Product:

Planning Analytics Workspace 73

Microsoft Windows 2016 server

Issue:

After upgrade of PAW, the admin tool stop with error like this:

Execution failed with exit code 1: Encountered errors while bringing up the project.

Error: for mongo Cannot start service mongo. Failed to create endpoint mongo on network nat.

When you try to start database mongo with command: docker start mongo, you get error

Error response from daemon: endpoint with name mongo already exist in network nat.

Error: failed to start containers: mongo

Suggested solution:

Start a powershell session as administrator on your PAW server.

Enter to get a list of networks: docker network ls

To see nodes in a network enter: docker network inspect nat

To remove old node in network enter: docker network disconnect nat mongo

To start mongo enter: docker start mongo

To list running containers enter: docker ps

Should look like above, if PAW73 is working fine.

More Information:

https://www.ibm.com/support/pages/failed-start-container-failed-create-endpoint-share-proxy-network-nat-file-local-kvdblock-being-used-another-process

https://www.ibm.com/docs/en/planning-analytics/2.0.0?topic=web-install-configure-tm1-microsoft-windows

https://www.ibm.com/support/pages/troubleshooting-planning-analytics-workspace-related-docker-issues

https://www.mirantis.com/product/basic-for-mirantis-container-runtime-formerly-docker-engine-enterprise-for-compatible-linux-and-windows-server/

https://docs.docker.com/config/pruning/

Product:
Planning Analytics Workspace 73

Microsoft Server 2016

Issue:

During Start.ps1 checks at the start of the upgrade of PAW, you get message that docker-compose is to old.

Command: Docker version

will list your docker version, in our case it was 17.06.2-ee-14

Solution:

Ensure server have connection to internet.

Start powershell as administrator.

Run this commands:

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

Above to active TLS1.2

Invoke-WebRequest "https://github.com/docker/compose/releases/download/1.29.2/docker-compose-Windows-x86_64.exe" -UseBasicParsing -OutFile $Env:ProgramFiles\Docker\docker-compose.exe

Above to install docker-compose version 1.29

Then try to install PAW again.

More information:

https://docs.docker.com/compose/compose-file/compose-versioning/

https://www.ibm.com/docs/en/SSD29G_2.0.0/com.ibm.swg.ba.cognos.tm1_prism_gs.2.0.0.doc/tm1_prism_gs.pdf

 

Product:
Cognos Enterprise Planning PLANSRVR_version=PLANSRVR-AW32-ML-RTM-10.2.1000.1-0

Cognos Analytics BI kit_version=11.0.12.18062512

Microsoft Windows 2012 R2 server

Problem:

The IBM Cognos service is restarting and people can not work. Error users can get are;

The server did something wrong</faultstring><detail><bus:exception><severity>error</severity><errorCode>DISPATCHER_NOT_YET</errorCode><bus:message><messageString>DPR-ERR-2109 The dispatcher cannot service the request at this time. The dispatcher is still initializing. Contact your administrator if this problem persists.

Suggested solution:

Stop all services.

Export all configuration.

Recreate the internal Cognos certificates.  Follow instructions at the links below.

Open Cognos Configuration and start the service in correct order. The order is very important. CA content manager must be started first.

Please note that the steps are different for different version of Cognos.

More Information:

https://www.ibm.com/support/pages/how-regenerate-cryptographic-keys-cognos-analytics-11

https://www.ibm.com/support/pages/how-regenerate-cryptographic-keys-cognos-1022

https://www.ibm.com/support/pages/how-regenerate-cryptographic-keys-cognos-bi-1021-and-earlier

Product:
Cognos Enterprise Planning 10.2.1
Microsoft Windows 2012 R2 Server

Problem:
When doing a large publish from inside Contributor Administration Console (CAC) to a SQL 2017 server an a different computer, you get a error at random times. It can work, but most of the time the publish fail.


The cognos planning publish process stop at different BCP jobs, and you can find the errors in the -out file. Best practice is to set the cognos planning services system path to a separate folder, then can you easy find the log files for cognos planning.

Error message:
Error Number: -2147220469
Line Number: 400
Description: Unable to execute Job Item
Execution failed after 1 attempt(s).
Unable to Bulk Load the data.
Error found in output.
SQLState = 08001, NativeError = 10054
Error = [Microsoft][ODBC Driver 17 for SQL Server]SSL Provider: An existing connection was forcibly closed by the remote host.
SQLState = 08001, NativeError = 10054
Error = [Microsoft][ODBC Driver 17 for SQL Server]Client unable to establish connection

Suggested Solution:
On both your SQL server and Cognos Planning server update the registry with this values, to turn off TLS 1.2 usage:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server]

“DisabledByDefault”=dword:00000000

“Enabled”=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client]

“DisabledByDefault”=dword:00000000

“Enabled”=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server]

“DisabledByDefault”=dword:00000000

“Enabled”=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client]

“DisabledByDefault”=dword:00000000

“Enabled”=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server]

“DisabledByDefault”=dword:00000000

“Enabled”=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client]

“DisabledByDefault”=dword:00000000

“Enabled”=dword:00000000

TCP/IP Registry Values That Harden the TCP/IP Stack ( Windows 2003 Servers )

If that does not help then add this value on the SQL server in registry;

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters]

“SycAttackProtect”=dword:00000000

This turn of DoS protection.
https://social.technet.microsoft.com/Forums/en-US/c55aa101-059d-491e-9fc2-73b5d8171eb8/protect-against-syn-attacks?forum=winservergen

You may need to reboot the servers to make the change take affect.

And if that does not help – install a later SQL driver on you cognos planning server, download from Microsoft and install.
https://www.microsoft.com/en-us/download/details.aspx?id=56567

https://docs.microsoft.com/en-us/sql/connect/odbc/download-odbc-driver-for-sql-server?view=sql-server-ver15

You can check the version of SQL driver you have, by going to the DOS prompt, and enter commando:
 bcp /v
to see version in use.

You may need to update the PATH on your windows server, to have the new driver folder first in path – so it is used by Cognos Planning.

Go to control panel – system – advance system settings
Click on Advance tab – click on Environment Variables
In System variables select path and click Edit
Add the SQL driver path to beginning of the path like; %SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;%SYSTEMROOT%\System32\WindowsPowerShell\v1.0\;C:\Program Files\Microsoft SQL Server\Client SDK\ODBC\170\Tools\Binn\

More information:

https://support.microsoft.com/sv-se/help/3135244/tls-1-2-support-for-microsoft-sql-server

https://books.google.se/books?id=VaS1U0gmiKoC&pg=PT233&lpg=PT233&dq=Value+name:+SynAttackProtect&source=bl&ots=RG8Vw1G676&sig=ACfU3U3St9O7S3H3F16RuePtgtNUoJL_YA&hl=sv&sa=X&ved=2ahUKEwiDiafAuszoAhUwwqYKHf0GDqUQ6AEwAXoECAsQLA#v=onepage&q=Value%20name%3A%20SynAttackProtect&f=false

https://docs.microsoft.com/en-us/sql/relational-databases/errors-events/mssqlserver-17832-database-engine-error?view=sql-server-ver15

https://community.hostek.com/t/ssl-security-error-for-microsoft-sql-driver/348

Server Hardening

Product:
Cognos Planning 10.2.1
Microsoft Windows 2012

(This text is partly a copy from IBM web site – to keep it, in case it is removed)

Problem

Previously, to perform a complete IBM Cognos Planning 10.2.1 installation, you had to obtain the Planning 10.2.1 components and the BI Server 10.2.2 components from separate locations. Now, however, you can download and install all components from one location in IBM Passport Advantage.

Resolving The Problem

This document walks you through the process of replicating the Planning Complete installation with the current version. The installation Kits for Planning 10.2.1 are full installs, and thus not able to upgrade any existing installation.

Downloading IBM Cognos Planning 10.2.1

To download and install the IBM Cognos Planning 10.2.1 eAssembly, follow the steps in Downloading IBM Cognos Planning 10.2.1.

The eAssembly consists of:

  • Planning Client (eImage: CNLY3ML)
  • Planning Server (eImage: CNLY4ML)
  • Planning Administration (eImage: CNLY5ML)
  • Planning Gateway (eImage: CNLY6ML)
  • Framework Manager 10.2.2 (eImage: CN1YRML)
  • BI Server 10.2.2 32-bit (eImage: CN1YNML)
  • BI Server 10.2.2 64-bit (eImage: CN1YPML)

Note: A corresponding Cognos Planning non-production eAssembly is also available.

https://www.ibm.com/support/pages/cognos-planning-1021-fix-lists

If you are an existing BI customer, you may use your existing install if it is version 10.2.2 or above. If you are a Cognos Analytics customer, you can use your existing install if it is CA 11.0.7 or above. You can use either 32 or 64 bit.

https://www-01.ibm.com/support/docview.wss?uid=swg21991239

Installing and configuring the components

Once you have downloaded the kits you need, you can start to install.

The BI server and the planning code must be installed in separate directories on your disk.

For example, and for the rest of this document, we’ll install BI into a folder called BI1022 and the planning software into the EP1021 folder. Recommended to only use short (8 characters) folder names.

You can place these into the root of a drive, below Program Files, or in any other path.

When installing a mixture of 64-bit and 32-bit Cognos products in a single environment, the 32-bit instance of the appropriate version of the BI gateway should be used. The 32-bit Gateway components for each product (Planning, BI, Metric Studio etc.) should all be installed to a single location on the Gateway or web server(s); and the 64-bit BI Gateway component is not required (however it does not need to be un-installed; if you are adding 32-bit components to an existing 64-bit BI environment, you can install each of the 32-bit Gateways to a new location on the server, and then simply re-configure IIS to reference the 32-bit Gateway location).

Step 1 – Install BI Server

Install the BI server kit into BI 10.2.2. This install is very similar to the Planning installs, and it will set up a few start menu icons for you, among which are Cognos Configuration.

Note: You should also install the latest BI 10.2.2 fix pack at this time. It can be downloaded from Fix Central at https://ibm.biz/BdY77S for 32-bit BI and https://ibm.biz/BdY776 for 64-bit BI.

https://www.ibm.com/support/pages/cognos-business-intelligence-1022-fix-lists

You need to copy the sqljdbc42.jar file to folder D:\ibm\bi1022\c10_64\webapps\p2pd\WEB-INF\lib

Step 2 – Install Planning Gateway

Install the Planning Gateway install Kit into the same location as the BI server. This will put some extra static files into the right folders in the BI server location. (This assumes that the BI gateway is on the same computer as the BI server. If the BI gateway is installed elsewhere the Planning Gateway should be installed on top of that).

 

Step 3 – Configure BI Server

Start Cognos Configuration that was just installed. You will see that this looks very similar to the configuration you are used to seeing in previous Planning versions. This will allow you to connect to a content store, and set up any security namespace that you need.

Setup Content Store

  1. Create a database using your Microsoft SQL Server administration tools.
    1. Ensure that the collation sequence for the database is case insensitive.

      In a custom installation, you choose a collation sequence, which includes character sets and sort order, during the Microsoft SQL Server setup. In a typical installation, the installation uses the locale identified by the installation program for the collation. This setting cannot be changed later.

    2. Ensure that TCP/IP connectivity is used for Microsoft SQL Server.
  2. From the Start menu, click Programs then click IBM Cognos 10 then click IBM Cognos Configuration.
  3. In the Explorer window, under Data Access, Content Manager, right-click Content Store, and click Delete.

    This removes the default content store properties, which are defaulted to use an IBM DB2® database.

  4. Right-click Content Manager, and click New Resource then click Database.
  5. In the Name field, type a name for the resource. Such as Content Store.
  6. In the Type box, select the appropriate Microsoft SQL Server database type, and click OK.

    If you use Windows authentication for your Microsoft SQL Server database, select Microsoft SQL Server database (Windows authentication). If not, select Microsoft SQL Server database.

  7. In Database server and port number, enter the name of your computer and port number on which Microsoft SQL Server is running. For example, localhost:1433. The value 1433 is the default port number used by Microsoft SQL Server. If you are using a different port number, ensure you use that value.
  8. Click the Value field next to the User ID and password property and then click the edit button when it appears. Type the appropriate values and click OK.
  9. In the Properties window, for the Database name property, type the name for your content store database.
  10. Right-click the resource you added for the content store database, and click Test.

    If the test is successful, Content Manager can create the required tables in the content store when you start the IBM Cognos service for the first time. If the connection properties are not specified correctly, you cannot start the IBM Cognos services.

You can also configure dispatchers and set up the connection to the website (Gateway URI).

The website should be set up exactly as you are used to, using IIS or similar software. See existing tech notes on how to do this.

Note: If you are upgrading from a previous install, and you have made customizations to, for example, the Cognos namespace, it would be a good idea to reuse your existing content store database. The upgrade then runs silently, which is the preferred method for a BI upgrade. Ensure that you back up your old content store database, restore it to a DB on your new system, and connect to it in Cognos Configuration.

Setup the connection to active directory

  1. In every location where you installed Content Manager, open IBM Cognos Configuration.
  2. In the Explorer window, under Security, right-click Authentication, and then click New resource > Namespace.
  3. In the Name box, type a name for your authentication namespace.
  4. In the Type list, click Active Directory and then click OK.

    The new authentication provider resource appears in the Explorer window, under the Authentication component.

  5. In the Properties window, for the Namespace ID property, specify a unique identifier for the namespace.
  6. Specify the values for all other required properties to ensure that IBM Cognos components can locate and use your existing authentication provider.
  7. Specify the values for the Host and port property.

    To support Active Directory Server failover, you can specify the domain name instead of a specific domain controller.

    For example, use mydomain.com:389 instead of dc1.mydomain.com:389.

  8. If you want to search for details when authentication fails, specify the user ID and password for the Binding credentials property.

    Use the credentials of an Active Directory Server user who has search and read privileges for that server.

  9. From the File menu, click Save.
  10. Test the connection to a new namespace. In the Explorer window, under Authentication, right-click the new authentication resource and click Test.

    You are prompted to enter credentials for a user in the namespace to complete the test.

    Depending on how your namespace is configured, you can enter either a valid user ID and password for a user in the namespace or the bind user DN and password.

    https://www.ibm.com/support/pages/enabling-single-sign-cognos-secured-against-active-directory

  11. In addition to those steps, if you want to use SSO, an advanced property needs to be set using Cognos Configuration to disable the use of Microsoft Kerberos for single signon like this:
    + In the Explorer window, under Security, Authentication, click the Active Directory namespace.
    + Click in the Value column for advanced properties and then click the edit button

    + In the Value – Advanced properties window, click Add.
    + In the Name column, type singleSignonOption (Case sensitive)
    + In the Value column, type IdentityMapping (Case sensitive)
    + Click OK.

Step 3a – Configure IIS Server

  1. In the Microsoft Windows Control Panel, click Programs > Programs and Features.

    If you are using Microsoft Windows 8 or 2012 Server, Programs and Features is available directly from the Control Panel.

  2. Click Turn Windows features on or off.
  3. If you are using Microsoft Windows 2012 Server, use the following steps:
    1. In the Add Roles and Features Wizard, click Role-based or feature-based installation, and click Next.
    2. Select your server, and click Next.
    3. Select Web Server (IIS), if it is not already installed, ensure that Common HTTP Features is selected, and click Next until you get to the Role Services section of the wizard.
    4. Expand Application Development.
    5. Select CGI and ISAPI extensions if it is not already selected, and click Next.
    6. Click Install.
  4. In the Internet Information Services (IIS) Manager console, under Connections, select your server name.
  5. Double-click ISAPI and CGI Restrictions.
  6. Under Actions, click Add.
  7. Enter the path to the cognos.cgi file. The file is in the c10_location\cgi-bin directory.

    You must enter the full path, including the file name. If the path includes spaces, ensure you use quotation marks around the path. For example, enter:

    C:\Program Files\ibm\cognos\c10\cgi-bin\cognos.cgi

  8. Enter a Description, such as CognosCGI.
  9. Select Allow extension path to execute, and click OK.
  10. Under Connections, expand Sites, and under your website, add the virtual directories as shown in the table:
    Table 1. Required virtual directories

    Alias

    Location

    ibmcognos

    c10_location/webcontent

    ibmcognos/cgi-bin

    c10_location/cgi-bin

  11. Select the cgi-bin virtual directory that you created.
  12. Double-click Handler Mappings.
  13. Under Actions, click Add Module Mapping.
    1. In Request Path, type cognos.cgi.
    2. In Module, select CgiModule.
    3. Leave Executable (optional) blank.
    4. In Name, enter a name for the entry, such as CognosCGI.
    5. Click OK.
  14. Under Actions, click Add Module Mapping.
    1. In Request Path, type cognosisapi.dll.
    2. In Module, select IsapiModule.
    3. In Executable, enter the path to the cognosisapi.dll file.

      For example, enter:

      C:\Program Files\ibm\cognos\c10\cgi-bin\cognosisapi.dll

    4. In Name, enter a name for the entry, such as CognosISAPI.
    5. Click OK.
    6. Click Yes in the dialog box to allow the ISAPI extension.
  15. Start IBM Cognos Configuration.
  16. In the Explorer panel, click Local Configuration > Environment.
  17. In the Gateway URI box, change the cognos.cgi part of the URI to cognosisapi.dll.

On the IBM Cognos 10 Gateway install,

  1. Open <COG_ROOT>\webcontent\default.htm in a text editor. For example, D:\cognos\c10\webcontent\default.htm.
  2. Find the line that reads
    1
    2
    window.setTimeout("window.location.replace('cgi-bin/cognos.cgi?
     b_action=xts.run&m=portal/main.xts&startwel=yes')",5);

    and change cognos.cgi to cognosisapi.dll.

    1
    2
    window.setTimeout("window.location.replace('cgi-bin/cognosisapi.dll?
     b_action=xts.run&m=portal/main.xts&startwel=yes')",5);

This will make http://<webserver>/<alias> work like http://<webserver>/<alias>/isapi, redirecting to the ISAPI Gateway after showing a splash screen.
For SSO, set windows authentication on the cgi-bin folder in IIS manager.

Results for IIS

Users can access the gateway by entering http://servername/ibmcognos in their Web browsers.

https://www.ibm.com/support/knowledgecenter/en/SSEP7J_10.2.2/com.ibm.swg.ba.cognos.inst_cr_winux.10.2.2.doc/t_inst_usetheisapigateway.html

After you are done, start the Cognos service and verify that you can connect to the website and access the portal and Cognos Administration.

If you use Windows Authentication to connect to the SQL content store database, you need to set the IBM Cognos service to use a windows account, and not local system, or you get below error;
CFG-ERR-0103 Unable to start IBM Cognos service.
Execution of the external process returns an error code value of ‘-1’.

Step 3b– copy the BI content store data

Export your old Cognos BI content to a zip file, copy the zip file to the new deployment folder, and import the content store data, to get security and reports moved over.

Data source you have to manually update in cognos connection, to point to correct server.

To be able to schedule Planning Macros from Cognos BI you need to add this;
In IBM Cognos Administration in Cognos BI, on the Configuration tab, click Dispatchers and Services. Click the Cognos BI dispatcher that you want to configure. The list of services is displayed. Find the MonitorService service. You may have to click the Next Page icon to find the service in the list.
Click the Set properties – MonitorService icon.
On the Settings tab, for the Advanced settings of the Environment Category, click Edit.
Select Override the settings acquired from the parent entry.
Create a new parameter named enable.session.affinity. Set its value to true.
Create another new parameter named session.affinity.services.
Set its value to serviceName=planningAdministrationConsoleService.

Click OK, then click OK again.

 

Step 4 – Install Planning Server and Planning Administration

Install Planning Server and Planning Administration into EP1021. This will give you some startup icons.

Note: You will now have two different Cognos Configuration instances that work on their own set of configuration files in the two locations you have installed into. This is how it should be.

At d:\cognos create cognos$ fileshare for your filesys.ini file. When installing Cognos Planning Server enter \\servername\cognos$\planning as Analyst UNC path, to get the files created at d:\cognos\planning\bin\filesys.ini


When installing admin tools on a server, mark that you run them on a citrix server.

Create a SQL alias for the planning store, in the SQL client on the Cognos Planning server.

You need to install the following Microsoft SQL Server 2005 Backward Compatibility Component:
● SQL Distributed Management Objects (SQL-DMO) from SQLServer2005_BC.msi file.

If you use the Generate Framework Manager extension or the Generate Transformer Model extension you will need to install either Framework Manager or Transformer on the same machine that you have installed the Planning Admin tools on.
Since Framework Manager and Transformer are now different renditions they need to be installed into separate directory paths. To accommodate for this in Cognos Configuration browse to the Planning entry in the Cognos Configuration tree and enter a path pointing to the directory that IBM Cognos Business Intelligence is installed in.


Note: A common mistake is browsing too deeply into the directory such as to the \bin location. Browse only to the parent directory such as \ibmcognos\c10 or in this example \ibm\bi1022\c10_fm.

Set the Gateway URI to the BI server like this
http://servername.domain.com:80/ibmcognos/cgi-bin/cognosisapi.dll
Set the External and Internal dispatcher URI to point to the Cognos Planning server itself as this
http://servername.domain.com:9301/p2pd/servlet/dispatch 
Dispatcher URI for external applications should point to BI server
http://servername.domain.com:9300/p2pd/servlet/dispatch
Content Manager URI should point to primary content manager on BI server http://servername.domain.com:9300/p2pd/servlet

 

Step 5 – Configure the Planning Store

Start the new Cognos Configuration from your Planning install and set up a planning store, by connecting to a new, fresh planning store database.

If not SQL server 2012 is shown inside Cognos Configuration as an option, you can add support to it by update the D:\ibm\ep1021\c10\bin\epEAdminSQL7Resources.xml file.
Make a backup copy of the c10_location\bin\epEAdminSQL7Resources.xml file.
Open the c10_location\bin\epEAdminSQL7Resources.xml file in a text editor.
Find the entry for Resource ID=”2k8DefaultProviderDriverString” and locate the <![CDATA[SQLNCLI10]]> entry.
Change the entry to read <![CDATA[SQLNCLI11]]>.
Save the file and close it.

Note: It is ok to reuse an old content store and therefore save some work configuring, for example, the security settings. However, you should always create a new, empty planning store database, and connect to that. All your planning components can then be moved over using the deployment export/import tool.

 

Make sure that the dispatchers you have in Planning configuration do not have port conflicts with the ones specified in the BI configuration. You have to select a different port on the Planning dispatchers.

In the Planning configuration, point to the main gateway so that it can find the content store. Therefore, ensure that the Gateway URI in the Planning configuration is the same as in the BI configuration. For this reason, you must configure your BI gateway first.

Start the Planning service and you should be able to run Analyst and Cognos Administration console.

The Cognos services should be set to startup type “Automatic (Delayed start)” on a Microsoft Windows 2012 server.

Step 6 – Install Planning Client (Optional)

Optionally, you can also install the Planning client kit if you want to have the client application on the same computer.

In folder C:\ibm\ep1021\bin\Language\English, on server where Analyst is installed, do
Copy adminbifs.amf to adminbif.AMF
Copy adminodbc.AMF to adminodb.AMF

You must start Cognos Planning Contributor Administration Console as “run as administrator” to make it work.

Post Installation

Moving Over Applications

Use the Deployment Wizard to move any applications from your old system that you want on the new, upgraded system. On the old system, select Export with data to export one or more applications into a folder on your disk. This folder can be moved to the deployment location on the new system, and you can use the Deployment wizard to import the application into the new system.

If you want the deployment wizard to bring in existing security settings, it is important that you have set up the same or similar namespaces. If the new namespaces contains the same users, groups and roles, the import wizard can automatically match the names and bring over the security. If you want to use new groups and roles, it also allows you to manually map from the old security to the new one.

Any Analyst libraries used by the exported Contributor applications can be included in the deployment files and easily moved to the new system. If you have some Analyst-only libraries or if you do not use Contributor at all, see the next section.

First import the database and then import macro and links.

Moving Over Applications – old way

Disconnect the application in the old CAC
Copy the database files over to the new SQL server (with SQL backup / restore)
Load the database in the new SQL server and setup the SQL login
Update each database with SQL Server Management Studio
Expand tables and select table dbo.adminoption
right click and select “edit top 200 rows”


find in column optionid, the following 3 rows and erase the value at optionvalue if any
PAD_GUID
PAD_NAME
PAD_NAMESPACE
Exit SQL Server Management Studio
Go into the new CAC and select Link to existing Applications.

 

Moving Over Analyst Libraries

Analyst objects are stored in files in folders. Therefore, if you want to use existing analyst libraries on a new system, you have two options:

  • If you don’t need to use the old system again, you can leave the libraries where they are, and move the file called LIBS.TAB to the new system. This file contains the path to all the libraries set up in Analyst. If you point to this file in the Filesys.ini entry called Libs= it will just work on the old libraries where they are stored already.
  • If you want a transition period, where both the old and the new system are operational, you should take a copy of all your existing Analyst library folders and move them to where you want them to be stored when using the new system.

After the libraries are moved, you can manually reconnect to the libraries via the Analyst administration screens. If you have many files, it is faster to make use of the old LIBS.TAB file and move it to the new system. This will replace the LIBS.TAB file created during installation. On a default installation, this will be in the BIN folder below your installation location.

Next, start Analyst, look on the administration screens, and you will see it pointing to the old Analyst libraries. Right-click in the table with the library information, and choose Change Path which allows you to search and replace portions of the path on all libraries in one operation.

For example, if your old libraries were stored below \\servername\data\analyst\libraries, and you made a copy of these in \\newservername\data\analyst\libraries, you would do a search and replace on \\servername and replace it with \\newservername.

If the filesys.ini is in the wrong folder, you can remove this instancelock line in the filesys.ini

and then copy the filesys.ini to the correct folder. You need to copy the other files too.


You need to update the path inside filesys.ini to point to the new location for all files.
Then from inside CAC, you go to Tools – Update FileSys.ini options to point out the new location.

Backing-Up Old Applications

As your model evolves or as budgeting cycles pass, you may have old applications on your system that you no longer use, but want to keep in case you ever need to reference them. There are various ways to remove them from your Administration Console to make it more manageable and easy to overview.

You should first determine if there is data in the applications that is not already stored elsewhere. Some applications work by loading data from external sources and never have data entered that is not already stored elsewhere. If you have the original data sources, you may not need to keep the old applications at all.

If you do need to keep a backup of your application, there are two options:

  • If you want to be able to bring the application back online and access the data via the Planning software, you can export the application with data using the Deployment wizard. The resulting folder can be compressed and backed up for later use. When it needs to be restored, the Deployment wizard will be able to do that as well.
  • If you just want to keep a copy of your data that can be accessed from any data access tool, you can publish the cubes into a database table. The data can then be viewed using whatever client tools you would normally use to access that database, or be backed up as you would any other database.

Additional settings on the Cognos Planning Windows server

To prevent errors because of people login to the server with the service account this should be set;

Logon to the application server as an administrator
Launch the group policy editor (click “Start – Run” then type “gpedit.msc”)
Navigate “Computer Configuration -> Administrative Templates -> System-> UserProfiles”
Double-click on “Do not forcefully unload the user registry at user logoff”
Change the setting from “Not Configured” to “Enabled”.

Move database log files to different folder

From inside the SQL management studio, do similar to this;

ALTER DATABASE database_name SET OFFLINE;
... move the file(s) to new location
ALTER DATABASE database_name MODIFY FILE ( NAME = logical_name, FILENAME = 'new_path\os_file_name' );
ALTER DATABASE database_name SET ONLINE;

More information:

https://www.ibm.com/support/pages/downloading-ibm-cognos-planning-1021

https://www-01.ibm.com/support/docview.wss?uid=swg21991239

https://www.ibm.com/support/pages/how-configure-ibm-cognos-planning-102-work-ibm-business-intelligence-1022-fp5

https://www.ibm.com/support/pages/node/161227

https://www.ibm.com/support/pages/error-unable-get-list-drives-0

https://www.microsoft.com/en-us/download/confirmation.aspx?id=42295

https://www.ibm.com/support/pages/node/553105

https://www.ibm.com/developerworks/data/library/cognos/infrastructure/web_servers/page599.html

https://www.ibm.com/support/pages/node/571589

https://social.technet.microsoft.com/Forums/en-US/c55aa101-059d-491e-9fc2-73b5d8171eb8/protect-against-syn-attacks?forum=winservergen

 

Product:
Planning Analytics Workspace version 36
Microsoft Windows 2016 server

Problem:
After some time use, the user can not access the paw. They can not login.
This happen after the server have rebooted during a Microsoft Windows Patching.
To find out if your PAW installation is damage, check this steps:
When you run a docker ps command, you see services listed as restarting.
When you run a ./paw.ps1 stop command, you see services that does not stop, even after 20 minutes.

Error message:
503 The server is temporarily unable to service your request due to maintenance downtime or capacity problems. Please try again later.

Follow this guide lines to troubleshoot:
https://www.ibm.com/support/pages/troubleshooting-planning-analytics-workspace-related-docker-issues
https://www.ibm.com/support/pages/how-stop-and-start-planning-analytics-workspace-command-line

If nothing helps do this:
– increase to 8 cpu cores on your Microsoft Windows 2016 box
– turn off your anti virus software (McAfee and Symantec)
– turn off Windows Defender Real-Time Protection
– uninstall latest windows patch applied before last reboot of Windows server
– run paw.ps1 command as is, to repair containers (if they exist with strange names)
– remove paw and install it again
– restore your paw database backup with the ./restore.ps1 script

If you do not have a backup of paw database content, you need to do this steps;
– set docker service to manual
– stop cognos and planning service
– reboot the windows server
– after windows have started fine, manually start the docker service
– in powershell, enter docker ps, to monitor that the containers have started
– enter the command ./paw.ps1 stop
– when all containers is stopped, run the ./backup.ps1 command to get the backup zip files created.

Remove paw
https://www.ibm.com/support/knowledgecenter/SSD29G_2.0.0/com.ibm.swg.ba.cognos.tm1_inst.2.0.0.doc/t_paw_uninstall.html
– copy the configuration files from folder d:\ibm\paw\config to a different temp folder
– copy the backup files from folder d:\ibm\paw\backup to a different temp folder
– run ./paw.ps1 stop to stop all containers
– run ./paw.ps1 down –rmi all -v
– run docker ps -a to list all containers
– run docker rm $(docker ps -a -q) to remove all containers
– run docker images to list all images still there
– run docker rmi <image-id> to remove any Hello-World containers
– run docker network ls to show the docker networks
– rename the d:\ibm\paw\log folder to log-old
– create a new empty d:\ibm\paw\log folder
– copy the config/paw.ps1 file to a temp folder
– remove the d:\ibm\paw\config\paw.ps1 file

In case you need to remove docker, follow the steps last on this page https://docs.microsoft.com/en-us/virtualization/windowscontainers/manage-docker/configure-docker-daemon

To install docker on Windows 2016, follow this steps https://docs.docker.com/ee/docker-ee/windows/docker-ee/

Run below command to test that docker works, before installing PAW.

docker container run hello-world:nanoserver-sac2016

Reinstall paw

– start the IBM Cognos Planning Analytics Services
– run ./Start.ps1 answer Yes to both questions.
– Inside the Administration web page, enter all the values (check in your old paw.ps1 file for values)
– click on validate
– click on update
– you may get a error, open the newly created d:\ibm\paw\config\paw.ps1 file in notepad++
– add manually the configuration values for $env:PAGatewayHTTPPort=”9580″ and $env:ProxyTimeoutSeconds=”600″ to the config/paw.ps1 file. Check from you backup config/paw.ps1 file what values you used last, when it was working.
https://www.ibm.com/support/knowledgecenter/SSD29G_2.0.0/com.ibm.swg.ba.cognos.tm1_inst.2.0.0.doc/c_paw_config_file.html
– Inside the Administration web page, click on restart
– wait for paw containers to start
– surf to your paw page, does it work, but the folders are missing?
– run the ./restore.ps1 d:\temp\backup\yyyy-mm-dd  command to restore from your backup
– surf to your paw page, hopefully all is there.

If you still have issues, please contact IBM Cognos support for better instructions.

There can be new versions of other software that have issues with Docker containers;
https://github.com/docker/for-win/issues/5044
If the system goes down after a few minutes, try to stop the VMware Tools service to see if that helps.

More information:

To prevent this from happening, you must:
Always run the ./paw.ps1 stop script before you restart docker service or reboot the server.
Every week run the ./backup.ps1 script, to make a zip backup of the content inside PAW.
Exclude the docker folders from your anti virus software.
Turn off Real Time Protection.
Set the Docker service to Automatically (Delayed Start)
Ensure there is at least 100 GB free space on the hard disk for docker files.
Add ./shutdown.ps1 script to windows shutdown policy.

https://www.ibm.com/support/knowledgecenter/SSD29G_2.0.0/com.ibm.swg.ba.cognos.tm1_inst.2.0.0.doc/t_paw_shutdown_on_windows_mongo_db.html

More info about Anti-virus software:

https://docs.microsoft.com/en-us/windows-hardware/drivers/ifs/anti-virus-optimization-for-windows-containers
https://docs.docker.com/engine/security/antivirus
https://success.docker.com/article/endpoint-security-for-windows-containers
https://support.symantec.com/us/en/article.tech183201.html
https://support.symantec.com/us/en/article.tech246815.html
https://kc.mcafee.com/corporate/index?page=content&id=KB90041
https://github.com/Microsoft/hcsshim/issues/437

“We find out with premier support that normally when container starts NET_LUID index for an NDIS loopback interface is allocated from registry key HKLM\SYSTEM\ControlSet001\Services\NDIS\IfTypes\24\IfUsedNetLuidIndices and when container stops it will be released.

But if you restart computer where is running containers then those values will not be released and if you have multiple automatically starting containers and scheduled restarts then eventually that registry key value will run out of free indexes and you are not anymore able to start containers”

Product:
Planning Analytics 2.0.5
Planning Analytics Workspace version 35
Linux Red Hat

Issue:
After setup of HTTPS to PAW you can not surf to the paw webpage.
If you check the pa-gateway log files in folder /ibm/paw/log/pa-gateway/ you see a error like this
AH01903: Failed to configure CA certificate chain!
in the pa-proxy-error.log file.

Solution:
Go to the /ibm/paw/config folder and check the file rights
ls -l
drwx—— dockeruser dockeruser 8774 Sep 26 11:03 pa-workspace.pem
if above will give that only the user dockeruser can read the certificate file, and therefor can not Apache read the file and include it in the upstart.
You need to ensure that the group docker can read the files.
To change owner and group of the file enter:
chown dockeruser:docker pa-workspace.pem
To change read rights to the file enter:
chmod 755 pa-workspace.pem
https://ss64.com/bash/chmod.html
https://ss64.com/bash/chown.html

Stop PAW with command in /ibm/paw/scripts folder;
./paw.sh stop
Start paw with command
./paw.sh

Now it should work. (you need to change path and users to match your environment.)

Troubleshoot:
In PUTTY you can write this BASH commands to check the PAW environment.
To check what docker containers that is running enter:
docker ps
if the first one say pa-gateway is restarting, this mean that the Apache server is not up and the pa-gateway can not load.
To go into the pa-gateway container enter:
docker exec -i -t pa-gateway /bin/bash
To read the Apache log enter:
more /var/log/apache2/error.log
Enter exit to return to Linux:
exit
To move to config folder enter:
cd /ibm/paw/config
To check content of paw.env file enter:
more paw.env
To edit paw.env file enter:
nano -w paw.env
Check that below rows are inside the paw.env file, this activate the https:
export EnableSSL=true
export ServerName=paw-server-name.domain.com
To save the changes in NANO enter:
ctrl+o
To exit NANO text editor enter:
ctrl+x

 

Sometimes a container is damage, then you can try to recreate it as below:

Stop the PAW containers with command:
./paw.sh stop
To erase pa-gateway container enter:
docker rm pa-gateway
To start paw and recreate containers missing enter:
./paw.sh

https://docs.docker.com/engine/reference/commandline/rm/

How setup HTTPS with PAW:
https://www.ibm.com/support/knowledgecenter/en/SSD29G_2.0.0/com.ibm.swg.ba.cognos.tm1_inst.2.0.0.doc/t_paw_enable_ssl.html

Product:
Planning Analytics 2.0.5 TM1 Perspective version 11.0.5.79-0
Microsoft Windows 2016 terminal server
TM1 package connector version 10.2.6100.8-0

Issue:
When you start TM1 Perspective you get a error, if TM1 Package Connector is installed on the same computer. If you remove TM1 Package connector – then TM1 perspective works fine.

Error message:
Microsoft Excel
Missing Library c:\program files\ibm\cognos\tm1_perspective\bin\gsk8ssl.dll
C:\program files\ibm\cognos\tm1_perspective\bin\gsk8km.dll

Suggested solution:
After install of TM1 Perspective, copy the gsk8*.dll files from the c:\program files\ibm\cognos\tm1_perspective\bin folder to the package connector folder c:\program files(x86)\ibm\cognos\c10\bin folder. Overwrite the existing files.

Test to start TM1 perspective again.

If you use a older TM1 Package Connector version, then above error is also gone.

Product:
Planning Analytics 2.0.5
Planning Analytics for Office
Microsoft Windows 2016 server

Problem:
When you connect to PAW server from PAX inside Excel you get a error.

Error message:
System.Net.WebException: Unable to connect to the remote server —> System.Net.Sockets.SocketException: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond 192.168.200.10:8080
at System.Net.Sockets.Socket.DoConnect(EndPoint endPointSnapshot, SocketAddress socketAddress)
at System.Net.ServicePoint.ConnectSocketInternal(Boolean connectFailure, Socket s4, Socket s6, Socket& socket, IPAddress& address, ConnectSocketState state, IAsyncResult asyncResult, Exception& exception)
— End of inner exception stack trace —
at System.Net.HttpWebRequest.GetResponse()
at Cognos.Office.Reporting.Common.ImageBalloon.ShowAnimation()

Possible solution:
That a proxy server is setup inside IE – Internet options that is preventing the communication to happen.

Go to Control panel on your laptop
Click on Internet Options
Click Connections tab
Click LAN settings button
Unmark Proxy server
Click OK and test again.

More information:
https://www.exploringtm1.com/how-to-install-planning-analytics-for-excel-pax/
https://www.ibm.com/support/knowledgecenter/en/SSD29G_2.0.0/com.ibm.swg.ba.cognos.tm1_inst.2.0.0.doc/t_tm1_inst_sso_pax.html

Setup of SSL at TM1WEB
https://www.ibm.com/support/knowledgecenter/SSD29G_2.0.0/com.ibm.swg.ba.cognos.tm1_inst.2.0.0.doc/t_pa_use_ibmkeymgmt.html

Product:
Cognos Enterprise Planning 10.2.1 PLANSVR=10.2.1000.1-0
Microsoft Windows 2016 Server

Problem:
How move analyst folders from PROD to DEV server?

Solution:
Locate where the files are on the server, normally in the same file share as the filesys.ini file.
Inside Analyst you find the path to filesys.ini from menu Tools – Options, read Active Filesys.ini file value.
Inside Analyst you find the path to your data from menu File – Administration – Maintain Libraries and Users, note down the path that is listed in this dialog.
Take a backup of the files in the BIN folder, that is mostly these files
Filesys.ini
LIBS.BAK
LIBS.TAB
PADLOCKS.TAB
UGR.BAK
UGR.TAB

From PROD copy the above files to DEV servers file share.
Rename folder containing any old planning analyst data files under folder \programs\ on the DEV server.
Copy all your planning data folders and files from PROD servers \\servername\planning$\programs\adaytum\… to your DEV server.
The path can be different in your setup.

Copy also the Locks.log and Logins.log files from the PROD to the DEV server in folder \\servername\planning$\bin\Locks.

On the DEV server open the filesys.ini file in NOTEPAD.
Edit the path to TAB and log files to match the new server.
change Libs=\\prodservername\planning$\bin\LIBS.TAB to Libs=\\devservername\planning$\bin\LIBS.TAB
change Locks=\\prodservername\planning$\bin\wct\..\Locks\Locks.log to Libs=\\devservername\planning$\bin\wct\..\Locks\Locks.log
change UGR=\\prodservername\planning$\bin\UGR.TAB to Libs=\\devservername\planning$\bin\UGR.TAB
Repeat for the top five lines to update.
Save your updated FILESYS.INI file on the DEV server.

Start Analyst against the DEV server and go into File – Administration – Maintain Libraries and Users dialog. Right click and select Change Library Path…
In dialog Replace Path Component enter below values:
Find String: \\prodservername\planning$
Replace with String: \\devservername\planning$
Click on Replace.

This will update the path to the data files in the LIBS.TAB file.
Click OK and exit Analyst.

Ask a different user to test Analyst in your DEV(test) environment to see that it worked.

User, Groups and Roles are stored in the UGR.TAB file.

In the Locks folder on the servers file share, you can see a USR00000.LOG file for each Planning Analyst user who have logged in.

More Information:
http://www-01.ibm.com/support/docview.wss?uid=swg21982904
ftp://public.dhe.ibm.com/software/dw/dm/cognos/upgrade_and_migration/performance_management/migrating_analyst_to_new_environments.pdf

So, in order for users to see the expected set of libraries in Analyst, the Planning Store defined in Cognos Configuration needs to contain the correct filesys.ini path (this Planning Store entry can be viewed or updated via CAC, at: Tools>Update FileSys.Ini options); And the filesys.ini defined in Planning Store/CAC needs to point to the correct LIBS.TAB file, which in turn needs to contain the correct library location information.

Changes to library paths, and the adding or removal of a library from Analyst, are made in the ‘File’>’Maintain Libraries and Users’ dialog in Analyst, which writes these changes to the LIBS.TAB file at the location indicated in filesys.ini. Use of the ‘File’>’Maintain Libraries and Users’ dialog is the only supported way to modify LIBS.TAB.