-
-
-
Installing the Windows Endpoint Agent
-
-
-
This content has been machine translated dynamically.
Dieser Inhalt ist eine maschinelle Übersetzung, die dynamisch erstellt wurde. (Haftungsausschluss)
Cet article a été traduit automatiquement de manière dynamique. (Clause de non responsabilité)
Este artículo lo ha traducido una máquina de forma dinámica. (Aviso legal)
此内容已经过机器动态翻译。 放弃
このコンテンツは動的に機械翻訳されています。免責事項
이 콘텐츠는 동적으로 기계 번역되었습니다. 책임 부인
Este texto foi traduzido automaticamente. (Aviso legal)
Questo contenuto è stato tradotto dinamicamente con traduzione automatica.(Esclusione di responsabilità))
This article has been machine translated.
Dieser Artikel wurde maschinell übersetzt. (Haftungsausschluss)
Ce article a été traduit automatiquement. (Clause de non responsabilité)
Este artículo ha sido traducido automáticamente. (Aviso legal)
この記事は機械翻訳されています.免責事項
이 기사는 기계 번역되었습니다.책임 부인
Este artigo foi traduzido automaticamente.(Aviso legal)
这篇文章已经过机器翻译.放弃
Questo articolo è stato tradotto automaticamente.(Esclusione di responsabilità))
Translation failed!
Installing the Windows Endpoint Agent
The agent installer is available as an MSI package. The MSI can either be installed manually or unattended through existing software deployment tools or Splunk’s Deployment Server.
Note
Securing the Configuration Directory
uberAgent can be configured via the
%ProgramData%directory (details). It is important to secure this directory, or standard users might be able to elevate their privileges to SYSTEM and/or abuse uberAgent.
Starting with version 7.0.2, uberAgent’s installer secures the agent’s %ProgramData% directories automatically. Two new MSI parameters provide control over the process: PROGRAMDATA_CONFIGDIR_RESETPERMISSIONS and PROGRAMDATA_CONFIGDIR_DELETEFILES (see below).
We recommend disabling those MSI parameters only if you’re managing the security of %ProgramData%\vast limits and its subdirectories via other means. We recommend the following permissions:
Administrators: full control SYSTEM: full control
Optionally provide read access to standard users on scripts that are to be executed in user context:
Users: read
Note
Changed Startup Behavior After Installation
Starting with uberAgent 7.2.1, the uberAgent installer does not start the service automatically after a successful installation. Please update any agent deployment procedures to reflect changes.
Manual Installation
Run the batch file uberAgent_endpoint\bin\manual-install.cmd.
Configuration
uberAgent can be configured very flexibly. By editing the configuration you can switch metrics on or off, change the data collection frequency and significantly reduce the data volume.
Note
Configuration Directory Change - Windows
Starting with uberAgent 7.3.0, the agent no longer searches for configuration files in the installation directory. To configure uberAgent, you can use the template configuration files that are part of the installation and can be found in the
Config Templatesfolder located in the installation directory. Once the config files have been customized, deploy the customized files to:%PROGRAMDATA%\vast limits\uberAgent\Configurationand start the uberAgent service. For more details, please see: Configuration via Local Config Files.
License File
If you have a license file for uberAgent, copy it to the installation directory (default: %ProgramFiles%\vast limits\uberAgent). Without a license file, uberAgent displays a splash screen during logon.
Installation Through a Software Deployment Tool
Install the appropriate MSI file from the directory uberAgent_endpoint\bin depending on the bitness of your machine: uberAgent-32.msi or uberAgent-64.msi.
MSI Parameters
Specify the following MSI parameters:
INSTALLDIR
- Required: no
- Description: installation directory
- Valid values: any local file system path
PROGRAMDATA_CONFIGDIR_RESETPERMISSIONS
- Required: no
-
Default:
1 -
Description: Set secure permissions on uberAgent’s ProgramData directory (
%ProgramData%\vast limits\uberAgent). -
Valid values:
-
0: disabled -
1: enabled
-
PROGRAMDATA_CONFIGDIR_DELETEFILES
- Required: no
-
Default:
1 -
Description: Delete existing config files in uberAgent’s ProgramData directory (
%ProgramData%\vast limits\uberAgent). Disable this setting only if you’re removing potentially malicious existing config files as part of your own deployment package logic. -
Valid values:
-
0: disabled -
1: enabled
-
License File
If you have a license file for uberAgent, copy it to the installation directory (default: %ProgramFiles%\vast limits\uberAgent). Without a license file, uberAgent displays a splash screen during logon.
Installation Through Splunk Deployment Server
Note: Deployment Server can only be used with Splunk Enterprise and requires Splunk Universal Forwarder on the endpoint as deployment client.
uberAgent
Copy the directory uberAgent_endpoint from the unzipped uberAgent download package to $SPLUNK_HOME\etc\deployment-apps on your deployment server.
Note: $SPLUNK_HOME refers to the base directory of the Splunk installation, typically %ProgramFiles%\Splunk.
Configuration
To deploy a customized configuration file, copy it into the directory $SPLUNK_HOME\etc\deployment-apps\uberAgent_endpoint\bin. This overwrites the default configuration file from the installation package.
License File
If you have a license file for uberAgent, copy it into the directory $SPLUNK_HOME\etc\deployment-apps\uberAgent_endpoint\bin.
Serverclass
Create a file called serverclass.conf in $SPLUNK_HOME\etc\system\local on your deployment server. Serverclass.conf defines what to deploy where. For a quick start paste the following content into Serverclass.conf to deploy uberAgent to all Windows machines. You may want to fine-tune this to suit your needs.
# [global]
# We cannot match by machine type here. We'll do that on the app level below.
whitelist.0 = *
# Define a serverclass
[serverClass:windows]
# Deploy only to Windows machines
machineTypesFilter = windows-*
# Define which apps to deploy to the serverclass
[serverClass:windows:app:uberAgent_endpoint]
stateOnClient = enabled
restartSplunkd = true
<!--NeedCopy-->
To make Splunk read the new file serverclass.conf, run the following command:
$SPLUNK_HOME\splunk.exe reload deploy-server
<!--NeedCopy-->
Citrix Site Monitoring
If some or all of your endpoints are running the Citrix Virtual Apps and Desktops (CVAD) VDA, you should install uberAgent on the Citrix delivery controller(s), too. Please see this page for details.
Endpoint to Backend Communication Via Splunk Universal Forwarder
Note: This is optional and not required for the recommended architecture.
If you decided to implement the alternative endpoint to backend communication path via Splunk Universal Forwarder, you need to install Universal Forwarder on each endpoint.
Imaging & Citrix PVS
If you intend to copy the agent installation via an imaging method or Citrix PVS, we recommend you remove instance-specific information. To do that, follow these steps right before capturing the image:
- Stop the service
uberAgent(but leave the start type atautomatic). - Open an administrative command prompt.
- Run the command:
reg delete "HKLM\SOFTWARE\vast limits\uberAgent" /f /reg:64. - Optionally: delete existing log files.
- Optionally: delete existing Persistent Output Queue files/folders.
- Prepare the machine for cloning as necessary, but do not reboot.
If you have Splunk Universal Forwarder installed, please follow the steps listed here, too.
Share
Share
This Preview product documentation is Citrix Confidential.
You agree to hold this documentation confidential pursuant to the terms of your Citrix Beta/Tech Preview Agreement.
The development, release and timing of any features or functionality described in the Preview documentation remains at our sole discretion and are subject to change without notice or consultation.
The documentation is for informational purposes only and is not a commitment, promise or legal obligation to deliver any material, code or functionality and should not be relied upon in making Citrix product purchase decisions.
If you do not agree, select I DO NOT AGREE to exit.