Transcription
IBM Endpoint ManagerVersion 9.1Configuration GuideIBM
IBM Endpoint ManagerVersion 9.1Configuration GuideIBM
NoteBefore using this information and the product it supports, read the information in “Notices” on page 77.This edition applies to version 9, release 1, modification level 0 of IBM Endpoint Manager and to all subsequentreleases and modifications until otherwise indicated in new editions. Copyright IBM Corporation 2010, 2014.US Government Users Restricted Rights – Use, duplication or disclosure restricted by GSA ADP Schedule Contractwith IBM Corp.
ContentsChapter 1. Introduction . . . . . . . . 1What is new in V9.1 . . . .Service Management Connect.Terms used in this guide . . 1. 2. 3Chapter 2. Additional configurationsteps . . . . . . . . . . . . . . . . 5Managing operators and permissions . . . . . . 5Site administrator responsibilities . . . . . . 5Operators permissions . . . . . . . . . . 6Operators and analyses . . . . . . . . . . 7Adding console operators . . . . . . . . . 8Integrating Linux Server with Active Directory . . 8Using multiple servers (DSA) . . . . . . . . 13Disaster Server Architecture (DSA) . . . . . 14Configuring relay failover . . . . . . . . 15Message Level Encryption and DSA . . . . . 16Managing Replication (DSA) on Windowssystems. . . . . . . . . . . . . . . 17Managing Replication (DSA) on Linux systems17Configuring ODBC . . . . . . . . . . . . 19Microsoft SQL Database Connection . . . . . 20DB2 Database Connection . . . . . . . . 21Increasing the size of the FillDB buffer directory . . 24HTTPS Configuration for Web Reports . . . . . 25Configuring HTTPS manually on Windowssystems. . . . . . . . . . . . . . . 27Configuring HTTPS manually on Linux systems 28Configuring the number of Web Reports results . . 29Downloading files in air-gapped environments . . 29On Windows systems . . . . . . . . . . 29On Linux . . . . . . . . . . . . . . 30Transferring Downloaded Files . . . . . . . 32FIPS 140-2 cryptography in the Endpoint Managerenvironment . . . . . . . . . . . . . . 34Configuring FIPS 140-2 on the Endpoint ManagerServer . . . . . . . . . . . . . . . 34Managing Client Encryption . . . . . . . . . 35Generating a new encryption key . . . . . . 37Creating top-level decrypting relays . . . . . 37Message Level Encryption (MLE) Overview . . . 38Changing the Client Icon . . . . . . . . . . 39Optimizing the servers . . . . . . . . . . 40Optimizing the consoles . . . . . . . . . . 40Managing Bandwidth . . . . . . . . . . . 41Dynamic Throttling. . . . . . . . . . . . 41Managing Downloads . . . . . . . . . . . 43Dynamic download White-lists . . . . . . . 44Creating custom client dashboards. . . . . . . 45Geographically locating clients . . . . . . . . 47Locking clients . . . . . . . . . . . . . 47Editing the Masthead on Windows systems. . . . 48 Copyright IBM Corp. 2010, 2014Editing the Masthead on Linux systems . . .Modifying Global System Options . . . . .Extending the IBM Endpoint Manager License.Re-creating Site Credentials . . . . . . .50525353Chapter 3. Maintenance andTroubleshooting. . . . . . . . . . . 55Chapter 4. Upload and archive managersettings . . . . . . . . . . . . . . 57Editing the archive manager settings .Creating a Custom Action . . . .Archive Manager . . . . . . .Archive Manager Settings . . .Archive Manager internal variablesArchive Manager Index File FormatUpload Manager . . . . . . .Upload Manager Settings . . . .PostFile. . . . . . . . . . .PostFile Settings . . . . . . .Resource Examples . . . . . . .5758585859606060626363Chapter 5. Command-Line Interface . . 65Location . . . . .Conventions and usageUser Authentication andLocal Data Directory .FIPS Deployments . .Making Requests . .Query Parameters .POST and PUT InputPortability . . . .IEM CLI Examples . .Actions . . . . .Advanced Options .Export masthead .Fixlet . . . . .LDAP . . . . .Login . . . . .Operators . . . .Replication . . .Role . . . . . .System Options . .Appendix. Support. . . . .Session. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6565656666666767676868686969697171717374. . . . . . . . . 75Notices . . . . . . . . . . . . . . 77Programming interface information . . . . .Trademarks . . . . . . . . . . . . .Terms and conditions for product documentation. 79. 79. 80iii
ivIBM Endpoint Manager: Configuration Guide
Chapter 1. IntroductionThis guide explains additional configuration steps that you can run in yourenvironment after installation.In this guide you find information about:v Chapter 2, “Additional configuration steps,” on page 5v Chapter 3, “Maintenance and Troubleshooting,” on page 55v Chapter 4, “Upload and archive manager settings,” on page 57v Chapter 5, “Command-Line Interface,” on page 65What is new in V9.1IBM Endpoint Manager V9.1 adds the following enhancements:Enhanced SecurityThis enhancement includes the following functions:v Ability to disable SHA-1 signatures in favor of SHA-256.v Support for TLS 1.2 communication protocol.v The root certificate key strength is increased from 1024 bits to 4096 bits.Note: Enabling Enhanced Security results in loss of management of anyagents or relays with versions earlier than 9.1, including proxy agents.For information about this enhancement, see Security ConfigurationScenarios.LDAP group support in Web ReportsFor information about this enhancement, see Step 2: Assign a Web Reportsrole to LDAP users or groups.Linux server processes are now 64-bitThe following services are now 64-bit:v Root Serverv Web Reportsv FillDBv GatherDBCommon Criteria security certification featuresThis enhancement includes the following functions:v Configurable login banners for Console and Web Reports.To configure the login banner, set the option loginWarningBanner asdescribed in Advanced Options for Windows systems or in Running theEndpoint Manager Administration Tool for Linux systems.v Inactivity timeout for Console and Web Reports.To configure the inactivity timeout, specify the optiontimeoutLockMinutes as described in Advanced Options for Windowssystems or in Running the Endpoint Manager Administration Tool forLinux systems.v Increased server audit logging. Copyright IBM Corp. 2010, 20141
To configure the server audit logging, specify the settingBESRootServer Audit Verbosity as described in /home?lang en#!/wiki/Tivoli Endpoint Manager/page/Configuration Settings.Dashboard API enhancementsThis enhancement includes the following functions:v Suppress warning for the StopAction API.v Tag actions when importing.v Asynchronous DownloadFile API.v Asynchronous UploadFile API.Enhanced screen reader support for the Client UIThis enhancement includes the following functions:v Enabled screen reader for About dialog and Action History dialog.v Support high contrast display mode in Client UI.REST API enhancementsThis enhancement includes the following functions:v Ability to add a file that will to be gathered by agents to a site.v Ability to delete a computer.v Users that are created through the REST API are now logged in theserver audit log.The information about REST API is available at the following web ikis/home?lang en#!/wiki/Tivoli Endpoint Manager/page/REST API.New agent inspectorsThis enhancement includes the following functions:v Square root, for example, "sqrt of 4".v Added comparison operators for type time of day with time zone .v Group membership inspectors, for example, "manual groups of client ".v Ability to percent-encode and percent-decode strings.v On Windows systems: ability to inspect whether Data ExecutionPrevention is enabled for a process.v On Windows systems: registry inspectors support the REG QWORDregistry type.v On Windows systems: get the process id (pid) of a service, for example,"pid of service ".v *nix: network socket inspectors.The information about agent inspectors is available at the following webpage cts Any.html.For a list of fixes that are included in the V9.1, see st-91.txt.For a list of known limitation that affects V9.1 (9.1.1065), see http://www01.ibm.com/support/docview.wss?uid swg21667537.Service Management ConnectConnect, learn, and share with Service Management professionals: product supporttechnical experts who provide their perspectives and expertise.2IBM Endpoint Manager: Configuration Guide
Access Service Management Connect at Endpoint eloperworks/wikis/home?lang it#/wiki/Tivoli%20Endpoint%20Manager. Use Service Management Connect to:v Become involved with transparent development, an ongoing, open engagementbetween other users and IBM developers of Tivoli products. You can access earlydesigns, sprint demonstrations, product roadmaps, and prerelease code.v Connect one-on-one with the experts to collaborate and network about Tivoliand the (enter your community name here) community.v Read blogs to benefit from the expertise and experience of others.v Use wikis and forums to collaborate with the broader user community.Terms used in this guideThe following terms are all IBM Endpoint Manager terms, but are used throughoutthe guide without being labeled every time with IBM Endpoint Manager:Agent means a computer where the IBM Endpoint Manager client is installedConsolemeans IBM Endpoint Manager consoleClient means IBM Endpoint Manager clientServer means IBM Endpoint Manager serverRelay means IBM Endpoint Manager relayIn addition, you might see which components labeled with "BigFix" or "BigFixEnterprise Suite" (BES), which is legacy terminology, now superseded by "IBMEndpoint Manager."Chapter 1. Introduction3
4IBM Endpoint Manager: Configuration Guide
Chapter 2. Additional configuration stepsThese topics explain additional configuration steps that you can run in yourenvironment.Managing operators and permissionsThere are three basic classes of users and each of them has different responsibilitiesand restrictions.Site AdministratorInstalls and maintains the software, including the IBM Endpoint ManagerServer, Console, and Client programs. The site administrator cannot createoperators. The site administrator has administrative access to the Servercomputer as well as access and the password to the site-level signing keys.For more information, see “Site administrator responsibilities.”Master OperatorsHave access to all IBM Endpoint Manager computers and the authority tocreate and manage the other console operators. Any master operator cancreate, distribute, and revoke publisher keys and management rights thatallow console operators to deploy actions. For more information, see“Operators permissions” on page 6.OperatorsManage the day-to-day operations of IBM Endpoint Manager, includingFixlet management and action deployment, typically on a subset ofcomputers subject to the management rights assigned by the masteroperator. For more information, see “Operators permissions” on page 6.Often these administrative roles overlap and one person might be assignedmultiple tasks. The network and database tasks are limited to minimal setupprocedures, which are described in this document.Note: When you define an operator, ensure that the user name does not containany of the following characters: :, @, and \.Site administrator responsibilitiesThe site administrator has the following primary responsibilities:Obtaining and securing the Action Site CredentialsTo install IBM Endpoint Manager, the site administrator must generate aprivate key, receive a license certificate from IBM, and create a mastheadwith the digital signature and configuration information. This is a specialkey and must be used only for site-level tasks such as:v Setting global system optionsv Editing Mastheadsv Administering Distributed Server Architecture (DSA)For day-to-day console operations, the site administrator must create amaster operator key. Copyright IBM Corp. 2010, 20145
Preparing the ServerThe IBM Endpoint Manager Server must be correctly set up tocommunicate externally with the Internet and internally with the Clients.The Server also needs to be configured to host the IBM Endpoint Managerdatabase (or another computer can be used as the SQL Server database).Installing the various componentsThe site administrator installs the IBM Endpoint Manager Client, Server,Relay, and Console modules.Maintaining the ServerThe IBM Endpoint Manager server runs an SQL Server database andseveral specific services. Standard maintenance tasks such as upgrades orfixes are managed using Fixlet technology or can be performed manuallyby the site administrator.Operators permissionsThe master operator creates other operators and assigns permissions to them fromthe IBM Endpoint Manager console. The authorizations associated to an operatorare set in the Permissions area of the Details tab of the operator’s description.This table associates the activities that an operator can perform with the type ofoperator:Table 1. Master operator and operator authorizations6ActivitiesMaster OperatorOperatorInitialize Action SiteYesNoManage Fixlet SitesYesNoChange Client heartbeatsYesNoCreate FixletsIf Custom Content is set toYESIf Custom Content is set toYESCreate TasksIf Custom Content is set toYESIf Custom Content is set toYESCreate AnalysesIf Custom Content is set toYESIf Custom Content is set toYESCreate BaselinesIf Custom Content is set toYESIf Custom Content is set toYESCreate GroupsYesManual Groups OnlyActivate/DeactivateAnalysesAllAdministeredTake Fixlet/Task/BaselineActionAllAdministeredIBM Endpoint Manager: Configuration Guide
Table 1. Master operator and operator authorizations (continued)ActivitiesMaster OperatorOperatorTake Custom ActionIf Custom Content is set toYESIf Custom Content is set toYESStop/Start ActionsAllAdministeredManage AdministrativeRightsYesNoManage Global RetrievedPropertiesYesNoView FixletsAllAdministeredView TasksAllAdministeredView AnalysesAllAdministeredView ComputersAllAdministeredView BaselinesAllAdministeredView Computer GroupsAllAdministeredView Unmanaged AssetsAdministeredAdministeredView ActionsAllAdministeredMake CommentsAllAdministeredView CommentsAllAdministeredGlobally Hide/UnhideYesNoLocally Hide/UnhideYesYesUse WizardsIf Custom Content is set toYESIf Custom Content is set toYESRemove computer fromdatabaseAllAdministeredCreate Manual ComputerGroupsYesYesDelete Manual ComputerGroupsYesNoCreate Automatic ComputerGroupsYesIf Custom Content is set toYESDelete Automatic Computer YesGroupsIf Custom Content is set toYES and AdministeredCreate Custom SiteYesNoModify Custom SiteOwnersYesNoModify Custom SiteReaders/WritersYesSite OwnersAdministered: The operator must own or have permissions.Requires Custom Authoring: Granted by the site administrator through the console.Operators and analysesOperators have various rights and restrictions when activating and deactivatinganalyses:Chapter 2. Additional configuration steps7
v Ordinary operators cannot deactivate an analysis activated by other operators oncomputers they administer.v Master Operators cannot directly activate custom analyses authored by ordinaryoperators. They can, however, make a copy of an analysis and activate the copy.Adding console operatorsThe master operator can add operators at any time by launching Start Programs IBM Endpoint Manager IBM Endpoint Manager Console.These are the types of operators that can be created:v Local operator (local IBM Endpoint Manager account). For information abouthow to add local operators, see the IBM Endpoint Manager Console Operator’sguide.v LDAP operator (operator whose credentials are authenticated via ActiveDirectory or LDAP). For information about how to add LDAP operators, see theIBM Endpoint Manager Console Operator’s guide.v LDAP Group to a role. For information about how to assign a LDAP group toan existing role, see the IBM Endpoint Manager Console Operator’s guide.Note: For LDAP operator and LDAP Group, you must first add an ActiveDirectory or LDAP domain to IBM Endpoint Manager.For information about additional operations that can be run against operators, seethe IBM Endpoint Manager Console Operator’s guide.Integrating Linux Server with Active DirectoryTo ensure a secure communication between Linux Endpoint Manager server andActive Directory, use the Kerberos protocol.This protocol is available in the Linux Endpoint Manager server package because itis a prerequisite of the Endpoint Manager server installation.To integrate the Linux Endpoint Manager server with the Windows ActiveDirectory domain using LDAP with Kerberos authentication, perform the followingsteps:1. Ensure that the host names and the time service are set correctly in both theLinux Endpoint Manager server and the Active Directory server2. Install the NSS and PAM libraries3. Configure the Kerberos LDAP security and authentication4. Modify the local LDAP name5. Configure the NSS and PAM librariesPreliminary ChecksBefore running the integration between the Endpoint Manager server running on aRed Hat Enterprise Linux 6 or Linux 7 system and the Active Directory server,ensure that:v The DNS host names of both the Red Hat Enterprise Linux 6 or Linux 7 systemand the Active Directory server are resolved correctly, by performing thefollowing steps on the Red Hat Enterprise Linux 6 system:1. Open the file /etc/host and ensure that both DNS host names are specifiedas fully qualified domain names.8IBM Endpoint Manager: Configuration Guide
2. Open the file /etc/sysconfig/network and ensure that the host name of theRed Hat Enterprise Linux 6 or Linux 7 system is specified as fully qualifieddomain name.v The time between the Active Directory and the Linux Endpoint Manager serveris synchronized. If needed, you can synchronize the time service on the Red HatEnterprise Linux 6 or Linux 7 system and the Active Directory server with thetime source server, by performing the following steps:1. In the file /etc/ntp.conf on the Red Hat Enterprise Linux 6 or Linux 7system, replace the following lines:server hostnamewith:server time source server namewhere time source server name is the server hostname or IP address of thetime source server used to synchronize the time.2. When DNS lookups are not reliable, configure the Red Hat Enterprise Linuxsystems to perform DNS lookups from the Active Directory server by editingthe /etc/resolv.conf file as follows:domain my.domain.comsearch my.domain.comnameserver1 ipaddress1nameserver2 ipaddress23. Activate the change on the Red Hat Enterprise Linux 6 or Linux 7 system by:– Stopping the ntp daemon:service ntpd stop– Updating the time:ntpdate Red Hat server IP– Starting the ntp daemon:service ntpd start4. Synchronize the Active Directory server with the time source server byentering:w32tm /config /manualpeerlist:"time source server name"/syncfromflags:manual /updatewhere time source server name specifies the list of DNS names or IP addressesfor the NTP time source with which the Linux server synchronizes. Forexample, you can specify time.windows.com as the NTP time server. Whenyou specify multiple peers, use a space as the delimiter and enclose thenames of the peers in quotation marks.5. On the Active Directory server, run the following command to ensure thatthe time is synchronized with the time source serverw32tm /query /status find "Source"w32tm /query /status find "source"6. On the Red Hat Enterprise Linux 6 system configure the ntpd daemon tostart at system boot:chkconfig ntpd onInstalling the NSS and PAM librariesEnsure that the following NSS and PAM packages are installed:nss-pam-ldapd-0.7.5-18.2.el6 4.x86 64.rpmpam krb5-2.3.11-9.el6.x86 64.rpmChapter 2. Additional configuration steps9
Note: If you have a valid RHN subscription, run yum as shown in the followingexample:yum install nss-pam-ldapd.x86 64 pam krb5.x86 64Configuring AuthenticationTo configure the Kerberos protocol, the LDAP security and the authentication filesfor Active Directory integration, you can use one of the following methods:v system-config-authentication graphical toolv authconfig command-line toolUsing the system-config-authentication graphical tool:To configure the authentication with the system-config-authentication tool, performthe following steps:1. Run the system-config-authentication graphical tool to define LDAP as theuser account database for user authentication.2. In Identity & Authentication, from the User Account Database drop-down list,select LDAP. Selecting the LDAP option allows the system to be configured toconnect to the Windows Active Directory domain using LDAP with Kerberosauthentication.10IBM Endpoint Manager: Configuration Guide
3. In LDAP Search Base DN specify to retrieve the user information using thelisted Distinguished Name (DN), such as dc tem,dc test,dc com.4. In LDAP Server specify the address of the LDAP server such asldap://winserver.tem.test.com5. In Authentication Method select Kerberos password.Chapter 2. Additional configuration steps11
6. Configures the realm for the Kerberos server in Realm, such as TEM.TEST.COM.Ensure you enter the Realm name in uppercase.7. Specify the Key Distribution Center (KDC) in KDCs for issuing Kerberos tickets,for example, winserver.tem.test.com8. Specify the administration servers running kadmind in the Admin Servers, suchas winserver.tem.test.com9. Click Apply.For more information about how to use this tool, see Launching the AuthenticationConfiguration Tool UI.Using the authconfig command-line tool:To update all of the configuration files and services required for systemauthentication, you can run the authconfig command-line tool, as shown in thefollowing example:authconfig --enableldap --ldapserver ldap://winserver.tem.test.com:389--ldapbasedn "dc tem,dc test,dc com" --enablekrb5--krb5realm TEM.TEST.COM --krb5kdc winserver.tem.test.com:88--krb5adminserver winserver.tem.test.com:749 --updatewhere:--enableldapSpecifies to configure to connect the system with the Windows ActiveDirectory domain using LDAP with Kerberos authentication.--ldapserverSpecifies the address of the LDAP server such as ldap://winserver.tem.test.com--ldapbasednSpecifies to retrieve the user information using the listed DistinguishedName (DN), such as dc tem,dc test,dc com--enablekrb5Enables the Kerberos password authentication method.--krb5realmConfigures the realm for the Kerberos server, such as TEM.TEST.COM. Ensureyou specify the realm name in uppercase.--krb5kdcSpecifies the Key Distribution Center (KDC) for issuing Kerberos tickets,such as winserver.tem.test.com.--krb5adminserverSpecifies the administration servers running kadmind, such aswinserver.tem.test.com.--updateApplies all the configuration settings.For more information about how to use this command, see ConfiguringAuthentication from the Command Line.Modifying the local LDAP nameTo modify the local LDAP name, perform the following steps:1. Make a backup copy of the LDAP configuration file as follows:12IBM Endpoint Manager: Configuration Guide
cp -p /etc/nslcd.conf /etc/nslcd.conf.bk2. Modify the value of the base and uri settings in the /etc/nslcd.conf file as inthe following example:base dc tem,dc test,dc comuri ldap://winserver.tem.test.com3. Restart the local LDAP name service daemon:service nslcd restart4. Ensure that the local LDAP name service daemon (nslcd) is set to start with theserver:chkconfig nslcd onConfiguring the NSS and PAM librariesTo use the LDAP database to authenticate users on a Linux system edit the/etc/nsswitch.conf and change passwd, shadow and group entries from the SSSDdaemon (sss) to LDAP:passwd:shadow:group:files sssfiles sssfiles sssto LDAP (ldap):passwd:shadow:group:files ldapfiles ldapfiles ldapTo configure the PAM libraries, edit the /etc/pam.d/system-auth and/etc/pam.d/password-auth files and add the pam krb5.so library entries:auth.account.password.sessionsufficientpam krb5.so use first pass[default bad success ok user unknown ignore] pam krb5.sosufficientpam krb5.so use authtokoptionalpam krb5.soNote: Remove the entries for the SSSD libraries (pam sss.so).For additional information on RedHat integration see Integrating Red HatEnterprise Linux 6 with Active Directory.Using multiple servers (DSA)Additional servers help to distribute the workload and create a redundant systemthat is hardened to outages. Knowing how it accomplishes this can help you tocreate the most efficient deployment for your particular network. Here are some ofthe important elements of multiple server installations:v Servers communicate on a regular schedule to replicate their data. You reviewthe current status and adjust the replication interval through IBM EndpointManager Administration Tool Replication.v When each server is ready to replicate from the other servers in the deployment,it calculates the shortest path to every other server in the deployment. Primarylinks are assigned a length of 1, secondary links 100, and tertiary links 10,000.Links that resulted in a connection failure the last time they were used areconsidered to be non-connected.Chapter 2. Additional configuration steps13
v When an outage or other problem causes a network split, it is possible for acustom Fixlet or a retrieved property to be modified independently on bothsides of the split. When the network is reconnected, precedence goes to theversion on the server with the lowest Server ID.v If multiple copies of Web Reports are installed, they operate independently.Each Web Report server can connect to the server that is most convenient,because they all contain equivalent views of the database.v By default, server 0 (zero) is the master server. The IBM Endpoint ManagerAdministration Tool only allows you to perform certain administrative tasks(such as creating and deleting users) when connected to the master server.v Depending on the platform where you installed the server, you can switch themaster to another server as it is explained in “Managing Replication (DSA) onWindows systems” on page 17 or “Managing Replication (DSA) on Linuxsystems” on page 17.Disaster Server Architecture (DSA)The following diagram shows a typical DSA setup with two servers. Each Server isbehind a firewall, possibly in a separate office, although it is easy to set upmultiple servers in a single office as well. The servers must have high-speedconnections to replicate the IBM Endpoint Manager data (generally LAN speedsfrom 10 to 100Mbps are required). The IBM Endpoint Manager serverscommunicate over ODBC and HTTP protocols.In case of a failover, the specific configured relays automatically find the backupserver and reconnect the network. For more information about the relayconfiguration see “Configuring relay failover” on page 15.14IBM Endpoint Manager: Configuration Guide
Configuring relay failoverIf an Endpoint Manager server goes down, whether due to disaster or plannedmaintenance, the DSA server might be used to find a new server connection. Whenthe disabled server comes back online, its data will automatically be merged withthe data on the healthy server.In order for the failover process to successfully occur set the DSA server as thesecondary relay in client settings using RelayServer2 for the top-level relays (orvia the console Computer right-click settings user interface). When a failure on theprimary IBM Endpoint Manager server occurs and lower level IBM EndpointManager relays are unable to report, they use the secondary IBM EndpointManager relay value during normal relay selection process to find and report tothe secondary IBM Endpoint Manager server.Note: The setting BESClient RelaySelect ResistFailureIntervalSecondsspecified on the client system can have an impact on failover timing. Its value canrange from 0 seconds to 6 hours and it defines how many seconds the clientignores reporting failures before attempting to find another parent relay. Thedefault value is 10 minutes. In case of a failover configuration, ensure that, ifChapter 2. Additional configuration steps15
defined, BESClient RelaySelect ResistFailureIntervalSeconds is set to a lowvalue.Message Level Encryption and DSAIf Message Level Encryption is enabled and clients are set using Task: BES ClientSetting: Encrypted Reports, move the Endpoint Manager server encryption key tothe secondary Endpoint Manager DSA server. This enables the Endpoint ManagerDSA server to process reports from encrypted Endpoint Manager clients duringnormal operations or in the event of an outage on the primary Endpoint Managerserver.Copy the encryption key (.pvk) from the Endpoint Manager server directory:v Windows 32-bit server: C:\Program Files\BigFix Enterprise\BESServer\Encryption Keys\v Windows 64-bit server: C:\Program Files (x86)\BigFix Enterprise\BESServer\Encryption Keys\v Linux server: /var/opt/BESServer/Encryption Keysto the DSA secondary server.16IBM Endpoint Manager: Configuration Guide
Managing Replication (DSA) on Windows systemsReplication servers are simple to set up and require minimal maintenance. Youmight want to change the interval or allocate your servers differently. Most ofthese changes are done through the IBM Endpoint Manager Administration Tool.Here you can see the current settings for your servers and make the appropriatechanges.Changing the replication interval on Windows systemsOn Windows systems if you have multiple servers in your deployment, you canschedule when each one replicates. The default is five minutes, but you canshorten the time for greater recoverability or increase it to limit network a
The following terms ar e all IBM Endpoint Manager terms, but ar e used thr oughout the guide without being labeled every time with IBM Endpoint Manager: Agent means a computer wher e the IBM Endpoint Manager client is installed Console means IBM Endpoint Manager console Client means IBM Endpoint Manager client Server means IBM Endpoint Manager .
