Deploying Operations Manager agents

The Operations Manager agent is a service that you deploy to computers and devices, usually termed “managed objects.” You want to manage and monitor this service using Operations Manager. The Operations Manager agent collects information from the managed object.

The information that it collects depends on the rules and monitors that are included in the collection of management packs installed on the Operations Manager server. For example, the System Center Management Pack for SQL Server management pack will compare telemetry from the monitored instance of SQL Server against rules and thresholds defined in the management pack. In the event that one of these rules or thresholds is breached, the Operations Manager agent will transmit data to the Operations Manager management server, triggering an Operations Manager alert.

There are four general methods that you can use to deploy the Operations Manager agent to computers running Windows based operating systems:

• Discovery Wizard Part of the Operations Manager console. You can use this wizard to deploy agents to computers running Windows, UNIX, or Linux operating systems as shown in Figure 1. You can also use it to deploy agents to supported network devices.
  

             FIGURE 1 Discover Windows computers

• Manual Installation While it’s certainly possible to install the Operations Manager agent by signing on to a computer and running through the installation wizard, doing this consumes substantially more time than other methods. When you are considering deploying the Operations Manager agent across hundreds, if not thousands of devices, you’ll need a method that requires less time than manual deployment.
• Scripted Installation Scripting the installation of the agent is more efficient than manually installing the agent, as it doesn’t require direct administrator intervention beyond launching the script.
• Inclusion in OS Deployment Image Rather than install the agent after a computer or virtual machine has been deployed, you can instead include the Operations Manager agent in the deployment image. This is especially effective in environments where computers are members of an AD DS domain and are able to query AD DS for Operations Manager settings.

Windows agent deployment using the Discovery Wizard

The Discovery Wizard is part of the Operations Manager console and allows you to deploy agents to computers or devices. If you want to deploy the Operations Manager agent using the Operations Manager console, you’ll need to use an account that is a member of the Operations Manager Administrator role.

To deploy the Operations Manager agent to Windows computers that are members of the same domain as the Operations Manager console, perform the following steps:

1. Right-click the Device Management node, located in the Administration workspace of the Operations Manager console. Then, click Discovery Wizard.

2. On the Discovery Type page of the Computer And Device Management Wizard, click Windows Computers.

More Info: Agent Deployment

You can learn more about deploying the Operations Manager agent at http://technet.microsoft.com/en-us/library/hh551142.aspx.

3. On the Auto Or Advanced page, click Automatic Computer Discovery as shown in Figure 2. Advanced Discovery gives you the option of specifying whether server or client operating systems will be discovered. You can also use this method to scan Active Directory for computers with particular names, owner, or with a particular description.

FIGURE 2 Automatic computer discovery

4. On the Administrator Account page, shown in Figure 3, select whether to use the Management Server Action Account, or a specific Active Directory user account that has the necessary privileges to install the agent on a managed computer. In most cases, this account will need to either be directly or indirectly a member of the local Administrators group on the target computer. When you click Discover, Operations Manager will query Active Directory for computer accounts. Depending on the number of objects within Active Directory, this might take some time.

FIGURE 3 Specify account credentials

5. On the Discovery Results page, shown in Figure 4, select all of the hosts on which you want to deploy the Operations Manager agent. You can use this dialog box to choose between Agent and Agentless management. Agentless management allows you to collect performance and availability data from a computer, but not all management packs support agentless mode.

FIGURE 4 Discovery results

6. On the Summary page, shown in Figure 5, specify the credentials that the agent should use when performing actions on the managed computer, and the folder on the target computer into which the agent should be installed. The default is to use Local System. Clicking Finish will deploy the Operations Manager agent to the selected computers.

FIGURE 5 Agent installation directory

7. You will be able to view the progress of the installation on the Agent Management Task Status dialog box, shown in Figure 6.

FIGURE 6 Agent task status

You can view a list of computers that have the Operations Manager agent already deployed and configured by selecting the Agent Managed node, under the Device Management node, in the Administration workspace of the Operations Manager console, as shown in Figure 7

FIGURE 7 Agent managed computers

UNIX/Linux agent deployment using the Discovery Wizard

You can deploy the Operations Manager agent on computers running supported versions of UNIX or Linux by performing a local manual installation, or a remote installation using the Discovery Wizard. The Operations Manager agent is supported on the following versions of UNIX and Linux:

• CentOS 5 and 6 (x86/x64)
• Debian GNU/Linux 5,6, and 7 (x86/x64)
• HP-UX 11i v2 and V3 (PA-RISC and IA64)
• IBM AIX 5.3, AIX 6.1 (POWER), and AIX 7.1 (POWER)
• Novell SUSE Linux Enterprise Server 9 (x86), 10 SP1 (x86/x64), and 11 (x86/x64)
• Oracle Solaris 9 (SPARC), Solaris 10 (SPARC and x86), and Solaris 11 (SPARC and x86)
• Oracle Linux 5 and 6 (x86/x64)
• Red Hat Enterprise Linux 4, 5, and 6 (x86/x64)
• Ubuntu Linux Server 10.04 and 12.04 (x86/x64)

The first method is to transfer the appropriate installation packages from the Operations Manager server to the UNIX or Linux computer, and install them using an account that has sufficient privileges on that computer.

More Info: Manual UNIX/Linux Agent Deployment

You can learn more about manually deploying the Operations Manager agent on computers running UNIX or Linux at http://technet.microsoft.com/en-us/library/hh212686.aspx.

The other option is to use the Discovery Wizard. Prior to deploying an agent to a computer running a supported version of UNIX or Linux using the Discovery Wizard, you need to configure a UNIX/Linux Action Account profile set up with a Monitoring Run As Account. To run the wizard to create this account, you’ll need to have configured the following:

• Username and password for unprivileged access to the computer running UNIX or Linux. This account needs to be configured on the computer running UNIX or Linux so that it can elevate privileges using either su or sudo. If using ‘su’ to elevate privileges, you’ll need to provide the ‘su’ password. Sudo will also need to be specially configured with appropriate TTY and password settings to support the Discovery Wizard. You can configure these using the visudo command. While it is also possible to configure an account that already has privileged access and doesn’t require su or sudo to elevate privilege, this presents a security risk and should be avoided.
• The computer will need to be configured so that an SSH connection can be made using this account and that appropriate ports are open on the computer’s firewall. You should verify that an SSH connection can be established from the management server to the computer running UNIX or Linux prior to attempting installation using the Discovery Wizard.

To create the account profile used by Operations Manager for installation of the agent on computers running UNIX or Linux, perform the following steps:

1. In the Administration workspace of the Operations Manager console, select UNIX/Linux accounts under Run As Configuration, and click Create Run As Account in the Tasks pane.

2. On the Account Type page of the Create UNIX/Linux Run As Account Wizard, click Agent Maintenance Account, as shown in Figure 8, and click Next. If you were creating an account to monitor a UNIX or Linux computer on which an agent was already installed, you would select the Monitoring Account option.

FIGURE 8 Agent maintenance account

3. On the General Properties page, provide a name and a description for the account.

4. On the Account Credentials page, shown in Figure 9, specify the username and password used to connect to the computer running UNIX or Linux. This connection will be made over SSH. You can choose a privileged account, which is assumed already have root privileges, or an unprivileged account. In that case su or sudo will be used to elevate privileges once a session is established.

FIGURE 9 Run As Account credentials

5. On the Elevation page, shown in Figure 10, select the method used to elevate privileges once the credentials specified in the previous step have been used to establish a connection.

FIGURE 10 Elevation options

6. On the Distribution Security page, select how credentials will be transmitted to managed computers, and then create the Run As Account.

Once the Run As Account is created, you’ll need to create a Run As Profile. To create a Run As Profile, perform the following steps:

1. In the Administration workspace of the Operations Manager console, select Profiles under Run As Configuration, and click Create Run As Profile in the Tasks pane.

2. On the General Properties page of the Run As Profile Wizard, provide a name for the Run As profile, and select a management pack in which to store the management pack.

3. On the Run As Accounts page, add the Run As Accounts that will be used with this profile. This will include the Agent Maintenance account described earlier and any Monitoring accounts that you have also configured to interact with computers running UNIX or Linux operating systems. This page is shown in Figure 11.

FIGURE 11 Run As Accounts

4. Complete the wizard to create the Run As Profile.

Once the Run As Profile is configured for supported Linux-based and UNIX-based computers, you’ll be able to deploy the Operations Manager agent to these computers using the Discovery Wizard by performing the following steps:

1. Right-click the Device Management node in the Administration Workspace of the Operations Manager console, and then click Discovery Wizard.

2. On the Discovery Type page of the Computer And Device Management Wizard, click UNIX/Linux computers.

3. On the Discovery Criteria page, select a target resource pool and click Add. This specifies where the monitored computers will be placed. Use the All Management Servers Resource Pool unless you have configured another option. A resource pool is a collection of Operations Manager management servers that share an Operations Manager workload.

4. On the Discovery Criteria dialog box, enter the IP address or FQDN of the computers running UNIX or Linux that you wish to deploy the agent on. Use the Set Credentials button to configure the credentials used for discovery and agent installation. This dialog box is shown in Figure 12. After you have configured the discovery criteria, save these criteria, and then click Discover on the Discovery Criteria page.

FIGURE 12 Discovery criteria

5. On the Computer Selection page, select the discovered computers that you want to manage, and click Manage. The agent will be deployed.

Manual agent installation

You’ll need to install the Operations Manager agent manually if you need to monitor computers located on a perimeter or isolated network, or if you need to monitor computers that are not members of an AD DS domain. You can perform manual installation in one of two ways:

• Double-clicking the MOMAgent.msi installer and answering the questions posed in the wizard
• Using the command line options to perform the installation

Using the MOMAgent.msi Setup Wizard

MOMAgent.msi comes in x64 and x86 versions. These files are located by default under the C:\Program Files\Microsoft System Center 2012 R2\Operations Manager\Server\AgentManagement folder, as shown in Figure 13.

FIGURE 13 Agent location

To install the agent manually using the wizard, perform the following steps:

1. Start the installer and accept the license terms.

2. Specify the destination folder. By default this will be C:\Program Files\Microsoft Monitoring Agent.

3. On the Agent Setup page, select whether you want Active Directory to configure the agent. This requires that you have configured a container in AD DS using MOMADAdmin.exe. You can also configure the agent to connect to Operations Manager to determine management group information.

4. On the Management Group Configuration page, specify the Management Group Name, the Management Server Name, and the Management Server Port. Figure 14 shows this page configured to connect to the management group named Tailspintoys on the management server Opsmgr.tailspintoys.internal.

FIGURE 14 Management group configuration

5. On the Agent Action Account page, choose whether actions performed by the Operations Manager agent are completed using the Local System account, a Domain account, or a Local account.

6. On the Microsoft Update page, choose whether Microsoft Update will be used to provide automatic updates.

7. Review the summary, like the one shown in Figure 15, and click Install to complete the agent installation.

FIGURE 15 Agent setup

Using the Command Line

Rather than walking through each page of the MOMAgent.msi Wizard, you can perform agent installation by running MOMAgent.msi using Msiexec.exe from the command line. Msiexe.exe allows you to run installers that use the .msi format and is located in the %WinDir%\System32 folder.

To run MOMAgent.msi from the command line, use the following format:

%WinDir%\System32\msiexec.exe /i path\Directory\MOMAgent.msi /qn USE_SETTINGS_
FROM_AD={0|1} USE_MANUALLY_SPECIFIED_SETTINGS={0|1} MANAGEMENT_GROUP=MGname
MANAGEMENT_SERVER_DNS=MSname MANAGEMENT_SERVER_AD_NAME=MSname SECURE_PORT=PortNumber
ACTIONS_USE_COMPUTER_ACCOUNT={0|1} ACTIONSUSER=UserName ACTIONSDOMAIN=DomainName
ACTIONSPASSWORD=Password AcceptEndUserLicenseAgreement=1

Where:

• USE_SETTINGS_FROM_AD={0|1} Use this option to specify whether management group settings are obtained from AD DS, or from the command line. This works in conjunction with the next setting. The computer must be a member of the domain, and Active Directory must be configured if you are going to use this option.
• USE_MANUALLY_SPECIFIED_SETTINGS={0|1} Use this option to specify whether management group settings are specified from the command line. This works in conjunction with the previous setting.
• MANAGEMENT_GROUP=MGname Use this option to specify the Operations Manager Management Group name, when you are using the command line to specify the options.
• MANAGEMENT_SERVER_DNS=MSname Use this option to specify the Operations Manager management server FQDN, when using the command line to specify the options.
• MANAGEMENT_SERVER_AD_NAME =MSname Use this option to specify the Active Directory computer account name of the Operations Manager Management Server, when using the command line to specify the options.
• SECURE_PORT=PortNumber Use this option to specify the health service port number. The default port number is 5723.
• ACTIONS_USE_COMPUTER_ACCOUNT={0|1} Use this option to specify whether the LOCAL SYSTEM account or a specified user account, specified using the ACTIONSUSER, ACTIONSDOMAIN, and ACTIONSPASSWORD settings, is used.
• ACTIONSUSER=UserName Use this option when using a custom account to specify the user name of the account.
• ACTIONSDOMAIN=DomainName Use this option when using a custom account to specify the domain name used with the account.
• ACTIONSPASSWORD=Password Use this option when using a custom account to specify the password associated with the account.
• AcceptEndUserLicenseAgreement=1 Use this option to agree to the Microsoft Software License Terms. This option is required when installing the Operations Manager agent from the command line.

Before a manually installed agent can be used, you’ll need to authorize it from the Operations Manager console.

Automatic agent assignment

You can use AD DS to assign computers with the Operations Manager agent installed to Operations Manager management groups. For example, you would do this when you have deployed the agent manually using the option to get management server and group settings from AD DS, or when you’ve deployed the Operations Manager agent as part of an operating system image.

To configure automatic agent assignment, perform the following steps:

1. Create a domain security group and add it to the Operations Manager Administrators security role. Figure 16 shows the TailspinMOMAdmin security group added to this security role.

FIGURE 16 Operations Manager Administrators

2. A member of the Domain Admins AD DS group must then run the following command MOMADADMIN.exe <ManagementGroupName> <MOMAdminSecurityGroup> <RunAsAccount> <Domain> where

• <ManagementGroupName> is the name of the Operations Manager management group.
• <MOMAdminSecurityGroup> is the name of the domain security group that has been added to the Operations Manager Administrators security role.
• <RunAsAccount> is an account that has the permission to read and write information to the newly created container in Active Directory.
• <Domain> is the domain that the container is created in.

3. Running this command also adds the <RunAsAccount> to the <MOMAdminSecurityGroup>.

More Info: Active Directory Assignment

You can learn more about Active Directory assignment at http://technet.microsoft.com/en-us/library/hh212922.aspx.

For example, to create the container for the TailspinToys management group, using the TAILSPINTOYS\TailspinMOMAdmin group as the security group, and TAILSPINTOYS\Administrator as the runas account, start the command:

MOMADAdmin.exe tailspintoys TAILSPINTOYS\TailspinMOMAdmin TAILSPINTOYS\Administrator
tailspintoys

The MOMADAdmin.exe utility is located by default in the C:\Program Files\Microsoft System Center 2012 R2\Operations Manager\Server folder. You can determine your Operations Manager management group name using the Get-SCOMManagementGroup Windows PowerShell cmdlet.

Once the container has been created, you run the Agent Assignment And Failover Wizard to assign agents to specific management servers within the management group. You can start the Agent Assignment And Failover Wizard by clicking Add on the Auto Agent Assignment tab of the Management Server Properties dialog box of the management server that you want to assign agents to, in the Administration workspace shown in Figure 17.

FIGURE 17 Auto Agent Assignment

You must run the Agent Assignment And Failover Wizard in each domain where you want to use it to perform auto assignment. To complete the wizard, perform the following steps:

1. On the Domain page, specify the domain for which you are configuring automatic agent assignment. Figure 18 shows the selection of the Tailspintoys.internal domain.

FIGURE 18 Domain selection

2. On the Inclusion Criteria page, you can create an LDAP query, or use the dialog box to configure a search based on criteria including name, description, managed by, operating system, and operating system version. Figure 19 shows the inclusion criteria that will include all of the computers that have names starting with the characters SYD.

FIGURE 19 Inclusion criteria

3. On the Exclusion Criteria page, you can enter a list of computers to be excluded from agent assignment. You should list computers using FQDNs, separating each by a semicolon, comma, or new line. Figure 20 shows the computer Excluded.tailspintoys.internal in the list of excluded computers.

FIGURE 20 Exclusion rule

4. On the Agent Failover page, you can specify whether agents will contact another management server in the same management group automatically, or manually fail over to specific management servers. Figure 21 shows the Agent Failover page of the Agent Assignment And Failover Wizard, with the Automatically Manage Failover option page.

FIGURE 21 Automatic failover management

Authorizing agents

If you are planning on installing the Operations Manager agent onto a computer manually, using the MOMAgent.msi installer, or plan to deploy the agent as part of an image, you’ll need to configure how the Operations Manager management deals with the agents once it is contacted.

You can configure one of the following options:

• Reject New Manual Agent Installations When you select this option, any requests from a manually deployed agent, or agent deployed as part of an image will automatically be rejected by the Operations Manager management server.
• Review New Manual Agent Installations In Pending Management View When you select this option, all requests from manually deployed agents or agents deployed as part of an image will be placed in a list, visible through the Pending Management queue. Administrators are able to use this list to perform approval.
• Auto-Approve New Manually Installed Agents When you select this option (only available if the Review option is already selected) any Operations Manager agent that contacts the management server will automatically be joined to the management group.

To configure how the Operations Manager management server responds to manual agent installation, perform the following steps:

1. In the Settings node of the Administration workspace, right-click Security under Type: Server, and click Properties.

2. On the Global Management Server Settings - Security dialog box, select the option that you want to configure, as shown in Figure 22.

FIGURE 22 Global Management Server Settings