Installing the SL1 Agent

This section describes how to install, upgrade, and uninstall SL1 Agents for Windows, Linux, AIX, and Solaris operating systems. All agent installations, upgrades, and uninstallations require command-line interface access to the targeted device.

If you use the SL1 Extended Architecture (which includes Compute Nodes, Storage Nodes, and a Management node), install the agent from the Agents page (Devices > Agent). For details, see Installing an Agent from the Agents Page.
With on-premises SL1 Extended Architecture systems, the TLS handshake can fail between the Windows Agent on a monitored device and the SL1 streamer service. For details and the workaround, see the following Knowledge Base article: Extended Architecture.
If you use the SL1 Distributed Architecture (where the SL1 Agent collects and transfers data to a Message Collector), install the agent from the Device Manager page (Devices > Device Manager). For details, see Installing an Agent from the Device Manager Page.
If you are using PhoneHome Message Collectors in a Distributed Architecture, see Configuring an SL1 Agent to Work with PhoneHome Collectors before you install the agent.

Use the following menu options to navigate the SL1 user interface:

To view a pop-out list of menu options, click the menu icon ().
To view a page containing all of the menu options, click the Advanced menu icon ().

Installing an Agent from the Agents Page

When running SL1 on the SL1 Extended Architecture, you can use the Agents page (Devices > Agents) to help you install the SL1 agent on a Linux, Windows, AIX, or Solaris device.

You can also upgrade and delete agents from SL1 on the Agents page.

You can filter the items on this inventory page by typing filter text or selecting filter options in one or more of the filters found above the columns on the page. For more information, see Filtering Inventory Pages.

The Agents page appears as an option on the Devices menu only when you are using the SL1 Extended Architecture. If your version of SL1 does not have an Agents page, see Installing an Agent from the Device Manager Page.

If you are using an SL1 system with the SL1 Extended Architecture, you must use the Agents page (Devices > Agents) to install agents, including AIX and Solaris agents. AIX and Solaris agents are not available for non-SL1 Extended systems.

If you want to remotely install one or more agents, see Remotely Installing an SL1 Agent.

You do not install the agent from the Agents page itself. Instead, the Agents page enables you to gather the information or files you need to then install the agent on a particular device.

The instructions on the relevant tab of the Agents page also include command line parameters such as URLFRONT, which is used to define the Streamer service you are using as part of the SL1 Extended Architecture.

If the agent installation is successful, one of the following automatically happens:

If the primary IP address of the device is not currently monitored by SL1, then SL1 creates a device record for the device and populates the device record with data provided by the agent. The device record is assigned a device class based on data reported by the agent.
If the primary IP address of the device is currently monitored by SL1, the device record for the existing device is updated with data provided by the agent.

During initial discovery, the agent returns operating system type and version information to SL1. Based on this information, SL1 assigns the corresponding device classes to a device monitored only by an agent. If a device is monitored by an agent and via SNMP, the device class assigned by SNMP discovery will take precedence.

Installing a Linux Agent

For a Linux system, the Agents page provides version-specific commands that you will need to run on the Linux system you want to monitor. This page includes commands for the following operating systems:

Ubuntu and Debian (64-bit)
Red Hat and CentOS (64-bit)
Red Hat and CentOS - OS Libs (64-bit)

The Linux agent installation program checks for the relevant version of libcurl before installing the agent. If libcurl is not installed, the agent installation program installs the most recent version of libcurl.

SL1 supports the use of proxy server connections when using the agent on Linux systems. For more information about installing and configuring a Linux agent with a proxy server, see Configuring the Linux Agent to Use a Proxy.

Beginning with Linux Agent version 184, by default the agent will install and run as a dedicated non-root user with the user name "scilog". To run the Linux agent as root, use the installation command which includes RUN_AS_ROOT=1. This configuration has the following limitations:

Process data is only Non-Intercepted Process Data (NIPD). There are no intercepts or library data.
Polled Data only works for the current user.
Log files can only be monitored if they are readable by the scilog user or scilog group.
You cannot upgrade the agent from the SL1 user interface because the installation and uninstallation processes require root privileges.

If you are installing on SELinux, see Using Agents with SELinux.

To install a Linux agent:

On the Agents page (Devices > Agents), click New Agent. The Agent Installation page appears:

Click the Linux tab at top left.
From the Select an Organization drop-down list, select an organization for the device on which you are installing the agent. The TENANT value in the commands on this page is updated with the SL1 Organization ID for the organization you selected.

The URLFRONT value is the URL for the Streamer service you are using as part of the SL1 Extended Architecture.
Based on the version of Linux running on the device you want to monitor, run the relevant commands from the Linux tab on the Linux device (the "target server"). After the commands complete, the Linux agent starts running in the background. The device on which you installed the agent appears on the Agents page (Devices > Agents), and the device is also added to the list of devices on the Devices page.

You can also install the Linux agent via the command line.

To install the Linux agent (Debian or Ubuntu) using the command line, execute the following command:

sudo TENANT=<organization id> URLFRONT=<streamer_URL> dpkg -i sl_agent.rpm

TENANT and URLFRONT are required.
The RUN_AS state can be set via command line with RUN_AS_ROOT=<0|1>.
The default RUN_AS state is "scilog" when there is no command line RUN_AS_ROOT=X parameter given.

To install the Linux agent (RHEL or CentOS) using the command line, execute the following command:

sudo TENANT=<organization_id> URLFRONT=<streamer_URL> rpm -ivh sl_agent.rpm

TENANT and URLFRONT are required.
The RUN_AS state can be set via command line with RUN_AS_ROOT=<0|1>.
The default RUN_AS state is "scilog" when there is no command line RUN_AS_ROOT=X parameter given.

Using Agents with SELinux

The Linux agent supports running in SELinux for CentOS or Red Hat in both permissive and enforcing modes. The RPM installer for Linux will detect if SELinux is active (permissive/enforcing) upon installation. The agent automatically creates and installs an appropriate SELinux policy for use with the agent daemon.

With the Linux Agent, a shared library gets injected into other processes. For non-root processes, this shared library should not generate any errors or audit logs. However, for root processes, this shared library might generate some additional audit logs where some of the shared library functionality is restricted by SELinux. If this is the case, you can update the agent configuration to exclude pre-loading into these root processes.

Installing an AIX Agent

Beginning with AIX agent version 184, by default the agent will install and run as a dedicated non-root system user named "scilog". To run the AIX agent as root, use the installation command which includes RUN_AS_ROOT=1.

For an AIX system, the Agents page provides a set of commands that you will need to run on the AIX system you want to monitor.

The AIX agent is a Beta feature.

To download and install an AIX agent:

On the Agents page (Devices > Agents), click New Agent. The Agent Installation page appears.
Click the AIX tab:
From the Select an Organization drop-down list, select an organization for the device on which you are installing the agent. The Tenant value in the commands on this page is updated with the SL1 Organization ID for the organization you selected.
The URLFront value is the URL for the Streamer service you are using as part of the SL1 Extended Architecture.
Run the relevant commands from the AIX tab on the AIX device (the "target server"). After the commands complete, the AIX agent starts running in the background. The device on which you installed the agent appears on the Agents page (Devices > Agents), and the device is also added to the list of devices on the Devices page.

You can also install the AIX agent via the command line.

To install the AIX agent using the command line, execute the following command:

sudo TENANT=<organization_id> URLFRONT=<streamer_URL> rpm -ivh sl_agent_aix.rpm

TENANT and URLFRONT are required.
The RUN_AS state can be set via command line with RUN_AS_ROOT=<0|1>.
The default RUN_AS state is "scilog" when there is no command line RUN_AS_ROOT=X parameter given.

Installing a Solaris Agent

Beginning with Solaris agent version 184, by defaul the agent will install and run as a dedicated non-root system user named "scilog". To run the Solaris agent as root, add the file /etc/scilog/run_state.txt containing RUN_AS_ROOT=1.

For a Solaris system, the Agents page provides version-specific commands that will need to run on the Solaris system you want to monitor. This page includes commands for the following versions:

Solaris 11 - SPARC
Solaris 11 - x86_64
Solaris 10 - SPARC
Solaris 10 - x86_64

The Solaris agent is a Beta feature.

To download and install a Solaris agent:

On the Agents page (Devices > Agents), click the New Agent button. The Agent Installation page appears.

Click the Solaris tab:
From the Select an Organization drop-down list, select an organization for the device on which you are installing the agent. The Tenant value in the commands on this page is updated with the SL1 Organization ID for the organization you selected.
The URLFront value is the URL for the Streamer service you are using as part of the SL1 Extended Architecture.
Based on the version of Solaris running on the device you want to monitor, run the relevant commands from the Solaris tab on the Solaris device (the "target server"). After the commands complete, the Solaris agent starts running in the background. The device on which you installed the agent appears on the Agents page (Devices > Agents), and the device is also added to the list of devices on the Devices page.

You can also install the Solaris agent via the command line.

To install the Solaris agent using the command line, execute the following commands:

mkdir -p /etc/scilog && printf "<configuration>\nTenant <organization_id> \nURLFront <streamer_URL>\n<configuration>\n" > scilog.conf && sudo cp scilog.conf /etc/scilog && rm scilog.conf

sudo pkgadd -d silo-agent.pkg

The file /etc/scilog/scilog.conf with fields TENANT and URLFRONT are required. Note that "<configuration>" is a valid component of the file content and not meant to be substituted with any company or organizational value.
The RUN_AS state can be set by adding file /etc/scilog/run_state.txt with RUN_AS_ROOT=<0|1>.
The default RUN_AS state is "scilog" when a /etc/scilog/run_state.txt file doesn't exist.

Installing a Windows Agent

For a Windows system, the Agents page provides an executable file (.exe) that you will need to run on the Windows system you want to monitor.

ScienceLogic provides an executable (.exe) installer called SiloAgent-install.exe. You will need to install and run the SiloAgent-install.exe file on the Windows system you want to monitor.

ScienceLogic also provides an MSI (.msi) installer upon request. The .exe installer is essentially a wrapper around the .msi file that allows for additional checks before installation, unwraps and runs the .msi file, prints information to the terminal, and provides information about failed installations. ScienceLogic recommends you use the .exe installer except for special cases. You can ask your ScienceLogic contact for an .msi file, if needed.

SL1 supports the use of proxy server connections when using the SL1 agent on Windows systems. For more information about installing and configuring a Windows agent with a proxy server, see Configuring the Windows Agent to Use a Proxy.

To download and install a Windows agent in SL1:

On the Agents page (Devices > Agents), click New Agent. The Agent Installation page appears.
Click the Windows tab at top left:
From the Select an Organization drop-down list, select an organization for the new agent. The Tenant value in the command on this page is updated with the SL1 Organization ID for the organization you selected.
Click Download Agent. An Opening SiloAgent-install.exe dialog appears.
Save the SiloAgent-install .exe file for installing the agent.
Copy the SiloAgent-install file you downloaded to the Windows system on which you want to run the agent. To do so, you can either go to the console of the Windows system or use a utility like WinSCP.
To install the agent, use Windows PowerShell as an Administrator to run the command on the Windows system (the command is listed in step 2 on the Windows tab on the Agents page):
.\SiloAgent-install.exe tenant=<organization_id> urlfront=<streamer_URL> RUN_AS_LOCAL_SYSTEM=1
or
.\SiloAgent-install.exe tenant=<organization_id> urlfront=<streamer_URL> USER=<user> PASSWORD=<password>
where <organization_id> is Organization ID for the organization you selected in step 3, and <streamer_URL> is the URL for the Streamer service you are using as part of the SL1 Extended Architecture.
For example:
.\SiloAgent-install.exe tenant=1 urlfront=streamer2020.int.sciencelogic.com RUN_AS_LOCAL_SYSTEM=1
RUN_AS_LOCAL_SYSTEM=1 indicates the agent service will run with administrator privileges. USER and PASSWORD designate a dedicated user to run the service. See Configuring the Windows Agent for more information.
When the agent installation completes, the PowerShell window displays "info: install complete", and the Windows agent starts running in the background. The device on which you installed the agent appears on the Agents page (Devices > Agents), and the device is also added to the list of devices on the Devices page.
To verify that the installation was successful, open the Windows Task Manager or enter the TASKLIST command to view running processes. The SiloAgent process will be running on the Windows machine.

When you upgrade to a newer version of the Windows agent, the installer upgrades the agent without generating a new CollectorID. The previous version's configuration file is passed to the upgraded version of the agent. The upgraded Windows agent continues to upload data to the same device record in SL1.

Configuring the Windows Agent Using the Command Line

The Windows agent can be configured with two command-line modes, RUN_AS_LOCAL_SYSTEM and RUN_AS_USER. You should choose which command line configuration your device needs. Prior to the Windows agent version 145, the agent was configured with user permissions equal to an administrator user when the agent ran under the Local System user account. For version 145 and later, you can specify any user account as the Windows agent runner. For security purposes, when a non-administrator user account is designated, the agent will have the same permissions and rights as that user account.

Configuring the Windows Agent to Run as Local System

Configuring the Windows agent service to run as a Local System with administrator privileges requires that you include RUN_AS_LOCAL_SYSTEM=1 in your installation command. This configuration is simple, allows the agent to collect many types of data from your device, and guarantees that Dynamic Applications(e.g. PowerShell collections through the agent) execute without issue.

Configuring the Windows Agent to Run as a Dedicated User

Configuring Windows agent service to run as a dedicated user account requires that you specify RUN_AS_USER=1 on the install or upgrade command to indicate that the agent should run as a specific user account. Using this mode allows you to have precise control over the agent permissions and an improved ability to audit agent actions. Before installing the Windows agent:

Create a Windows user account (local user on the device or domain user) that will be used to run the SiloAgent Service.
Grant the user the exact permissions required to run the agent. Some permissions may be granted as part of the installation command but you may also configure the use before installation.

Using RUN_AS_USER=1 requires additional command-line options that must be configured properly for the agent to collect data and execute actions.

Include USER=<user> in your installation command (required):
- USER. Defines the user that will run the agent service when using RUN_AS_USER=1. USER may be a username, which indicates a local user account, or it may be in the doman\username form. USER is required for the agent to successfully install with RUN_AS_USER=1. It is not necessary to specify USER during an upgrade except to modify the property.
Include PASSWORD=<password> or PROMPT_FOR_PASSWORD=1. One or the other is required:
- PASSWORD. Defines the password associated with USER. The password is required to set the USER as the agent's service runner and to add domain accounts to groups.PASSWORD, or PROMPT_FOR_PASSWORD is required if RUN_AS_USER=1 is designated. It is not necessary to specify PASSWORD during an upgrade except to modify the property.
- PROMPT_FOR_PASSWORD. This property is only available if using the .exe installer. Use PROMPT_FOR_PASSWORD=1 on the command line instead of PASSWORD so that the .exe installer will prompt for a password before starting the installation. The value entered takes the place of PASSWORD. This option can be used to avoid entering plaintext passwords into the command line.

There are additional command line options in your installation command that grant permissions to the account specified by USER.You may want to grant permissions to the USER before the installation for the most control. There are a few permissions that are essential to the agent's central functions and you have the option to grant these during installation.

LOG_ON_AS_A_SERVICE. User accounts require the "Log on as a service" user right to run services. LOG_ON_AS_A_SERVICE=1 grants this permission to the user. The agent installation may succeed, but the agent service will fail to start if the USERdoes not have this right.

The "Log on as a service" user right is required to run the the SiloAgent service as a dedicated user. You must either use the LOG_ON_AS_A_SERVICE=1 option, or manually grant the user this right.

DEBUG_PROGRAMS. To view the process details of processes owned by other users, a user account must have the required "Debug programs" user right. DEBUG_PROGRAMS=1 grants this right to USER. Without this permission, only processes owned by USER can be monitored.
PERFORMANCE_MONITOR_USERS. PERFORMANCE_MONITOR_USERS=1 adds the USER to the Windows group "Performance Monitor Users" which enables the agent to read Windows Performance Counters such as CPU utilization, memory utilization, and disk utilization. This permission is required for the Microsoft Windows PowerShell dynamic applications to work correctly and allows the Windows Management Instrumentation (WMI) queries to execute properly.
PERFORMANCE_LOG_USERS. PERFORMANCE_LOG_USERS=1 adds the USER to the Windows group "Performance Log Users" which enables the agent to monitor application events through log monitoring and allows local WMI queries to execute properly.
EVENT_LOG_READERS. EVENT_LOG_READERS=1 adds the USER to the Windows group "Event Log Readers" and enables the agent to monitor application events through Log Monitoring.

If neither mode is specified in a new install, the agent will default to RUN_AS_USER=1. If neither mode is specified during an upgrade, the agent will default to the mode already designated. Therefore, any agent running on version 144 and earlier will upgrade to RUN_AS_LOCAL_SYSTEMif not specified in the command line.

Example Install Commands:

When installing the agent for the first time on a device running as Local System:

SiloAgent-install.exe TENANT=0 URLFRONT=10.1.1.2 RUN_AS_LOCAL_SYSTEM=1

Tenant and URLFront values must be specified.
- TENANT. Corresponds to Organization ID in SL1. TENANT is required for agent installation. The Windows agent will continue to use the same Tenant value during an upgrade.
- URLFRONT. The URL or IP for the streamer service. URLFRONT is required for Agent Installation. The Windows agent will continue to use the same URLFront value during an upgrade.
RUN_AS_LOCAL_SYSTEM=1 must be specified.

When installing the agent for the first time on a device running as a dedicated user named "scilogrunner" (local account on the device) with a password "qwerty".

SiloAgent-install.exe TENANT=0 URLFRONT=10.1.1.2 RUN_AS_USER=1 USER=scilogrunner PASSWORD=qwerty

When installing the agent for the first time on a device running as a dedicated user named "MYDOMAIN\scilogrunner" (domain account) on "MYDOMAIN" with password "qwerty".

SiloAgent-install.exe TENANT=0 URLFRONT=10.1.1.2 RUN_AS_USER=1 USER=MYDOMAIN\scilogrunner PASSWORD=qwerty

When installing the agent for the first time on a device running as a dedicated local user named "scilogrunner" with the password "qwerty", and granting the suer the "Log on as a service" user right, the "Debug programs" user right and adding the user to the "Performance Monitor Users" group.

SiloAgent-install.exe TENANT=0 URLFRONT=10.1.1.2 RUN_AS_USER=1 USER=scilogrunner PASSWORD=qwerty LOG_ON_AS_A_SERVICE=1 DEBUG_PROGRAMS=1 PERFORMANCE_MONITOR_USERS=1

Grant the user the "Log on as a service" and "Debug programs" user rights.
Add to the Performance Monitor Users group.

Example Upgrade Commands:

When you upgrade the agent installation:

To upgrade an existing agent installation currently running as Local System, you are not required to specify any properties. The properties configured in the previous version are stored and the new version of the agent will continue to run as Local System, using the same Tenant and URLFront.

SiloAgent-install.exe

To upgrade an existing agent installation currently running as a dedicated user, you are not required to specify any properties. The upgraded agent stores the preferences from the previous version. The new version of the agent will continue to run as USER with the same Tenant and URLFront.

SiloAgent-install.exe

To change from a current agent installation running as Local System to a dedicated user during an upgrade, you are not required to provide Tenant and URLFront, but the RUN_AS_USER=1 and USER and PASSWORD must be specified. Once specified, the new version of agent will run as USER.

SiloAgent-install.exe RUN_AS_USER=1 USER=scilogrunner PASSWORD=qwerty

To change from a current agent installation running dedicated user to Local System during an upgrade, you are not required to provide Tenant and URLFront, but RUN_AS_LOCAL_SYSTEM=1 must be specified.

SiloAgent-install.exe RUN_AS_LOCAL_SYSTEM=1

To change the USER and PASSWORD of an existing agent installation, use the same installer and specify the new USER and PASSWORD.

SiloAgent-install.exe USER=scilogrunner_new PASSWORD=different_password

Troubleshooting the Windows Installation Agent

If you experience issues during the installation process, review the example scenarios below.

When an installation fails, a SiloAgent_install_log.txt file is generated in the current directory. If you need to contact ScienceLogic Support, please have that file when you contact them.

The agent installation fails when attempting to install with RUN_AS_USER=1

Specify a user account that already exists on the computer or domain.
Ensure that either PASSWORD=[password] or PROMPT_FOR_PASSWORD=1 is specified.
Ensure that the USER and PASSWORD provided are valid.
Ensure that all property names are spelled correctly.

The agent installation succeeds, but the SiloAgent service does not start. If USER and PASSWORD are valid, but USER does not have the"Log on as a service" user right, the installation will succeed but will not start. In this situation, you have two choices:

manually grant USER the "Log on as a service" user right and then start the service
re-run the installation or upgrade command with LOG_ON_AS_A_SERVICE=1

Please ensure that your USER account or containing groups do not have the "Deny log on as a service" user right. This right supersedes the "Log on as a service" right and will prevent the agent service from starting.

Additional Considerations

Beyond installation errors, there may be other service-related concerns you could experience.

The Upgrade button present on the SL1 agent page sends a simple upgrade command to the Windows agent. The upgraded agent will have the same run-as mode as the previous version. There is currently no way to change USER which runs the agent service from the current SL1 user interface. The upgrade must be done from the command line.
For upgrades from the SL1 user interface to be successful, the USER must be in the administrator group because administrator access is required for the agent to upgrade itself (i.e. initiating installation of new software). Otherwise, the upgrade must be conducted by an administrator via the command line.
Other USER permissions should be limited (e.g. "Deny log on locally" or "Deny Access to this computer from the network").
Exercise caution when adding the USER to the administrator group as you are passing administrator credentials during the installation.
The USER must have read access to any directories where log file monitoring will occur or the log file monitoring will fail.
The USER must have any permissions required to execute PowerShell commands or commands passed by Dynamic Applications or those commands will fail.
Additional permissions or configuration may be required for other Dynamic Applications which execute scripts through the agent, such as PowerShell Performance and PowerShell Configuration Dynamic Applications. For example, the Microsoft: SQL Server PowerPack applications will not operate correctly unless the USER is granted permissions to the SQL server instance and databases.

Configuring an SL1 Agent to Use a Proxy Server Connection

The following section covers how you can configure a proxy server connection when using an agent on Linux or Windows systems.

Configuring a Linux Agent to Use a Proxy

To configure the Linux agent to use a proxy server connection:

Create a configuration file named scilog_proxy.conf and add the following proxy information to the new file:
Proxy-Server
Proxy-Port
Proxy-Username
Proxy-Password
For example:
Proxy-Server 10.1.1.1
Proxy-Port 8080
Proxy-Username admin1
Proxy-Password passw0rd
The agent requires at least the proxy server and proxy port information. If no authentication is required, leave the username and password commented out with a "#". If values are present for the username and password, the agent will try to use them. The agent currently supports Basic Authentication.
Add the new file to the /etc/scilog directory on the SL1 server. This directory is also where the scilog.conf file resides.
If the scilog_proxy.conf file exists, the agent will try to connect to a proxy. If you do not need a proxy, remove or rename this file to prevent the agent from accessing it. Alternatively, you can leave the parameters blank in the scilog_proxy.conf file.

Installing and Configuring with the Proxy Settings

You can set the proxy parameters at install time by including them as parameters for the install command, just as you do with the Tenant and URLFront values. Use the package name for the package being installed.

For example:

deb

sudo TENANT=0 URLFRONT=10.1.1.2 proxyserver=10.2.1.1 proxyport=3128 proxyusername=1 proxypassword=1 dpkg -i sl_agent_v173.15.deb

rpm

sudo TENANT=0 URLFRONT=10.1.1.2 proxyserver=10.2.1.1 proxyport=3128 proxyusername=1 proxypassword=1 rpm -ivh sl_agent_v173.16.rpm

aix

sudo TENANT=0 URLFRONT=10.1.1.2 proxyserver=10.2.1.1 proxyport=3128 proxyusername=1 proxypassword=1 rpm -Uvh scilogd-0.173.17-0.aix7.2.noarch.rpm

If no proxy is used, you can remove the proxy parameters in the install command. Similarly, if a proxy is used without credentials, remove the proxyusername and proxypassword parameters in the install command, and only include the proxyserver and proxyport parameters .

Also note that the Tenant and URLFront values can now be passed on the install command for AIX.

Configuring a Windows Agent to Use a Proxy

To configure the Windows agent to use a proxy server connection:

Create a configuration file named scilog_proxy.conf and add the following proxy information to the new file:
Proxy-Server
Proxy-Port
Proxy-Username
Proxy-Password
For example:
Proxy-Server 10.1.1.1
Proxy-Port 8080
Proxy-Username admin1
Proxy-Password passw0rd
The agent requires at least the proxy server and proxy port information. If no authentication is required, leave the username and password values blank. If values are present for the username and password, the agent will try to use them. The agent currently supports Basic Authentication. The agent will discover the type of supported authentication, so there is no need to specify it in the configuration file.
Add the new file to the C:\Program Files\ScienceLogic\SiloAgent\conf directory on the SL1 server. This directory is also where the scilog.conf file resides.
If the scilog_proxy.conf file exists, the agent will try to connect to a proxy. If you do not need a proxy, remove or rename this file to prevent the agent from accessing it. Alternatively, you can leave the parameters blank in the scilog_proxy.conf file. If you use the .msi installer, you can input the parameters in the dialog box for the installer.

When configuring a proxy password with the above procedure, SL1 encodes the proxy password in the scilog_proxy.conf file. The password displays as a seemingly random string of characters.

You can manually edit the scilog_proxy.conf file, you can manually enter the proxy password. The agent will still work with a proxy password in plain text. The agent will detect if the setup script encoded the password; otherwise, it assumes the password is in plain text.

Installing and Configuring an Agent with the Proxy Settings

You can set the proxy parameters at install time by including them as parameters for the install command, just as you do with the Tenant and URLFront values.

For example:

.\SiloAgent-install.exe Tenant=0 URLFront=10.1.1.2 proxyserver=10.2.1.1 proxyport=3128 proxyusername=1 proxypassword=1

If no parameters are passed to SiloAgent-install.exe, including Tenant and URLFront, a pop-up dialog will appear where you can enter these values. If you do not require proxy credentials, you can leave those values blank.

Upgrading an Agent

When you have the latest version of the SL1 agent, a check mark icon () appears in the Newest Version column for that agent. If you do no have the latest version of the agent, an Upgrade button appears in the Newest Version column on the Agents page.

To upgrade to the latest version of an agent:

On the Agents page (Devices > Agents), locate the agent you want to upgrade:
Click the Upgrade button for that agent. The agent starts the upgrade process, which might take up to a minute to complete.
Click the Refresh button in your browser to ensure that a check mark icon () appears in the Newest Version column for that agent.

It is not possible to configure the service USER when upgrading through the SL1 user interface as the agent will continue using the service that USER already uses.

It is also possible to upgrade the agent from device command line.

To upgrade from the Windows command line:

Open the command line as an administrator and run the new .exe installer. It is not necessary to specify Tenant or URLFront values during an upgrade as those parameters carry over.
Change or configure any properties described in Installing a Windows Agent directly in the upgrade command line.

To upgrade with Linux :

Debian or Ubuntu

sudo dpkg -i sl_agent.deb

The RUN_AS state can be changed via the command line with RUN_AS_ROOT=1 or by updating the file /etc/scilog/run_state.txt with the same information.
- The command line option will always take precedence.
- The default RUN_AS state is "root" when no command line RUN_AS_ROOT=X parameter is given and there is no /etc/scilog/run_state.txt file.

RHEL or CentOS

sudo rpm -U sl_agent.rpm

The RUN_AS state can be changed via the command line with RUN_AS_ROOT=1 or by updating the file /etc/scilog/run_state.txt with the same information.
- The command line option will always take precedence.
- The default RUN_AS state is "root" when no command line RUN_AS_ROOT=X parameter is given and there is no /etc/scilog/run_state.txt file.

To upgrade with AIX:

sudo rpm -U sl_agent_aix.rpm

The RUN_AS state can be changed via the command line with RUN_AS_ROOT=1 or by updating the file /etc/scilog/run_state.txt with the same information.
- The command line option will always take precedence.
- The default RUN_AS state is "root" when no command line RUN_AS_ROOT=X parameter is given and there is no /etc/scilog/run_state.txt file.

To upgrade with Solaris:

sudo pkgadd -a /usr/share/overwrite.conf -d sl_agent.pkg scilogd

The RUN_AS state can be set by adding the file /etc/scilog/run_state.txt with RUN_AS_ROOT=<0|1>.
The default RUN_AS state is "root" when no /etc/scilog/run_state.txt file exists.

Upgrades of the same version can be used to change the RUN_AS state.

Stopping an Agent

You can use the "delete" option on the Agents page to stop an agent from running. When you delete an agent, SL1 stops the agent from running on the device, deletes the data gathered by that agent, and removes that agent from the Agents page.

Using the "delete" option for an agent does not actually remove the agent from the device. As a best practice, use the delete process to delete the data gathered by the agent (the uninstallation process does not delete this data), and then uninstall that agent, if needed. For uninstallation details, see Uninstalling an Agent. Also, ScienceLogic recommends that you delete the device that had the agent installed on it, or at least remove the agent-related Dynamic Applications, to prevent SL1 from attempting to use the data the agent gathered from that device.

To delete an agent and its data:

On the Agents page (Devices > Agents), locate the agent you want to delete.
Click the Actions button () for that agent and select Delete. SL1 stops the agent from collecting data.

You can also delete an agent from SL1 using the Device Manager page in the classic user interface. Click the checkbox for the device with the agent and select Delete Selected Devices from the Select Action menu at the bottom of the page.

You can also stop an agent through the command line.

To stop an agent on a Linux system (Debian, Ubuntu, RHEL, or CentOS), execute the following command:

sudo service scilogd stop

To stop an agent on an AIX system, execute the following command:

sudo /etc/rd.d/init.d/scilogd stop

To stop an agent on a Solaris system, execute the following command:

sudo svcadm disable scilogd

Uninstalling an Agent

When you uninstall an agent, you remove that agent completely from SL1, but you do not lose the data collected by that agent.

Uninstalling a Linux Agent

To uninstall an agent on a Linux system:

Log in to the Linux system via the console or SSH as a user that has sudo administrator permissions.
For Red Hat, CentOS, and Oracle, execute the following command:
sudo rpm –e scilogd
For Debian and Ubuntu, execute the following command:
sudo dpkg -r scilogd
Optionally, you can remove the agent configuration directory from the Linux system. The configuration directory can be found at:
/etc/scilog (rm -rf /etc/scilog)

Uninstalling an AIX Agent

To uninstall an agent on an AIX system:

Log in to the AIX system via the console or SSH as a user that has sudo administrator permissions.
To determine which package version is currently running, execute the following command:
sudo rpm –ga|grep -i scilogd
To determine which package version is running from a previous command, execute the following command:
sudo rpm –e
Optionally, you can remove the agent configuration directory from the Linux system. The configuration directory can be found at:
/etc/scilog (rm -rf /etc/scilog)

Uninstalling a Solaris Agent

To uninstall an agent on a Solaris system:

Log in to the Solaris system via the console or SSH as a user that has sudo administrator permissions.
To uninstall the agent, execute the following command:
sudo pkgrm scilogd
Optionally, you can remove the agent configuration directory from the Linux system. The configuration directory can be found at:
/etc/scilog (rm -rf /etc/scilog)

Uninstalling a Windows Agent

To uninstall an agent on a Windows system:

On the Windows system, open the Control Panel.
Go to the Programs and Features page (Control Panel > Programs > Uninstall a program).
Select the SiloAgent program from the list, and then click Uninstall.

Installing an Agent from the Device Manager Page

If you are using a distributed SL1 system without the SL1 Extended Architecture (which includes Compute Nodes, Storage Nodes, and a Management Node), you must use the Agent Installation page to install the agent. You can access the Agent Installation page from the Device Manager page.

TCP port 443 must be open between the Message Collector and the device on which an agent is installed.

If you are not using the SL1 Extended Architecture, the Agents page (Devices > Agents) will not be available in the SL1 user interface.

To install an agent from the Device Manager page, you first need to gather installation information from the Agent Installation page:

For a Linux system, the Agent Installation page provides commands that must be executed on that system.
For a Windows system, the Agent Installation page provides an executable file to run on the Windows system.

To gather the necessary commands and executable files to install an agent on a device:

Go to the Device Manager page (Device > Device Manager in the SL1 user interface, or Registry > Devices > Device Manager in the classic user interface).

Click Actions and select Download/Install Agent. The Agent Installation page appears:

Complete the following fields:

Select an OS. Select the operating system running on the device on which you want to install the agent.

NOTE: If you require a FIPS-compliant version of the SL1 agent, select RedHat/CentOS 64-bit (OS Libs).

Select an Organization. Select an organization from the list of possible organizations. The list of organizations is dependent on your user account. If the agent discovers a new device, that device will be associated with the organization you select here.

If you are installing an agent on a device that has already been discovered, you must select the organization that is already aligned with the existing device.

Select a Message Collector. Select the Message Collector to which the agent will send its collected data.

If you selected a Linux operating system in the Select an OS field, the Agent Installation page displays a list of commands to execute on the Linux system. Copy the commands for use during the installation on the Linux device.
If you selected a Windows operating system in the Select an OS field, the Agent Installation page displays a Download Windows Agent link. Click the link and save the executable file for use during the installation on the Windows device.

If you are installing an agent on multiple devices that run the same operating system, are part of the same organization, and connect to the same Message Collector, you can re-use the same commands or executable file on each of those devices.

Installing an Agent on a Linux System

To install an agent on a Linux system:

Copy and execute the appropriate commands from the Agent Installation page to download and install the agent. For more information, see Installing a Linux agent for details about install commands.

NOTE: SL1 supports the use of proxy server connections when using the SL1 agent on Linux systems. To do so, open a command window on the target server and first configure curl to use a proxy server using the CURLOPT_PROXY option, and then to use a username and password combination for that proxy server using the CURLOPT_PROXYUSERPWD option.

Upgrading an Agent on a Linux System

To upgrade the agent on a Linux system:

When using the classic SL1 user interface, agents must be upgraded from the device command line. For more information, see Upgrading an Agent.

Installing an Agent on a Windows System

To install an agent on a Windows system:

Copy the SiloAgent-install.exe file you downloaded from the Agent Installation page to the Windows system.
Execute the appropriate command copied from the Agent Installation page to install the agent. For more details about install commands see Installing a Windows Agent.

SL1 supports the use of proxy server connections when using the SL1 agent on Windows systems. In Windows 10, go to Settings > Network & Internet > Proxy to set up a proxy; in older versions of Windows, you can do this by clicking on the Control Panel and going to Internet Options > Connections > LAN Settings. If a proxy server requires authentication, you will need to provide a username and password before traffic is allowed through the proxy server and to the Internet.

Configuring an SL1 Agent to Work with Phone Home Collectors

If you are using PhoneHome Message Collectors in a Distributed Architecture, you will need to configure the settings for the Message Collector to prevent SL1 from incorrectly configuring the SL1 agent to use the loopback IP address when it should be using the local IP address for the Message Collector.

If you do not perform the configuration steps below, when you try to install the agent from a Message Collector when it is configured as a PhoneHome Collector, the URLs for both the download and the internal configuration of the agent reference the loopback address instead of the accessible public/private IP address of the Message Collector.

For more information about PhoneHome Collectors, see Configuring SL1 for PhoneHome Communication.

To configure the SL1 agent to work with a PhoneHome Collector:

Go to the Appliance Manager page (System > Settings > Appliances):

In the Message Collection Unit row, click the Agent Endpoint Configuration icon () for the agent. The Agent Endpoint Configuration modal appears:

Make sure that the configuration information under the Appliance Details field is accurate.
Complete the following fields:

Download Link Visibility. Select whether you want to display the download link in the Agent Installation modal page.
- If you select Enabled, the link to the Message Collector appears on the Agent Installation modal, which is available on the Device Manager page (Devices > Device Manager or Registry > Device > Device Manager in the classic user interface) when you click the Actions button and select Download/Install Agent:
- If you select Disabled, the link to the Message Collector does not appear in the Agent Installation modal page.
Endpoint Name for Download Link. This field contains the name of the Message Collector. If the name is not populated by default, you can enter the name.
Hostname/IP for Agent Download. Make sure that this field contains the IP address for the Message Collector.
Hostname/IP for Data Collection. Enter the IP address for the Message Collector.
Default CUG Alignment. Select the Collector Group aligned with the agent.

Click Save. The agent is now configured to work with a Message Collector when it is configured as a PhoneHome Collector.

Remotely Installing an SL1 Agent

This section covers how to configure remote installations of the Linux agent and the Windows agent.

The following procedures are examples of how you could set up these installations, using Ansible as the tool for the installation. You might use Ansible in a different way, or you might use another tool altogether. These examples represent just one way to configure the remote installation of agents.

Remotely Installing a Linux Agent

This topic provides an example of how you can use Ansible to remotely install the SL1 Linux agent. Please refer to the Ansible product documentation as needed.

To remotely install the Linux agent using Ansible:

Set up your Ansible control node, using the documentation at Installing Ansible.
Download the SL1 Linux agent installers from the Agents page (Devices > Agents > New Agent button) in SL1. For example:
- silo-agent-x86_64.rpm
- silo-agent-x86_64.deb

Create the hosts.yml file, using the following code as an example:

servers:
  hosts:
    centos_host:
      ansible_host: 172.16.54.195
      ansible_user: root
    debian_host:
      ansible_host: 10.2.16.125
      ansible_user: root

Create the playbook.yml file, using the following code as an example:

---
- hosts: servers
  vars:
    tenant: 0
    url_front: 10.2.16.49
    package_rpm: silo-agent-x86_64.rpm
    package_deb: silo-agent-x86_64.deb
  tasks:
 
  - name: check if agent exists
    stat:
      path: /usr/bin/scilogd
    register: agent_binary
 
  - name: copy rpm installer
    copy:
      src: "{{ package_rpm }}"
      dest: ~/{{ package_rpm }}
    when: (agent_binary.stat.exists == False and ansible_facts['os_family'] == 'RedHat')
 
  - name: copy deb installer
    copy:
      src: "{{ package_deb }}"
      dest: ~/{{ package_deb }}
    when: (agent_binary.stat.exists == False and ansible_facts['os_family'] == 'Debian')
 
  - name: install rpm agent
    shell: TENANT={{ tenant }} URLFRONT={{ url_front }} rpm -ihv ~/{{ package_rpm }}
    args:
      creates: /usr/bin/scilogd
    when: (agent_binary.stat.exists == False and ansible_facts['os_family'] == 'RedHat')
 
  - name: install deb agent
    shell: TENANT={{ tenant }} URLFRONT={{ url_front }} dpkg -i ~/{{ package_deb }}
    args:
      creates: /usr/bin/scilogd
    when: (agent_binary.stat.exists == False and ansible_facts['os_family'] == 'Debian')
 
  - name: remove rpm installer
    file:
      path: ~/{{ package_rpm }}
      state: absent
    when: (agent_binary.stat.exists == False and ansible_facts['os_family'] == 'RedHat')
 
  - name: remove deb installer
    file:
      path: ~/{{ package_deb }}
      state: absent
    when: (agent_binary.stat.exists == False and ansible_facts['os_family'] == 'Debian')

Run the playbook by executing the following command:

ansible-playbook playbook.yml -i hosts.yml --ask-pass

This example uses the --ask-pass parameter so that you are prompted for a single password to use with all remote computers.

The following code is an example of the output:

$ ansible-playbook playbook.yml -i hosts.yml --ask-pass
SSH password:
 
PLAY [servers] ********************************************************************************************
 
TASK [Gathering Facts] ************************************************************************************

ok: [centos_host]
ok: [debian_host]
 
TASK [check if agent exists] ******************************************************************************
ok: [centos_host]
ok: [debian_host]
 
TASK [copy rpm installer] *********************************************************************************
skipping: [debian_host]
changed: [centos_host]
 
TASK [copy deb installer] *********************************************************************************
skipping: [centos_host]
changed: [debian_host]
 
TASK [install rpm agent] **********************************************************************************
skipping: [debian_host]
changed: [centos_host]
 
TASK [install deb agent] **********************************************************************************
skipping: [centos_host]
changed: [debian_host]
 
TASK [remove rpm installer] *******************************************************************************
skipping: [debian_host]
changed: [centos_host]
 
TASK [remove deb installer] *******************************************************************************
skipping: [centos_host]
changed: [debian_host]
 
PLAY RECAP ************************************************************************************************
centos_host                : ok=5    changed=3    unreachable=0    failed=0    skipped=3    rescued=0    ignored=0  
debian_host                : ok=5    changed=3    unreachable=0    failed=0    skipped=3    rescued=0    ignored=0

Remotely Installing a Windows Agent

This topic provides examples of how you can use the PowerShell console or Ansible to remotely install the SL1 Windows agent. Please refer to the PowerShell or Ansible product documentation as needed.

To remotely install the Windows agent using InstallSoftwareRemotely.ps1:

Download the Windows Agent installer from the Agents page (Devices > Agents > New Agent button) in SL1 and add the installer to your domain-controller n its own directory. For example, C:\files\SiloAgent-install.exe.
Download the third-party PowerShell script to your domain-controller.
Create a comma-separated value (CSV) file with the names of the computers where you want to install the agent. For example: C:\computers.csv, such as:
rstlsw12t16ls01
rstlsw12t16ex01
computer3
computer99
Run the following command from a PowerShell console:

.\InstallSoftwareRemotely.ps1 -CSV C:\computers.csv -AppPath 'C:\foo\SiloAgent-install.exe' -AppArgs "Tenant=<organization_id> urlFront=<streamer_URL> RUN_AS_LOCAL_SYSTEM=1"

where:
- -CSV uses the full path to the .csv file you created in step 3, above.
- -AppPath uses the full path to the installer in step 1, above. Make sure the file is in its own directory.
- RUN_AS_LOCAL_SYSTEM=1 is an example configuration. See Configuring the Windows Agent for more information.
- You can optionally use the -Credential option to be prompted for a different username and password to access all remote machines. Otherwise the script will use your current login account to access all remote machines.

The following code is an example of the output:

PS C:\> .\InstallSoftwareRemotely.ps1 -CSV C:\computers.csv -AppPath 'C:\foo\SiloAgent-install.exe' 
-AppArgs "Tenant=0 URLFront=streamer-shared-e2e-testing.int.sciencelogic.com"
Start remote installation on 2020-56-20 09:56:17
No credential specified. Using logon account
-----------------------------------------------------------------
Attempt 1 of 5
-----------------------------------------------------------------
COMPUTER RSTLSW12T16LS01 (1 of 2)
Coping C:\foo to \\rstlsw12t16ls01\C$\temp
Installing SiloAgent-install.exe on RSTLSW12T16LS01
Executing C:\temp\foo\SiloAgent-install.exe Tenant=0 URLFront=streamer-shared-e2e-testing.int.sciencelogic.com
Deleting C:\temp\foo
SiloAgent-install.exe installed successfully.
COMPUTER RSTLSW12T16EX01 (2 of 2)
Coping C:\foo to \\rstlsw12t16ex01\C$\temp
Installing SiloAgent-install.exe on RSTLSW12T16EX01
Executing C:\temp\foo\SiloAgent-install.exe Tenant=0 URLFront=streamer-shared-e2e-testing.int.sciencelogic.com
Deleting C:\temp\foo
SiloAgent-install.exe installed successfully.
-----------------------------------------------------------------
100% Success installing SiloAgent-install.exe on 2 of 2 computers:
rstlsw12t16ls01 rstlsw12t16ex01

To remotely install the Windows agent using Ansible:

Set up your Ansible control node. Refer to Ansible documentation for installing on other operating systems: Installing Ansible with pip.
Update your Ansible control node to manage Windows servers by running the following command:
sudo pip3 install pywinrm
Ensure that remote machines are set up with PowerShell 3 or later:
https://github.com/jborean93/ansible-windows/blob/master/scripts/Upgrade-PowerShell.ps1
Ensure that remote machines are setup for Windows Remote Management:
https://github.com/ansible/ansible/blob/devel/examples/scripts/ConfigureRemotingForAnsible.ps1
Download the SL1 Windows agent installer, SiloAgent-install.exe, from the Agents page (Devices > Agents > New Agent button) in SL1.

Create the hosts.yml file, using the following code as an example:

group1:
  hosts:
    win2008r2:
      ansible_host: 10.2.16.41
      ansible_user: Administrator
    win2012:
      ansible_host: 10.2.16.42
      ansible_user: Administrator
    win2012r2:
      ansible_host: 10.2.16.40
      ansible_user: Administrator
group2:
  hosts:   
    dc01:
      ansible_host: 10.2.16.60
      ansible_user: administrator@T16TESTDOMAIN
    ls01:
      ansible_host: 10.2.16.62
      ansible_user: administrator@T16TESTDOMAIN   
    es01:
      ansible_user: administrator@T16TESTDOMAIN
      ansible_host: 10.2.16.64

Create the my_playbook.yml file, using the following code as an example:

---
- hosts: group1
  gather_facts: no
  tasks:
  - name: Ping Windows Hosts
    win_ping:
  - name: Copy agent installer
    win_copy:
      src: ./SiloAgent-install.exe
      dest: C:\Temp\SiloAgent-install.exe
  - name: Exec Installer
    win_command: C:\Temp\SiloAgent-install.exe Tenant=yyy URLFront=zzz
  - name: Remove agent installer
    win_file:
      path: C:\Temp\SiloAgent-install.exe
      state: absent

Run the playbook by executing the following command:
ansible-playbook playbook.yml -i hosts.yml --ask-pass
This example uses the --ask-pass parameter so that you are prompted for a single password to use with all remote computers. Alternately, you could include the password in hosts.yml or ./group_vars/all.yml.

The following code is an example of the output:

[em7admin@jkay88 demo_ansible]$ ansible-playbook my_playbook.yml -i hosts.yml --ask-pass
SSH password:
 
PLAY [group1] *********************************************************************************************************
 
TASK [Ping Windows Hosts] *********************************************************************************************
ok: [win2012]
ok: [win2008r2]
 
TASK [Copy agent installer] *******************************************************************************************
changed: [win2012]
changed: [win2012r2]
changed: [win2008r2]
 
TASK [Exec Installer] *************************************************************************************************
changed: [win2012]
changed: [win2012r2]
changed: [win2008r2]
 
PLAY RECAP *************************************************************************************************************
win2008r2                  : ok=3    changed=2    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0  
win2012                    : ok=3    changed=2    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0  
win2012r2                  : ok=3    changed=2    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0