Cognos Analytics

 View Only
  • 1.  What happens when configurations\certs expire and how to know when they will expire

    Posted Thu June 23, 2022 01:43 PM
    So when the certificates in your configuration\certs folder expire, what happens? Does cognos fail. Do you then have to manually regenerate the keys?

    And if you just have the Cognos default certificates with the default expiry dates, what determines the expiry date?

    When you regenerate your keys, supposedly the expiry date is set to 730 days out. But restarting the cognos service or saving from cognos configuration resets the dates? And there is something about a freshness indictor? 

    https://www.ibm.com/support/pages/how-verify-when-encryption-keys-crypto-keys-will-expire#:~:text=Summary,you%20can%20update%20them%20beforehand.
    https://www.ibm.com/support/pages/how-find-out-when-cryptographic-keys-will-expire

    ------------------------------
    brenda grossnickle
    BI Programmer Analyst
    FIS
    ------------------------------

    #CognosAnalyticswithWatson


  • 2.  RE: What happens when configurations\certs expire and how to know when they will expire

    IBM Champion
    Posted Fri June 24, 2022 03:36 AM
    Hi Brenda,

    If you save the configuration with Cognos Configuration, it will refresh cryptography keys expiring date. You can use the command line interface to save the configuration in a batch file, for instance.

    I don't think there is a freshness indicator, except ikeyman that is useful to check the validity dates of the "encryption key".

    Best regards,

    ------------------------------
    Patrick Neveu
    Positive Thinking Company
    ------------------------------



  • 3.  RE: What happens when configurations\certs expire and how to know when they will expire

    Posted Mon June 27, 2022 12:45 PM
    Since we have to reboot our Cognos Windows servers at least monthly for Windows patching, every time I go to restart the Cognos server I first re-save the configuration so it will re-update the security keys.  I've actually had some Windows patches invalidate/corrupt the keys if I didn't re-save.  It only takes a moment longer when re-starting Cognos so is well worth the habit.


    Wayne

    ------------------------------
    Wayne Westlake
    ------------------------------



  • 4.  RE: What happens when configurations\certs expire and how to know when they will expire

    Posted Thu July 07, 2022 03:24 PM
    I don't understand what you mean by "re-save" and what are you "re-saving"?

    ------------------------------
    brenda grossnickle
    BI Programmer Analyst
    FIS
    ------------------------------



  • 5.  RE: What happens when configurations\certs expire and how to know when they will expire

    Posted Fri July 08, 2022 02:20 AM
    Hi Brenda,

    I got used to this approach with Cognos8 increasing the stability and proceed with all further Cognos versions. Open the Cognos Configuration (as administrator) right click the root element --> "Test" then "Save" (re-save) and restart the service. Besides updating the cryptographic keys, I also prefer the transparency checking the details during this process.

    ------------------------------
    Yvonne Warmbier
    Project Manager, Senior Consultant and Coach for BI and DWH projects
    2pr warmbier
    ------------------------------



  • 6.  RE: What happens when configurations\certs expire and how to know when they will expire

    Posted Mon June 27, 2022 12:57 PM
    Many of our customers are in the habit of stopping and starting the cognos service from windows services, and not from cognos configuration. Is this a bad habit? besides resetting the certificate expiration date, what are the advantages of using cognos configuration and what are the disadvantages of using windows services to restart cognos?

    ------------------------------
    brenda grossnickle
    BI Programmer Analyst
    FIS
    ------------------------------



  • 7.  RE: What happens when configurations\certs expire and how to know when they will expire

    Posted Mon June 27, 2022 01:13 PM
    Hey Brenda!

    When we were back on 10.2.2 we occasionally had the search index files get corrupted.  So I had implemented a weekly process that called a batch file that stopped the cognos windows services, deleted the index search files and then restarted the windows services.  However, even then, when manually bringing down and restarting Cognos I always used the configuration.

    When we migrated to 11.0.12 often times Cognos would not come up correctly when just starting the windows services.  Also I think it was in 11.0.13 or maybe 11.1.5 (which we are currently on) when IBM finally fixed the search files corruption so I no longer use that weekly process (though I still occasionally delete the search\collections folder before restarting to force it to rebuild the search index - keeps it more efficient).

    As far as using windows services vs configuration, I haven't seen any major real difference except for, as discussed, having the opportunity to re-save the configuration, thus refresh the encryption keys.  But for me, always using the configuration at least to start Cognos I get to see all the messages as it's coming up to ensure there aren't any problems.  Something that's more difficult to see in the Windows Event Viewer and heaven forbid actually trying to parse the Cognos log files!

    Regards,

    Wayne

    ------------------------------
    Wayne Westlake
    ------------------------------



  • 8.  RE: What happens when configurations\certs expire and how to know when they will expire

    Posted Wed June 29, 2022 10:46 AM
      |   view attached
    Thank you Wayne,

    You are right, most of the times Search index was corrupted, we faced that issue in 11.2.1 as well. when we try to search it throws an error "A network error has occurred.HTTP Code 503".
     We fixed it by Copying and renaming the data folder in Analytics\Data. and deleted the data in the Data folder and then it gets the free space to store the search index and now it allows searching.  

    Thanks,
    Anki Reddy