Section 3.1. Agent Functions

3.1. Agent Functions

The agent is the engine of execution in MOM 2005. Fundamentally, it does two things: it collects data from the data providers on the managed computer and it executes the management pack instructions given by the agent on the management server. When there is a match between the collected data and the parameters described in the rules, the agent takes whatever action has been defined in the rule. This could be to generate an alert, pass the data to the management server, or to run a script or piece of managed code as a response.

A MOM agent runs as the MOMService.exe process using the local system account as its security context. The MOMService process is responsible for communicating with the management server, reading and writing to local event logs, reading WMI data, and performing file transfer sends and receives. When an action needs to be taken on the local computer, the MOMService.exe spawns a new process named MOMHost.exe . The MOMHost.exe runs in the security context of the agent action account. MOMHost.exe collects performance counter collection and runs scripts, managed code, and batch responses. Other actions are executed by the MOMService.exe impersonating the agent action account. The maximum number of responses that can run simultaneously can be configured, but the default is five. The isolation provided by running responses under separate process adds greatly to the stability and reliability of agents. Figure 3-1 shows where an agent sits and the tasks it performs relative to the local computer and the management server.

Figure 3-1. MOM 2005 agent details

The agent always initiates communications with the management server over TCP port 1270 and UDP port 1270 for heartbeats. Agents are designed to run independently of their owning management server in case there is a communications failure or if the management server is otherwise unavailable. By default, agents cache up to 3 MB of data on disk and this can be adjusted to suit your environment. For example, if there are frequent communications failures between the agent and the management server, you could increase this value so that valuable data is not lost. How long 3 MB lasts depends on how many management packs the agent is executing and how active the server is. On average, 3 MB will actually last a long period of time. For example, by using the sizing calculations from the "MOM 2005 Operations and Reporting Database Planning" section in Chapter 2--four 6-KB alerts per machine per day, 200 2.5-KB events per machine per day, and 10,000 200-byte performance monitor counter dataa single machine generates about 2.75 MB of data per day. So, the default 3 MB will last about a day, but it will vary.

Table 3-1 shows the default values for agents that can be set at a global level to apply across the management group. Some of these settings can be overridden at the management-server level, allowing agent configuration flexibility. These settings control the behavior of agents after they have been installed and act at the agent level.

Table 3-1. Agent settings that can be configured globally

Global agent setting	Default value	Management server override
Request configuration information (rule updates and configuration changes)	1 minute	No
Send heartbeat signal (lets the management server know the agent is alive and working)	10 seconds	No
Number of simultaneous responses allowed	5	Yes
Amount of temporary storage	3,000 KB	Yes
Service status check interval (monitors for changes in status of services)	On; 20 seconds	Yes
Event and performance data buffer duration	30,000 ms	Yes
Alert and response buffer duration	1,000 ms	Yes
Packet size	50 KB	Yes
Maximum amount of data to send per second	1,000 KB	Yes
Collect event binary data (information in the data frame of the properties of a Windows event log event)	Disallowed	Yes