. not in x86 folder.

All Sorted.

Agent_19

why this happens.

Because

if you see the Agent Directory in SCOM Installation media, it seems there is no agent for 64bit windows, so sometime users manually installed the i386 version of SCOM agent.

But  for 64 bit windows install the agent from AMD64 bit folder. :)

for ITANIUM bases servers installed the agent from : ia64 folder

for 32bit based servers install agent from : i386 folder

for 64bit Intel/AMD based servers install agent from : AMD64 folder

20-01-2012 16-01-44

Thanks

hope it helps someone :)

Aman Dhally

Monday, January 16, 2012

How to Deploy or Install Audit Collection Services (ACS) in SCOM 2007 R2

Hi all,

Q: what is Audit Collection Service (ACS)

Answer: In Operations Manager 2007, you can use Audit Collection Services (ACS) to collect records generated by an audit policy and store them in a centralized database. By default, auditing is configured on individual computers and all events generated from an audit policy are saved to the local Security log of the audited computer. {microsoft}

In simple language, ACS keep the copy of “Security Log” of the Event Log. It save all these security logs in to a database.

This consist of three things.

- ACS Forwarders : this is  service which is installed by default with SCOM-Agents installations but disabled.

- ACS Collector : This collector receive data from forwarders and then send the data to ACS database

- ACS Database : The SQL Database which save all the  security logs in to it.

 

Enough theory, let’s start implementing it now.

I am installing ACS Service on my Root Management server.

PART-1                                                                                                                                                                                               

Install Audit Collection Services Server

Let’s start.

as per Microsoft in you ACS server you have the latest version of MDAC {http://go.microsoft.com/fwlink/?LinkId=74155.}. When i check the the latest version of MDAC it is 2.8 with SP1. and i already have this version because this version was published in year 2005.

16-01-2012 16-17-24 

Insert your SCOM installation media and run “SetupOm.exe” or if its autorun it will open automatically.

Click on “Install Audit Collection server

2

a welcome wizard for ACS installation will open now then click on “NEXT

3

Select “I accept the agreement” and click on “Next

4

I don’t have any previously created ACS database, so i choose “Create a new database” , click on “Next

5

Here it is using MDAC to connect to the SQL Server. lets choose default data source name “OpsMgrAc” and click on “Next

6

In Database, i have a separate “SQL Server” for SCOM databases. Select “Remote Database Server”,  and type the name of you remote “SQL Server” and in database name choose i am choosing the default name “OperationsManagerAC”, now click on “Next”.

7

In “Database Authentication” i choose “Windows Authentication” you can also choose “SQL Authentication” its up to you. click on “Next

8

In “Database Creation Option” i choose the “use SQL Server’s default data and log file directories”, because in my SQL Server i already defined the file location for data and log files that’s why i want to use this option. click on “Next

9

In “Event Retention Schedule” i choose the 3:00am and i want to keep the security log data for at least for 2 months, so i choose 60 days. Click on “Next”.

10

in “timestamp” i want to use my local time . click on “Next

11

it’s showing the “Summary of installation”, now click on “Next”

12

Now it trying to create ACS database and it asking for “SQL Server Login” credentials, i was using windows authentication, so i just click on “Use trust Collection” and click on OK.

13

Yippy!!! its showing that our ACS Server is successfully installed.  Click on Finish.

14

I logged in to my SQL Server to check if the database is created or not. It is successfully created.

Cool.

15

Till here our installation for ACS Server is finished. The next step is to enable auditing on agent.

PART-2                                                                                                                       

Enable Auditing on Agent

Open SCOM console.

Click on “Monitoring” tab and navigate to “Operations Manager” and then click on “Agents” and then click on “Agent health State”. Now the two pane will open , but we are concerned about the “Right hand side” pane only.

16

Now choose the Agents on the right hand side of the pane and in action tab under “Health Service tasks” click on “Enable Audit Collection

17

In Credentials.I am using my “Administrator” account to run the task. provide the credentials and click on “RUN

18

When you click on “RUN” it show you that task is started.

19

Now the status is “Success” all done :)

20

How can i see the Logs???? ahhh !!! that is crucial part. we need to configure “SQL Reporting Services to access these logs.

PART-3                                                                                                       

Configure ACS Reporting Services to Access these Logs or view report bases of Security Logs

make sure you have “SQL Reporting Services Installed” to configure this and make sure that you are able to access http://YourReportServerName/ReportServer .

it should look like this.

24

Now Login to your ACS Server or any SCOM Management Server and create a ACS folder in C Drive of it  C:\ACS

21

Go to your SCOM installation media navigate to ReportsModels\acs and copy all files to C:\ACS folder

22

now open “command prompt” and navigate to c:\ACS and type the command

UploadauditReports.cmd <urACSDatabase Servername> http://YOURREPORTSERVER/ReportServer C:\ACS

 

23

after run the command it shows you that its uploaded few files.

25

now open access you report server again http://YourReportServerName/ReportServer . and you will see that a new folder is added named as “Audit Reports

26

Cool now open this page. http://YourReportServerName/Reports make sure this is Reports not ReportServer

A page will open like below.

28

and then click on “Audit Reports

27

Then click on “DB.Audit” if you not able to find the “DB.audit” then just soft the files by details.

29 

I Keep the everything as it is except i choose “windows integrated security”. Click on Apply.

30

All Done… now lets check it…….

PART-4                                                                                

everything is done and step up now.

Now Open SCOM Console and click on Reporting tab.

You will see the “Audit Reports” options in the left hand side, click on it and then you will see the some predefined templates on right hand side.

31

Open any report and run it.

Voilaa!!! Working now :)

32

I hope that it save someone else time

Thanks

aman dhally