Installing Powertech Compliance Monitor for IBM i

These instructions describe how to install Powertech Compliance Monitor for IBM i or update from a previous version.

Updating users: Fortra recommends updating the Consolidator to the latest version prior to updating the endpoints. Once the Consolidator has been updated, the endpoints can be updated when convenient.

NOTE: If you are upgrading from Powertech Compliance Monitor for IBM i version 2.x, please contact Fortra Support for upgrade information.

Before You Begin

Read this section before you install Powertech Compliance Monitor for IBM i.

When installing Powertech Compliance Monitor for IBM i in an HA environment:

  1. Stop the replication of user profiles from production to HA system by either ending the replication software or ending the replication of the user profiles.
  2. Install Powertech Compliance Monitor for IBM i on the HA and production systems.
  3. Setup Powertech Compliance Monitor for IBM i replication per the HA Setup instructions. To view these instructions, see Powertech Compliance Monitor for IBM i Setup in an HA Environment.
  4. Start replication (including the user profiles).

System Requirements

  • IBM i version 7.3 or higher

  • IBM i version 7.5 requires Cumulative PTF Package C2321750 or higher

  • Java 1.8 32-bit (required minimum)
  • Library QICU – International Components for Unicode, option 39
  • 256 MB of disk space
  • PASE (Portable Applications Solutions Environment), option 33
  • The fully-qualified domain name of the IBM i must be name-resolved on the system. To check this:
    • On the IBM i, PING the unqualified system name: PING 'SYSTEM_A' , where "SYSTEM_A" is the system's name.
    • From the messages displayed, note the fully qualified domain name, for example, "SYSTEM_A.yourdomain.com".
    • PING the qualified domain name: PING 'SYSTEM_A.yourdomain.com' .
      If the PING to the qualified domain name is successful, the name is resolved correctly. If not, adjust the system's host table entries or domain information, or configure DNS, to allow the fully qualified domain name to be resolved.
NOTE: During installation an FTP connection is initiated. The FTP server responds with messages that prompt for FTP login credentials. The standard port reserved to establish an FTP connection to the IBM i is port 21. Consequently, it is required that this port is open and ‘listening’ on the server in order to establish a connection with the Installation Wizard and facilitate a successful installation.

If FTP is not available, you must install the product manually. See Manual Installation of Powertech IBM i Products.

Licensing

Powertech Compliance Monitor for IBM i requires that you enter a valid license key. Contact keys@fortra.com if you need to request a new license key.

System values

It is Fortra’s goal not to change system values on customer systems because we recognize that security-conscious organizations have rigorous change control processes in place for even small changes to system values. Therefore, we ask you to make any system value changes that are needed. However, the Powertech Compliance Monitor for IBM i installation process could change a system value to allow the install to proceed if a system value is not set as specified below. If the Installation Wizard changes a system value during install, it changes it back to its original value when the install completes. To install Powertech Powertech Compliance Monitor for IBM i on your system, the following system values that control object restores must be configured as shown.

  • Set QALWOBJRST to *ALWPGMADP (at a minimum) to allow the system to restore programs that adopt authority. Many Powertech Powertech Compliance Monitor for IBM i programs adopt the authority of the product owner, rather than forcing you to give authority directly to administrators and end users.
    NOTE: For some system configurations, *ALL is required temporarily.
  • QALWUSRDMN controls which libraries on the system can contain certain types of user domain objects. You should set the system value to *ALL or include the name of the Powertech Compliance Monitor for IBM i product libraries (PTCMT2 [Consolidator], PTCMT3 [Endpoint], and QTEMP as a minimum) for the product to function properly.
  • Set QVFYOBJRST to 1, 2, or 3. This allows Powertech Compliance Monitor for IBM i to restore all objects regardless of their signature.
  • Set QFRCCVNRST (Force conversion on restore) to 0, Do not convert anything.

Installing or Updating Powertech Compliance Monitor for IBM i

Follow these instructions to install Powertech Compliance Monitor for IBM i, or update from a previous version:

  1. Ensure the system is not in a restricted state and that the following servers are available and running prior to updating:
    • FTP Server
    • Remote Command
    •  ServerFile Host Server

      • NOTE: If the File Host server is not active: Run the commands

      STRSBS QSYS/QSERVER

      STRHOSTSVR SERVER(*FILE)

  2. Download the Powertech Compliance Monitor for IBM i installer (setupComplianceMonitor4.exe) from the Fortra Downloads Page on our website. Double-click it to start it.

  3. Specify how you want to load Compliance Monitor on your system, from the following:

    • Consolidator only
    • Endpoint only
    • Both (Installs both the Consolidator and Endpoint programs on the same system; this is the default selection).
      NOTE: The Consolidator does not have to be an Endpoint.
  4. On the IBM i Details panel:
    1. Select or enter the IBM i where you want to load Powertech Compliance Monitor for IBM i.
    2. Make sure the user profile is a member of the user class *SECOFR and has at least the following special authorities: *ALLOBJ, *SECADM, *JOBCTL, *IOSYSCFG, and *AUDIT. The user profile should have Limit capabilities set to *NO. This profile will be used to restore and copy objects, and for product maintenance on the IBM i.
    3. (Optional) In the Advanced Settings section:
      • Enter a port number or use the arrows if you want to change the FTP port number to something other than the default of 21.
      • Select Secure File Transfer if you want to use FTPS (FTP over SSL) during the file transfer. The default FTPS secure port is 990, but it can be changed to the required secure port for your environment.
      • In the Timeout (seconds) field, enter the number of seconds the session should be kept active during an FTP transfer. You can choose anywhere between 25 and 1800 seconds (30 minutes).
        NOTE: If the transfer takes longer than the amount of time specified, the session will expire.
    4. Click Next.
  5. You have two options on the Product Load Options panel:
    1. Click Immediate Load if you’d like to load the product on the IBM i now.
      NOTE: If you're doing an update, this ends Powertech Compliance Monitor for IBM i until the product load completes. After you are done, we’ll restart the product.
    2. Click Staged Load if you’d like to transfer the objects now and load them on the IBM i at a later time.
      NOTE: See “Loading Staged Objects on the IBM i” below for instructions on how to load the staged objects on your selected IBM i system.
      NOTE: The Powertech Compliance Monitor for IBM i Consolidator and Endpoint install processes run pre-checker programs that evaluate your system to verify that the install can proceed, including that you have the proper authority, that the operating system and PTFs are at the correct level, and that the default port (3035) used by Powertech Compliance Monitor for IBM i is available. If the pre-checkers find any problems, you should review the message logs (CM2INSTP for the Consolidator, PCMINSTP for the Endpoint) for more information.

  6. The Product Load Progress panel for Powertech Compliance Monitor for IBM i launches. When the processing is complete, you have two choices:

    • If this is the only installation or update of Powertech Compliance Monitor for IBM i that you're doing, click Finish.
    • If you have installs or updates to do on other IBM i systems, click Restart. Then, return to step 4.
    NOTE: If the Product Load Progress panel ends with an overall Failed message, the product upload could not complete properly. To find the reason the upload failed, click View Logs and review your logs. You can also use Download at the top of the logs to save the information for future review.

Powertech Compliance Monitor for IBM i installs a work management subsystem, PTWRKMGT, that allows Powertech products to submit long-running batch jobs without interfering with customer job queues. The PTWRKMGT subsystem is also used by other Powertech products, so if you have another Powertech product installed, it is not installed again. The PTWRKMGT library consists of a subsystem description, a class description, job queue descriptions for Powertech products, and job descriptions for Powertech products and features. PTWRKMGT is activated when a product needs to use it. All jobs in PTWRKMGT are submitted jobs; there are no prestart or auto-start jobs.

Use the WRKSPLF command to display the job log for complete information on the Powertech Compliance Monitor for IBM i install.

NOTE: The installed profile PLCM2ADM is added as an authorized user to the QPWFSERVER authorization list as part of the installation procedure.

Loading Staged Objects on the IBM i

If you chose to stage your objects during step 5b of the installation or update process, do the following to manually load them on the IBM i you identified above.

  1. On the IBM i, execute the following command to display the Work with Loads panel:

    HSLOADMGR/HSWRKLOAD

  2. Enter option 1, Load, next to the Load Name for Powertech Compliance Monitor for IBM i and press Enter.

Objects Installed

 

Consolidator
Profiles PLCM2ADM
PLCM2OWN
Authorization Lists PLCM2ADM
PLCM2DTA
PLCM2PGM
Library

PTCMT2

Directory /Powertech/ComplianceMonitor
Commands in QGPL ENDPTCMCSL (end Consolidator)
STRPTCMCSL (start Consolidator)
PLCMASMT (request assessment)
Exit Points POWERLOCK_CM2 (unregistered)

 

Endpoint
Profiles PLCMADM
PLCMOWN
Authorization List PLCMADM
Library PTCMT3
Directory No directories for Endpoint
Commands in QGPL STRPTCMEPT (start Endpoint monitor job)
ENDPTCMEPT (end Endpoint monitor job)

 

Consolidator & endpoint
Profile PTWRKMGTOW
Library PTWRKMGT
Subsystem PTWRKMGT
Exit Points POWERLOCK_WRKMGT (unregistered)

After You Are Done

Congratulations! Powertech Compliance Monitor for IBM i is now installed. Read the following for additional information and next steps.

Setting up Powertech Compliance Monitor for IBM i

After you’ve installed Powertech Compliance Monitor for IBM i, do the following to complete the setup:

On the consolidator system

  1. Add the Powertech Compliance Monitor for IBM i Consolidator library to your library list:

    ADDLIBLE PTCMT2

  2. Enter the following command to display the License Setup panel:

    CALL CM2280

    Enter your Powertech Compliance Monitor for IBM i license code.

  3. Enter the following command to start the Powertech Compliance Monitor for IBM i monitor job, QP0ZSPWT, in the PTWRKMGT subsystem:

    PTCMT2/STRPTCMCSL

  4. When prompted for a username and password, enter the following:
    • User name: PLCM2ADM (this is the Powertech Compliance Monitor for IBM i administrator user profile).
    • Password: Enter a password of your choice and assign it to the PLCM2ADM profile.

On the endpoint systems

Sign on to each Endpoint system and do the following:

  1. Add the Powertech Compliance Monitor for IBM i Consolidator library to your library list:

    ADDLIBLE PTCMT3

  2. Enter the following command to display the License Setup panel:

    CALL PCM280

    Enter your Powertech Compliance Monitor for IBM i license code. The Endpoint license code is different from the Consolidator license code.

  3. Enter the following command to start the Powertech Compliance Monitor for IBM i monitor job:

    PTCMT3/STRPTCMEPT

NOTE: You do not need to start the Endpoint monitor job at this time. The Endpoint starts automatically when you request an Assessment for the Endpoint.

From your browser

  1. Enter the following to connect to the Consolidator system:

    HTTP://SYSNAME:3035/ptcm/

    where

    • sysname is the name of the system or IP address where the Consolidator is installed
    • 3035 is the default port number used by Powertech Compliance Monitor for IBM i
  2. When the Login window displays, enter the following user name and password:
    • PLCM2ADM—the Powertech Compliance Monitor for IBM i administrator profile
    • password—the password you specified for PLCM2ADM

      The first time you log on to Powertech Compliance Monitor for IBM i, you must sign on as the administrator.