Cognos Analytics 11.0.8
Microsoft Windows 2012 R2 Server
New installation of Cognos Analytics 11, but when you surf to the http://servername/ibmcognos you get a error like “Error Message: 403.6 – Forbidden” or “This page can’t be displayed”.
You have tried to reinstall Cognos Analytics gateway server parts, that did not help.
If you surf direct to the dispatcher at http://IBM_Cognos_Analytics_server_host_name:9300/bi/v1/disp it works fine.

Please note that CA11 needs to use http://servername/ibmcognos/bi/ and not http://servername/IBMCOGNOS/bi with capital letters, that may not work.

If you get a blank page – click inside it and wait some more.

The IIS setup have somehow become corrupt. Redo the IIS setup.
Inside IIS manager – mark cgi-bin and select delete.
Mark SSO under IBMCOGNOS and select delete.
Mark IBMCOGNOS (and COGNOS8 if it exist) and select delete.
Exit IIS manager and stop iis.
Erase web.config files from folders like c:\program files\ibm\cognos\analytics\webcontent\web.config file and c:\program files\ibm\cognos\analytics\webcontent\bi\.

If you run more than one IBM® Cognos® Analytics instances of the same product, on one computer, you must create a separate application pool for each instance and then associate the aliases for that gateway instance to each application pool.

Go into control panel – administrative tools – server manager. Select the local server.
In the Add Roles and Features Wizard, click Role-based or feature-based installation, and click Next.
Select Web Server (IIS), ensure that Common HTTP Features is selected including WebDAV Publishing, Performance Static Content Compression, Under Security select Request Filtering and Windows Authentication, and click Next until you get to the Role Services section of the wizard.
Expand Application Development.
Select CGI and ISAPI Extensions, ISAPI filters and click Next.
Select IIS Management Console, IIS Management Scripts and Tools, Management Service.
Features as NET framework 4.6 and ASP.NET 4.6 should be selected.
Click Install.

Download the IIS add ons needed for Cognos Reverse proxy. Install them in below order;
1. Stop IIS first by typing net stop was /y and net stop wmsvc /y on an elevated command-line window

2. Download and install the Web Farm Framework module. It is currently available in version 1.1

3. Download and install the External cache module. It is currently available in version 1.0

4. Download and install the URL Rewrite module. It is currently available in version 2.0

5. Download and install ARR itself. It is currently available in version 3.0

6. Start the IIS services back by enter IISRESET (or, simply reboot your server).

Download the Cognos script to configure IIS. (CA_IIS_Config_v1.09(11.02.17).zip)
1. Download the file to your Cognos Analytics Gateway Server.
2. Extract the CA_IIS_config.bat file to a folder.
3. Open CA_IIS_config.bat in a text editor like Notepad++.
4. The variables, that are to be modified, are located at the top of the file. Edit the BAT file in Notepad++ before you run it.
Run the BAT file as a local administrator.

Then you need to Adjust request size limits.  Go into IIS Manager.

Select the bi directory under the ibmcognos application created earlier.
Double-click Request Filtering.
Click Edit Feature Settings… from the right-hand panel.
Set Maximum URL length (bytes) to 8192.
Set Maximum query string (bytes) to 8192.
Click OK.  (The Cognos Script have already change the values for /bi/ folder)

Configure IIS to allow to pass through the custom 441 errors that are used for recoverable exceptions from CAM. Otherwise, IIS can block these errors, and the customer sees the “Invalid Logon Response” error when trying to log on.

Click the ibmcognos virtual directory.
In the Home view, Management section, double-click Configuration Editor.
In the Section drop-down list, expand system.webServer, and select httpErrors.
Set the existingResponse property to PassThrough. It may already be set correct by the Cognos script.
Apply the configuration change.

If you configured the SSO application in previous steps, enable Windows Authentication.

Select the SSO application folder in IIS manager. For Microsoft Edge browser, select the ibmcognos application folder.
Double-click Authentication. Disable Anonymous Authentication, and enable Windows Authentication.

If you do not want to use Kerberos, at the namespace, add Advance properties singleSignOnOption: IdentityMapping

Cognos Analytics should now be available at: http://iis-host/ibmcognos.

WebDav setup

Note: webdav is not working in 11.0.8 – update to a later version of CA 11.

Under Connections, expand your web server, Sites, and select your website. For example, select Default Web Site.
Double-click WebDAV Authoring.
Click Enable WebDAV.
Click WebDAV Settings.
If you have anonymous access enabled, select True for Allow Anonymous Property Queries, and click Apply.
Select the directory or virtual directory /ibmcognos/bi/samples/images/ to which you want to allow WebDAV access.
Double-click WebDAV Authoring.
Click Add Authoring Rule, and add the appropriate rules for your environment. Like Allow access to: All Content, User: All users, Access: Read.

For example, if you installed the samples and you want to use the default path, under the ibmcognos virtual directory, expand bi/samples, and select images, and add an authoring rule for the image files in that folder.
In Windows Explorer right-click the directory or virtual directory you added authoring rules to, in above it can be /cognos/analytics/webcontent/bi/samples/images, and click Properties.
Click Security tab, and add the appropriate permissions. For example,  add permissions for the anonymous user access.
You may need to setup webdav for other images folders on the IIS gateway server if they are used in the reports.

Best is to keep all pictures in the same folder /ibmcognos/bi/samples/images/ on all the Cognos BI servers.

Change the Gateway URI in IBM Cognos Configuration to match the new IIS configuration, i.e. http(s)://web-host:80/ibmcognos/bi/v1/disp
Access the Gateway through http(s)://web-host:80/ibmcognos/bi/

Create a redirect file and place in the C:\inetpub\wwwroot as default.htm
<title>Cognos Connection</title>
<meta http-equiv=”refresh” content=”0 ;url=”>


More information:

Samples Landing Page

Cognos Analytics 11.0.7
Microsoft Windows 2012 R2

When you inside Cognos Administration on Dynamic Cubes click on “properties” for a specific cube you get a error.
If you surf direct to the dispatcher on port 9300, and do the same thing inside Cognos Connection you do not get a error. Therefor the error is with IIS. Check the windows event log for more details:

Error message:
An unhandled exception has occurred.
C:\Program Files\ibm\cognos\analytics\webcontent\
The length of the query string for this request exceeds the configured maxQueryStringLength value. at System.Web.HttpRequest.ValidateInputIfRequiredByConfig() at System.Web.HttpApplication.PipelineStepManager.ValidateHelper(HttpContext context)

Withing IIS Default Web Site > ibmcognos > bi

Click on ‘Configuration Editor’

Select Section ‘system.web/httpRuntime’
set the following attribute setting –

maxQueryStringLength = 2048 -> 8192
maxRequestLength = 4096 -> 8192

Restart IIS

More information:

Adjust request size limits. (Sometimes this settings does not work and you need to edit as above).
Select the bi directory under the ibmcognos application created earlier.
Double-click Request Filtering.
Click Edit Feature Settings… from the right-hand panel.
Set Maximum URL length (bytes) to 8192.
Set Maximum query string (bytes) to 8192.
Click OK.

Cognos Analytics 11.0.7
Microsoft Windows 2012 R2 Server

On new Windows 7 computer you get a blank screen when you surf to Cognos Connection.

Error message in left corner of browser:
Webpage error details
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3)

Message: ‘performance’ is undefined
Line: 42
Char: 3
Code: 0
URI: https://caservername/ibmcognos/bi/

Install a different browser like Internet Explorer 11.

For any issues in CA11, please first check with a different browser like Chrome. Many issues is only in a specific version of Web Browser.

Cognos Analytics only supports IE11 and some other browsers.

To install IE11 you need SP1 for Windows 7 and this updates

Press F12 and select network, to troubleshoot more inside IE.

Cognos Analytics 11.0.7
Microsoft Windows 2008/2012/2016 server
How setup SSL with the IIS for the cognos users?
For testing in your demo environment, you can create own certificate, but for setup in production you need to buy a certificate from trusted CA store.

More information on OPENSSL can be found  here

Demo setup:
Download open ssl from here in a good installation package
Check the file for virus before you install it.
Install openssl on your server
Click next on all dialogs to install it






Create a folder c:\ssl
Start a command prompt as administrator
Change into c:\ssl directory.
Make a directory called keys.
Make a directory called certs.
Make a directory called requests.
Make a directory called demoCA.
Move to the demoCA folder
Make a directory called demoCA/newcerts.
Do Echo 01 >demoCA/serial.
Create an empty txt file called demoCA/index.txt.
You can also try to Open notepad to create the index.txt file
Save the file and close notepad.
Note the name of the server and domain to create the certs.
The name that is in the cert must exist in the DNS to make it work.
Generate the private key and CA certificate needed to sign requests
you need to add openssl\bin to path, otherwise you get below error
Open control panel – system – advance settings
add the BIN folder to path and click OK

We will create a simple SSL cert, recommendation is that you create a newer and stronger cert in your testing.

Start a new administrative command prompt and move to SSL folder
Enter this command to create the ca key
openssl genrsa -des3 -out keys/ca.key 1024
Ensure to enter the same password in all the steps.
e.g cognos101
generate a self-signed CA certificate that will be used later to sign all certificate requests
Enter this command to create the root ca
openssl req -new -x509 -out certs/ca.cer -key keys/ca.key -days 365
Enter values that make sense for you.
Above is to setup the ca – this can also be done in Windows IIS to or use a public vendor like;
Start IIS on the Microsoft Windows Server 2016 where the Cognos gateway are installed.
Click on Server Certificates
Click on Create certificate request

Save file in request folder
Now create the cert with this command
openssl ca -md sha1 -policy policy_anything -cert certs/ca.cer -keyfile keys/ca.key -in requests/certreq.txt -days 365 -out certs/certreq.cer
If you get errors, it can be that the index.txt file was not created in correct way.
Check that a cert was created with this command
openssl x509 -text -in certs/certreq.cer
Now you have a cert file.
Complete the process on the IIS server to import the cert now.
Inside IIS manager mark the servername and click on SSL certificates
Click on complete certificate request
Browse to the new cer file
Enter a name
And click OK
After some time the cert will show up in the list.
Mark default web site and click on bindings
Click on Add in site Bindings dialog.
Select https
Select the SSL certificate from the drop-down list
This is only the simplest demo setup, and therefor in production you should also follow things like this if above error comes up
If you can not save with a blank host name, enter a name and remove it later.
Click close.
Mark ibmcognos virtual folder in IIS manager and click on SSL settings
Mark Require SSL and click on Apply in top right corner.
Restart the iis webserver.
Now if you surf to http://labwin2012ca:9300/bi/ you go direct to cognos server and do not use a encrypoted session.
If you surf to https://labwin2012ca/ibmcognos you will get this message
If you click on continue to this website – you will come through to the website.
To get away of this error message, we will import the trust cert (CA) into Internet Explorer.
Go to internet options and click on content
Click on Trusted Root Certification Authorities and click import
Click next
Mark the ca.cer file that was created by openssl
And click next
There is a suggestion on how to do the SSL setup, there are other ways that are more correct.
Click Next
Click finish
Because this is a cert we created we get this warning, click yes, to import it to your laptops IE.
If you check the cert should be in your IE now.
Close IE and try to surf again.
Now you get direct to CA 11 without errors. You see on the lock in the toolbar that it is a secure connection, you can click on the lock to get more information.
if you use your own OPENSSL cert, you need to import the ca cert in every client computer to get a secure connection without error messages. Therefor it is simpler to buy a cert from a known CA.
You will also need to install the CA.CER in the Cognos BI server to be able to create PDF reports with pictures.
Copy your ca.cer to the cognos\bin folder
Open an administrative dos prompt
Enter this command
ThirdPartyCertificateTool.bat -i -T -r “C:\Program Files\ibm\cognos\analytics\bin\ca.cer” -p NoPassWordSet
Above error comes when the “ is of the wrong format.
Enter the command in NOTEPAD to ensure you have the correct signs. Copy from notepad to the cmd prompt.
Now restart Cognos services and try the report to PDF again.
Important that the reference to a picture in a Cognos report is relative like this
If you use the sample images that are stored in folder C:\Program Files\ibm\cognos\analytics\webcontent\bi\samples\images\
then it will work with both http://labwin2012ca:9300/bi/ (direct to BI services) and https://labwin2012ca/ibmcognos/bi (secure link to the IIS gateway).

Use F12 in IE to troubleshoot, if you get errors, you will see text like this
SEC7132: The certificate protecting this web site uses weak cryptography, SHA1. The web site should replace this certificate with a SHA2 certificate before SHA1 is no longer allowed https://labwin2012ca/ibmcognos/bi/pat/images/select_container.png

You need to create a stronger SSL cert, to not get above warning in the Web Browser.

SSL Setup in Production IIS server:
How setup SSL with a bought certificate.
Create a DNS alias for the server, so you have a good FQDN that will work in your domain.
Test that the users can surf to you IIS/IBMCOGNOS server with use of the dns alias like this
Get a cert from your supplier for the DNS alias.
You need to fill in information like this – please talk to your Internet provider, they can help.
You will get a PFX file that you will have a password to, normally you get the password by sms.
Place the cert file in a folder on the IIS server.
Import Cert to IIS
Start IIS manager
Mark the computer (server)
Click on server certificates
Click on Import to read in the certificate you have got from your ISP.
Enter the path and filename of pfx file
Enter the password you have got for the certificate.
Leave it to store in Personal folder.
Click OK.
Mark the default web site and click on Bindings to the right.
Click on add to add the new cert
Fill in the hostname
Click on select to select the cert you have read in.
Click OK
Click Edit on the same line you saved.
Remove the host name so it is blank.
Click OK to save it again.
Mark your IBMCOGNOS folder in IIS Manager and click on SSL settings
Mark Require SSL and click Apply in the top right corner.
This will make that a user that surf to /IBMCOGNOS/ must have a cert.
We have left port 80 open to default website, so users do not get a message that the site does not exist.
To make it easier for users, we create a default.htm page with below content and place it in the iisroot folder (C:\inetpub\wwwroot). This should make users that surf only to the server name, are redirected to the correct address.
<title>Cognos Connection</title>
<meta http-equiv=”refresh” content=”0 ;url=https://labwin2012ca/ibmcognos”>
<a href=”https://labwin2012ca/ibmcognos” >click here</a>.
More information on how you could do it in old Cognos;

To get report with pictures to be created as PDF, you need to import the root cert to Cognos BI server.
Export CA cert from IE for your trust issuer
Go to Windows control panel
Open internet options
Click on certificates
Click on Trusted Root Certificate Authorities
If you do not find your supplier in the list, check on your local Windows 7 computer, it can have more certificates than a Windows server.
Select you certificate and click on Export
Click next
Select BASE-64 CER file and click Next
Enter a filename and click next.
CLick finish
You will need to copy the cer file to your Cognos BIN folder.

Import CA cert to CA 11.0.7 content store
Place the ca2.cer file in your cognos BIN and BIN64 folder.
Start an administrative command prompt
Move to the bin folder
Enter the command ThirdPartyCertificateTool.bat -i -T -r ca2.cer -p NoPassWordSet
The password is the password for the Cognos storage, most cases NoPassWordSet
This will get the cert into the Cognos store.
If you get an error like “short read” then the cer file is in the wrong format. Please export it again from IE.
In most cases you need to put the full path to the file like this
ThirdPartyCertificateTool.bat -i -T -r “C:\Program Files\ibm\cognos\analytics\bin\ca2.cer” -p NoPassWordSet
Then it should be possible to read in the cert without errors.
You must restart the Cognos Analytics service, to make it notice the new cert.
Test by create a cognos report with a picture and run it as a PDF.
You should use the ../samples/images/Alex_Active.png to the picture if you have the picture in folder C:\Program Files\ibm\cognos\analytics\webcontent\bi\samples\images

Cognos Framework manager will work, as long it points to the CA server and not the gateway.
So, FM and other clients like Cube Designer should point to http://servername:9300/bi/v1/disp
If FM use a Gateway URI that use HTTPS and point to the IBMCOGNOS, then you need to do the same import in their local store.
This is for all Cognos tools that uses Java.

When testing, ensure that the Cognos Service have started correct, and also ensure that the web browser you use, have the trusted root cert for you cert. You must clear the web browser cache between every test.

More information

Cognos Analytics 11.0.7
Microsoft Windows 2012 R2 server

The custom control is not found.

Suggested solution:
For this example you can download this files

Place the file AlternatingBackground.js in folder C:\Program Files\ibm\cognos\analytics\webcontent\bi\samples\js on your Cognos server.
If you use SSO, you may need to start IIS Manager and go to the
ibmcognos virtual folder, then step down to bi-samples.
Mark samples folder and click on Authentication icon.
Mark Anonymous Authentication and click Enable.
Exit IIS manager.

Create a list report on some sample data in Cognos Analytics.
Test that the report works.
In edit mode click on TOOLBOX icon.
Expand ADVANCE section and drag in a Custom Control to your report.
Set the description to a name like: AlternatingBackground
Click on module path and set it to be

include the js file in the path name.

Click on configuration and enter this
“isCrosstab”: false,
“controlName”: “List1”,
“firstColor”: “yellow”,
“secondColor”: “#EAE6E3”
Click Apply
Click OK
Save the report.

The controlname refer to the report object that will be affected.
Important that the JSON configuration is inside “curly brackets” { }.

Test the report again in HTTP. Go to the last page of the report to ensure it is working.

Here a video on how to set it up

Cognos Analytics 11.0.7 FrameWork manager
Microsoft Windows Server 2016 standard

User can not login to Frame Work Manager. They get a error message at the login dialog, even do they have not enter any name.

Error message:
Windows Security
Connecting to
Server Busy
This action cannot be completed because the other program is busy. Choose ‘Switch to’ to active the busy program and correct the problem.

Start Internet Explorer
Go to Internet Options
Go to Trusted sites
Unmark the “Require server verification ….”
Enter the CA servername like
Click on Add
Click Close
Click on custom level
Scroll down to the bottom of settings.
Mark “Automatic logon with current user name and password” at logon.
Click OK.
Click OK.
Exit Internet Explorer and start Framework Manager again, to see if the issue is gone.

In Cognos Configuration for FM under Environments ensure that Gateway URI is


Cognos Analytics 11.0.7
kit_name=IBM Cognos Analytics
Microsoft Windows 2008 R2 server

Error message when try to install to C drive. This happens in the beginning of the installation when you try to select where to install the Cognos software. The C drive is hidden by a Group Policy. You can in file explorer enter C:\ to view the drive and the files, but this is not good enough for the Install software.

Error message:
Install Location
The specified drive in c:\program files\ibm\cognos\analytics is invalid. Please specify a valid drive.

Possible solution:
Ask your IT department for Windows support to turn of the Group Policy that prevent the user from seeing the C drive.
The Install Anywhere program need to see the drive to allow that you select it in the installation dialog.

You can check the registry on the Windows server to see if there is a policy making this issue.
Start REGEDIT by type that on the START-RUN line.
Go to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
If there is a NoDrives=4, then there is a policy for the logged in users to not see the C drive.
Right click on key Explorer and select “export” to get a backup of that registry part. Save to a file.
Change the value to 0 for NoDrives.
Exit Regedit.
Log out of Windows server.
Log in as the same user again.
Then you may be able to see the C drive direct, and the installation will work.

Otherwise you have to install it to a different drive (e.g. D:).

The value you can set at nodrives is a 26 Bit mask
A: 1
B: 2
C: 4
D: 8
E: 16
F: 32
G: 64
H: 128
add the numbers up to hide more than one drive.

Cognos Analytics 11.0.7
kit_name=IBM Cognos Analytics
Microsoft Windows 2008 R2 server

Silent installation of new Cognos Analytics does not work. No error message.

Possible solution:
Turn of the anti virus software on the server during installation.

The anti virus software on the Windows server have a rule that prevent EXE files to run from users TEMP folder.
When the Install Anywhere software start, after you click on the EXE, it will unpack a javaw.exe and a ANALYTICS_BI.EXE file, in the users temp folder. After unpack the Install Anywhere will try to start the JAVAW to continue with the installation of your cognos software, but here the antivirus will stop the action. Then the installation quits without error messages. There is also no log file from Install Anywhere.

If you click on your antivirus software (McAfee) and check the log file for it you will see message similar to this;
9/15/2017 3:00:31 PM Would be blocked by Access Protection rule (rule is currently not enforced) domain\username C:\WINDOWS\EXPLORER.EXE C:\USERS\username\APPDATA\LOCAL\TEMP\I1505480296\WINDOWS\RESOURCE\JRE\BIN\JAVA.EXE Common Standard Protection:Prevent common programs from running files from the Temp folder Action blocked : Read
or C:\WINDOWS\EXPLORER.EXE C:\TEMP\I1505483120\WINDOWS\ANALYTICS_BI.EXE Common Standard Protection:Prevent common programs from running files from the Temp folder Action blocked : Read

How to do a silent installation:
Copy your install file ca_server_win64_11.0.7.exe to a folder like c:\install\media on the Windows server.
Run the installation with below command to create the response file, do the installation as you normally should do.
c:\install\media\ca_server_win64_11.0.7.exe  -r  c:\install\media\
Now there is a response file created.
Uninstall Cognos Analytics.
Create a CMD file and enter below line to make it possible to start the silent installation;
c:\install\media\ca_server_win64_11.0.7.exe -i silent -f c:\install\media\
Start the above CMD file from a administrative prompt.
This will run the installation with your choices as before.

You can include in your CMD file, that you copy the database drivers (sqljdbc4.jar) you need to the drivers folder.
Create a folder c:\install\media\drivers and place the jar file in there. Then add below line to you CMD file.
copy /Y /V c:\install\media\drivers\*.* “C:\Program Files\ibm\cognos\analytics\drivers\”
Also you can include in your CMD file that you copy any pre-adjusted XML (cogstartup.xml) files to configuration folder.
copy /Y /V c:\install\media\configuration\*.* “C:\Program Files\ibm\cognos\analytics\configuration\”
When the installation is done, you start Cognos Configuration on server, adjust the values for your environment and click save.
Then start the Cognos service. (please note there is more steps to get CA11 up to run, this is only the silent installation).

Below example on a file.
# Tue Sep 05 09:27:57 CEST 2017
# Replay feature output
# ———————
# This file was built by the Replay feature of InstallAnywhere.
# It contains variables that were set by Panels, Consoles or Custom Code.

USER_INSTALL_DIR=C:\\Program Files\\ibm\\cognos\\analytics

-fileOverwrite_C\:\\Program\ Files\\ibm\\cognos\\analytics\\Uninstall_IBM_Cognos_Analytics.lax=Yes
-fileOverwrite_C\:\\Program\ Files\\ibm\\cognos\\analytics\\resource\\iawin64_x64.dll=Yes
-fileOverwrite_C\:\\Program\ Files\\ibm\\cognos\\analytics\\resource\\iawin32.dll=Yes
-fileOverwrite_C\:\\Program\ Files\\ibm\\cognos\\analytics\\resource\\win64_32_x64.exe=Yes
-fileOverwrite_C\:\\Program\ Files\\ibm\\cognos\\analytics\\resource\\remove.exe=Yes
-fileOverwrite_C\:\\Program\ Files\\ibm\\cognos\\analytics\\resource\\invoker.exe=Yes
-fileOverwrite_C\:\\Program\ Files\\ibm\\cognos\\analytics\\configuration\\preserve\\preserve.txt=Yes
-fileOverwrite_C\:\\Program\ Files\\ibm\\cognos\\analytics\\configuration\\preserve\\.ca_base_preserve.txt=Yes

More Information:

Cognos Analytics 11.0.6
Microsoft Windows 2012 R2 server

In a new setup, we created a data source to a TM1 server, but when doing test in Cognos connection we get a error.
Test of SQL server data source is working.

This is in a SSO CAM security setup with Active Directory.

Error message:
XQE-CM-0008 Unable to retrieve credentials for namespace “CAMID(“AD”)”: java.lang.NullPointerException

In some cases the test of data source does not work when using external authentication.
Set to NO AUTHENTICATION and test again.
If the test works, set it back to you AD External Namespace authentication.
Create a report and use that to test that you can get some data from the TM1 data source.

As per the IBM Cognos documentation, you are not able to test a data source which is configured to use an external namespace for authentication.

Cognos Analytics 11.0.6
Microsoft Windows 2012 R2 server

When start Cube Designer we get a log on dialog – even do Cognos BI is setup with Single Sign On (SSO) to the Active Directory (AD).

This is by design.
This version of Cube Designer does not support SSO.

Only the BI developers should be using the tool, so there is a few persons who should need to enter the windows password.

More Information: