It's all correct...
Original Message:
Sent: Mon October 14, 2024 07:55 AM
From: Nagarajan Singaram
Subject: ILMT Hardware Inventory status showing error (ILMT Agent disconnected scanner)
Hi Oktawian,
Sorry my last post I may missed the screen shot of TLSv1.3 disabled in java_for_vmmt.security file.
Thanks,
Nagaraj.
------------------------------
Nagarajan Singaram
Original Message:
Sent: Sun October 13, 2024 03:37 AM
From: Oktawian Powązka
Subject: ILMT Hardware Inventory status showing error (ILMT Agent disconnected scanner)
Hi,
I'm not sure which screenshot are you referring to...
Anyhow, disabling TLSv1.3 protocol been described in update nr. 24
There is no other way.
An uploaded output (vmman_test.out from 2024-09-26) confirms that TLSv1.3 has been disabled.
TLS handshake is started with TLSv1.2 only
------------------------------
Thank you,
Oktawian
Oktawian Powązka, L3 Support
IBM License Metric Tool
Original Message:
Sent: Fri October 11, 2024 09:22 AM
From: Nagarajan Singaram
Subject: ILMT Hardware Inventory status showing error (ILMT Agent disconnected scanner)
Hi Oktawian,
I have added the TLSv1.3 value as per below screen shot and we tested the vmman.sh test process. but it was not helped.
Correct me If I add the vale in the right direction to disabled TLSv1.3 in ILMT.
Because Our network team if enabled TLSv1.3 from firewall then our testing is completed, if they disabled TLSv1.3 from firewall then our test would failed with SSL error.
Also our network policy should be disabled TLSv1.3 in infra.
Thanks,
Nagarajan.
------------------------------
Nagarajan Singaram
Original Message:
Sent: Fri October 11, 2024 08:39 AM
From: Oktawian Powązka
Subject: ILMT Hardware Inventory status showing error (ILMT Agent disconnected scanner)
Hello,
This is not TLS1.3 issue...
ILMT & VM Manager tool supports TLSv1.2 for a pretty long time...and will keep this for a pretty long time.
Furthermore, I've asked you to explicitly disable the TLSv1.3 (look at my update nr. 24),
after this step TLS handshake is always started with TLSv1.2 only.
------------------------------
Thank you,
Oktawian
Oktawian Powązka, L3 Support
IBM License Metric Tool
Original Message:
Sent: Thu October 10, 2024 04:16 PM
From: Nagarajan Singaram
Subject: ILMT Hardware Inventory status showing error (ILMT Agent disconnected scanner)
Hi Oktawian,
Thanks for your valuable commands and advice, the issue has been identified now and it is from network team block TLS1.3 from gateway and they allow only TLS1.2.
For testing they enabled the TLS1.3 and tested the VM manager testing, it was working good.
The network team requested to use ILMT application can support TLS1.2 for vCenter Integration ?
Our ILMT application currently we are running with 9.2.34 on RHEL server.
Thanks,
Nagarajan.
------------------------------
Nagarajan Singaram
Original Message:
Sent: Wed October 09, 2024 06:33 AM
From: Oktawian Powązka
Subject: ILMT Hardware Inventory status showing error (ILMT Agent disconnected scanner)
Hello,
tcpdump shows that upon initial Client Hello (TLS handshake) the other end responded with [FIN, ACK] (TCP).
It means that server (or anything sitting between this machine and 10.5.100.112) immediately shuts down the connection and is not willing to speak anymore.
Again, something is interfering with the TLS handshake, either improper firewall setup or some routing device between which is blocking the TLS protocol.
As I've mentioned before, this type of network investigation should be conducted by a local network/security guy...
There is nothing more I can help you with without access to this very network infrastructure.
------------------------------
Thank you,
Oktawian
Oktawian Powązka, L3 Support
IBM License Metric Tool
Original Message:
Sent: Tue October 08, 2024 03:47 AM
From: Nagarajan Singaram
Subject: ILMT Hardware Inventory status showing error (ILMT Agent disconnected scanner)
Hi Oktawian,
I have run the cmd in two way and uploaded two different log file in IBM Case number TS017166253.
cmd 1: tcpdump -vvv -XX dst host 10.5.100.112 -w tcpdump.out --> output file name "tcdump.out1"
cmd 2: tcpdump -vvv -XX port 443 -w tcpdump.out --> output file name "tcpdump.out"
Thanks,
Nagaraj.
------------------------------
Nagarajan Singaram
Original Message:
Sent: Mon October 07, 2024 02:10 PM
From: Oktawian Powązka
Subject: ILMT Hardware Inventory status showing error (ILMT Agent disconnected scanner)
Hello,
around 300MB for 1 minute execution of cmd..
wow, that's...pretty impressive.
looks like that machine act as a google internet provider...
Seriously, let's limit that size a little bit by filtering by the destination (that vCenter host) :
tcpdump -vvv -XX dst host 10.5.100.112 -w tcpdump.out &
It's not encrypted format, it's called 'PCAP Capture File Format'.
The best tool to read those in human-friendly way is through Wireshark...
Just please upload that output into the ticket and I'll look into it.
------------------------------
Thank you,
Oktawian
Oktawian Powązka, L3 Support
IBM License Metric Tool
Original Message:
Sent: Mon October 07, 2024 01:00 PM
From: Nagarajan Singaram
Subject: ILMT Hardware Inventory status showing error (ILMT Agent disconnected scanner)
Hi Oktawian,
I have ran the command in terminal and got the tcpdump.out file in /var directory, But file is not readable, it is encrypted format and around 300MB for 1 minute execution of cmd.
tcpdump -vvv -XX port 443 -w tcpdump.out & openssl s_client -connect 10.5.100.112:443
Do we have any other option to get the file with readable format?
Thanks,
Nagaraj.
------------------------------
Nagarajan Singaram
Original Message:
Sent: Mon September 30, 2024 04:34 AM
From: Oktawian Powązka
Subject: ILMT Hardware Inventory status showing error (ILMT Agent disconnected scanner)
Hello again,
Well, the next step would be to troubleshoot some layers below HTTP.
I'd start with tcpdump:
tcpdump -vvv -XX port 443 -w tcpdump.out &
openssl s_client -connect 10.5.100.112:443
Those two commands needs to be run from the machine where VM Manager tool is located.
Wait until openssl finishes and stop/kill the tcpdump after all.
At last, collect the tcpdump.out file...
Let me remind you that this type of investigation should be conducted by a local network guy...
------------------------------
Thank you,
Oktawian
Oktawian Powązka, L3 Support
IBM License Metric Tool
Original Message:
Sent: Fri September 27, 2024 10:42 PM
From: Nagarajan Singaram
Subject: ILMT Hardware Inventory status showing error (ILMT Agent disconnected scanner)
Hi Oktawian,
From another server browser I am trying to access the link "https://10.5.100.112:443/sdk/vimService.wsdl" and below responses.
Also I am able to connect vCenter link in the same server browser.
Any help for further testing from our side to share the error for network team, so that they will look into this as network related.
Thanks,
Nagaraj.
------------------------------
Nagarajan Singaram
Original Message:
Sent: Fri September 27, 2024 04:29 AM
From: Oktawian Powązka
Subject: ILMT Hardware Inventory status showing error (ILMT Agent disconnected scanner)
Hello Nagarajan,
openssl has failed to conduct the TLS handshake.
No particular reason has been provided.
Definitely port 443 is opened but something is interfering with the TLS handshake.
It could be some network connection breakage (TCP/IP layer) or some improper firewall setup.
The best course of action would be to first make this URL test directly from vCenter box.
If that works we would have confirmation that it's definitely network/firewall related issue.
At last,
Please remember there is no point to make any tests using VM Manager tool UNLESS openssl/curl confirm a successful HTTPS test.
------------------------------
Thank you,
Oktawian
Oktawian Powązka, L3 Support
IBM License Metric Tool
Original Message:
Sent: Thu September 26, 2024 04:34 PM
From: Nagarajan Singaram
Subject: ILMT Hardware Inventory status showing error (ILMT Agent disconnected scanner)
Hi Oktawian,
I have uploaded the screen shot of running the cmds below in case number TS017166253 .
(file name: ILMTVM-DUP0010.JPG & ILMTVM-DUP0011.JPG)
curl -v --insecure https://x.x.x.x:443/sdk/vimService.wsdl openssl s_client -connect x.x.x.x:443
Thanks,
Nagaraj.
------------------------------
Nagarajan Singaram
Original Message:
Sent: Thu September 26, 2024 06:25 AM
From: Oktawian Powązka
Subject: ILMT Hardware Inventory status showing error (ILMT Agent disconnected scanner)
Hello Nagarajan,
Still the same thing: handshake_failure
Let's leave the ILMT server for a moment and use some tools once more:
curl -v --insecure https://x.x.x.x:443/sdk/vimService.wsdl
openssl s_client -connect x.x.x.x:443
Make sure to run those tests from ILMT server's machine...
------------------------------
Thank you,
Oktawian
Oktawian Powązka, L3 Support
IBM License Metric Tool
Original Message:
Sent: Thu September 26, 2024 12:41 AM
From: Nagarajan Singaram
Subject: ILMT Hardware Inventory status showing error (ILMT Agent disconnected scanner)
Hi Oktawian,
I have added the line and ran the cmd, also attached the vmman.out file in TS017166253 with filename as vmman_test.out.
Thanks,
Nagaraj.
------------------------------
Nagarajan Singaram
Original Message:
Sent: Wed September 25, 2024 05:18 AM
From: Oktawian Powązka
Subject: ILMT Hardware Inventory status showing error (ILMT Agent disconnected scanner)
Hello Nagarajan,
vCenter just replied with so the so called TLS handshake's alert message without giving the exact root cause...typical.
Nevertheless, there a tiny hint: TLS13 alert(handshake_failure)
It could mean that vCenter is rejecting any TLS handshake which is advertising TLSv1.3 in Client Hello message ("supported_versions (43)": {"versions": [TLSv1.3, TLSv1.2]},).
To check that variant please modify the '/opt/ibm/LMT/jre/jre/lib/security/java_for_vmmt.security' file by adding the 'TLSv1.3' attribute into 'jdk.tls.disabledAlgorithms' property:
jdk.tls.disabledAlgorithms=SSLv3, TLSv1, TLSv1.1, TLSv1.3, RC4, DES, MD5withRSA, DH keySize < 1024, DESede, \
At last, run the 'vmman.sh -testconnection' for a quick connection check...
------------------------------
Thank you,
Oktawian
Oktawian Powązka, L3 Support
IBM License Metric Tool
Original Message:
Sent: Tue September 24, 2024 02:05 PM
From: Nagarajan Singaram
Subject: ILMT Hardware Inventory status showing error (ILMT Agent disconnected scanner)
Hi Oktawian,
Thanks for the updates and I have added the parameter and execute the cmds which you shared before, also attached the vmman.out file in TS017166253.
vmman.sh file screenshot also attached for my reference to add the line to verify with you.
Thanks,
Nagaraj.
------------------------------
Nagarajan Singaram
Original Message:
Sent: Sun September 22, 2024 09:36 AM
From: Oktawian Powązka
Subject: ILMT Hardware Inventory status showing error (ILMT Agent disconnected scanner)
At the end of existing line add continually :
-Djavax.net.debug=all -Dcom.sun.xml.internal.ws.transport.http.client.HttpTransportPipe.dump=true
------------------------------
Thank you,
Oktawian
Oktawian Powązka, L3 Support
IBM License Metric Tool
Original Message:
Sent: Sun September 22, 2024 02:19 AM
From: Nagarajan Singaram
Subject: ILMT Hardware Inventory status showing error (ILMT Agent disconnected scanner)
Hi Oktawian,
I need to add the following line into vmman.sh file in screen shot marked right?
VMM_PROPERTIES_DEFS=-Djavax.net.debug=all -Dcom.sun.xml.internal.ws.transport.http.client.HttpTransportPipe.dump=true
or
VMM_PROPERTIES_DEFS="${VMM_PROPERTIES_DEFS} -Dcom.sun.xml.internal.ws.transport.http.client.HttpTransportPipe.dump=true -Dhttps.protocols=TLSv1.2,TLSv1.1,TLSv1 -Dcom.ibm.jsse2.disableSSLv3=false -Dcom.ibm.tools.attach.enable=no"
The marked line continually or next line I could add the property value right?
Once added the value then I have to execute the following cmd right?
vmman.sh -testconnection > vmman.out 2>&1
and share the output file of "vmman.out 2>&1.
Thanks,
Nagarajan.
------------------------------
Nagarajan Singaram
Original Message:
Sent: Sat September 21, 2024 02:44 AM
From: Oktawian Powązka
Subject: ILMT Hardware Inventory status showing error (ILMT Agent disconnected scanner)
Hello Nagarajan,
Indeed, it's just 'Remote host terminated the handshake'...
No root cause (I still opt for TLS version mismatch),
As the next step, I'd have to add this VMM_PROPERTIES_DEFS property vmman.sh script...
------------------------------
Thank you,
Oktawian
Oktawian Powązka, L3 Support
IBM License Metric Tool
Original Message:
Sent: Fri September 20, 2024 12:57 PM
From: Nagarajan Singaram
Subject: ILMT Hardware Inventory status showing error (ILMT Agent disconnected scanner)
Hi Oktawian,
I have attached the screen shot of trace.log_vmmconf_xxx.log and full log file I will upload into TS017166253.
Thanks,
Nagaraj.
------------------------------
Nagarajan Singaram
Original Message:
Sent: Thu September 19, 2024 03:02 AM
From: Oktawian Powązka
Subject: ILMT Hardware Inventory status showing error (ILMT Agent disconnected scanner)
Hello Nagarajan,
A blind guess would be the TLS protocol mismatch,
9.2.34 only accepts TLSv1.2....it's quite possible that this vCenter server tries negotiate some older TLS version.
At first I'd check the corresponding VM Tool trace file :
'../VMMAN/logs/trace.log_vmmconf_xxx.log
for any SSLHandshakeException entries....
If SSLHandshakeException doesn't show the root cause (TLS version mismatch or something similar) the next step is to modify the 'vmman.sh' script by adding a following value at the end of the existing VMM_PROPERTIES_DEFS property :
-Djavax.net.debug=all -Dcom.sun.xml.internal.ws.transport.http.client.HttpTransportPipe.dump=true
Next, run the following command to test connection:
vmman.sh -testconnection -config config/vmmconf_xxx.properties > vmman.out 2>&1
You'd have analyze the vmman.out file or send me for verification...
------------------------------
Thank you,
Oktawian
Oktawian Powązka, L3 Support
IBM License Metric Tool
Original Message:
Sent: Wed September 18, 2024 02:17 PM
From: Nagarajan Singaram
Subject: ILMT Hardware Inventory status showing error (ILMT Agent disconnected scanner)
Hi Oktawian,
Now I could see the port 443 open from ILMT server (local vm manager tool) to vCenter server, but while do the testing in ILMT console--> Management--> VM Manager--> Test connection --> "failed with SSL/TLS exception) error.
do we have any help or workaround to fix this error?
Thanks,
Nagarajan.
------------------------------
Nagarajan Singaram
Original Message:
Sent: Fri September 13, 2024 04:50 AM
From: Oktawian Powązka
Subject: ILMT Hardware Inventory status showing error (ILMT Agent disconnected scanner)
Hello,
As I wrote before,
ILMT v9.2.34 has Local VM Manager tool always installed (starting from v9.2.22).
If Local VM Manager tool has some issues or it's not running you will see a dedicated message on 'Management: VM Managers' panel:
You cannot add VM managers because the local VM Manager can't be started.
If you would like to get unequivocal proof of the Local VM Manager tool status just run :
/opt/ibm/LMT/VMMAN/vmman.sh -reloadconfig
echo $?
The output should say '0'
without any errors...
------------------------------
Thank you,
Oktawian
Oktawian Powązka, L3 Support
IBM License Metric Tool
Original Message:
Sent: Thu September 12, 2024 12:51 PM
From: Nagarajan Singaram
Subject: ILMT Hardware Inventory status showing error (ILMT Agent disconnected scanner)
Hi Oktawian,
How can I check weather VM Manager tool install and running on my ILMT server?
do we have any command to check this process?
Thanks,
Nagarajan.
------------------------------
Nagarajan Singaram
Original Message:
Sent: Thu September 12, 2024 11:43 AM
From: Oktawian Powązka
Subject: ILMT Hardware Inventory status showing error (ILMT Agent disconnected scanner)
Hello,
Not really,
A source port from ILMT to vCenter is called an ephemeral.
(allocated automatically from a predefined range of port numbers).
Those ephemeral ports are almost never cause of the problem....
------------------------------
Thank you,
Oktawian
Oktawian Powązka, L3 Support
IBM License Metric Tool
Original Message:
Sent: Thu September 12, 2024 10:18 AM
From: Nagarajan Singaram
Subject: ILMT Hardware Inventory status showing error (ILMT Agent disconnected scanner)
Hi Oktawian,
I have verified and it is saying port 443 closed
Do I need to open any other port from ILMT (vm manager tool) to vCenter ? other than 443 port
Thanks
Nagaraj.
------------------------------
Nagarajan Singaram
Original Message:
Sent: Thu September 12, 2024 04:13 AM
From: Oktawian Powązka
Subject: ILMT Hardware Inventory status showing error (ILMT Agent disconnected scanner)
Hello Nagarajan,
Indeed, the default vCenter server port (443) seems to be closed or is blocked by some Firewall.
You should contact vCenter admin for details...
For future testing better use curl command :
curl -v --insecure https://x.x.x.x/sdk/vimService.wsdl
------------------------------
Thank you,
Oktawian
Oktawian Powązka, L3 Support
IBM License Metric Tool
Original Message:
Sent: Wed September 11, 2024 12:30 PM
From: Nagarajan Singaram
Subject: ILMT Hardware Inventory status showing error (ILMT Agent disconnected scanner)
Hi Oktawian,
Thanks for your update and I am trying from my ILMT server (formally local vm manager configured) to vCenter server port 443, it is saying connection closed.
May be this error causing the issue on vm manager connection status in ILMT web-console (management--> VM manager--> add connection/test connection)
Thanks,
Nagaraj.
------------------------------
Nagarajan Singaram
Original Message:
Sent: Wed September 11, 2024 08:04 AM
From: Oktawian Powązka
Subject: ILMT Hardware Inventory status showing error (ILMT Agent disconnected scanner)
Hello,
ILMT v9.2.34 has the so called 'Local VM Manager tool' running directly on my ILMT server.
No BigFix server/fixlets are required for this...
So, you just go to the ILMT web-console and management-->VM manager --> new connection and provide the vCenter details...
The VM manager connection is being established directly from ILMT server to vCenter box.
In any case, if Local VM Manager tool has some internal issues and can't be used or it's not running you should see a dedicated message on 'Management: VM Managers' panel:
You cannot add VM managers because the local VM Manager can't be started.
------------------------------
Thank you,
Oktawian
Oktawian Powązka, L3 Support
IBM License Metric Tool
Original Message:
Sent: Tue September 10, 2024 09:28 AM
From: Nagarajan Singaram
Subject: ILMT Hardware Inventory status showing error (ILMT Agent disconnected scanner)
Hi Oktawian,
I am running ILMT v9.2.34 Linux platform and I could see VM manager by default will be Installed while ILMT was Installed/configured. So once It is Installed then I could go to the ILMT web-console and management-->VM manager --> new connection and provide the vCenter details and do Test connection right?
Or do I need to configure the vCenter details manually in ILMT Linux server under VM manager directory with the help of /var/opt/BESClient/LMT/VMMAN/config/vmmconf_template.properties ?
(while I was running ILMT with BigFix mean I used to deploy the fixlet from BigFix console for the VM manager tool on BigFix Root server and did the vCenter configuration in ILMT web console) but now I am using only ILMT with disconnected scanner scenario and not sure how to configure/Install the VM manager.
Could you help on how to check weather our ILMT already having this VM manager tool Installed and running and follow the vCenter configuration in ILMT web-console?
Thanks,
Nagarajan.
------------------------------
Nagarajan Singaram
Original Message:
Sent: Mon September 09, 2024 03:54 AM
From: Oktawian Powązka
Subject: ILMT Hardware Inventory status showing error (ILMT Agent disconnected scanner)
Hello,
We've provided a complementary guideline how to deal with "No VM manager data" status:
https://www.ibm.com/docs/en/license-metric-tool?topic=scshw-troubleshooting-outdated-vm-manager-data-no-vm-manager-data-statuses
Pleases let me know which part needs clarification/verification....
Thanks,
------------------------------
Thank you,
Oktawian
Oktawian Powązka, L3 Support
IBM License Metric Tool
Original Message:
Sent: Sat September 07, 2024 05:54 AM
From: Nagarajan Singaram
Subject: ILMT Hardware Inventory status showing error (ILMT Agent disconnected scanner)
Thanks for your update Chip Layton, We have 2 environments like Azure and on-prem.
for azure VM - we have marked the value as "public cloud- Microsoft Azure"
for on-prem - we are not sure how the value could set for "no VM manager data" error. because all the on-prem servers are running with vCenter.
Thanks,
Nagarajan.
------------------------------
Nagarajan Singaram
Original Message:
Sent: Fri September 06, 2024 05:29 PM
From: CHIP LAYTON
Subject: ILMT Hardware Inventory status showing error (ILMT Agent disconnected scanner)
Make sure that all you Azure based servers are flagged as being in a public cloud.
------------------------------
CHIP LAYTON
Senior IT Management Consultant
IBM Technology Expert Labs - Systems
Phone: 1-770-855-5329
E-mail: chipl@us.ibm.com
Original Message:
Sent: Thu September 05, 2024 04:53 PM
From: Nagarajan Singaram
Subject: ILMT Hardware Inventory status showing error (ILMT Agent disconnected scanner)
Hi Team,
I am running ILMT v9.2.34 for on-prem and azure servers with ILMT disconnected scanners agent in our infrastructure. while generate the Hardware Inventory, it is saying server "No VM Manager Data" in the report.
But we are using/running all the VM into vCenter console,
Need any suggestion to get the hardware capacity scan status "OK" in Hardware Inventory.
Thanks,
Nagarajan.
------------------------------
Nagarajan Singaram
------------------------------