Table of Contents

Agent-Based Management

In this Topic

Background

Server Manager includes an agent-based solution to monitor and download logs from remote computers. Our agent-based solution solves several potential problems with existing built-in technologies. To understand the benefits we must first understand the technologies used to remotely manage Windows hosts. Event Logs are downloaded using a WMI whereas Text Logs require either Windows Shares, SFTP/SSH or FTP/S to download logs. Other monitors, such as Windows Certificates and Performance Counters, rely on other seemingly undocumented APIs.

  • In some Server Hardened environments, management services are not permitted to run as domain or local administrators.
  • In some Server Hardened environments, remote WMI and Performance Counters are not accessible.
  • Windows blocks discovery and remote management of the certificate store.
  • WMI is quite slow when transmitting Event Log entries and often throws what seems are random errors on a regular basis.
  • In rare cases, WMI corrupts itself requiring the WMI service to be restarted or repaired.
  • WMI requires multiple ports, one of which is randomly assigned. The randomly assigned port can be configured to use a fixed port, however, the fixed port must be configured on each client host.
  • Internet based servers cannot typically be managed.
  • Hosts that periodically connect to the local network (e.g. Law Enforcement laptops), can be difficult to manage on a polling schedule. The polling schedule must be fast enough to catch each managed laptop when they just so happen to be logged into the local network often generating unnecessary traffic as well as a high number of errors in the meantime.

Corner Bowl Software solves all of these issues with our Server-Side Server Agent and our remotely installed lightweight Agent while also downloading Event Log entries 12 times faster than WMI.

The Corner Bowl Server Manager Agent

Many of the Windows Templates include an Agent-Based Template flag. Once an Agent-Based Template is assigned to a remote host, Server Manager uses Windows Shares to upload the Agent installation file to the host then uses WMI to remote install onto the host. If Server Manager is unable to penetrate the firewall to upload and remote install, you have the option to manually install the Agent to the remote host. Once installed, by default, the Agent connects once a minute to get list of templates to execute. The connection frequency can be overridden. Once Templates and Filters are received, the Agent executes the Templates and applies the Filters. Finally, data is transmitted to the management server.

Information Important! The Agent requires the .Net 7 Runtime. Our installers automatically install the runtime when not already installed, however the installer needs Internet access. If Internet access is not available, please download and install the runtime from Microsoft.

Supported Templates

The following templates are currently supported:

How to configure the Agent Server

  • From the Explorer View, navigate to then select Agent Server. The Agent Server Properties View displays.
  • The Agent Server Properties View contains 2 tabs.

The Options Tab

  • From the Agent Server Properties View use the Enabled check box to enable or disable the Agent Server.
    Alert Once enabled, the server attempts to install the Agent to all configured hosts that have Agent-Based Templates assigned to them. If you do not want to automatically install the Agent to each host that has an Agent-Based Template assigned, you can either globally disable the Agent installer (below) or disable specific hosts via the Host Properties View. For more information see: Host Properties
  • Use the Add all new hosts check box to automatically add any agent host to the software when initially connecting.
  • Use the Host identification method drop-down to select how you would like connecting hosts to be identified.
    OptionDescription
    DNS LookupThe server uses DNS to resolve the hostname.
    DNS and FQDN LookupThe server uses DNS and Active Directory to resolve the Fully Qualified Domain Name (FQDN).
    Remote IP AddressThe server uses the IP address.
    Local HostnameThe agent sends its local hostname to server for identification.
    Local FQDNThe agent sends its locally resolved FQDN to server for identification.
    Local IP AddressThe agent sends its local IP address to server for identification.
  • Use the Agent installer enabled check box to use WMI and Windows Shares to automatically install the Agent Service to each host that has an Agent-Based Template assigned.
    Information Once installed, Server Manager automatically updates out-of-date agents. When an agent connects, if the agent is a lower version than the server, the agent automatically downloads the latest installer directly on the connected TCP/IP socket. Internet access is not required. Once downloaded, the agent automatically updates itself.
    Alert The Agent Server does not update agents running on Windows Server 2008 R2, Windows 8 and Windows 7. To use our agent on those operating systems, install the Corner Bowl Server Manager 2022 Agent.
  • Use the Agent connect schedule drop-down to select the schedule or frequency you want all of your Agents to connect. By default, the agent connects once a minute.
    Information
    • When a real-time schedule is assigned, agents re-connect every minute.
    • When a range schedule is assigned, agents re-connect at a random interval within the specified time range.
    Information To override this value for a host group or specific Windows Host, from the Explorer View, select the target host group or Windows Host, right click, then select Host Properties. The Host Properties View displays. From the General Tab, use the Agent connect schedule drop-down to override this value.
    Information To enable Real-Time Event Log Monitoring, from the Explorer View, select the target host group or Windows Host, right click, then select Host Properties. The Host Properties View displays. From the General Tab, set the Keep agent connected option, then use the Assignements View to assign a Real-Time Agent-Based Event Log Monitor Template.
    Agent Server Properties View
    Agent Server Properties View
  • Selecting the Assignments Tab reveals a blacklist as well as various lists of objects to automatically assign to the newly added devices. By default, all new hosts are added to a node called Agent Devices, however if you assign another group or set of groups to the Hosts Groups List, new hosts are only added to those groups.
    Information By default, the following sample templates are assigned to each host: Event Log Consolidation (Application, System) (Agent) and Event Log Consolidation (Security) (Agent) and Event Log File Backup (Agent) templates are assigned enabling Windows Application, Security and System Event Logs entries to be automatically saved to the centralized log database, and, for the defense industry, the raw EVTX files centrally saved to the management server.

How to automatically install the Agent on remote hosts

  • From the Explorer View, navigate to Agent Server then right click and select Properties. The Agent Server Properties View displays.
  • Check Enabled.
  • Click Save.
  • From the Explorer View, navigate to Templates | Sample Templates | Log Consolidation then right click on Agent-Based Event Log Consolidation and select Assign.
    Information You can assign any template that has been flagged as an Agent-Based Template. For more information see below.
    The Select Services, Devices and Endpoints View displays.
  • From the Select Services, Devices and Endpoints View, check each host you would like to install the Agent, then click OK.
  • Once assigned, Server Manager will attempt to remote install the Agent onto each assigned host.
Alert Firewalled and Air Gapped Installations: The Agent requires .Net 7 Runtime. The installer's bootstrapper checks, then automatically downloads the required framework from Microsoft. If remote managed hosts are firewalled or air gapped, you can instead download a version of the installer that includes .Net 7 within the installation's bootstrapper from Corner Bowl Software's' website. Once downloaded, place the file into the installation directory (e.g. c:\Program Files\Corner Bowl\Server Manager). Do not change the filename, it must be ServerManagerAgentDotNetInstaller.exe. When Server Manager detects the current major version of the agent has not yet been installed, this file is uploaded instead of the default lightweight agent only installer. There is no need to continually update this file because, once installed, the agent is automatically updated to the version running on the management server.

How to manually install the Agent on remote hosts

  • From the host you have installed Server Manager, copy the following file to each target host:
    C:\Program Files\Corner Bowl\Server Manager\ServerManagerAgentInstaller.exe
  • From each target host, open a command prompt as Administrator then run the executable with the following command line options:
    ParameterDescription
    HOSTThe fully qualified hostname of the host Server Manager is installed.
    PORTThe port to connect with. The default value is 21843
    TLSENABLEDtrue to enable TLS 1.2. Please note the server must be configured to use TLS. For more information see: Server Configuration
    TLSCERTIFICATEThe optional TLS client certificate to use for TLS 1.2.
    -qSilently run the installation.
    -norestartSuppress reboot.
    For Example:
    ServerManagerAgentInstaller.exe -q HOST=1.2.3.4 PORT=21843
Alert Firewalled and Air Gapped Installations: The Agent requires .Net 7 Runtime. The installer's bootstrapper checks, then automatically downloads the required framework from Microsoft. If remote managed hosts are firewalled or air gapped, you can instead download a version of the installer that includes .Net 7 within the installation's bootstrapper from Corner Bowl Software's' website. Once downloaded, use this version of the installer.

How to update the Agent configuration

Just like the Service, the Agent uses a JSON configuration file to load the parameters to connect to the server. Configuration is implemented through the tcpserver.json file located in the program data directory. The default location is:
C:\ProgramData\Corner Bowl\Server Manager Agent\tcpserver.json

Configuration File Reference

{
  "Host": "SERVERNAME",
  "Port": 21843,
  "IdleTimeout": 300,
  "ReceiveTimeout": 120,
  "SendTimeout": 120,
  "TlsConfiguration": {
    "Enabled": false,
    "Certificate": null,
    "RequireRemoteCertificate": false,
    "AllowSelfSignedCertificate": true,
    "CheckCertificateRevocation": false,
    "AllowCertificateChainErrors": true
  }
}

For more information see: Server Configuration

How to configure Agent-Based templates

  • Select File | New Template. The Select Template Type view displays.
  • Click the Template type to create. The Template Properties view displays.
  • Select the Agent Template Tab
  • Use the Enabled Check Box to flag the template as an Agent-Based Template.
  • Use the Trigger Check Box to trigger actions when assigned hosts do not connect within the configured time span.
  • Use the On Host Not Connecting Drop-Down to assign the actions to fire when assigned hosts do not connect within the configured time span.

Troubleshooting

If the Agent does not appear to be connecting or processing templates you can view the Agent's verbose output log for detailed information. The log file is located in the following directory on each remotely managed host:

C:\ProgramData\Corner Bowl\Server Manager Agent\agent.log

Related Topics

Adding Hosts

Assignments

Server Configuration