-
Administration of Cisco Prime LAN Management Solution 4.1
-
Preface
-
Open Source License Acknowledgements
-
Chapter 1: Overview of Administration
-
Chapter 2: Setting up Security
-
Chapter 3: Administering LMS Server
-
Chapter 4: Administering Discovery Settings and Device and Credential Repository
-
Chapter 5: Managing Groups
-
Chapter 6: Administering Data Collection
-
Chapter 7: User Tracking and Dynamic Updates
-
Chapter 8: Administering Collection Settings
-
Chapter 9: Monitoring and Troubleshooting Settings
-
Chapter 10: Notification and Action Settings
-
Chapter 11: Administering Change Audit and Software Management
-
Chapter 12: Managing Jobs
-
Chapter 13: Working With Software Center
-
Chapter 14: Discrepancies and Best Practices Deviations
-
Chapter 15: Report Setting
-
Chapter 16: Purge Settings
-
Chapter 17: Debugging Options
-
Chapter 18: Understanding LMS Tasks
-
Appendix A: CLI Tools
-
Appendix B: Troubleshooting and FAQs
-
Appendix C: Data Extraction Engine
-
Appendix D: Understanding Cisco Prime Security
-
Appendix E:Commands to Enable Mac Notification Traps
-
Appendix F: Recommended Best Practices
-
Index
-
FeedbackTable Of Contents
Setting Up Local Users Through CLI
Migrating User Details from LMS 3.2 to LMS 4.x versions
Changing Cisco Prime User Password Through CLI
Managing Processes Through CLI
Viewing Process Details Through CLI
Viewing Brief Details of Processes
Working With Third Party Security Certificates
Uploading Third Party Security Certificates to LMS Server
Using the SSL Utility Script to Upload Third Party Security Certificates
Setting up Browser-Server Security
Enabling Browser-Server Security From the Command Line Interface (CLI) On Windows Platforms
Disabling Browser-Server Security From the Command Line Interface (CLI) On Windows Platforms
Using LMS Server Hostname Change Scripts
Running the Hostname Change Script
Using DCR Features Through CLI
Viewing the Current DCR Mode Using CLI
Using Group Administration Features Through CLI
Deleting Stale Groups Using CLI
User Tracking Command Line Interface
Exporting Switch Port Usage Report
Installing UTLite Script on Active Directory
Installing UTLite Script on Windows
Installing UTLite Script on NDS
Uninstalling UTLite Scripts From Windows
Uninstalling UTLite Scripts From Active Directory
Uninstalling UTLite Scripts From NDS
User Tracking Debugger Utility
Understanding Debugger Utility
Configuring Switches to Send MAC Notifications to LMS Server
Administration Command Line Interface
CLI Tools
This section explains all the CLI utilities that are available for the administrator in LMS 4.1.
This section contains:
•
Setting Up Local Users Through CLI
•
•
•
•
•
•
•
•
•
•
•
•
•
Setting Up Local Users Through CLI
You can set up the local users through CLI. This feature helps you in:
Adding Local Users
You can add bulk local users through CLI. This feature allows you to specify a file that has information about the local users as an input. The input file you use should be a plain text file.
Note
Each local user information should be represented in the following format in the text file:
Username:Password:E-mail:Roles:DeviceUname:DevicePassword:DeviceEnPassword
where,
•
•
You can leave this field blank in the text file and enter the password in the command line when you run the CLI utility.
Note that you should enter the password either in the command line or in the input text file. If you mention the password in both the places, the local user will be added with the password specified in the command line. On adding the user by giving password in the command line prompt, default role will be assigned to the user if the role is missing in the input file.
•
This is mandatory if you assign the approver role to the local user. Otherwise, this is optional.
•
–
–
–
–
–
–
•
•
•
The following is an example of local user information to be represented in input text file:
admin123:admin123:admin123@cisco.com:Help Desk,SystemAdministrator:admin:roZes123:roZesTo add local users through CLI, enter the following commands:
•
•
where,
•
•
This command line parameter is optional if you have specified the passwords for local users in the input text file. Note that you should enter the password either in the command line or in the input text file.
If you specify this parameter, the local users are added to Cisco Prime only with this password irrespective of the password entries specified in the input text file.
For example, enter the following command to add local users mentioned in the input file localuser.txt with the password admin:
C:\progra~1\CSCOpx\bin\perl C:\progra~1\CSCOpx\bin\AddUserCli.pl -add C:\files\localuser.txt admin
Even if you have entered password for the local users in the localuser.txt file, the local users are added with the password mentioned in the command line.
Importing Local Users
This feature allows you to import local user information to the local server from a remote LMS Server.
You can import local users from ACS through CLI. See, Importing Users From ACS for more information.
You should have the privileges to import local users from remote LMS Server through CLI.
Before you import users from a remote server, you should install the peer certificate of the remote server in the local LMS Server, if the LMS Server is in HTTPS mode. See Setting up Peer Server Certificate for more information.
To import users from a remote server, enter the following commands:
•
•
where,
•
The supported values are HTTP or HTTPS.
•
•
•
•
For example, enter the following command to import the local users from the remote LMS Server lmsdocpc:
NMSROOT\bin\perl NMSROOT\bin\AddUserCli.pl -import HTTP lmsdocpc 1741 admin admin
Importing Users From ACS
To import users from ACS through CLI, enter the following commands:
•
•
where,
•
•
Migrating User Details from LMS 3.2 to LMS 4.x versions
To migrate user details from LMS 3.2 to LMS 4.x:
Step 1
For Solaris and Soft Appliance:
/NMSROOT/lib/jre/bin/java -cp
/NMSROOT/lib/classpath:/NMSROOT/www/classpath:/NMSROOT/MDC/tomcat/shared/lib/
castor-0.9.5-xml.jar:/NMSROOT/MDC/tomcat/shared/lib/castor-0.9.5.jar
com.cisco.nm.cmf.servlet.CWPassMigration <cwpass file location> <output file name with .xml
extension>where, NMSROOT is the directory where you have installed Cisco Prime.
Example:
/opt/CSCOpx/lib/jre/bin/java -cp
/opt/CSCOpx/lib/classpath:/opt/CSCOpx/www/classpath:/opt/CSCOpx/MDC/tomcat/shared/lib/
castor-0.9.5-xml.jar:/opt/CSCOpx/MDC/tomcat/shared/lib/castor-0.9.5.jar
com.cisco.nm.cmf.servlet.CWPassMigration /cwpass /output.xmlFor Windows:
/NMSROOT/lib/jre/bin/java -cp
/NMSROOT/lib/classpath;/NMSROOT/www/classpath;/NMSROOT/MDC/tomcat/shared/lib/
castor-0.9.5-xml.jar;/NMSROOT/MDC/tomcat/shared/lib/castor-0.9.5.jar
com.cisco.nm.cmf.servlet.CWPassMigration <cwpass file location> <output file name with .xml
extension>where, NMSROOT is the directory where you have installed Cisco Prime.
Example:
C:/Progra~1/CSCOpx/lib/jre/bin/java -cp
C:/Progra~1/CSCOpx/lib/classpath;C:/Progra~1/CSCOpx/www/classpath;C:/Progra~1/CSCOpx/MDC/tomcat/shared/lib/castor-0.9.5-xml.jar;C:/Progra~1/CSCOpx/MDC/tomcat/shared/lib/
castor-0.9.5.jar com.cisco.nm.cmf.servlet.CWPassMigration C:/cwpass C:/output.xmlStep 2
Step 3
The Local User Setup page appears.
Step 4
Step 5
Step 6
Migrating User Details using Selective Backup Method
The user details can be migrated from LMS 3.2 to LMS 4.x versions by remote upgrade procedure.
Step 1
NMSROOT\bin>perl NMSROOT\bin\backup.pl -dest= <Backup Directory> -system
where, NMSROOT is the directory where you have installed Cisco Prime.
Step 2
Step 3
Step 4
NMSROOT\bin>perl NMSROOT\bin\restorebackup.pl -d <Backup Directory>
Step 5
Step 6
Note
Changing Cisco Prime User Password Through CLI
You can change the Cisco Prime user password using the Cisco Prime user password recovery utility.
To change the user password on Solaris/Soft Appliance:
Step 1
Step 2
setenv LD_LIBRARY_PATH /opt/CSCOpx/MDC/lib:/opt/CSCOpx/lib
This environment variable set is applicable to the current working shell only.
Now, you can change the password using the Cisco Prime user password recovery utility.
Step 3
Here NMSROOT refers to the Cisco Prime Installation directory.
A message appears:
Enter new password for username:Step 4
Step 5
To change the user password on Windows:
Step 1
Step 2
A message appears:
Enter new password for username:Step 3
Step 4
Managing Processes Through CLI
You can also manage the Cisco Prime processes through CLI. You can perform the following activities through CLI:
•
•
Viewing Process Details Through CLI
The pdshow command displays the details of the specified processes or all processes in the CLI prompt.
•
–
–
•
–
–
where ProcessName1 and ProcessName2 are the name of the processes.
The command displays the process details of one or more processes. See Viewing Process Details for description of each of these items.
•
•
•
•
•
•
•
The pdshow command additionally displays the following process details.
During the startup of Daemon Manager, sometimes the pdshow command may display information message requesting you to wait and enter the command again.
This happens particularly when the Daemon Manager is busy in running the tasks one by one in the queue. You must enter the command again to view the process details.
Viewing Brief Details of Processes
The pdshow -brief command displays the brief status of all processes or specified processes in tabular format in the CLI prompt.
•
–
–
•
–
–
where ProcessName1 and ProcessName2 are the name of the processes.
The command displays the following details in tabular format:
•
•
•
For example, if you enter /opt/CSCOpx/bin/pdshow -brief Tomcat Apache in the command prompt, the following output is displayed:
Process State Pid******* ***** ***Tomcat Program Started - No mgt msgs received 13824Apache Running normally 13847Viewing Processes Statistics
The pdshow -stat command displays the statistics of all processes or specified processes in tabular format.
Note
To display the brief details of all processes, enter:
/opt/CSCOpx/bin/pdshow -stat (on Solaris/Soft Appliance)
To display the details of one or more specified processes, enter:
/opt/CSCOpx/bin/pdshow -stat ProcessName1 ProcessName2 (on Solaris/Soft Appliance)
where ProcessName1 and ProcessName2 are the name of the processes.
The command displays the following details in tabular format in the command line.
Starting a Process
You must enter the following commands to start a process through CLI:
•
•
The dependent processes are started first before the specified process is started.
If the process is being restarted after a shutdown, any dependent processes registered with the Daemon Manager is not automatically restarted. Dependent processes are automatically restarted only when the Daemon Manager itself is restarted.
Stopping a Process
You must enter the following commands to stop a process through CLI:
•
•
The dependent processes are also shut down using this CLI command.
Working With Third Party Security Certificates
Cisco Prime provides an option to use security certificates issued by third party certificate authorities (CAs). You may want to use this option in cases where your organizational policy prevents you from using Cisco Prime self-signed certificates or requires you to use security certificates obtained from a particular CA.
You can use these certificates to enable SSL when you need secure access between LMS Server and your client browser. You can do the following:
•
•
Uploading Third Party Security Certificates to LMS Server
You can upload Third Party Security Certificates using the SSL Utility Script.
This utility is available at:
•
•
Note
This utility has the following options:
Using the SSL Utility Script to Upload Third Party Security Certificates
To upload the certificates:
Step 1
On Windows:
•
On Solaris/Soft Appliance:
•
Step 2
On Windows:
a.
b.
On Solaris/Soft Appliance:
a.
b.
Step 3
Step 4
The script verifies if the server certificate is valid. After the verification is complete, the utility displays the options.
If the script reports errors during validation and verification, the SSL Utility displays instructions to correct these errors. Follow the instructions to correct those errors and then try to upload the certificates.
Step 5
Or
Select option 6, if you have a certificate chain to upload, that is if you have a server certificate and intermediate certificates.
Cisco Prime does not allow you to proceed with the upload if you have not stopped the Cisco Prime Daemon Manager.
The utility displays a warning message if there are hostname mismatches detected in the server certificate being uploaded, but you can continue to upload the certificate.
Step 6
•
•
SSL Utility uploads the certificates, if all the details are correct and the certificates meet Cisco Prime requirements for security certificates.
Step 7
Enable SSL to establish a secured connection between LMS Server and your client browser, if you have not enabled already.
Note
Setting up Browser-Server Security
This section contains:
•
•
Enabling Browser-Server Security From the Command Line Interface (CLI) On Windows Platforms
To enable Browser-Server Security from CLI:
Step 1
Step 2
Step 3
Step 4
•
•
Step 5
The LMS Server creates the security certificate. You can use this certificate to enable SSL in the LMS Server from your client browser.
Step 6
Step 7
a.
b.
Step 8
When you restart the Cisco Prime session after enabling SSL, you must enter the URL with the following changes:
•
•
If you do not make the above changes, LMS Server will automatically redirect you to HTTPS mode with port number 443. The port numbers mentioned above are applicable for LMS Server running on Windows.
Enabling Browser-Server Security From the Command Line Interface (CLI) On Solaris/Soft Appliance Platforms
To enable Browser-Server Security from CLI:
Step 1
Step 2
Step 3
Step 4
•
•
Step 5
The LMS Server creates the security certificate. You can use this certificate to enable SSL in the LMS Server from your client browser.
Step 6
Step 7
a.
b.
Step 8
When you restart the Cisco Prime session after enabling SSL, you must enter the URL with the following changes:
•
•
If your LMS Server is integrated with any Network Management Station (NMS) in your network using the integration utility (NMIM), you must perform the integration every time you enable or disable SSL in the LMS Server. This is required to update the application registration in NMS.
For more information, see the Integration Utility Online Help.
Disabling Browser-Server Security From the Command Line Interface (CLI) On Windows Platforms
To disable Browser-Server Security from CLI:
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
a.
b.
Step 7
When you restart the Cisco Prime session after disabling SSL, you must enter the URL with the following changes:
•
•
The port numbers mentioned above are applicable for LMS Server running on Windows.
Disabling Browser-Server Security From the Command Line Interface (CLI) On Solaris/Soft Appliance Platforms
To disable Browser-Server Security from CLI:
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
a.
b.
Step 7
When you restart the Cisco Prime session after disabling SSL, you must enter the URL with the following changes:
•
•
If your LMS Server is integrated with any Network Management Station (NMS) in your network using the Integration Utility (NMIM), you must perform the integration every time you enable or disable SSL in the LMS Server. This is required to update the application registration in NMS.
For more information, see Integration Utility Online Help.
Backing up Data Using CLI
To back up data using CLI on Windows and Solaris/Soft Appliance:
On Windows, run:
NMSROOT\bin\perl NMSROOT\bin\backup.pl BackupDirectory [LogFile]
email=[comma_separated_email_ids] [Num_Generations]
On Solaris/Soft Appliance, run:
/opt/CSCOpx/bin/perl /opt/CSCOpx/bin/backup.pl BackupDirectory [LogFile] email=[comma_separated_email_ids] [Num_Generations]
where,
•
•
•
•
To back up only selective data using CLI on Windows and Solaris/Soft Appliance:
On Windows, run:
NMSROOT\bin\perl NMSROOT\bin\backup.pl -dest=BackupDirectory -system [-log=LogFile] -gen=Num_Generations]
On Solaris/Soft Appliance, run:
/opt/CSCOpx/bin/perl /opt/CSCOpx/bin/backup.pl -dest=BackupDirectory -system [-log=LogFile] [-gen=Num_Generations]
where,
•
•
•
•
Using LMS Server Hostname Change Scripts
When you change the hostname of the LMS Server, you need to change the hostname related entries in the Cisco Prime directories and files, registry entries, and databases.
LMS provides a CLI utility to update the new hostname information in the LMS related directories and files, registry entries, and databases, after you have changed your hostname.
You can use the hostnamechange.pl script to update the hostname changes in all files, database entries and registry entries.
Caution
Prerequisites
Before running the hostname change script, you should do the following:
Step 1
On Solaris:
•
•
•
For Solaris/Soft Appliance, the sys-unconfig command erases the hostname and IP addresses pertaining to the Solaris/Soft Appliance system (not the LMS or SMS software) and guides you through the server-renaming process. You can also do this when you change the hostname in the hosts, hostname.hme0, and nodename files in the /etc directory.
On Soft Appliance:
To change the hostname in Soft Appliance operating system:
a.
b.
c.
d.
/etc/init.d/dmgtd stopin shell mode.e.
Config prompt appears. Enter "hostname <new host name>"
f.
g.
On Windows:
To change the hostname in Windows operating system:
a.
Or
Click Start > Settings > Control Panel > System.
The System Properties dialog box opens.
b.
c.
d.
e.
f.
Step 2
You must restart the machine when you:
•
Step 3
•
•
Step 4
Step 5
•
•
Running the Hostname Change Script
You can either:
•
After you have restarted your system, ensure that you stop the Daemon Manager and then enter the following command to run the hostname change CLI utility.
–
–
Or
•
Use this option to change the hostname only if the previous attempt of running this script had failed and the hostname changes were unsuccessful.
You need not restart your machine to run the hostnamechange.pl CLI utility with command line options
Enter the following command to run the hostnamechange.pl CLI utility:
–
–
where,
Old_ Hostname —Old Hostname of the LMS Server
New_Hostname —New Hostname of the LMS Server
Domain —Domain name of the LMS Server. Entering domain name is optional.
The hostnamechange.pl script performs the following:
1.
–
–
–
2.
–
–
3.
HKEY_LOCAL_MACHINE\SOFTWARE\Cisco\Resource Manager\CurrentVersion\Environment
The CLI utility looks for all the instances of hostname under these registry entries, and replaces them with the new hostname.
4.
5.
6.
OldhostName:NewhostName
OldhostName—Previous hostname as registered with CCR(regdaemon.xml)
NewhostName—Current hostname as registered with CCR(regdaemon.xml)
The entries for hostname in regdaemon.xml and changehostname.info should be identical.
The changehostname.info file resides in the LMS Server until you restart the Daemon Manager. This file will not be available in LMS Server after the Daemon Manager is restarted.
7.
–
–
The NS_Ref file is restored in LMS Server after the Daemon Manager is restarted.
8.
9.
–
Or
–
After you have completed running the script, ensure that you:
•
–
–
•
•
For example, if you are changing the hostname of a machine that is configured as a Slave, then it needs to reregister with the Master. If you are changing the hostname of a machine that is configured as a Master, then all its Slaves need to be updated with the new Master hostname.
If the hostname of the machine changes, the stability of the system is not guaranteed and it fails in some cases.
Using DCR Features Through CLI
Using Command Line Interface, you can add, delete, and modify devices, and change the DCR modes. You can also view the list of attributes that can be stored in DCR, and view the current DCR mode. The dcrcli provided with LMS helps you perform these tasks using CLI.
The Display Name and the Host Name/Domain Name combination must be unique for each device in DCR. A device will be considered duplicate if:
•
•
•
•
dcrcli operates in both the Shell and Batch modes. The Shell mode is interactive whereas the Batch mode runs the specified command and exits to the prompt after the command is run.
You can set DCRCLIFILE environment to point to the file where LMS password is present. If you set DCRCLIFILE variable, password will not be asked when you run dcrcli in shell or batch mode.
The password file should contain an entry in the format username password. Make sure that there is only one blank space between the username and the password in the password file. For example, if admin is the username and the password for the Cisco Prime user, the password file must contain the following entry:
admin adminThis section has the following:
•
Viewing the Current DCR Mode Using CLI
To view the current DCR mode in Shell mode:
Step 1
Step 2
Step 3
It lists the DCR ID, the DCR Group ID, the current DCR mode, and the associated Master and Slaves.
To view the current DCR mode in Batch mode:
Step 1
Step 2
Viewing Device Details
To view device details using dcrcli in Shell mode:
Step 1
Step 2
Step 3
This lists all the details about the device with the ID you have specified. For example,
detail id=54341 lists the details for the device with device ID 54341.To view device details using dcrcli in Batch mode:
Step 1
Step 2
Changing DCR Mode Using CLI
To change mode to Master in Shell mode:
Step 1
Step 2
Step 3
The DCR mode gets changed to Master.
To change mode to Master in Batch mode:
Step 1
Step 2
To change mode to Standalone in Shell mode:
Step 1
Step 2
Step 3
The DCR mode gets changed to Standalone.
To change mode to Standalone in Batch mode:
Step 1
Step 2
To change mode to Slave in Shell mode:
Step 1
Step 2
Step 3
You have to specify the Master for this slave.
The DCR mode gets changed to Slave. For example,
setslave master=1.2.1.3 port=443To change mode to Slave in Batch mode:
Step 1
Step 2
Using Group Administration Features Through CLI
You can use OGSCli command line utility to:
•
•
You should have Network Administrator, System Administrator, or Super Admin privileges to use OGSCli command line utility.
OGSCli runs in only Batch mode. It runs the specified command and exits to the prompt after the command is run.
This section explains:
Exporting Groups Through CLI
To export groups through CLI:
Step 1
Step 2
•
Or
•
where,
NMSROOT is the directory where you have installed CiscoWorks.
CiscoWorks_Username is the login username of a CiscoWorks user.
For example, you can enter /opt/CSCOpx/bin/OGSCli.sh -u admin on Solaris/Soft Appliance systems.
The system prompts you to enter your Cisco Prime password.
Step 3
The system prompts you to enter a task name, import or export. The default task is export.
Step 4
The system prompts you to enter an output file name.
Step 5
If you do not enter file name with its absolute path name, the export file will be stored on \nmsroot\bin.
A warning message appears indicating that the selected file will be overwritten with the new information on exported groups.
The system uses the file name that you have entered to generate the output XML file irrespective of whether the file exists on the server.
You should have the required directory-level permissions where you want to save the output XML file.
You must either enter y to continue or n to exit.
The system prompts you to enter an export group hierarchy.
Step 6
Default value is All.
For example, you can enter the group hierarchy name as /CS@ doc-pc2/User Defined Groups/Group1.
The system generates an export format XML file and stores on the specified directory on the server.
Importing Groups Through CLI
To import groups through CLI:
Step 1
Step 2
•
Or
•
where,
NMSROOT is the directory where you have installed CiscoWorks.
CiscoWorks_Username is the login username of a CiscoWorks user.
For example, you can enter /opt/CSCOpx/bin/OGSCli.sh -u admin on Solaris/Soft Appliance systems.
The system prompts you to enter your Cisco Prime password.
Step 3
The system prompts you to enter a task name, import or export. The default task is export.
Step 4
The system prompts you to enter the input XML filename.
Step 5
The system lists the groups to be imported from the source XML file.
Step 6
You can enter one or more item numbers separated by comma.
The system lists the Grouping Server locations where you can import the groups.
Step 7
You can enter one or more item numbers separated by comma. You must enter 1 to import the selected groups to all listed servers.
A message appears indicating whether the import of groups is successful.
See Exporting Groups for the possible causes for the import groups job to fail.
Deleting Stale Groups Using CLI
You can delete groups that belonged to users removed from Cisco Prime. To delete a stale group, you must run the DeleteStaleGroups utility.
To run the DeleteStaleGroups utility:
On Windows:
Step 1
Step 2
On Solaris/Soft Appliance:
Step 1
Step 2
The explanation for these optional entries are as follows:
-user: Current user who has the necessary privileges to delete groups.
-pfile: Absolute Path of the text file with Cisco Prime login password of the current user, in one line.
-staleuser: The user whose group has to be deleted.
If you run the DeleteStaleGroups utility without specifying any of these optional entries, all the stale groups will be deleted.
User Tracking Command Line Interface
You can run User Tracking commands from the command line in Solaris/Soft Appliance and Windows 2000.
Enter ut -cli options -u username -p password.
The options can be one or more of those shown in Table A-1.
•
•
Table A-1 User Tracking CLI Commands
-prompt
No keywords or arguments.
This command is required if you do not enter your password from the command line.
If -prompt is specified, User Tracking prompts you to enter your password.
-help
No keywords or arguments.
Prints the command line usage.
-ping
{enable | disable}
Enables the Ping Sweep option so that the ANI Server pings every IP address on known subnets before discovery. The default is the last setting used.
User Tracking does not perform Ping Sweep on large subnets, for example, subnets containing Class A and B addresses.
Hence, ARP cache might not have some IP addresses and User Tracking may not display the IP addresses.
In larger subnets, the ping process leads to numerous ping responses that might increase the traffic on your network and result in extensive use of network resources.
To perform Ping Sweep on larger subnets, you can:
•
To configure the value, you must use the
arp time-out interface configuration command on devices running Cisco IOS.•
This ensures that when you run User Tracking Acquisition, the ARP cache of the router contains the IP addresses.
-performMajorAcquisition
No keywords or arguments.
Acquires data about all users and hosts on the network and updates the LMS database.
This option starts an acquisition but does not wait for it to complete.
-query
This option takes one of the following arguments:
Queries the Topology and Layer 2 services module database and updates the User Tracking table.
all
Gets all User Tracking entries. Similar to "All Host Entries" or a simple query in the GUI.
name
Runs the named advanced or simple query, created earlier in the GUI.
dupMAC
Finds duplicate MAC addresses.
dupIP
Finds duplicate IP addresses.
hub
Finds ports with multiple MAC addresses (hubs).
-queryPhone
all
Gets all IP Phone entries.
name
Runs the named advanced query, created earlier in the GUI.
-layout
layout_name
Uses the specified main table layout while performing a query to fetch User Tracking display entries.
-layoutPhone
layout_name
Uses the specified IP phone table layout while performing a query to fetch IP phone display entries.
-host
ANI Server device name or IP Address
Specifies the host name or IP address of the LMS Server.
Use this argument when you need to run the CLI command on a remote LMS Server.
-port
ANI Server web port number
Specifies the web server port number of the ANI Server. The default is 1741.
-export
filename
Exports data to a text file.
You must first specify the -query option to fetch the data that you want to export.
-import
filename
Imports lost or deleted UserName and Notes fields from the last exported file.
-importMACToAcceptableOUI
filename
Imports MACs and converts them to OUI and adds the MACs to the Acceptable OUI List.
For example:
cd NMSROOT/bin ut -cli -importMACToAcceptableOUI filename -u username -p password
-stat
No keywords or arguments.
Displays statistical information, such as time of last acquisition, acquisition status, number of records in the User Tracking database, and so on.
-debug
No keywords or arguments.
Enables trace and debug messages for the User Tracking client application.
-wireless
No keywords or arguments.
Displays detailed information on Wireless clients connected to the network.
If you enter this option along with the export option, data can be exported to a text file.
For example:
NMSROOT/campus/bin ut -cli -wireless -export c:/sample -u username -p password
-switchPortCapacity
For complete details on this, see Exporting Switch Port Usage Report.
-switchPortreclaimreport
For complete details on this, see Exporting Switch Port Usage Report
-switchPortSummary
For complete details on this, see Exporting Switch Port Usage Report
For details on Lookup Analyzer Script, see Using Lookup Analyzer Utility
Exporting Switch Port Usage Report
Switch Port Capacity report lists switches whose utilization percentage falls in the specified range.
Switch Port Reclaim reports lists:
•
and
•
Switch port usage reports can be generated from the command prompt as given in Table A-2:
where NMSROOT is the directory where you installed Cisco Prime.
Note
The report generated by the above options is saved as a file in the CSV format, at the specified location.
You can generate various Switch Port Usage reports, select Reports > Switch Port.
Using Lookup Analyzer Utility
Lookup Analyzer is a utility used to analyze the performance of DNS servers and provide the following information:
•
•
•
•
For Solaris/Soft Appliance:
The utility file is NMSROOT/campus/bin/LookupAnalyzer.sh
If dir is the directory where the file is present, run the following command to run the utility:
dir# ./LookupAnalyzer
For Windows:
The utility file is NMSROOT\campus\bin\LookupAnalyzer.bat
If dir is the directory where the file is present, run the following command to run the utility:
dir> LookupAnalyzer
Example output of the Lookup Analyzer script:
Host IP: 172.20.123.74, DNS Server: 64.104.76.247, Time taken: 35, Status: FAILUREHost IP: 172.20.123.74, DNS Server: WINS, Time taken: 22, Status: FAILUREHost IP: 10.77.209.254, DNS Server: 64.104.128.248, Time taken: 18, Status: FAILURE....DNS Server : 64.104.128.248Success Count: 12Failure Count: 76Failure % : 86 %Total Time : 1 secs 561 msMin Time : 0 msMax Time : 52 msAvg Time : 17 msServer Efficiency(successCount/totalTime): 7.0--------------------------------DNS Server : 64.104.76.247Success Count: 0Failure Count: 76Failure % : 100 %Total Time : 2 secs 729 msMin Time : 0 msMax Time : 61 msAvg Time : 35 msServer Efficiency(successCount/totalTime): 0.0--------------------------------DNS Server : WINSSuccess Count: 0Failure Count: 76Failure % : 100 %Total Time : 750 msMin Time : 0 msMax Time : 23 msAvg Time : 9 msServer Efficiency(successCount/totalTime): 0.0--------------------------------Overall Summary-----------------Success Count: 12Failure Count: 76Failure % : 86 %-----------------Current Namelookup Related Settings---------------------------------UTMajorUseDNSSeperateThread: falseUT.nameResolution: bothUT.nameResolution.threadCount: 1UT.nameResolution.winsTimeout: 2000UT.nameResolution.threadThresholdPercentage: 10UT.nameResolution.dnsTimeout: 2000UTMajorUseDNSCache: falsenameserver.usednsForUT: trueDB.dsn: ani---------------------------------ISSUES/RECOMMENDATIONS-----------------------Issue #1: Failure Percent is greater than 20%Recommendation: Check all DNS/WINS entries and ensure proper hostnames are configuredIssue #2: DNS reverse lookup is NOT done as separate processRecommendation: Enable UTMajorUseDNSSeperateThread=true in ut.propertiesIssue #3: Name Resolution DNS server order is not optimalRecommendation: Change dns server order as 64.104.128.248=7.0, 64.104.76.247=0.0, WINS=0.0,Other Recommendations:* If hostnames in your network are less likely to change often, set UTMajorUseDNSCache=true* If reverse lookup failure % is more, try increasing UT.nameResolution.winsTimeout, UT.nameResolution.dnsTimeout and UT.nameResolution.threadThresholdPercentage* Optimal timeout values are: UT.nameResolution.winsTimeout=0, UT.nameResolution.dnsTimeout=48The script can also be run by setting properties in the ut.properties file.
Understanding UTLite
UTLite is a utility that allows you to collect user names from Primary Domain Controllers, Active Directory, and Novell servers.
To do this you need to install UTLite in the Windows Primary Domain Controllers and in the Novell servers. You can also install UTLite in an Active Directory server.
UTLite sends traps to LMS whenever a user logs in or logs out. UTLite traps are processed by LMS at the rate of 150 traps per second, with a default buffer size of 76800.
If you need a higher trap processing rate, say 300 traps per second, increase the buffer size to 102400.
To increase the buffer size:
Step 1
Step 2
Step 3
Step 4
Caution
To receive UTLITE events:
Step 1
Step 2
Or
You can change the property of URTlite state by launching LMS. Select the Acquisition Settings option from Admin > Collection Settings > User Tracking > Acquisition Settings. The Acquisition Settings page appears. In the Acquisition Settings page, check the Get user names from hosts in NT and NDS domains and click Apply.
The UTLite script is supported on these platforms:
•
•
•
•
•
•
The UTLite script is not supported on these UNIX hosts:
•
•
•
This section contains:
•
•
•
•
•
•
Installing UTLite Script on Active Directory
You must install the UTLite script on the Active Directory server and update the server's logon script to get user logon information from Active Directory hosts.
You must have Administrator privileges on the Active Directory server to install the UTLite logon script. To install the script:
Step 1
a.
b.
NMSROOT\campus\bin\UTLite33.exe
NMSROOT\campus\bin\UTLiteNT.bat
where NMSROOT is the directory in which you installed Cisco Prime.
c.
NETLOGON is located at:
%SystemRoot%\sysvol\sysvol\domain DNS name\scripts,where %SystemRoot% is usually c:\winnt and domain DNS name is the DNS name of the domain
Step 2
a.
b.
start %WINDIR%\UTLite33 -domain domain -host ipaddress -port 16236
If port 16236 is already in use, enter a different number. This port number must match the number that you entered in the Use Port Number field, in the User Tracking Acquisition Settings page (Select Admin > Collection Settings > User Tracking > Acquisition Settings).
For more details, see Modifying UT Acquisition Settings.
Edit the logon script files to run the UTLiteNT.bat file when users log into the network by adding this line:
UTLiteNT.bat
Step 3
The first time users log into the network after you edit this script, UTLite33.exe is copied to the local WINDIR directory on their Windows client system.
Installing UTLite Script on Windows
You must install the UTLite script on the primary domain controller and update the domain controller logon script to get user logon information from Windows hosts. Do this once for each domain.
You must have Administrator privileges on the primary domain controller to install the UTLite logon script. To install the script:
Step 1
a.
b.
C:\Program Files\CSCOpx\campus\bin\UTLite33.exe
C:\Program Files\CSCOpx\campus\bin\UTLiteNT.bat
where C:\Program Files\ is the directory in which you installed Cisco Prime.
c.
NETLOGON is located at
%SYSTEMROOT%\system32\Repl\Import\Scripts,where, SYSTEMROOT% is the root directory for the Windows operating system files.
Step 2
a.
b.
start %WINDIR%\UTLite33 -domain domain -host ipaddress -port 16236
If port 16236 is already in use, enter a different number. This port number must match the number that you entered in the Use Port Number field, in the User Tracking Acquisition Settings page (Select Admin > Collection Settings > User Tracking > Acquisition Settings).
For more details, see Modifying UT Acquisition Settings.
Step 3
UTLiteNT.bat
Step 4
The first time users log into the network after you edit this script, UTLite33.exe is copied to the local WINDIR directory on their Windows client system.
Installing UTLite Script on NDS
You must install the UTLite script on the Novell Server and update the domain controller logon script, to get user logon information from Windows hosts. You only need to do this once for each domain.
You must have ZenWorks installed and running on the Novell Server, and you must be using NDS 5.0 or later.
To install the script:
Step 1
Step 2
Step 3
•
•
where C:\Program Files\ is the directory in which you installed Cisco Prime.
Step 4
Step 5
Step 6
Step 7
start %WINDIR%\UTLite33 -domain domain -host ipaddress -port 16236
If port 16236 is already in use, enter a different number. This port number must match the number that you entered in the Use Port Number field, in the User Tracking Acquisition Settings page (Select Admin > Collection Settings > User Tracking > Acquisition Settings).
For more details, see Modifying UT Acquisition Settings.
Edit the logon scripts.
Step 8
Step 9
Step 10
Step 11
@\\%FILE_SERVER%\sys\public\your_folder_name\UTLiteNDS.bat where your_folder_name is the name of the folder you created in Step 1.
Uninstalling UTLite Scripts From Windows
If you choose not to have LMS server automatically collect user names, follow these instructions to properly remove the UTLite scripts. To uninstall the script:
Step 1
Step 2
Step 3
To quickly locate the WINDIR directory, enter set windir from a command prompt window on each client.
Uninstalling UTLite Scripts From Active Directory
If you choose not to have LMS server automatically collect user names, follow these instructions to properly remove the UTLite scripts. To uninstall the script:
Step 1
Step 2
Step 3
To quickly locate the WINDIR directory, enter set windir from a command prompt window on each client.
Uninstalling UTLite Scripts From NDS
If you choose not to have LMS server automatically collect user names, you must perform these steps to properly remove the UTLite scripts. To uninstall the script:
Step 1
Step 2
Step 3
To quickly locate the WINDIR directory, enter set windir from a command prompt window on each client.
User Tracking Debugger Utility
The User Tracking Debugger Utility is a command line tool to help debug common problems with User Tracking. This section contains:
•
Understanding Debugger Utility
The utility displays a report on the reasons why User Tracking failed to discover end hosts on specific ports.
In many cases, User Tracking may not perform as expected. This may be because of problems in other LMS applications. For instance LMS Server may have devices that are not discovered or inadequate VLAN discovery in Topology Services.
You can run the utility to troubleshoot problems, or provide the report and log generated by the utility when you contact TAC for help in diagnosing problems.
The debugger utility uses the data collected by LMS Server and reports the reasons for the missing ports in User Tracking.
This tool also has an SNMP component embedded which runs an SNMP query for the table as a part of verification for SNMP failure. For example, SNMP bugs in Catalyst operating system because of which User Tracking may fail to discover devices.
This generates an Action Report that you can use to analyze the data.
The Debugger Utility:
1.
2.
3.
4.
Using Debugger Utility
The Debugger Utility is available at $NMSROOT/campus/bin/ (where $NMSROOT is the directory where you have installed Cisco Prime).
To run the Debugger Utility, run the command:
utdebug -switch switch-ip -port port1[,port2 ...] [-export filename]
where,
switch is the switch to which the end hosts are connected.
ports are the ports on the switch which have missing end hosts User Tracking.
-export filename specifies that the debug messages be stored in the file specified. If this option is not used, the messages are displayed on the console.
For example,utdebug -switch 10.29.6.12 -port 5/12utdebug -switch 10.29.100.10 -port Fa0/10utdebug -switch 10.29.6.14 -port Gi6Configuring Switches to Send MAC Notifications to LMS Server
You must configure the Cisco switches for sending SNMPv1/SNMPv2 MAC Notification Traps when a host is connected to or disconnected from that port. Even if the device is managed with SNMPv3, Network Topology, Layer-2 Services, and User Tracking, it processes only SNMPv1/SNMPv2 traps.
You can configure the ports only through Command Line Interface (CLI). If you do not have Configuration Management functionality enabled on your LMS Server, you have to manually configure the switches for the switches to send MAC Notifications to the LMS server. Ensure that you have configured System Identity User under Admin > Trust Management > Multi Server > System Identity Setup and the same username and password is configured under Admin > System > User Management > Local User Setup.
For a list of commands to be run on each device, see the Appendix Commands to Enable MAC Notification Traps on Devices.
For complete list of devices supported by LMS, see http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_lan_management_solution/4.1/device_support/table/lms41sdt.html
Administration Command Line Interface
This section describes how to administer LMS database from the command line. This is explained in the following topics:
•
•
•
•
•
•
This section also explains SNMP Configuration on Devices
Replacing Corrupted Database
If you have a corrupted database, you can use the database administration tools to restore the database from a previous backup. However, if you do not have a previous backup, you must re-initialize the database.
When you run this command, if Data Collection is running, it is automatically stopped and then restarted when the database initialization is complete.
Caution
Note
Re-initializing the Database
From the command prompt or shell window, enter:
•
•
The following message appears:
This will erase all data from the database. Are you sure [y/n] ?If you enter y, it erases all data (database tables Wbu*...) from the server.
Deleting all Active Entries from User Tracking, and Restarting Servers
From the command prompt or shell window, enter:
•
•
where active entries are hosts that are currently logged in
Deleting all Inactive Entries from User Tracking, and Restarting Servers
From the command prompt or shell window, enter:
•
•
where inactive entries are hosts that are currently not logged in
Deleting all History Entries from User Tracking, and Restarting Servers
From the command prompt or shell window, enter:
•
•
where history entries are complete entries. That is, hosts that have a login and logout in the past.
Deleting all User Tracking Entries, and Restarting Servers
From the command prompt or shell window, enter:
•
•
Restoring the Original Data in the Server
From the command prompt or shell window, enter:
•
•
Note
Restoring Data from Another Server
When you take database backup for LMS in one server and restore it in another server, the NMSROOT logfile location may not be the same in both servers.
In that case, LMS will log messages to the log file stored in the default NMSROOT location in the restored machine.
where NMSROOT is the root directory where you installed Cisco Prime.
Performance Tuning Tool
When you get out of memory errors in LMS, the following command can be used to tune the performance:
NMSROOT/bin/perl NMSROOT/campus/bin/CMPTT.pl ProcessName HeapSize MaxPermSize
•
–
–
•
Ensure you have enough swap space in the server before tuning the heap size.
•
SNMP Configuration on Devices
SNMP v3 Device Configuration Settings
LMS supports the following Authentication protocols for SNMP v3:
•
•
LMS supports the following Privacy protocols for SNMP v3:
•
•
•
•
•
For using various LMS features in devices running SNMPv3, you must make specific configurations on the devices. The commands that need to be configured are:
•
•
Configuring MIB Views
For Catalyst devices, enter the following command:
set snmp view campusview 1.3.6.1 included nonvolatile
For IOS devices, enter the following command:
snmp-server view campusview oid-tree included
Configuring Access Groups
You must set the access rights for a group with a certain security model in different security levels.
For Catalyst devices, enter the following command:
set snmp access campusgroup security-model v3 authentication read campusview write campusview nonvolatile
For IOS devices, enter the following command:
snmp-server group campusgroup v3 auth read campusview write campusview access access-list
Configuring Device with Context Name
For Catalyst devices, enter the following commands:
set snmp access campusgroup security-model v3 authentication read campusview write campusview context vlan- prefix nonvolatile
Context exact is also supported. The following is an example:
set snmp access campusgroup security-model v3 authentication read campusview write campusview context vlan-1 exact nonvolatile
For IOS devices, enter the following command:
snmp-server group campusgroup v3 auth context vlan-1 read campusview write campusview
IOS image versions prior to12.4 support only exact context name.
IOS image versions 12.4 or higher, support both exact or prefix context names.
You need to configure the device with and without context name, since Data Collection manages the device without context name and User Tracking requires context name to contact the device.
Configuring a New User
For Catalyst devices, enter the following command:
set snmp user campususer authentication md5
For IOS devices, enter the following command:
snmp-server user campususer campusgroup v3 auth md5 password1
Configuring Password for a User
For Catalyst devices, enter the following command:
set snmp user campususer authentication md5 password1
For IOS devices, enter the following command:
snmp-server user campususer campusgroup v3 auth md5 password1
Relating a User to a Group
Using a specified security model you can relate a user to a group.
For Catalyst devices, enter the following command:
set snmpw group campusgroup user campususer security-model v3 nonvolatile
For IOS devices, enter the following command:
snmp-server user campususer campusgroup v3
Configuring Privacy Protocol
For Catalyst devices:
set snmp user campususer authentication md5 password1privacy des password2
For IOS devices:
snmp-server user campususer campusgroup v3 auth md5 password1 priv des password2
Configuring SNMP view to prevent %SNMP-3-AUTHFAIL Syslog due to polling of shutdown VLANs
Due to the limitation of stpxPVSTVlanEnable mib object, data collection polls shut down VLANs for fetching STP related data which will enable the device to trigger %SNMP-3-AUTHFAIL Syslogs. In order to avoid the polling of shut down VLAN, SNMP-VACM-MIB view has to be created in the device, associated with SNMP credential and the property vacmContextNameEnabled has to be set to 1 in LMS.
You can enable it by creating a view and by including and excluding MIBs as mentioned in the below configuration:
snmp-server view <view-name> iso included
snmp-server view <view-name> internet included
snmp-server view <view-name> internet.6.3.15 excluded
snmp-server view <view-name> internet.6.3.16 excluded
snmp-server view <view-name> internet.6.3.18 excluded
snmp-server view <view-name> cTapMIB excluded
snmp-server view <view-name> internet.6.3.16.1.1 included
In LMS, by default the property vacmContextNameEnabled in ANIServer.properties under NMSROOT/campus/ect/cwsi has the value 0. This value has to be changed to 1 and then restart the daemons.
Note
