Troubleshooting UNIX/Linux agent discovery in Operations Manager 2012

Select the type of issue you are experiencing below.

In this situation you will typically receive an error similar to the following:

The WinRM client cannot complete the operation within the time specified. Check if the machine name is valid and is reachable over the network and firewall exception for Windows Remote Management service is enabled. 

Most likely causes include the following:

• The host is unreachable due to incorrect name resolution, network outage or host outage.
• A network or host-based firewall is blocking TCP port 1270 connectivity to the target host. 

Select the type of certificate issue you are experiencing below.

When certificate verification fails you will typically get an error similar to the following:

Agent verification failed. Error detail: The server certificate on the destination computer (lx1.contoso.com:1270) has the following errors:The SSL certificate could not be checked for revocation. The server used to check for revocation might be unreachable.The SSL certificate contains a common name (CN) that does not match the hostname.

subject= /DC=name/DC=newdomain/CN=newhostname/CN=newhostname.newdomain.nameissuer= /DC=name/DC=newdomain/CN=newhostname/CN=newhostname.newdomain.namenotBefore=Mar 25 05:21:18 2008 GMTnotAfter=Mar 20 05:21:18 2029 GMT

You can also change the hostname and domain name on the certificate by using the –h and –d switches, as in the following example:

/opt/microsoft/scx/bin/tools/scxsslconfig -f -h <hostname> -d <domain.name>

Once complete, restart the agent by running the following command:

/opt/microsoft/scx/bin/tools/scxadmin -restart

If you would rather add an entry to the hosts file, if the FQDN is not in Reverse DNS you can add an entry to the hosts file located on the management server to provide name resolution. The hosts file is located in the \Windows\System32\Drivers\etc folder. An entry in the hosts file is a combination of the IP address and the FQDN. For example, to add an entry for the host named “newhostname.newdomain.name” with an IP address of 192.168.1.1, add the following to the end of the hosts file:

192.168.1.1 newhostname.newdomain.name

Another common cause of this error is that the certificate has been signed by untrusted authority, such as when multiple Management Servers are members of the Resource Pool used for discovery but certificate trust has not been configured between the Management Servers. To verify this, confirm that all Management Servers in the Resource Pool used for Discovery trust each other server’s certificate.

More information on how to manage resource pools for UNIX and Linux computers can be found in the following TechNet document:

Managing Resource Pools for UNIX and Linux Computers

Your UNIX/Linux Agent Discovery issue is resolved.

It appears that we are unable to resolve your issue by using this guide. For more help resolving this issue please see our TechNet support forum or contact Microsoft Support.

When the certificate signing operation is not successful, it is usually caused by one of two problems:

The user account specified for discovery has insufficient privileges to perform file operations involved in signing. 

or

Sudo elevation privileges for the user account specified for discovery was not correctly configured.

Resolution:

Verify the user account by inspecting the StdErr output in the error details to identify the cause of the failure. 

Also verify the sudo privilege configuration for the account used for certificate signing.

Select the type of network name resolution issue you are experiencing below.

These issues typically fall into one of two categories:

1. Error Description: Failed to resolve IP address 192.168.25.25 to name
   This can occur when an IP address for the host was entered for discovery but the IP address is not resolvable to a name in DNS (reverse lookup)
   To resolve this issue, correct name resolution (DNS) configuration for the reverse lookup zone, ensuring that an IP address to name mapping exists for the affected host.
2. Error Description: Failed to resolve name server.contoso.com to IP address
   This can occur if an FQDN for the host was entered for discovery but the name is not resolvable to IP address in DNS (forward lookup)
   To resolve this issue, correct name resolution (DNS) configuration for forward lookup, ensuring that a host name to IP address mapping exists for the host.
   

In this situation you will typically receive an error similar to the following:

The provided hostname ServerName resolved to the IP address of 10.137.216.102. The hostname ServerName.contoso.com returned by reverse lookup of the IP address 192.168.x.x did not match the provided hostname. Verify the DNS configuration and try the request again. 

Select the error you are receiving below

Error Description:

Failed during SSH discovery. Exit code: -1073479162Standard Output:Standard Error:Exception Message:An exception (-1073479162) caused the SSH command to fail - No connection could be made because the target machine actively refused it. 

Possible Causes:

• The ssh daemon is not running on the target system.
• A network or host-based firewall is preventing ssh connections on TCP port 22.

Error Description:

Failed during SSH discovery. Exit code: -1073479118Standard Output:Standard Error:Exception Message:An exception (-1073479118) caused the SSH command to fail - Server sent disconnect message: type 2 (protocol error : Too many authentication failures for root) 

Possible Causes:

• The user account specified for discovery is not permitted to login via ssh.
• The user account specified for discovery was input with an invalid username or password

Error Description:

Failed during SSH discovery. Exit code: 1Standard Output: Sudo path: /usr/bin/Standard Error: sudo: sorry, you must have a tty to run sudoException Message: 

Cause:

Sudo elevation was selected in the user credential input, however the requiretty option was not disabled for the user in sudoers.

Error Description:

.[?1034hopsuser@lx1:~> su - root -c 'sh /tmp/scx-opsuser/GetOSVersion.sh; EC=$?; rm -rf/tmp/scx-opsuser;exit $EC'Password:exitsu: incorrect passwordopsuser@lx1:~> exitlogout

One common -2147221248 exception error you might see is below.

Failed during SSH discovery. Exit code: -2147221248Standard Output:Standard Error: Could not chdir to home directory /home/username: No such file or directory 

Another common -2147221248 exception error you might see is below:

Failed during SSH discovery. Exit code: -2147221248Standard Output:Standard Error: root's password:Exception Message:Operation timed out

Cause:

Sudo elevation was selected in the user credential input, however the user account specified for discovery is not correctly configured to use passwordless sudo elevation, or the required sudo elevation privileges were not granted for the user account used in discovery. 

Resolution:

Review sudo elevation configuration documentation and verify user configuration for sudo. Note that passwordless sudo must be configured.

Select the error you are receiving below

Possible causes of this error include:

1. The agent is installed, and the agent certificate has been signed, however the user credential provided for agent verification is invalid.
2. The user account specified for discovery was configured to authenticate with an SSH key, but the user credential provided for agent verification is invalid.
3. There is a permission problem or incorrect PAM configuration on the UNIX side.

Sep 3 14:49:07 server auth|security:debug /opt/microsoft/scx/bin/omiserver PAM: pam_authenticate: error Authentication failed. 

Possible causes of this issue include:

• The Discovery Type option was set to “Only computers with an installed agent and signed certificate” and the target host has the agent installed, however the target host certificate has not been signed. In order to use the WSMan-only discovery option “Only computers with an installed agent and signed certificate”, the agent must be installed and the certificate manually signed.
• The Discovery Type option was set to “Only computers with an installed agent and signed certificate” but the target host does not have the UNIX/Linux agent currently installed.
• The Discovery Type option was set to “Only computers with an installed agent and signed certificate” but the UNIX/Linux agent is not currently running.
• The Discovery Type option was set to “Only computers with an installed agent and signed certificate” but the target host is unreachable, a network or host-based firewall is preventing connectivity or the UNIX/Linux agent is currently down.

Please select your error

Error Description:

The task cannot be executed against the object(s) because the target of the task does not match any of the classes of the object. 

Cause:

In a System Center 2012 Operations Manager management group, this can occur if the UNIX/Linux management packs imported are Operations Manager 2007 R2 versions.

Resolution:

Import the System Center 2012 versions of the UNIX/Linux operating system management packs.

Error Description:

The agent is installed and the computer is already being monitored by Operations Manager. 

Cause:

The target host has already been discovered in this Management Group

Resolution:

No action is required. Agent upgrade or migration to an alternate resource pool can be performed from the UNIX/Linux Servers view in the Administration pane of the Operations Console.

Error Description:

Unable to enumerate Installable agent types. The associated resource pool may still be initializing. If you had selected a newly created resource pool, please wait a few minutes before using it. 

Causes:

• The Resource Pool used in discovery is not healthy (e.g. a majority of member servers are offline).
• The Resource Pool used in discovery was recently created and it has not yet fully initialized.

Error Description:

Failed to find a matching supported agent instance in the imported management packs.Import the Management Pack(s) for this platform in order to discover this computer. 

Possible Causes:

• The target host is running an unsupported operating system.
• The correct management pack for the target host’s operating system has not been imported.
• The correct management pack for the operating system has recently been imported but has not yet fully loaded.