Cognos Analytics 11.1.7
Microsoft Windows 2019 Server

After change to use HTTPS in Cognos Configuration, you get a error when you save.

[Populate authentication settings] [ WARNING ] Failed to populate the authentication settings to server

When change values in Cognos Configuration that have with certificates, you need to first stop the “IBM Cognos” windows service.
Then you can save the configuration without warnings.


More Information:

To active Cognos internal certificate, you need to inside Cognos Configuration on your Content Manager server change HTTP to HTTPS under environment – group properties.
Check that server FQDN is at Cognos – Cryptography ;DNS names and Server common name.
Save will create the certificate files.

Start CMD, and move to folder C:\Program Files\ibm\cognos\analytics\bin
Run this to export the Cognos certificate
ThirdPartyCertificateTool.bat -E -T -p NoPassWordSet -r ca.cer

Start MMC on your Windows server where Cognos Gateway is installed, and certificates and go to “Trusted Root Certification Authority”. Right click to Import certs.
Select the ca.cer file and import it.

Inside IIS manager, go to \ibmcognos\bi folder and click on URL Rewrite icon.
Click on Reverse proxy Rules to edit.
At action properties – Rewrite URL: change the http to https{R:0}
Click apply in the right corner.
Exit IIS manager.

On PA server open Command Prompt as an Administrator and navigate to the \bin64\ directory.

Execute the following command to import/trust the certificate for Tm1 admin:
gsk8capicmd_64 -cert -add -db “C:\Program Files\ibm\cognos\tm1_64\bin64\ssl\ibmtm1.kdb” -stashed -label caRoot -file “C:\Program Files\ibm\cognos\tm1_64\bin64\ssl\ca.cer” -format ascii -trust enable

Go to \bin64\jre\bin\ to import it to PMPSVC java keystore.
keytool.exe -import -trustcacerts -file “C:\Program
Files\ibm\cognos\tm1_64\bin64\ssl\ca.cer” -keystore “C:\Program
Files\ibm\cognos\tm1_64\bin64\ssl\tm1store” -alias caRoot -storepass applix

You need also to add the ca.cer file to the correct keystore for TM1WEB.

Configure Planning Analytics 2.0 TM1 Server with SSL Cognos BI Dispatcher (

How to Configure Planning Analytics to Connect to an SSL Secured Cognos Dispatcher (

Configuring TM1 Server to trust the SSL certificate on CA Side (

Cognos Analytics 11.1.7
Microsoft Windows 2019 Server

The selection of non-production environment is missing from the installation of CA11, why?

New Cognos BI version have that you set the production or non-production from inside the Cognos Connection portal.

After you have done the installation, go into the production environment – go to Manage – Licenses and select Production. Click Apply.

This will make the files in folder C:\Program Files\ibm\cognos\analytics\iso-swid to change names.

You have both a production and non-production file here, CA11 will switch the ending .sample to the file that is not used. It will also keep the file date, so you will not easy notice the switch.

The content of the file does not change, only a smart switch of the file name ending. The ILMT program will pick up this file to report on what type of installation you have.


More information:

What to know before IBM Audits Your IBM Cognos Analytics and Planning Analytics Licenses.

Cognos Analytics 11.1.7
Microsoft Windows 2019 server


Error in cognosserver.log file on a new installation.

2021-01-28T09:31:51.384+0100 ERROR Audit.RTUsage.cms.CAM.AAA.SRVC [Thread-51] qjl2C9lhh82hwvqyyvM4MyGG2lldydCyGw49dw4l 0 NA 9300 8C38E8DDD4011089DE605BFA04DA4A10EEBABF5DFCA9E0C4BAF46FADC73864A4 qjl2C9lhh82hwvqyyvM4MyGG2lldydCyGw49dw4l_0_ AAA 5964 Logon <parameters><item name=”namespace”><![CDATA[AD]]></item><item name=”username”><![CDATA[admin]]></item><item name=”display name”><![CDATA[admin]]></item><item name=”CAMID”><![CDATA[CAMID(“AD:u:8791a873dc836d499a0fc7f6000540d2″)]]></item><item name=”REMOTE_ADDR”><![CDATA[::1]]></item><item name=”TENANTID”><![CDATA[]]></item></parameters> Success Account /directory/AD/account/admin


This is normally not a error, only the basic logging that a user have logged in to the CA11 (ibmcognos) portal. Best would be not to flag it as ERROR, more like INFO.

Only happens when you have BASIC logging activated in Administration.

More information:

Log files are found in folder C:\Program Files\ibm\cognos\analytics\logs

Cognos Analytics 11.1.7
Microsoft Windows 2016 Server
Oracle database

During a import of a large content store deployment file into a new Content Store database schema – the process take time and there is no new object imported.
After some time, if you browse to the IBMCOGNOS website on the server, you do not get a response either.
Troubleshoot by on the Cognos server start Cognos Configuration and right click on your content store and click Test.

ORA-00257: Archiver error. Connect AS SYSDBA only until resolved.
2021-01-14T INFO startup.Audit.JSM [Thread-56] NA  9300 __ JSM 5836 Run Failure Error connecting to the database, some services may not work properly. Check the logs for further details. ORA-00257: Archiver error. Connect AS SYSDBA only until resolved.


Ask the Oracle DBA to check the oracle server and log files.
After Oracle is corrected, then the Cognos Analytics (BI service) will continue to import data.
You do not need to restart Cognos, only adjust the Oracle settings.

More Information:

Cause: The archiver process received an error while trying to archive a redo log. If the problem is not resolved soon, the database will stop executing transactions. The most likely cause of this message is the destination device is out of space to store the redo log file

Cognos Analytics 11.1.7  Product_version=11.1 R7 (LTS)
Microsoft Windows 2019 Server
Microsoft SQL server 2016

How install CA 11.1.7 on a Windows 2019 server?

Follow the IBM Cognos instruction first, then use this as a compliment. Download latest fix pack from

Install Web Server with NET framework 4.7 and Windows Authentication and WebSocket Protocol.

Install rewrite_amd64_en-US.msi and the Application Request Routing extension for IIS by going to the following URL:

Run setup of CA11 from file ca_instl_win_2.0.200618.exe
Click Next

Click browse and select the file and click Open and Next.
Choose IBM Cognos Analytics and click next.
Mark “I accept the terms of the License Agreement” and click Next.
Mark “Make shortcut visible to all users in the Start menu” and click Next.
Click Yes.
Select Custom and click Next.

If installed on a single server, select all and click Next.
Click Install.
Click Done. (install the latest fix pack on top of your installation of CA11)

Add SQL driver sqljdbc42.jar to CA11 folder C:\Program Files\ibm\cognos\analytics\drivers

Prevent creation of DUMP files in CA11
Open file C:\Program Files\ibm\cognos\analytics\configuration\cclWinSEHConfig.xml in notepad++

Change to <env_var name="CCL_HWE_ABORT" value="0"/>

Save the xml file.

Download the new policy zip file from
Unzip the file in a new folder (c:\install), creating folder C:\install\unrestricted.

Copy the two new files (US_export_policy.jar and local_policy.jar)to folder C:\Program Files\ibm\cognos\analytics\ibm-jre\jre\lib\security\policy\unlimited

Open Cognos Configuration and go to Cryptography > Cognos. Change Confidentiality Algorithm and PDF Confidentiality Algorithm to Advanced encryption standard with Cipher Block Chaining (CBC) mode 256 bit key.

At subject alternative name for DNS names, enter both the FQDN and the HOSTNAME with a space between. You must use lowercase letters on all server names in Cognos Configuration.
Configure the AD connection to your domain.

Remove the DB2 connection and create a new Microsoft SQL Server connection.
Configure the Content Store connection to your SQL server.

Save the configuration and start Cognos service.

Setup IIS with script found in folder C:\Program Files\ibm\cognos\analytics\cgi-bin\templates\IIS
Edit the file to include your servers name, then run the CA_IIS_Config.bat from a administrator CMD window.

Ensure all is correct and press Y.

Check that you can access cognos on
Setup WebDAV for report creators:

  • Go to IIS Manager
  • Under Connections, expand your web server, Sites, and select Default Web Site.
  • Double-click WebDAV Authoring.
  • Click Enable WebDAV.

  • Click WebDAV Settings.

  • If you have anonymous access enabled, select True for Allow Anonymous Property Queries, and click Apply.
  • Select the /bi/samples/images directory
  • Double-click WebDAV Authoring.
  • Click Add Authoring Rule.
    Select All content and All users and Read Permissions and click OK.
  • Right-click the /images you added authoring rules to, and click Edit Permissions.

  • Click Security tab, and click edit. Click add and enter everyone. (or a user group that should have access) and click check names.
  • Click OK.
  • Click OK again.

Install SQL 2012 native client, to make old report connections work (SQLNCLI11).

Open firewall ports 80 and 443 for clients, and ports 9300, 9362, 4300, 5701, 9301 for Cognos servers to be able to talk to each other.

Setup SSO with Kerberos Active Directory is possible (but not covered here)

Set “Allow anonymous access” to False.
Change the log on user for the IBM Cognos service to a domain account, instead of Local System.

Set the server to trust for delegation inside the Active Directory.
You need to do more;

Instead of kerberos can you use old windows login, inside cognos configuration setup (enter below values);

Save and restart Cognos, try to browse to

Show the Legacy Studios in CA11.1.x
Check that they are active in Manage – Configuration – System – Appearance.
Please Note: In order to access the legacy studios, you must be using Internet Explorer or Mozilla Firefox.

Setup the samples

Setup the skins

For CA11 installations with many users, you can increase the Windows TCP ports;

  1. Click on Start menu, run – Enter regedit
  2. In the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters directory, create a new DWORD-32 value named MaxUserPort.
  3. Set the properties for MaxUserPort to use a value of 65534 and a base of Decimal.
  4. In the same directory, add another DWORD-32 value named TcpTimedWaitDelay.
  5. Set the properties for TcpTimedWaitDelay to use a value of 50 and a base of Decimal.

    The range for value is from 30 seconds to 300 seconds, with a default value of 240 seconds (4 minutes).

    After closing the regedit application, restart your computer.

Data server connections to PA can give below error if TM1 cert is not loaded in the CA keystore.
XTR-ERR-0005 A request to TM1 resulted in error: “[400] PKIX path building failed: unable to find valid certification path to requested target”.

Add Planning Analytics cert to the keystore. Copy the file \\paservername\c$\Program Files\ibm\cognos\tm1_64\bin64\ssl\tm1\ibmtm1.arm file to your CA11 server to folder c:\install.
Start C:\Program Files\ibm\cognos\analytics\ibm-jre\jre\bin\ikeyman.exe, run as administrator.

Click on open keystore. Select C:\Program Files\ibm\cognos\analytics\ibm-jre\jre\lib\security\cacerts file and open it with password changeit.

Switch to Signer Certificates and click Add.
Browse for c:\install\ibmtm1.arm and open it and give it the name TM1ServerCert.

Data Server Connections to PA can give below error if the UseSSL=T is not correct in data connections.
XTR-ERR-0005 A request to TM1 resulted in error: “[400] Connection reset”.

Ensure that the Use SSL is marked if the UseSSL=T is in the tm1s.cfg file for the TM1 instance. Planning Analytics have UseSSL=T as default, if the line is missing from tm1s.cfg file.

To be able to connect to old TM1; run installation of PA, on CA server, with issetup.exe from \\servername\fileshare\planninganalytics\tm1_winx64h_2.0.93.28_ml.tar\winx64h and select TM1APIs.

Report performance can be adjusted in different ways to match your hardware

Go to Manage – Administration console.
Click on System at Status tab.

Click on All Servers drop down – go to Service – go to Report (or Batch Report)
Right click on ReportService and select Set Properties
Click on Settings tab – select Tuning in Category drop-down menu.

Set Maximum number of processes for the report service during peak period to a higher value, maybe start with the same number of CPU cores you have on the server. Do the same for Maximum number of processes for the report service during non-peak period, and also for Maximum number of processes for the batch report service during non-peak period.
Check that Number of low affinity connections for the report service during peak period is not below 8.
Values you set, depend on number of users and your hardware.

More information:
To show info about the Windows server, go to the command prompt and enter MSINFO32.EXE.

To list installed roles on server enter in powershell this command:

Get-WindowsFeature | Where-Object {$_. installstate -eq “installed”} | Format-List Name,Installstate >  roles.txt

Cognos Analytics 11.1.7
Microsoft Windows 2019 server

How do i change CA11 WLP to use balanced in java?

Suggested solution:

The log file cbs_run_WebSphereLiberty.log say “CBSBootstrapService attempt to load config from “C:\Program Files\ibm\cognos\analytics\bin64/bootstrap_wlp_winx64.xml”
This should mean that the WLP is controlled from the file bootstrap_wlp_winx64.xml. Open file in Notepad++
Change line 37 to;

param condName=”${java_vendor}” condValue=”IBM”>-Xgcpolicy:balanced</param>

save the file and restart the server, will give that WLP use garbage collection Balanced instead of default gencon. Then this will not help you, if you not have a big solution that maybe need it.

WLP settings for Planning Analytics is on the other hand stored in file C:\Program Files\ibm\cognos\tm1_64\bin64\bootstrap_wlp_tm1_winx64.xml

Normally you add the line -Xgcpolicy:balanced to the file C:\Program Files\ibm\cognos\tm1_64\wlp\usr\servers\tm1\jvm.options instead, of doing above.

Edit C:\Program Files\ibm\cognos\analytics\wlp\usr\servers\cognosserver\jvm.options to have the line -Xgcpolicy:balanced  will not work with CA11. You may need to do something more….

More information:

Cognos Analytics 11.1.7
Microsoft Windows 2016 server

After upgrade of Cognos and the IIS gateway settings the large dashboard with many columns does not work. If you use less columns the dashboard work. Error like this:

We can’t retrieve the data from data set….

Inside IIS Manager on your Microsoft Windows server, check the values for Maximum URL length.
Go to your ibmcognos\bi folder and click on “request filtering”.

Click on edit feature settings on the right side.
Update to 8192 or 16000. (adjust other values as needed)
Click OK (the values are saved in C:\Program Files\ibm\cognos\analytics\webcontent\bi\web.config)
Restart the IIS service and test again.

The CA_IIS_Config.bat file should set this values in your windows server:

More Information:

Cognos Analytics 11.1.7
Microsoft Windows 2016 server

On a installation where you use SSL only to the IIS gateway, and not to the Cognos dispatchers.
When try to login to Cognos Analytics HTTPS portal you get a error similar to this;
HTTPS Error 404.0 – Not Found…
Requested URL
Physical Path  c:\inetpub\wwwroot\bi\

Run the CA_IIS_Config script with HTTP instead of HTTPS, so you change the Reverse Proxy Inbound Rule to have Rewrite URL http://ca_servers/bi/{R:0} instead of HTTPS.
Add the certificate server name to the IIS manager – Default web site – bindings. Edit the settings for HTTPS port 443, so you have a host name in the host name field.

After any change to IIS, restart it from a DOS prompt with command: iisreset

From your web browser test that you can browse to the Gateway URL;

More Information:

Cognos Analytics 11.1.7
Microsoft Windows 2016 Server

After upgrade to CA 11.1.7 in a Multi server solution the event studio events are not running all the time, and also you get other errors in cogserver.log file.

CNC-ASV-0048 Error building report template: {0} CNC-ASV-0048 Error building report template: PRS-REQ-0760 The operation “/” “” “” is invalid. Certificate for <servername> doesn’t match any of the subject alternative names:…

CNC-SDS-0222 An error occurred while trying to send a message in message manager

Suggested Solution:

Upgrade your installation to the latest Fix Pack of CA11.1.7

If you restart the IBM Cognos windows service by some script, change the script to instead use the Cognos Configuration program to do the restart. Create a CMD file with this content:


call “C:\Program Files\ibm\cognos\analytics\bin64\cogconfig.bat” -stop

PING -n 31>nul

call “C:\Program Files\ibm\cognos\analytics\bin64\cogconfig.bat” -s

Name the file c:\scripts\birestart.cmd and put your schedule software to use that, instead of the NET STOP command, as stopping Cognos BI from windows may corrupt some temp files.

CA 11.1.7 demands that all server names are in FQDN format.
Stop the Cognos BI service on Windows from Cognos Configuration.
Update all the server name in Cognos Configuration to be FQDN and lowercase. Also ensure the Server Common Name, under Security – Cryptography -Cognos, is the FQDN server name.

Gateway URI
External dispatcher URI
Internal dispatcher URI
Dispatcher URI for external applications
Content Manager URIs
Environment > Configuration Group
Group contact host
Member coordination host
Security > Cryptography > Cognos
Server common name
Subject Alternative Name > DNS names
Subject Alternative Name > IP addresses
Note: You must at DNS names enter both the FQDN and HOSTNAME to make the logging to work.
Check that the windows firewall does not block the port used by cognos – particular ports 9300, 9362, 4300, 5701, 9301. They need to be open between Cognos servers.

Before start of the Cognos from Cognos Configuration, clean out some folders to ensure there are no old settings around.
Backup and then remove the analytics/configuration/data/flipper folder
(You need a backup of flipper folder, like file flipper\config\global\, as it will erase your new cognos advance settings, or you need to manually add the values back.)
Backup and then remove the analytics/configuration/data/discovery folder
Backup and then remove the analytics/wlp/usr/servers/cognosserver/workarea folder
Backup and then remove the analytics/wlp/usr/servers/dataset-service/workarea folder
Backup and then remove the analytics/javasharedresources folder
Backup and then remove the analytics/temp folder
Backup and then remove the analytics/logs folder
Backup and then remove the analytics/data folder

You can check the setup of Configuration Group by browse in IE to the server first on
and login, then change the URL in IE, and browse to
This json file can be saved.

If you have old reports that fails, please try to upgrade the reports to the latest version.

  1. Open IBM Cognos Administration.
  2. On the Configuration tab, click Content Administration.
  3. Click the arrow on the new content maintenance button New content maintenance on the toolbar, and then click New Report Upgrade
  4. Type a name for the upgrade task and, if you want, a description and screen tip. Click Next.
  5. Select the packages and locations for the report specification you want to upgrade. Click Next.

    If you upgrade report specifications by folder, all reports in the folder will be upgraded.

  6. Choose one of the following:
    • Save and run once opens the run with options page.
    • Save and schedule opens the scheduling tool.
    • Save only allows you to save the upgrade so that you can run it at a later time.

    Give time to upgrade all reports and all templates in your Cognos solution. To upgrade users my folders, select Directory – My Folder of AD (your namespace).

If schedule or events are not working, try dropping the NC* tables with this script:

1. Stop the Cognos Service
2. Take a physical backup of the Content Store or Notification database
3. Select the appropriate folder for your content store or notification database type ,like C:\Program Files\ibm\cognos\analytics\configuration\schemas\delivery\sqlserver for SQL.
4. Run NC_DROP_MS.sql against the content store or notification database in Microsoft SQL Management Studio.
4. Restart Cognos Services.

Should dropping the NC* tables not resolve the issue, then restore the content or notification store from the last backup version.

CA 11.1.x have made changes to the IIS setup for URL rewrite, manually change IIS settings to the new values or use the script in folder: C:\Program Files\ibm\cognos\analytics\cgi-bin\templates\IIS

Check the rules under ibmcognos and bi folder in IIS manager. Compare yours to the latest webpage

  • Name is Event Studio.
  • Pattern is ^(ags|cr1|prompting|ccl|common|skins|ps|cps4)/(.*)
  • Open the Conditions section.
  • Change the Logical Grouping to Match Any
  • Click Add.
    • Condition input is {HTTP_REFERER}
    • Check if input string is Matches the Pattern
    • Pattern is v1/disp
    • Check Ignore case.
  • Click Add
    • Condition input is {HTTP_REFERER}
    • Check if input string is Matches the Pattern
    • Pattern is (ags|cr1|prompting|ccl|common|skins|ps|cps4)/(.*)\.css
    • Check Ignore case.
  • Action type is Rewrite
  • Rewrite URL is /ibmcognos/{R:0}
  • Check Stop processing of subsequent rules.
  • Click Apply and Back to Rules.

In IIS Manager on the Application Pool for Cognos (ICApool) change to 10 for Maximum Worker Processes, if you have many users in Cognos.


If nothing helps – contact Cognos Support.

More information:

Cognos Analytics 11.1.7
Microsoft Windows 2016 server

There are 3 jave.exe on the Cognos Analytics server, what are they for?

Java.exe (with most memory usage is Query Service, if you use Dynamic Cubes) command line c:\program files\ibm\cognos\analytics\ibm-jre\jre\bin\java.exe
Java.exe (with command line ..\ibm-jre\jre/bin/java.exe is the Content Manager and WLP service for the cognos portal) it have -Xgcpolicy:gencon
Java.exe (with least memory usage is the exploration engine in CA11) command line c:\program files\ibm\cognos\analytics\ibm-jre\jre\bin\java.exe” -Xms1024m -Xmx8192m -XX:MaxDirectMemorySize=512m

The 3 java.exe process for exploration in CA11 is part of the query service and is configured with advanced parameters in cognos connection;

  1. From Manage > Administration console, open Cognos Administration.
  2. On the Configuration tab, click Dispatchers and Services, and click your dispatcher name.
  3. In the list of services, locate the Query service, and click its properties icon Set properties.
  4. On the Settings tab, under Category, select Environment.
  5. Next to Advanced settings, click Edit.
  6. Select the Override the settings acquired from the parent entry check box.
  7. Type or copy the parameter names and their values, from the Cognos documentation.
  8. Click OK.
  9. Restart the Query service.

The Java.exe for Query Service memory usage is also controlled from cognos connection.

JVM heap size limit for the query service: Specifies the maximum size, in MB, of the JVM heap.

JVM garbage collection policy: Specifies the garbage collection policy used by the JVM.

Go to Cognos Administration page, and click on System in the left.
Click the arrow at All servers and select Services – Query.
Now you only see the QueryService for each server. Click on arrow and select Set properties.
Change the Initial JVM heap size for the query service to a unique value like 2048, then after a restart it is easier to tell the jave.exe apart from each other.

The Java.exe for content manager and WLP is setup from inside Cognos Configuration.
If you have the RAM in the server, it can be increased to 24576 MB.  The start up time of Cognos will be longer, when the WLP use more memory.

  1. Start IBM Cognos Configuration.
  2. In the Explorer window, expand Environment > IBM Cognos services, and then click IBM Cognos.
  3. In the Properties window, change the value for Maximum memory in MB.
    • To reduce the startup time, memory footprint, and resources that are used, use the default setting of 8192.
    • This value can be adjusted based on available system resources.
  4. From the File menu, click Save.

More information: