2.5.2 For Hyper-V
When the virtual environment to be monitored is Hyper-V, PFM - RM for Virtual Machine uses WMI to collect performance data from the monitored host. If a WMI connection has not been set up, performance data cannot be collected. Therefore, you must set up WMI on the PFM - RM host and the monitored host.
- Organization of this subsection
(1) Setting up WMI connection
This subsection explains how to set up WMI connection.
The following are the settings for connecting WMI:
-
DCOM
You must set DCOM on both the PFM - RM host and the monitored host.
If you run the PFM - RM host in a cluster system, set DCOM at both the executing node and the standby node.
-
Firewall
Set a firewall on the monitored host, if necessary.
-
WMI namespace
Set a WMI namespace on the monitored host, if necessary.
When the above settings have been made, check that connection can be established from the PFM - RM host to the monitored host. For details about how to check the connection, see (2) Checking the WMI connection status.
- Note about setting up WMI connection:
-
Data cannot be collected if the startup type of the Windows Management Instrumentation service (service name: WinMgmt) that provides system management information for the OS of the monitored host is disabled.
(a) Environment settings required for connection
The following settings are required in order to set WMI:
-
User account settings
To use WMI, you must have accounts for the PFM - RM host and the monitored host.
-
Account for the PFM - RM host
To set up an account, specify the appropriate values for HostUserID, HostPassword, and HostDomain, as shown in Table 2-5. You specify this account when you set up an instance.
If you run PFM - RM for Virtual Machine in a cluster system, set up an account for the PFM - RM host in such a manner that the same user name and password can be used to log on to both the running system and the standby system.
If Hyper-V on a PFM - RM host is included in the target hosts to monitor their instances, specify a local account user in the instance settings.
For Windows Server 2008 R2, use the following user:
1. Built-in Administrator user
For Windows Server 2012 or later, use either of the following users:
1. Built-in Administrator user
2. Member of Performance Log Users or Performance Monitor Users group and Hyper-V Administrators group
Also, in a domain environment, specify the computer name of the PFM - RM host for HostDomain (it might be different from the host name in the hosts file or DNS system).
-
Account for the monitored host
To set up an account, specify the appropriate values for UserID, Password, and Domain, as shown in Table 2-8. You specify this account when you set up the monitoring target.
In Windows Server 2008 R2, The account to be used either following User.
For Domain account user :
1. Domain Administrator's user.
For Local account user :
1. Built-in Administrator's user.
2. Member of Administrators group#.
In Windows Server 2012 or later, The account to be used either following User.
For Domain account user :
1. Domain Administrator's user.
For Local account user :
1. Built-in Administrator's user.
2. Member of Administrators group#.
3. Member of Performance Log Users or Performance Monitor Users group and Hyper-V Administrators group.
If you monitor Hyper-V on a PFM - RM host, do not specify the account for the monitoring-target host (UserID, Password, and Domain).
- #
-
If used member of the administrators group(other than Built-in Administrator's account user), UAC restricts the permissions, causing the user to log on as a general user. As a result, performance information might not be acquired due to denial of access.
To prevent this, disable UAC or execute the following command on the monitoring target:
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f
To override the settings specified by the above command and restore the previous status, execute the following command:
reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v LocalAccountTokenFilterPolicy /f
-
-
WMI service settings
Set the monitored host's WMI service startup to a setting other than Disabled. If it is set to Disabled, performance data cannot be collected.
(b) Setting DCOM
This subsection describes how to set DCOM on the PFM - RM host and the monitored host.
-
Setting on the PFM - RM host
To set DCOM on the PFM - RM host:
-
In Windows, choose Start, and then Run.
-
Enter dcomcnfg.exe, and then click the OK button.
The Component Services window appears.
-
Click Component Services, then Computers to expand the tree.
-
Choose My Computer and then, from the right-click menu, choose Properties.
The My Computer Properties dialog box appears.
-
Choose the Default Properties tab, and then select Enable Distributed COM on this computer.
-
Click the OK button.
The My Computer Properties dialog box closes.
-
Restart the host.
This is necessary only when the Enable Distributed COM on this computer setting has been changed.
-
Setting on the monitored host
This subsection describes how to set DCOM on the monitored host.
To set DCOM on the monitored host:
-
In Windows, choose Start and then Run.
-
Enter dcomcnfg.exe, and then click the OK button.
The Component Services window appears.
-
Click Component Services, then Computers, to expand the tree.
-
Choose My Computer and then, from the right-click menu, choose Properties.
The My Computer Properties dialog box appears.
-
Choose the Default Properties tab, and then select Enable Distributed COM on this computer.
-
Select the COM Security tab and then, in Access Permissions, click the Edit Limits button.
The Access Permission dialog box appears.
Check if the user who connects to the monitored host or the group to which this user belongs is displayed in Group or user names.
If the user or its group is not displayed, click the Add button and add the user or the group.
-
In Group or user names, select the user that connects to the monitored host or the group to which this user belongs.
Check that the check box for Allow is selected for Remote Access. If this check box is cleared, select it.
-
Click the OK button.
The Access Permission dialog box closes.
-
Select the COM Security tab and then, in Launch and Activation Permissions, click the Edit Limits button.
The Launch and Activation Permission dialog box is displayed.
Check if the user who connects to the monitored host or the group to which this user belongs is displayed in Group or user names.
If the user or its group is not displayed, click the Add button and add the user or the group.
-
In Group or user names, select the user that connects to the monitored host or the group to which this user belongs.
Check that the check boxes for Allow are selected for Remote Launch and Remote Activation. If these check boxes are cleared, select them.
-
Click the OK button.
The Launch and Activation Permission dialog box closes and the My Computer Properties dialog box is displayed.
-
Click the OK button.
The My Computer Properties dialog box closes.
-
Restart the host.
This is necessary only when the Enable Distributed COM on this computer setting has been changed.
(c) Setting a firewall
If the Windows firewall is enabled, you must perform this setting. For details about how to check the firewall status, see (3) Checking the Windows firewall settings.
To set a firewall:
-
In Windows, choose Start and then Run.
-
Enter gpedit.msc, and then click the OK button.
The Local Group Policy Editor window is displayed.
-
Click Computer Configuration, Administrative Templates, Network, Network Connections, and Windows Firewall in this order to expand the tree.
-
Click Standard Profile# and then, in the right-hand pane, from the right-click menu of Windows Firewall: Allow inbound remote administration exception, choose Properties.
The Windows Firewall: Allow inbound remote administration exception Properties dialog box is displayed.
- #
-
If the host is a domain environment, click Domain Profile instead.
-
Choose the Setting tab, and then select Enabled.
-
Click the OK button.
The Windows Firewall: Allow inbound remote administration exception Properties dialog box closes.
(d) Setting a WMI namespace
To set a WMI namespace:
-
In Windows, choose Start and then Run.
-
Enter wmimgmt.msc, and then click the OK button.
The wmimgmt - [Console Root\WMI Control (Local)] window is displayed.
-
Choose WMI Control (Local) and then, from the right-click menu, choose Properties.
The WMI Control (Local) Properties dialog box is displayed.
-
On the Security page, click Root and then CIMV2, and then select CIMV2.
-
Click the Security button.
The Security for ROOT\CIMV2 dialog box is displayed.
Check if the user who connects to the monitored host or the group to which this user belongs is displayed in Group or user names. If the user or its group is not displayed, click the Add button and add the user or the group.
-
In Group or user names, select the user that connects to the monitored host or the group to which this user belongs.
Check if the check boxes for Allow are selected for Enable Account and Remote Enable. If these check boxes are cleared, select them.
-
Click the OK button.
The Security for ROOT\CIMV2 dialog box closes and the WMI Control (Local) Properties dialog box is displayed.
-
On the Security page, click Root and then Virtualization, and then select Virtualization.
-
Click the Security button.
The Security for ROOT\virtualization dialog box is displayed.
Check if the user who connects to the monitored host or the group to which this user belongs is displayed in Group or user names. If the user or its group is not displayed, click the Add button and add the user or the group.
-
In Group or user names, select the user that connects to the monitored host or the group to which this user belongs.
Check if the check boxes for Allow are selected for Enable Account and Remote Enable. If these check box are cleared, select them.
-
Click the OK button.
The Security for ROOT\virtualization dialog box closes and the WMI Control (Local) Properties dialog box is displayed.
-
On the Security page, click Root, virtualization, and V2, and then select V2. (In Windows Server 2012 R2 or later)
-
Click the Security button. (In Windows Server 2012 R2 or later)
The Security for ROOT\virtualization\v2 dialog box is displayed.
Check if the user who connects to the monitored host or the group to which this user belongs is displayed in Group or user names. If the user or its group is not displayed, click the Add button and add the user or the group.
-
In Group or user names, select the user that connects to the monitored host or the group to which this user belongs. (In Windows Server 2012 R2 or later)
Check if the check boxes for Allow are selected for Enable Account and Remote Enable. If these check boxes are cleared, select them.
-
Click the OK button. (In Windows Server 2012 R2 or later)
The Security for ROOT\virtualization\v2 dialog box closes and the WMI Control (Local) Properties dialog box is displayed.
-
Click the OK button.
The WMI Control (Local) Properties dialog box closes.
-
In the wmimgmt - [Console Root\WMI Control (Local)] window, from the File menu, choose Exit to close the window.
(2) Checking the WMI connection status
Use the wbemtest.exe Windows tool to check if the PFM - RM host is connected to the monitored host.
To check the WMI connection status (perform this procedure on the PFM - RM host):
-
At the command prompt, execute the following command:
runas /user:user-name wbemtest
If you specify a user who belongs to a domain, specify the user name in user-name@domain-name format.
The Windows Management Instrumentation Tester window appears.
Make sure that, for the user name, you specify the same value that is specified for HostUserID and HostDomain during setup of the instance environment. When the command prompts you to enter a password, specify the same value that is specified for HostPassword.
For details about HostUserID, HostDomain, and HostPassword, see Table 2-5.
-
Click the Connect button.
The Connect dialog box is displayed.
-
Enter appropriate information in Namespace, User, Password, and Authority.
The following explains the information to be entered:
-
Namespace
Enter \\monitored-host-name\root\cimv2 or \\monitored-host-name\root\virtualization. For monitored-host-name, specify the value that is set for Target_Host in the monitoring target settings.
-
User
Enter the user name used to log on to the monitored host. For this user name, specify the value set for UserID in the monitoring target settings.
-
Password
Enter the user's password. For the user password, specify the value set for Password in the monitoring target settings.
-
Authority
Enter ntlmdomain:monitored-host's-domain-name. If the monitored host is a work group, leave this item blank. For the domain name of the monitored host, specify the value set for Domain in the monitoring target settings.
The following shows an example:
For details about Target_Host, UserID, Password, and Domain, see Table 2-8.
-
-
Click the Connect button.
If connection is established successfully, the Connect dialog box closes and all the buttons in the Windows Management Instrumentation Tester dialog box are enabled.
If an error dialog box is displayed, check the settings on the basis of the displayed error number. The error numbers and their causes are listed below.
Note that if you change settings while the wbemtest.exe tool is running, an error might result when you retry connection establishment. If this happens, restart the tool and then retry establishing connection.
-
0x8001011c
DCOM has not been set up on the PFM - RM host.
-
0x80070005
Possible causes are as follows:
• DCOM has not been set up on the PFM - RM host.
• DCOM has not been set up on the monitored host.
• The user name, password, or domain name used to connect to the monitored host is invalid.
-
0x80041003
On the monitored host, Namespace has not been set for WMI.
-
0x80041008
The value specified in Authority does not begin with ntlmdomain:.
-
0x800706XX
Possible causes are as follows:
• The monitored host name is invalid.
• The monitored host is not running.
• A firewall has not been set up on the monitored host.
• The password for the user logging on to the monitored host has expired.
-
-
Click the Enum Instances button.
The Class Info dialog box is displayed.
-
In Enter superclass name, enter Win32_PerfRawData_PerfOS_System, and then click the OK button.
The Query Result dialog box is displayed.
Check if the list contains the entry Win32_PerfRawData_PerfOS_System=@. If it doesn't or an error dialog box is displayed, the user who connects to the monitored host may not have the permission to access.
Note that if you change settings while the wbemtest.exe tool is running, an error might result when you retry instance enumeration. If this happens, restart the tool and then check again.
- When the result is normal:
-
- When the result is an error:
-
(3) Checking the Windows firewall settings
Check if the Windows firewall is enabled or disabled.
In Windows, from the Start menu, choose Control Panel, and then Windows Firewall to display the Windows Firewall window. You can check the settings in this window.
The following figure shows an example in which the Windows firewall is disabled.