Product:
Planning Analytics 2.0.8
Microsoft Windows 2016 Server

Problem:
How install the ILMT BIG FIX client to Planning Analytics servers?
IBM demand that virtual PA installations have the ILMT client installed and that the customer provide an ILMT report of the CPU usage for virtual installations.

https://lodestarsolutions.com/why-have-i-never-heard-about-the-ibm-ilmt-tool-for-cognos-bi-or-tm1/
http://www.aramartech.co.uk/for-ibm-cognos/ilmt-(1)
https://exploringtm1.com/tm1-ilmt/

How install the BIG FIX client:
You should have installed the ILMT and BIG FIX server in your organization on a separate server.
During the installation of the Big Fix server a license is created for your organization.
Above is a must for you to be able to install the client.

The simplest way is that you get a setup.exe and actionsite.afxm file from the server copied to your Planning Analytics (TM1) server – place all files in same folder (c:\install). If you do not have the afxm file you get a error like this:

Run the installation of the client program BigFix-BES-Client-9.5.14.73.exe


(The files to copy for the client, can be found on the BigFix server in folder C:\Program Files (x86)\BigFix Enterprise\BES Installers\Client)

Click OK to the language selection.

Click Next.

Click next to the selection of installation folder.


Click install.


Click finish.

The client should talk to the server and show up direct, inside the Big Fix server console.

Then the IT department need to activate the scans for IBM software.
https://help.hcltechsw.com/bigfix/9.5/inventory/Inventory/planinconf/t_scheduling_soft_scans.html

There is the possibility that IT department need to download other scan software, as part of the Big Fix server configuration to allow the Big Fix client to perform the software scan. This is done with the Big Fix system.

Download software from here (old version):

Install the installation generator first from here;
http://software.bigfix.com/download/bes/95/BigFix-BES-9.5.2.56.exe

The server exe is found here;
http://software.bigfix.com/download/bes/95/BigFix-BES-Server-9.5.2.56.exe


After the installation generator is setup, you get instructions on how to install the clients.

More information:

https://support.hcltechsw.com/csm?id=bigfix_support
https://help.hcltechsw.com/bigfix/10.0/platform/Platform/Installation/c_licensing_tasks.html
https://help.hcltechsw.com/bigfix/9.5/platform/Platform/Installation/c_installing_the_client_manually.html
https://www.ibm.com/support/knowledgecenter/SS8JFY_9.2.0/com.ibm.lmt.doc/Inventory/planinconf/t_changing_freq_sch_scan.html
https://www.ibm.com/support/knowledgecenter/SS8JFY_9.2.0/com.ibm.lmt.doc/Inventory/overview/c_overview_main.html
https://www.ibm.com/support/knowledgecenter/SS8JFY_9.2.0/com.ibm.lmt.doc/Inventory/planinconf/c_default_scan_configuration.html
https://forum.bigfix.com/t/bigfix-server-install-fails-missing-masthead/17434/4


The big fix program use port 52311 to talk to the server.

On the Big Fix server, launch console, create a lot of default values.

https://uit.stanford.edu/service/bigfix/pc
https://www.ibm.com/support/knowledgecenter/SS8JFY_9.2.0/com.ibm.lmt.doc/Inventory/planinconf/t_installing_bigfix_win.html#task_rnp_xzm_tx
https://forum.bigfix.com/t/endpoint-manager-need-to-create-new-masthead-file/13327/5
https://help.hcltechsw.com/bigfix/9.2/platform/Platform/Config/c_editing_the_masthead.html

Please check the current license demands from IBM on the Cognos and TM1 products, as they may change.

Product:
Planning Analytics Workspace
Microsoft Windows 2016 server

Problem:
PAW take long time to start when anti-virus software is running.
https://success.docker.com/article/endpoint-security-for-windows-containers

Suggested solution:
Depending on your anti virus program, the settings are different.

Please try this:
exclude this folders and sub-folders from scanning
c:\programdata\docker
c:\Program Files\ibm\cognos\tm1_64
c:\Program Files\ibm\cognos\analytics\temp\
c:\ProgramData\Microsoft\Windows\HNS
d:\ibm\paw
d:\docker
d:\tm1applications folder ( can be d:\tm1server\app1\data )

Folders name depend on the installation made of docker and PAW on your server.

For McAfee you can setup the exclude like this:
On-Access Default Processes Policies
**\Docker\*
**\ProgramData\Microsoft\Windows\HNS\*
**\Install\ipa_workspace_local_win*\*

Exclude also all “active scanning” and instead run a scan on the disk once a week, when you have stopped the PAW and Docker. Turn off Windows Defender Real-Time Protection.

Exclude scan of the processes used by docker and cognos, like java.exe.

 

Upgrade your anti virus software to latest version and see if that helps.

More information:
https://docs.docker.com/engine/security/antivirus/
https://ashleypoole.co.uk/2017/common-issue-pulling-windows-docker-images/
https://docs.microsoft.com/en-us/windows-hardware/drivers/ifs/anti-virus-optimization-for-windows-containers
Redundant scanning problem

There will likely be many containers depending on the same package layers. The same data stream of a given package file will provide the data for placeholders on multiple container system volumes. As a result, there is potential for redundant AV scans of the same data in every container. This has an unnecessary negative impact on the performance of containers. This is a signification cost given that containers are expected to start quickly and may be short-lived.

https://www.windowscentral.com/how-exclude-files-and-folders-windows-defender-antivirus-scans
https://github.com/moby/moby/issues/38582

https://docs.microsoft.com/en-us/windows-hardware/drivers/ifs/anti-virus-optimization-for-windows-containers

https://success.docker.com/article/endpoint-security-for-windows-containers

https://support.symantec.com/us/en/article.tech183201.html

https://support.symantec.com/us/en/article.tech246815.html

https://kc.mcafee.com/corporate/index?page=content&id=KB90041

https://www.ibm.com/support/pages/which-cognos-files-need-be-excluded-virus-scan

Product:
Planning Analytics 2.0.8
Microsoft Windows server 2016

Problem:
Open a tm1web view in the new PA version give error, it worked in the old TM1 server.

Error message:
Limits exceeded
The action has been terminated because it exceeds the configured maximum memory limit.

Solution:

Open tm1web_config.xml file in Notepad++. It is in folder C:\Program Files\IBM\cognos\tm1_64\webapps\tm1web\WEB-INF\configuration\

Having WorkbookMaxCellCount blank or setting it to less than 0 indicates that an unlimited cell count for workbooks is allowed.
Before IBM Planning Analytics version 2.0.7, the default value is -1, which indicates an unlimited number of cells are allowed in a workbook.
After IBM Planning Analytics version 2.0.7, the default value is 500000.
Setting this parameter to 0 indicates that workbooks cannot have any cells.
You must set it to above 0.

You must do a restart of the application server for the change to take affect.

If WorkbookMaxCellCount parameter is in tm1web_config.xml and it is not the default, when the user opens a workbook, the server validates its cell count against WorkbookMaxCellCount. If the cell count of the workbook exceeds WorkbookMaxCellCount, an error message is logged and the workbook is not opened.

Can also be other values that affect how tm1 show cells.

More information:
https://www.ibm.com/support/pages/tm1-error-maximum-memory-action-exceeded-view-may-be-too-large
https://www.ibm.com/support/knowledgecenter/SSD29G_2.0.0/com.ibm.swg.ba.cognos.tm1_inst.2.0.0.doc/c_tm1web_cfg_params_v10r2.html

Product:
Cognos TM1 10.2.2
Microsoft Windows 2008 server

Problem:
Can not connect to TM1 server from client TM1 Architect.
Error:  TM1 Perspectives cannot connect to TM1 Admin server

Solution:
Check that you have access to the TM1 admin server, by run telnet from the DOS prompt your client computer;

TELNET  servername  5498

if you get a black screen, and no error message, then you have a open connection.

Then check that you have the same version on you client as on the TM1 server.

You can check the file tm1api.dll in folder C:\Program Files\ibm\cognos\tm1_64\bin

Above the 10.2.2 TM1 client in RTM version.

Above the TM1 10.2.2 fix pack 7 version.  Version number 10.2.20700

https://www.ibm.com/support/pages/how-determine-exact-version-tm1-installed

If you do not have correct version, uninstall the TM1 client from your computer.

Install the correct program and update, and try again.

Run tm1_64b_10.2.2_win_ml.tar.gz and then up_tm1client_win64_10.2.5270.109_ml.tar.gz to install the needed software.

More Information:

https://www.ibm.com/support/knowledgecenter/SSD29G_2.0.0/com.ibm.swg.ba.cognos.tm1_inst.2.0.0.doc/c_tm1_inst_defaultvaluesfortm1installation.html

https://www.ibm.com/support/pages/ibm-cognos-tm1-ssl-expiration-manual-fix-approach-landing-page

https://www.ibm.com/support/pages/node/553505

https://www.ibm.com/support/pages/e4-cannot-connect-admin-server-host-and-port-caused-expired-ssl-certificates

Product:
Planning Analytics 2.0.8
Planning Analytics Workspace 46
Microsoft Windows 2016 Server

Problem:
When going to Planning Analytics Workspace Administration dialog some of the TM1 instance are grey, in the area for memory and cpu usage.

Error:

On PA Agent version 2.0.47.1220, you can find this kind of error in the file c:\Program Files\ibm\cognos\tm1_64\paa_agent\wlp\usr\servers\kate-agent\logs\messages.log
00000048 SystemErr R ERROR:status.py:Error while getting windows registry details: ERROR: The system was unable to find the specified registry key or value
00000048 SystemErr R ERROR:status.py:error getting the registry details: local variable ‘return_object’ referenced before assignment
00000048 com.ibm.pa.kate.agent.scheduler.ScheduledTask E Error occurred while updating the server info json file
Traceback (most recent call last):
File “kateagent/scripts\status.py”, line 1053, in <module>
logger.exception(
NameError: name ‘data_directory’ is not defined
0000005d com.ibm.pa.kate.agent.service.PAKateAgentService E Exception
java.lang.NullPointerException

 

Solution:
A space have come into the TM1 application name in the TM1S.CFG file, and when registered with Microsoft Service, got a extra space in the name.
The PA Agent can not parse the space in the name, and therefor will not display all values.

Stop the TM1 instance.
Edit the tm1s.cfg file to correct value.
ServerName= proven_techniques
should be changed to
ServerName=proven_techniques
Delete the TM1 instance in Cognos Configuration.
Check that the instance is gone – if not, you may need to delete it from a DOS command line.

Enter
sc delete ” proven_techniques”
in the elevated cmd prompt.
Now the windows service should be gone.
Go into Cognos Configuration again,
Add the new TM1 instance and enter a correct name “proven_techniques”
and point out the folder for the configuration file.
Start the service from inside Cognos Configuration.

Surf to PAW and check that the administration page is correct.

Product:
Planning Analytics 2.0.5
Microsoft Windows 2016 server

Problem:
How do i copy files from one server to another server and keep the NTFS security?

Solution:
Check you have a file share on source server.
Create a file share on destination server.
Give everyone full access to the share.
Ensure that the user running the script is local administrator on both servers
Open notepad
Enter below line (modify it for your server names)
robocopy \\serverSource\ShareA \\serverDestination\ShareA /MIR /COPYALL /DCOPY:T /R:1 /W:1 /NP /TEE /LOG:d:\temp\ShareA-RobocopyResults.log
Save file as d:\temp\robocopyfiles.cmd

Open a command prompt as administrator
move to the folder where the script is
run
robocopyfiles.cmd

Check the log files for errors when it is done.

(solution is from this site https://social.technet.microsoft.com/Forums/en-US/3c42061c-d739-4c44-90ec-014b0e08c45c/how-to-copy-file-security-permissions-from-one-server-to-another-one-by-using-robocopy?forum=winserverfiles)
======================
TITLE “Copying ShareA from TestSource to TestDestination”
robocopy \\TestSource\ShareA \\TestDestination\ShareA /MIR /COPYALL /DCOPY:T /R:1 /W:1 /NP /TEE /LOG:C:\Logs\ShareA-RobocopyResults.log
PAUSE
======================

The switch functions are as follows:

/MIR – Creates a mirror copy.

/COPYALL – Copies ALL file attributes

/DCOPY – Copies (ie retains original) Directory Creation/Modified Timestamps. If you don’t include this, all directories will be recreated with NEW timestamps

/R:1 – Retry copy once on failure

/W:1 – Wait 1 second between retries

/NP – No Percentage Completion written to output

/TEE – Output progress to Command Window (I guess TEE = Terminal Emulation)

/LOG – Write out and save to a specified Log File

More information:
https://community.spiceworks.com/topic/278298-move-shared-folders-and-retain-file-and-share-permissions-with-robocopy

Product:
Planning Analytics 2.0.8
Microsoft Windows 2016 server

Problem:
When you click on a TM1 application Web link in Cognos Connection (from Cognos Analytics 11) you get a error. You also noted that the SSO did not work to your Cognos Analytics 11 webpage.
You can also get into pmpsvc page, but with wrong colors.

Error:
error, see logs

Solution:
To make a link from CA work to Planning Analytics Web (PMPSVC) you must login correct to Cognos Analytics (CA11) first.
Ensure you surf to http://servername/ibmcognos and not to http://servername:9300/bi/v1/disp

Please also try to, in Internet Explorer change the Compatibility view settings to be blank.

“Display intranet sites in Compatibility View” should be checked off.

More information:
https://www.ibm.com/support/pages/how-setup-tm1-web-and-tm1-applications-cam-authentication

https://docs.microsoft.com/en-us/internet-explorer/ie11-deploy-guide/missing-the-compatibility-view-button

Product:
Planning Analytics 2.0.9
Microsoft Windows 2016 server

Problem:
After upgrade to Planning Analytics 2.0.9, user of TM1 Application web (contributor) get a blank page or below error in web browser when they try to open a link.

Error:

Solution:
Clear the web browser cache before you surf to PMPSVC webpage.

You can also try a script to clean the browser cache, please test the script in your lab first.
Below script will clean Chrome browser cache:

REM echo %username% > C:\ProgramData\user.$$$

ECHO       Clearing Chrome cache
taskkill /F /IM “chrome.exe”

REM Set /p uname=< C:\ProgramData\user.$$$
REM set ChromeDataDir=C:\Users\%uname%\AppData\Local\Google\Chrome\User Data\Default

set ChromeDataDir=C:\Users\%USERNAME%\AppData\Local\Google\Chrome\User Data\Default
set ChromeCache=%ChromeDataDir%\Cache
del /q /s /f “%ChromeCache%\*.*”
del /q /f “%ChromeDataDir%\*Cookies*.*”

set ChromeDataDir=C:\Users\%USERNAME%\Local Settings\Application Data\Google\Chrome\User Data\Default
set ChromeCache=%ChromeDataDir%\Cache
del /q /s /f “%ChromeCache%\*.*
del /q /f “%ChromeDataDir%\*Cookies*.*”
ECHO      Clearing Chrome cache DONE

More Information:
https://community.spiceworks.com/topic/2018333-help-me-complete-batch-file-script-to-clear-google-chrome-cache-only
https://stackoverflow.com/questions/25210330/script-for-clearing-chrome-or-firefox-cache-on-windows

Product:
Planning Analytics 2.0.8
Microsoft Windows 2016 server

Problem:
What is the requirements for the windows service account to run TM1 servers?

Solution (from IBM web):

User accounts for running TM1 services on Windows

https://www.ibm.com/support/knowledgecenter/en/SSD29G_2.0.0/com.ibm.swg.ba.cognos.tm1_inst.2.0.0.doc/c_tm1serviceaccount_n701df.html

The account must have the following privileges on the local computer:

Act as part of the operating system

Bypass traverse checking

Increase quotas (Adjust memory quotas for a process)

Replace a process level token

Log on as a service

Have read and write privileges on the Windows Registry item

If you use “local system” you will not be able to use Kerberos, or have access to read csv files from external file shares.

https://www.ibm.com/support/knowledgecenter/SSD29G_2.0.0/com.ibm.swg.ba.cognos.tm1_inst.2.0.0.doc/c_integratedlogin_nc0007.html#IntegratedLogin_NC0007

In integrated login mode (security mode 3), TM1 authentication compares the user’s domain-qualified Microsoft Windows login name to the contents of the UniqueID element of the }ClientProperties cube.

If there is a match, the user is authenticated to TM1. If Active Directory groups have been imported into the TM1 Server, Active Directory group memberships are honored.

If no match is found, TM1 displays an error message stating that the client name does not exist. TM1 Server does not prompt for login information.

Users who want to access TM1 data in a server that is configured for integrated login must authenticate to Microsoft Windows first and then use TM1 clients to access the TM1 Server.

https://www.ibm.com/support/knowledgecenter/SSD29G_2.0.0/com.ibm.swg.ba.cognos.tm1_inst.2.0.0.doc/t_settingupintegratedloginmanually_nc0644.html

 

  1. Run ETLDAP and import the user and group information from your LDAP server, as described in Running ETLDAP. Or update the }ClientProperties cube with other TI scripts.
  2. Shut down the TM1 Server.
  3. Edit the following parameters in the tm1s.cfg file located in your TM1 Server data directory:
    • Set the IntegratedSecurityMode parameter to 3.
    • Set the SecurityPackageName parameter to the security protocol you use for integrated login.

    In the following example, the server is configured to use Kerberos.

    [TM1S]
    SecurityPackagename=Kerberos
    IntegratedSecurityMode=3
    Servername=myserver
    DatabaseDirectory=datafiles
  4. Save and close the tm1s.cfg file.
  5. Restart the TM1 Server.
  6. Optional: Configure the TM1 clients to use integrated login by setting the Use Integrated Login option in the associated user interface.

Follow the directions from IBM knowledge articles for most accurate information.

https://www.ibm.com/support/knowledgecenter/SSD29G_2.0.0/com.ibm.swg.ba.cognos.tm1_inst.2.0.0.doc/c_parametersinthetm1s.cfgfile_n1503fe.html

More Information:

Enabling Cognos single signon to use Kerberos authentication with constrained delegation

https://www.ibm.com/support/knowledgecenter/en/SSEP7J_11.0.0/com.ibm.swg.ba.cognos.inst_cr_winux.doc/t_inst_sso_active_drctry_constrained_del.html

You must configure the constrained delegation in the Active Directory Users and Computers administration tool. On the Delegation tab for all users (IISUser, CognosCMUser, and CognosATCUser), you must select Trust this user for delegation to specified services only and Use Kerberos only to use Kerberos with constrained delegation. Select Trust this user for delegation to specified services only and Use any authentication protocol if you are using the S4U Kerberos extension.

 

Product:
Planning Analytics 2.0.8  TM1_version=TM1-AW64-ML-RTM-11.0.8.37-0
Microsoft Windows 2016 server

Problem:
During installation of Planning Analytics on a new server, the server reboots.
Further investigation show that if you do not select to install “Performance Modeler” then the installation works. There are no errors in the Windows Event log for this issue.

Solution:
Remove McAfee virus software totally from server.

If you copy out the performance modeler msi file and only run installation of that you get this message from the anti-virus software.

You can create a cmd file with this content to run the installation;
msiexec /i “c:\temp\PerformanceModeler64.msi” /L*V “c:\temp\mypm.log” TARGETDIR=”c:\Program Files\pm” ALLUSERS=1

That will give a log file in folder c:\temp, that you can check for errors.

When you run new Planning Analytics Workspace installation on the same Windows server 2016, it will give this error if McAfee is installed.

The Start.ps1 file uses the file Debug-ContainerHost.ps1 to check for the program. The McAfee program need to be removed, not only stopped for the PAW installation to proceed.
if ($null -ne (Get-Process mcshield -ErrorAction Ignore) -Or (Get-WmiObject -class Win32_SystemDriver -Filter “DisplayName LIKE ‘%McAfee%'” | Where-Object -Property State -eq ‘Running’ | Measure-Object).Count -ne 0) ….

 

More Information:

https://www.ibm.com/support/knowledgecenter/SSD29G_2.0.0/com.ibm.swg.ba.cognos.tm1_inst.2.0.0.doc/c_paw_install_prereq.html

https://docs.docker.com/engine/security/antivirus/