Installing a CA User Activity Reporting Module Server

Implementation Guide › Installing CA User Activity Reporting Module › Installing a CA User Activity Reporting Module Server

Installing a CA User Activity Reporting Module Server

The installation process involves the following steps:

Complete the CA User Activity Reporting Module server worksheet
Install the CA User Activity Reporting Module management server
Note: If using SAN storage, take precautions to avoid installing on a SAN drive.
Install one or more CA User Activity Reporting Module collection servers
(Optional) Install one or more reporting servers
Note: If you do not install a server dedicated to reporting, you can use the management server for this reporting server role.
(Optional) Install a restore point server
Verify the installation
View self-monitoring events

Important! Configure your storage disks in a RAID array before you begin the CA User Activity Reporting Module installation. Configure the first two disks as RAID 1 and make this array the bootable array. Configure the remaining disks as a single RAID 5 array. Failure to configure the RAID array could result in a loss of data.

As part of the overall security of the CA User Activity Reporting Module server itself, during installation the Grand Unified Boot-loader (GRUB) utility is password-protected.

More information:

Install with Disabled SAN Drives

Install with Enabled SAN Drives

CA User Activity Reporting Module Server Worksheet

Before you install a CA User Activity Reporting Module server, gather the information in the following table. After you complete the worksheet, you can use it as you work through the installation prompts. You can print and complete a separate worksheet for each CA User Activity Reporting Module server you plan to install.

CA User Activity Reporting Module Information	Value	Comments
OS Disk
Keyboard Type	appropriate value	Specify the keyboard type you want to use by its national language setting. The default value uses hardware settings for the keyboard you have connected to the server when it starts.
Time Zone Selection	your desired time zone	Select the time zone where this server resides.
Root Password	new root password	Create and confirm a new root password for this server.
Application Disk
New Hostname	hostname for this CA User Activity Reporting Module server For example: CA-ELM1	Specify the hostname for this server using only supported characters for hosts. Industry standards recommend A-Z (case-insensitive), 0-9, and hyphen, where the first character is a letter and the final character is alphanumeric. Do not use the underscore character in a host name. Note: Do not append a domain name to this host name value.
Select a device	device name	Select the name of the network adapter to use for event log collections and communications. Press the space bar to enter the configuration for the device.
IP Address, Subnet Mask, and Default Gateway	relevant IP values	Enter a valid IP address for this server. Enter a valid subnet mask and default gateway for use with this server.
Domain name	your domain name	Enter the fully-qualified domain name in which this server operates, for example, mycompany.com. Note: The domain name must be registered with the Domain Name Server (DNS) server in your network to enable resolution of the hostname to IP address.
List of DNS servers	relevant IPv4 or IPv6 addresses	Enter one or more DNS server IP addresses in use in your network. The list is comma-separated with no spaces between entries. If your DNS servers use IPv6 addressing, enter these addresses in that format.
System Date and Time	local date and time	Enter a new system date and time if needed.
Update Time through NTP?	Yes (recommended) or No	Indicate whether you want to configure the CA User Activity Reporting Module server to update its date and time from an established Network Time Protocol (NTP) server. Note: Time synchronization helps ensure alerts contain complete data.
NTP Server Name or Address	relevant hostname or IP address	Enter the host name or the valid IP address of the NTP server from which this CA User Activity Reporting Module server gets date and time information.
Sun Java JDK EULA	Yes	Read through the license agreement, paging down until you reach the question, Do you agree to the above license terms? [yes or no].
CA EULA	Yes	Read through the license agreement, paging down until you reach the question, Do you agree to the above license terms? [yes or no].
Local or Remote CA Embedded Entitlements Manager server?	Local - for the first installed server (management server) Remote - for each additional server	Indicate whether you plan to use a local or a remote CA EEM server. For a management CA User Activity Reporting Module server, choose Local. The installation prompts you to create a password for the default EiamAdmin user account. For each additional server, choose Remote. The installation prompts you for the management server name. Regardless of whether you chose local or remote, you must use the EiamAdmin account ID and password to log into each CA User Activity Reporting Module server the first time.
Enter name of the CA EEM server	IP address or hostname	This prompt displays only if you select Remote for the Local or Remote server prompt. Enter the IP address or host name of the management CA User Activity Reporting Module server that you installed first. The host name must be registered with the DNS Server.
CA EEM Server Admin password	EiamAdmin account password	Record the password for the default administrator account, EiamAdmin. Your CA User Activity Reporting Module server requires these account credentials for the initial login. If you are installing the management server, you are creating and confirming a new EiamAdmin password here. Make a note of this password as you will use it again during the installations of other CA User Activity Reporting Module servers and agents. Note: The password you enter here is also the initial password for the default caelmadmin account that you will use to access the CA User Activity Reporting Module server directly through ssh. You can create additional administrator accounts to access the CA EEM functions after installation, if desired.
Application Instance Name	CAELM	When you install the first CA User Activity Reporting Module server in your network, you create an application instance value in this prompt. Subsequent CA User Activity Reporting Module servers use this value to register with the management server. The default application instance name is CAELM. You can use any name for this value. Make a note of the application instance name for use with later CA User Activity Reporting Module installations.
Do you want to run CAELM Server in FIPS Mode?	yes or no	Your response to this prompt determines whether the CA User Activity Reporting Module server will start up in FIPS mode. Note: If you are adding a server to an existing CA User Activity Reporting Module deployment, the CA User Activity Reporting Module management server or remote CA EEM server must also be in FIPS mode. Otherwise the new server cannot register and you will have to reinstall the new server again.

Note: The install provides you with a chance to review and to change the CA EEM server details before it attempts connection.

If the installation program is unable to connect with the management server you specify, and you decide to continue the installation, you can register the CA User Activity Reporting Module server with the embedded CA EEM functionality manually. If this happens, you must also import the content, CEG, and agent management files manually.

More information:

Acquire Certificates from CA EEM Server

Import CA User Activity Reporting Module Reports

Import CA User Activity Reporting Module Data Mapping Files

Import Common Event Grammar Files

Import Common Agent Management Files

Install CA User Activity Reporting Module

Use this procedure to install a CA User Activity Reporting Module server.

To install the CA User Activity Reporting Module software

Boot the server with the OS installation DVD.
The operating system installation starts automatically.
Respond to the prompts using the information you gathered in the CA User Activity Reporting Module server worksheet.
Declining the license agreement stops the installation and shuts down the server.
Respond to the reboot prompt by first removing the media and then clicking Reboot.
Insert the CA User Activity Reporting Module Application disk when prompted and press Enter.
Respond to the prompts using the information you gathered in the work sheet.
The installation continues. When you see the message, "CA User Activity Reporting Module installation succeeded." the installation is complete.

Note: When you install a second or subsequent CA User Activity Reporting Module server, you may notice an error message in the installation log saying the application name that the installation attempted to register with the CA EEM server already exists. You can safely ignore this error, as each CA User Activity Reporting Module installation attempts to create the application name as if it was new.

After the installation is complete, you must configure your CA User Activity Reporting Module server before you can receive events. This may include configuring a connector on the default agent to receive syslog events.

More information

Installation Troubleshooting

Configuring the Default Agent

Verify that the iGateway Process is Running

If you are unable to access the CA User Activity Reporting Module server's web interface after installation, and you are sure that the network interface ports are correctly configured, it may be that the igateway process is not running.

You can perform a quick check of the iGateway process status using this procedure. The iGateway process must be running for the CA User Activity Reporting Module server to collect events and for the user interface to be accessible.

To verify the iGateway daemon

Access a command prompt on the CA User Activity Reporting Module server.
Log in with the caelmadmin account credentials.
Switch users to the root account with the following command:
```
su - root
```
Use the following command to verify that the iGateway process is running:
```
ps -ef | grep igateway
```
The operating system returns the iGateway process information and a list of processes running under iGateway.

More information:

Resolve Network Interface Configuration Error

Start the iGateway Daemon or Service

The iGateway daemon or service is the process that handles all calls to the user interface for both CA EEM and CA User Activity Reporting Module. The process must be running for you to access either application. Use this procedure to start the iGateway process if it is not running.

Note: If you are unable to start iGateway, ensure the "/" folder has available disk space. Lack of disk space can prevent you from successfully starting iGateway.

To start the iGateway daemon or service

Log in as the caelmadmin user for the CA User Activity Reporting Module server.
Switch users to the root account with the following command:
```
su -
```
Start the igateway process with the following command:
```
$IGW_LOC/S99igateway start
```
S99igateway is the start-up script for the igateway process and is owned by the root account. When the igateway process starts, it runs under the caelmservice user account.

Stop the iGateway Daemon or Service

To stop the iGateway daemon or service

Log in as the caelmadmin user for the CA User Activity Reporting Module server.
Switch users to the root account with the following command:
```
su -
```
Stop the igateway process with the following command:
```
$IGW_LOC/S99igateway stop
```
S99igateway is the shut down script for the igateway process and is owned by the root account. When the igateway process starts, it runs under the caelmservice user account.

Start the CA User Activity Reporting Module Agent Daemon or Service

To start the CA ELM Agent daemon or service

Access a command prompt and enter the following command:

Linux, UNIX, Solaris:  /opt/CA/ELMAgent/bin/S99elmagent start

Windows:  net start ca-elmagent

Stop the CA User Activity Reporting Module Agent Daemon or Service

The CA User Activity Reporting Module agent daemon or service is the process that manages connectors which send collected events to a CA User Activity Reporting Module server. The process must be running for connectors to be able to collect events. Use this procedure to stop the CA User Activity Reporting Module agent process. Normally, start and stop commands are issued from within the Agent Explorer on any CA User Activity Reporting Module server. You might use this command in preparation to restart an agent process and all of its connectors.

To stop the CA ELM Agent daemon or service

Access a command prompt and enter the following command:

Linux, UNIX, Solaris:  /opt/CA/ELMAgent/bin/S99elmagent stop

Windows:  net stop ca-elmagent

Verify the CA User Activity Reporting Module Server Installation

You can verify the CA User Activity Reporting Module server installation using a web browser. You can perform an initial verification of the installation by logging into the CA User Activity Reporting Module server.

Note: When you log into the CA User Activity Reporting Module application for the first time, you must use the EiamAdmin user credentials with which you installed the CA User Activity Reporting Module server. After you log in with this user account, you can only see and use specific user and access management functions. You must then configure your user store and create a new CA User Activity Reporting Module user account to access the other CA User Activity Reporting Module functionality.

To verify the CA User Activity Reporting Module server

Open a web browser and enter the following URL:
```
https://<server_IP_address>:5250/spin/calm
```
The CA User Activity Reporting Module login screen appears.
Log in as the EiamAdmin administrative user.
The Administration tab's User and Access Management subtab appears. You can consider the installation successful if you are able to log into the CA User Activity Reporting Module server.

Note: You must configure one or more event source services before you can receive event data and view reports.

View Self-Monitoring Events

You can use self-monitoring events to verify that CA User Activity Reporting Module server is installed properly. While you have some configuration tasks to complete before CA User Activity Reporting Module can collect and report on event log data from around your network, you can see self-monitoring events generated by the CA User Activity Reporting Module server right away.

Logging into the CA User Activity Reporting Module server is the first and best test of a successful installation. Self-monitoring events are another way to check on the status of the CA User Activity Reporting Module server. There are a number of self-monitoring event types available. Use this procedure to see additional event data from events generated by the CA User Activity Reporting Module server itself.

To view self-monitoring events

Log into the CA User Activity Reporting Module server.
Access the Reports tab.
Click the System tag and select the report, Self Monitoring Events Detail.
The self-monitoring events report loads.
Verify that the self-monitoring events for your login and other preliminary configuration actions are present in the report.