by ·Comments Off on How use ikeyman

Product:
Cognos Analytics 11.1.4
Microsoft Windows 2019 server

Issue:
How request and use external certificate for CA11 internal communication, e.g. port 9300?

If both internal and external connections use HTTPS, then you can use port 9300 for HTTPS. Otherwise you need to set a separate port number for the HTTPS services, suggestion 9334 or 9443.

Solution:

The IKEYMAN tool allows you to include more fields for your certificate request. This instruction is hard to find, so a copy is provided here.

You need to do the steps on all your CA11 servers, but you start with the Content Manager server first.

1. Ensure that all IBM Cognos component services in the environment are shut down. Close any IBM Cognos Configuration that is open.
2. Copy the complete <cognos>\configuration directory to a safe place and name it configuration_original. At any point, this backup configuration directory can be restored to bring the state of the cryptographic keys for this component back to the original state.
3. Run iKeyman.exe as administrator (or ./ikeyman for linux/unix users) from C:\Program Files\ibm\cognos\analytics\ibm-jre\jre\bin (for IBM Cognos 11.1.X+). For IBM Cognos 11.0.13 and lower versions, the path is <cognos>\jre\bin.

4. Click the folder with the curved arrow icon at the top of the window. In the open dialog panel, select PCKS12 as the Key Database Type, then browse to the <cognos>\configuration\certs directory and select CAMKeystore. Click OK. The default password is NoPassWordSet.

 

Generating a Certificate Signing Request (CSR):
5. Once the CAMKeystore loads, there are two certificates under the Personal Certificates drop down: ca and encryption.

 

 

6. Select the encryption certificate and rename it to encryption_old.
7. Select Create at the top of the iKeyman window, then click New Certificate Request. Make sure that Key Label is called “encryption“. The recommended Key Size is 2048 and the recommended Signature Algorithm is SHA256WithRSA.
The rest of the details can be completed as necessary. Multiple DNS names separated by a comma or a space can be used as well.
8. The CSR is called certreq.arm and it is located in <cognos>\configuration\certs. Give the certreq.arm to the certificate authority to generate the signed certificates.
9. Take another backup of the <cognos>\configuration directory and store it in a safe place. Name it “configuration_with_CSR“.
10. If the certificate authority returns two or three separate certificate files (root, intermediate (optional), and server certificates), in iKeyman, ensure that the Personal Certificates dropdown is set, then select Receive. Select only the server certificate.
If there is a dialog box that mentions that the CA (root certificate) is missing, click OK, and the encryption certificate is highlighted in yellow or the encryption certificate will be listed alongside the ca and encryption_old certificate.
Change the Personal Certificates drop down to Signer Certificates, then select Add and import the root certificate and intermediate certificate if the certificate authority returned one. The labels can be named root and intermediate.
If the certificate authority returns one file containing the certificates (.pem or .p12), click Receive or Add in either the Personal or Signer Certificates drop down, and select “Import all” at the prompt. All of the certificates are placed in their correct section.
11. Open Cognos Configuration. Under Environment, change these URIs to https:
  • Gateway URI
  • Dispatcher URIs for gateway
  • Controller URI for gateway
  • External and Internal dispatcher URI
  • Dispatcher URI for external applications
  • Content Manager URI
12. Under Cryptography > Cognos, switch “Use third-party CA?” to True.
Also, change the following to match the values used for the CSR in step 7:
  • Server common name (CN)
  • Organization name (O)
  • Country or region code (C)
Change the DNS Names field under Subject Alternative Name to match the DNS name(s) that were used during the generation of the CSR in Step 7.
13. Save the configuration and start the IBM Cognos services.

Important Note: During this process, IBM Cognos Configuration cannot be opened and the IBM Cognos Services cannot be started until these steps are completed. If the certificate authority takes some time to send the signed certificates, consider using the Third-Party Certificate Tool method instead.

More information:

The DOS program supports 3 values in the request;

ThirdPartyCertificateTool.(bat|sh) -c -e

[-p keystore_password] -a key_pair_algorithm

-r path_to_cert_or_csr

-d dn

[-H subject_alternative_nameDns_name_dn]

[-I subject_alternative_ip_addresses]

[-M subject_alternative_email_addresses]

 

 

by ·Comments Off on Cognos JAVA is only restarting

Product:
Cognos Analytics 11.1.7
Microsoft Windows 2016 server
Microsoft SQL server

Issue:
New installation of CA11. At start the IBM cognos service take long time to start. But the JAVA.EXE spins up to 6 GB ram and then crash and start over.

Errors like this are found log cbs_run_WebSphereLiberty.log:

Fri Aug 27 11:28:08 2021  INFO  t[e20] CBSBootstrapService attempt to load config from “D:\Program Files\ibm\cognos\analytics\.\bin64\./bootstrap_wlp_winx64.xml”

Fri Aug 27 11:28:11 2021  ERROR t[e20] CBSSocketCommand failed to connect, CAM error: <errorDetail><errorCode>-12</errorCode><errorMessage>CAM-CRP-0026 The underlying socket: ‘10.123.123.65:9300’ returned an error.</errorMessage><errorStack><errorCode>10061</errorCode><errorMessage>Could not connect the socket, errno: 0x274d(10061)</errorMessage>

Error found in windows event log:

Faulting application name: cogbootstrapservice.exe, version: 11.1.5.2, time stamp: 0x5daf2515

Faulting module name: ntdll.dll, version: 10.0.14393.4530, time stamp: 0x60e33cac

Exception code: 0xc0000374

Fault offset: 0x00000000000f7153

Faulting process id: 0x960

Faulting application start time: 0x01d79b1621caeb73

Faulting application path: D:\Program Files\ibm\cognos\analytics\bin64\cogbootstrapservice.exe

Faulting module path: C:\Windows\SYSTEM32\ntdll.dll

 

Thu Aug 26 20:59:12 2021  WARN  t[1908] CBSSockSendAction did not detect success string in response.

Thu Aug 26 21:00:14 2021  ERROR t[1908] PingChildProcess ping loop: process “wlp” is not active, so restarting it.

Thu Aug 26 21:00:52 2021  ERROR t[1908] CBSSocketCommand failed to connect, CAM error: <errorDetail><errorCode>-12</errorCode><errorMessage>CAM-CRP-0026 The underlying socket: ‘172.10.10.123:9300’ returned an error.</errorMessage><errorStack><errorCode>10061</errorCode><errorMessage>Could not connect the socket, errno: 0x274d(10061)

Error in Cognos Configuration at start:

[ ERROR ] CFG-ERR-0106 IBM Cognos Configuration did not receive a response from the IBM Cognos service in the time allotted.

Check that IBM Cognos service is available and properly configured.

16:31:03, ‘LogService’, ‘StartService’, ‘Success’.

Suggested solution:

Ensure DEP is only for needed processes.

Check that the if the server have two network cards, they are correct configured.

Check that the IP address and interface metric is not the same as other cards on the server.

Test to change to IBM cognos instead of NIST SP 800-131A.

Check that the IP addresses in cognos configuration is then one of your server.

Check for ports in use with DOS command:  netstat -a | find “9300”

Export the configuration, and recreate the crypto keys; like this

 

1. Stop the running of your service in Cognos Configuration.

2. On the Content Manager computer, click ‘File > Export As’.

3. Choose ‘Yes’ at the prompt and save the file. For example, name it ‘backup.xml’ which will be stored in the c11\configuration folder.

4. Close Cognos Configuration.

5. On the Content Manager computer
5.1 Create a backup of the following files before moving them to a different, secure location (as during the cryptographic keys regeneration process they will be re-created):

The files are:

· c11/configuration/cogstartup.xml

· c11/configuration/caSerial

· c11/configuration/certs/CAMCrypto.status

· c11/configuration/certs/CAMKeystore

· c11/configuration/certs/CAMKeystore.lock

· c11/temp/cam/freshness

5.2 Create a backup of the following directories before moving it to a different, secure location (as during the cryptographic keys regeneration process they will be re-created). Alternatively you can also rename the directories.

The directory is

· c11/configuration/csk

6. In the c11\configuration folder, rename ‘backup.xml’ to ‘cogstartup.xml’.

7. Open Cognos Configuration, save the configuration and start the services.

 

Restart windows server and see if that helps.

More information:

https://www.ibm.com/support/pages/node/286475

https://www.ibm.com/docs/en/cognos-analytics/11.1.0?topic=problems-starting-cognos-analytics

https://www.ibm.com/support/pages/faulting-application-name-cogbootstrapserviceexe-0xc0000374-error-event-viewer-when-starting-ibm-cognos-service

https://www.ibm.com/support/pages/error-starting-cognos-service-cogbootstrapserviceexe-application-error

https://www.ibm.com/support/pages/node/6379144

https://www.cognoise.com/index.php?topic=14377.0

https://www.ibm.com/support/pages/cognos-service-will-not-start-process-wlp-not-active

https://www.ibm.com/support/pages/dpr-err-2109-dispatcher-cannot-service-request-time-dispatcher-still-initializing-cognos-analytics

https://www.ibm.com/support/pages/node/6386326

https://www.ibm.com/support/pages/cognos-analytics-11-flipper-diagnostic

by ·Comments Off on How change report engine

Product:
Cognos Controller 10.4.2
Microsoft Windows 2016 server

Issue:
How change from Cognos BI report, to the Controller report engine.

Solution:

To activate the controller report function, you need to change a web.config file.

1. Make sure that the Windows service ‘IBM Cognos Controller Reports‘ has already been successfully installed

 

2. Browse to the folder: C:\Program Files\IBM\cognos\ccr_64\ControllerProxyServer
3. As a precaution, create a backup copy of web.config
4. Open the file web.config inside notepad
5. Search for the entry: <appSettings>
6. Underneath that line, add an entry similar to:
<add key=”ccrReports” value=”http://servername.domain.com:9082/fcm.reports/report” />
7. Save changes
8. Browse to the folder: C:\Program Files\ibm\cognos\ccr_64\fcmweb\wlp\etc\

9. As a precaution, create a backup copy of server.env
10. Open the file server.env inside notepad
11.  Add the following line and save changes.  The default location for Java home is: C:/Program Files/IBM/cognos/ccr_64/fcmweb/jre
JAVA_HOME=C:/Program Files/IBM/cognos/ccr_64/fcmweb/jre
12. Make sure that the Windows service ‘IBM Cognos Controller Reports‘ is re-started
To turn off the controller report function, and use Cognos BI again. Remark it out like this:
<!– <add key=”ccrReports” value=”http://win2019server.domain.com:9082/fcm.reports/report” /> –>
Save the file, and wait a while.
More information:

by ·Comments Off on Grey line in View Batch Queue

Product:

Cognos Controller 10.4.2
Microsoft Windows 10

Issue:

Go into maintain – batch queue – manage

You see a grey line to the left over the dialog. If you move the dialog window, the lines follow the window.

Workaround:

Go to Maintain – User – Personal Defaults.

Click on Layout tab.

Mark “Save Window Size”

Click Save.

Exit Cognos Controller Client program, and login again.

 

by ·Comments Off on Dialog is missing when press button

Product:
Cognos Controller 10.4.2
Microsoft Windows 2019 server

Issue:

When press the Schedule Job icon in Optimize Database dialog – the windows is not visible.
The button does not work.
Solution:
Most common is that the controller dialog is outside the screen.

To reset all cognos controller windows to center or top left corner, do this steps inside Cognos Controller client program:

1. Click “Maintain / User / Personal Defaults > tab Layout (2)”
2. Uncheck the box ‘Save Window Size’:

3. Click Save
4. Logoff from Controller, and re-launch the Controller client.

More information:

https://www.ibm.com/support/pages/hanging-slow-crashing-when-using-controller-triggered-message-appearing-inside-window-located-offscreen-triggered-save-window-size-being-enabled

https://www.ibm.com/support/pages/node/375391

https://www.ibm.com/support/pages/blurred-text-andor-strange-looking-fonts-andor-incorrect-display-layout-inside-controller-classic-client-caused-using-display-scaling-not-using-100-scaling-96-dpi-triggered-controller-not-being-high-dpi-aware

The values for Cognos Controller dialog position is stored in the users ccr.config file in there user profile folder, at C:\Users\%username%\AppData\Roaming\Cognos\ccr.

You can change them in the file — but that is more difficult, than reset them as above.

<WinPos>
<add key=”frmRightsSystemReport-Left” value=”1950″ />
<add key=”frmRightsSystemReport-Top” value=”945″ />
<add key=”frmFormsDefine-Left” value=”390″ />
<add key=”frmFormsDefine-Top” value=”390″ />
<add key=”frmFormsDefine-Width” value=”15225″ />
<add key=”frmFormsDefine-Height” value=”8520″ />
<add key=”frmDefineFormSets-Left” value=”225″ />
<add key=”frmDefineFormSets-Top” value=”525″ />
<add key=”frmDefineFormSets-Width” value=”15675″ />
<add key=”frmDefineFormSets-Height” value=”8925″ />
<add key=”frmOptimize-Left” value=”45″ />
<add key=”frmOptimize-Top” value=”390″ />
<add key=”frmSubmission-Left” value=”45″ />
<add key=”frmSubmission-Top” value=”315″ />
<add key=”frmSubmission-Width” value=”10590″ />
<add key=”frmSubmission-Height” value=”6960″ />
<add key=”frmSubmissionReport-Left” value=”45″ />
<add key=”frmSubmissionReport-Top” value=”330″ />
<add key=”frmScheduleJob-Left” value=”45″ />
<add key=”frmScheduleJob-Top” value=”330″ />
<add key=”frmCompanyStructDef-Left” value=”60″ />
<add key=”frmCompanyStructDef-Top” value=”345″ />
<add key=”frmCompanyStructDef-Width” value=”12105″ />
<add key=”frmCompanyStructDef-Height” value=”11400″ />
</WinPos>

https://www.ibm.com/support/pages/window-sizes-changeshrink-and-cannot-be-resized-plus-font-text-size-changes-when-using-java-functions-remote-desktop-caused-using-windows-81-option-let-me-choose-one-scaling-level-all-my-displays

by ·Comments Off on Cannot resolve the collation conflict between SQL_Latin1_General_CP1_CI_AS and …

Product:
Cognos Controller 10.4.2
Microsoft Windows 2019 server
Microsoft SQL server 2016

Issue:

When open data entry, you get a system.exception error:

Source: ControllerForms12
Description: System.Web.Services.Protocols.SoapException: Server was unable to process request. —> System.Exception: Cannot resolve the collation conflict between “SQL_Latin1_General_Pref_CP1_CI_AS” and “SQL_Latin1_General_CP1_CI_AS” in the equal to operation.
at Microsoft.VisualBasic.ErrObject.Raise(Int32 Number, Object Source, Object Description, Object HelpFile, Object HelpContext)
at ControllerServerCommon.RaiseErrSrv.RaiseException….

This on a new SQL server installation, where you have restored your Controller database backup.

Solution:

Change collation settings on the SQL server. Cognos Controller demand that the SQL server and its TEMPDB have the same collation as the controller databases. Therefor you often have dedicated SQL servers for Cognos Controller systems.

Recommended format is: “SQL_Latin1_General_CP1_CI_AS”

Other collations will work, as described here: https://www.ibm.com/support/pages/which-sql-collations-are-supported-controller

You can change the SQL server collation without reinstall it, by this hidden feature.

  • Stop all Cognos services.
  • Detach all user databases (right click on Controller database in SQL manager and select Tasks – Detach)
  • Make backup of all other stuff
  • Stop SQL Server Service – can be done in Windows services.
  • Start a CMD prompt as Administrator
  • Go to folder C:\Program Files\Microsoft SQL Server\MSSQL13.MSSQLSERVER\MSSQL\Binn
  • Start the SQL Server Service using this command:
    sqlservr -m -T4022 -T3659 -q”SQL_Latin1_General_CP1_CI_AS”
  • Now check for the message “Recovery is completed”, and then press CTRL+C to Stop the SQL Server service
  • Start the SQL Services Normally – from Windows services.
  • Check for the change in SQL Management Studio with below query:
    select serverproperty(‘COLLATION’) as servercollation
  • Attach the user databases back (right click on Databases in SQL manager and select Attach)

Use this with extra care and with your own risk!

 

More information:

https://www.sanssql.com/2013/10/change-sql-server-collation-without.html

https://www.mssqltips.com/sqlservertip/3519/changing-sql-server-collation-after-installation/

Download SQL manager from https://docs.microsoft.com/en-us/sql/ssms/release-notes-ssms?view=sql-server-ver15#previous-ssms-releases

https://www.dbvis.com/download/

 

by ·Comments Off on Bad Request – Request Too Long

Product:

Cognos Analytics 11.1.7

Microsoft Windows 2016 server

Issue:
Only one user get a error when running a report in CA11, after he have logged in with SSO, if he do not use SSO with IIS, and instead enter name and password at Cognos dialog, then the report works.

A check of the users – showed he belongs to a lot of domain groups.

net user  donaldduck  /DOMAIN   >  c:\temp\userlist.txt

Error message:

HTTP Error 400. The size of the request headers is too long.

Solution:

Increase the allowed header size on the Cognos Gateway server

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HTTP\Parameters]

"MaxFieldLength"=dword:00032768

"MaxRequestBytes"=dword:01000000

Login to the server, and start REGEDIT program.

Expand to [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HTTP\Parameters]

Add the DWORD values.

You must restart the Windows server, for the registry changes to take affect.

You may also need to update the TCPIP values:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters]
"MaxUserPort"=dword:0000fffe
"TcpTimedWaitDelay"=dword:00000032

or change the IIS \ibmcognos\bi folders Request Filtering to a higher value, to get the report to work.

 

More information:

https://stackoverflow.com/questions/1097651/is-there-a-practical-http-header-length-limit

Although each web server software has some limitations, there is a difference whether there’s a limit for the HTTP request line plus header fields or for each header field.

Here’s a summary:

  • Apache 1.3, 2.0, 2.2, 2.3: 8190 Bytes (for each header field)
  • IIS:
    • 4.0: 2097152 Bytes (for the request line plus header fields)
    • 5.0: 131072 Bytes, 16384 Bytes with Windows 2000 Service Pack 4 (for the request line plus header fields)
    • 6.0: 16384 Bytes (for each header fields)
  • Tomcat:
    • 5.5.x/6.0.x: 49152 Bytes (for the request line plus header fields)
    • 7.0.x: 8190 Bytes (for the request line plus header fields)

So to conclude: To be accepted by all web servers above, a request’s request line plus header fields should not exceed 8190 Bytes. This is also the limit for each header fields (effectively even less).

You can edit tomcat/conf/server.xml’s HTTP/1.1 Connector entry, and add a maxHttpHeaderSize=”65536″ to increase from the default maximum of 8K or so, to 64K

https://docs.microsoft.com/en-US/troubleshoot/iis/httpsys-registry-windows

https://stackoverflow.com/questions/42862828/how-to-increase-size-limit-for-http-header-value-in-request-for-azure-iis

https://docs.microsoft.com/en-us/troubleshoot/iis/http-bad-request-response-kerberos

https://www.leansentry.com/guide

https://docs.microsoft.com/en-us/iis/configuration/system.webserver/security/requestfiltering/requestlimits/headerlimits/

https://www.leansentry.com/guide/reset-restart-recycle-iis

https://www.ibm.com/support/pages/kerberos-based-single-sign-fails-some-not-all-users

 

by ·Comments Off on user not allowed to log on to this computer

Product:
Cognos Controller Client 10.4.2
Microsoft Windows 10

Issue:
During manual install of ccrlocalclient64.msi on a users laptop they get a error message.

Installing a program on a workstation demand that you are local administrator on that workstation.
In many cases, this is not allowed at companies, but you can get a temporary different user account that is local administrator.

But even when you use this temporary admin account, during installation, you get above error.

Solution:

First ensure that you account is local admin on the computer.

It should belong to a global Active Directory group that you can find in the list of administrator groups on the laptop.

The command net user adminDonald /DOMAIN will show the groups the account is part of.
Then check that one of these groups is part of the Administrator group on your computer.

Press the Win + R keys on your keyboard to open Run, enter the command compmgmt.msc, and then press Enter or OK.

Go to groups and click on Administrators to see what groups are listed.
If the group is in the list, that account is local admin on the workstation.
If it still does not work, ensure the workstation name is listed as allowed (see below).

If you run the below command for user Donald, you get a result similar to this.

C:\Windows\system32>net user adminDonald /DOMAIN
The request will be processed at a domain controller for domain europe.com.

User name Admindonald
Full Name Donald Duck admin
Comment 
User's comment
Country/region code (null)
Account active Yes
Account expires 2022-08-11 00:00:00

Password last set 2021-08-11 14:12:59
Password expires 2022-08-11 14:12:59
Password changeable 2021-08-12 14:12:59
Password required Yes
User may change password Yes

Workstations allowed myWorkstationName
Logon script
User profile
Home directory
Last logon Never

Logon hours allowed All

Local Group Memberships
Global Group memberships *Computers_local_admins *Domain Users
*other group x

The command completed successfully.

If Workstations allowed is missing, then you get above error.

More Information:

http://woshub.com/restrict-workstation-logon-ad-users/

https://www.digitalcitizen.life/ways-open-computer-management-windows/

by ·Comments Off on System.IndexOutOfRangeException: Index was outside the bounds of the array

Product:

Cognos Controller 10.4.2
Microsoft Windows 2019 server

Issue:
When starting and stopping the Cognos Controller client several times you get this error when you try to login.

System.Web.Services.Protocols.SoapException: Server was unable to process request. —> System.IndexOutOfRangeException: Index was outside the bounds of the array. at
Cognos.Controller.Proxy.ControllerReportNetService.RepNet.GetUserInfo ….

Solution:

There can be many cause of this issue, but first make sure you do not have previous errors that trigger this.

Logoff cognos controller client and restart your laptop, to ensure there are no excel or controller software running in the background.

Then login and try again.

When you get one error in Cognos Controller, it is best to logoff and restart the client completely to not get other errors as an affect of the first error.

More Information:

https://www.ibm.com/support/pages/error-occurred-while-trying-access-server-systemindexoutofrangeexception-index-was-outside-bounds-array-when-launching-controller-client

https://www.ibm.com/support/pages/troubleshooting-index-was-outside-bounds-array-when-launching-controller-client

by ·Comments Off on Date in Cognos Controller report is in wrong format.

Product:
Cognos Controller 10.4.2
Microsoft Windows 2019 server

Issue:
After new installation of Cognos Controller, when for example you check the data format in accusation registry.

It show like 28/02/2020

When it should look like 2020-02-28. This is the expected format for Sweden. Each country have its default format. This is often set inside your local computer, at Region in Control panel.

Solution:

Change the format in region to your country.

Go to Control panel.
Go to Region.

Change in the format drop down to your country, and click apply.
Click OK.
Start Cognos Controller client on your computer and try your report/view again.

On a citrix server, each users, have there own windows profile, and can have different region settings even do they are on the same citrix server.

More information:

https://www.ibm.com/support/pages/time-zone-clock-date-formats-controller-explanation-and-description

https://support.citrix.com/article/CTX103288