insights

2022.4

false

Insights

DELIVERY:

Automation Cloud Automation Cloud Public Sector Automation Suite Standalone

Last updated Oct 25, 2024

Installation

Important:

Please note that this is a change from our HW/SW specs from Insights 2021.10. Insights 2021.10 requires a single Windows machine, while Insights 2022.4 requires a Windows machine and a Linux machine with RHEL.

In 2021.10, the Insights Windows machine ran Docker which hosted the Looker Linux container. Starting with 2022, the driver used to nest the Linux containers in Windows OS (called lcow) is not supported anymore by Microsoft for enterprise applications. As a result, we had to change our deployment architecture to require 2 machines - one Windows machine to run the UiPath Insights components, and a Linux machine to run the Looker container. With this change, enterprise support is available from OS vendors for the components needed to run UiPath products. The supported versions of Linux OS are the same that Automation Suite supports.

Installs on non-supported versions of RHEL are blocked and you need to update to a supported version. Check Operating System to find out the supported versions.

Important: Insights shouldn't be installed in a /tmp folder as this can create issues after a reboot. The installation needs to be done in a persistent directory.

Overview

Note: Check Insights Hardware and Software Requirements.

Make sure that ip_forward is enabled.

To install Insights Standalone v2022.4 you need to follow these procedures in the order captured below:

Prepare the Insights Windows Machine and the Insights Linux Machine

Step 1

Prepare the Certificate(s) to enable SSL for both machines. For more information, please click here.

Note: Please make sure to import the Looker and Insights certificates to the machine that you want to access Insights on.

The certificate for the Insights Linux machine should be installed on the Insights Windows machine because the LookerPreinstallationtool.exe will export the certificate from the Insights Windows machine to the Insights Linux machine.

Step 2

Configure two machines that meet the hardware and software requirements.

Important:

Make sure that you select the db_owner role as this is required when you add the database owner role during the Insights SQL machine configuration.
Both the Orchestrator and Insights major versions need to match. For example, if you have upgraded Orchestrator to 2022.4.X, you need to run a 2022.4.X version of Insights to establish proper communication between the two UiPath products.
The Insights database needs to point to the same database that was created when you enable Insights during the installation of Orchestrator.
If you have a large database, consider manually adding indexes using SQL scripts . The installation might fail during the Insights Database migration if it has to index a large set of data (see Database migration fails during installation.

Preparing a Linux machine

Preparing an AWS EC2 Linux machine

Step 1 Launch a Linux instance in AWS EC2

Initiate instance launch.
Select the Red Hat Enterprise Linux 8 Image (We support versions 8.2 - 8.6)
Choose an Instance Type and configure Instance Details.
Add storage to your instance and change the Size to 32.
Review and Launch the Instance
For more information, see Initiate instance launch in AWS.

Note:

Script uses Sudo to do initialization and if Linux host uses dzdo instead of Sudo, the script will also use dzdo.

Step 2 Open inbound ports

Open the inbound ports listed in the table below by following the instructions here:

Type	Port range	Source	Description
Custom TCP	9999	Anywhere-IPv4	This is the Looker port.
Custom TCP	19999	Anywhere-IPv4	This is the Looker API port.
Custom TCP	29999	Anywhere-IPv4	This is the LookML update port.

Preparing a Microsoft Azure Linux environment

Step 1 Create a machine running Linux

Navigate to Services > Virtual machines > Create.
Go to See all images and select Red Hat Enterprise Linux 8.2 - 8.6 from the Plan. For the offline RHEL bundle, click here.
Under Administrator account choose between SSH public key or Password. If you use an SSH public key, you can generate it and then choose Use existing key stored in Azure.

Step 2 Open Inbound ports to the created machine

To open the Inbound ports listed in the table below, follow the instructions here

Destination port ranges	Name	Priority	Source
9999	Looker_Port	310	Any
19999	LookerAPI_Port	320	Any
29999	LookMLUpdate_Port	330	Any

To configure additional settings, see Create an inbound security rule.

Step 3 Increase storage allocation for Azure Linux machines

The default storage allocation in an Azure Linux machine is 8GB and it could cause out of space errors when pulling images, creating backups, or using multiple dashboards.

Important: For air-gapped environments, a check for enough free space is performed but make sure that /var volumes have at least 10GB free space. Before running the deployment script, follow the steps below to increase storage allocation and avoid out-of space errors:

Open a SSH client in the Linux machine by running the command below:
```
ssh azureuser@<your-hostname>ssh azureuser@<your-hostname>
```
Where <your-hostname> needs to be adjusted to reflect your machine hostname.
Change to root user by running the command below:
```
sudo -isudo -i
```
Check the disk size by running the command below:
```
lsblk -flsblk -f
```
You’ll find the /var Mountpoint is under the name sda2 > rootvg-varlv.
Check the size of /dev/sda2 by running the command below:
```
lsblk /dev/sda2lsblk /dev/sda2
```
Where /dev/sda2 is retrieved from step 3. You will now see the size for /var , which is 8G.
Next, check the available space by running the command below:
```
vgdisplay rootvgvgdisplay rootvg
```
You’ll see the Free PE / Size will be around 40 GiB.
Increase the size of rootvg-varlv by running the command below:
You can change it to +10G or a different value that is smaller than the available 40GB (the size of free memory that you see in Step 5).
```
lvresize -r -L +10G /dev/mapper/rootvg-varlvlvresize -r -L +10G /dev/mapper/rootvg-varlv
```
Check if the resize succeeded by running the command below:
```
lsblk /dev/sda2lsblk /dev/sda2
```

Now you’ll have enough space for docker (located in /var/lib/docker).

Preparing a Windows machine for hosting the Insights service

Configure a Windows machine that meets the hardware and software requirements.
Open the default inbound port 443. For instructions on how to open an inbound port in AWS, see Authorizing access to an instance. For instructions on how to open an inbound port in Azure, see NSG Quickstart Portal.
Run the Install-Prerequisites.ps1 script to Enable IIS 10+, install .NET required for your version, and then restart the IIS service. Alternatively, you can manually install the prerequisites highlighted in the sub-steps below:
1. Open an RDP session in the created machine to install the prerequisites.
2. Enable IIS 10+.
  To enable IIS 10+, go to Control Panel > Programs > Turn Windows features on or off. This will open the Add Roles and Features Wizard. Follow the wizard to enable Web Server (IIS).
  
  This will open the "Add Roles and Features Wizard". Follow the wizard to enable Web Server (IIS).
  
  Enable the following Web Server (IIS) modules:
  - Web Server
    - Common HTTP Features
      - Default Document
      - Directory Browsing
      - HTTP Errors
      - Static Content
    - Health and Diagnostics
      - HTPP Logging
    - Performance
      - Static Content
    - Security
      - Request Filtering
  - Management Tools
    - IIS Management Console
3. Download and install .NET Hosting Bundle version 6.0.7+.
4. In PowerShell, run the following commands:
```
net stop was /y ; net start w3svcnet stop was /y ; net start w3svc
```
Enable HTTPS on your machine using an SSL certificate. Prepare your certificate using a procedure similar to the one provided for Orchestrator. See .
When specifying a hostname for Insights, make sure that the desired hostname is resolvable within your DNS.
Make sure to use TLS 1.1 or 1.2.

SQL Server Configuration

Before installing Insights, you need to configure the Insights SQL Server instance that you want to use.

Note: The Insights SQL database must be case insensitive (“InsightsDB” = “insightsdb”). If it is created during the Insights installation process, it is automatically set as such. If you create your own Insights database, set the collation sequence to Latin1_General_CI_AS to configure it manually as case insensitive.

Make sure that you have the following information readily available as it is needed for running the Insights installer:

The name of the SQL Server machine.
The name of the instance, if it’s not the default instance.

Also, ensure:

The SQL Server port is open in the firewall of the SQL Server machine. You can use SKIP_FIREWALL_RULE_CREATION=true` to skip firewall rule creation.
The TCP Protocol in SQL Server Configuration Manager is enabled.
The SQL Server service is set to listen on a fixed port, not on a dynamically allocated one.

Configure one of the following authentication methods through which Insights can connect to the SQL Server database:

Windows Integrated Authentication
SQL Server Authentication

Windows Integrated Authentication

For this option, a new login is required for the SQL Server as a service account. The service account should be a domain user whose password never expires. Looker, the analytics platform used by Insights, runs in a Linux container.

Important: To enable Windows Authentication, SQL Server needs to support authentication through the Kerberos protocol.

For more details on how to enable Kerberos authentication on SQL Server, see Manual SPN Registration.

Considerations when configuring Windows Integrated Authentication

Before configuring the Kerberos authentication, make sure that the Insights Server can access your Active Directory (AD) and SQL Server. You can review this with your IT administrator.
SQL Server needs to be added to your AD domain.
Insights machine needs to be on the same network as the AD Domain and SQL Server.
DNS should be configured so that Insights machine can resolve the domain names for both AD Domain and SQL Server.
AD user should exist with access to SQL Server and DB permissions as defined in the Permissions section. Domain, username, and password for this user must be provided during the Insights install process. Keep in mind that the username is case sensitive and that this also serves as the sAMAccountName of the user.
Open cmd as admin and run set user to get the USERDNSDOMAIN and USERNAME.
SQL server needs to have SPN entries in AD. For more information, see Register a Service Principal Name for Kerberos Connections.
Important: It is critical that the Insights machine needs to resolve the domain names of both AD Domain and SQL Server. You can verify this by running nslookup <your_AD_domain_name> and nslookup <your_SQL_server_domain_name> on the host machine.

Create new login in SQL Server Management Studio.

In the Object Explorer panel, navigate to Security > Logins.
Right-click the Logins folder and select New Login.
Select the Windows Authentication option. The window is updated accordingly.
In the Login name field, type the user domain you want to use as a service account.
From the Default Language list, select English.
Important: Ensure that the Default Language is set to English. If it isn't, the website will not be able to start, and the Event Viewer on the machine on which Insights is installed will display the following error message: The conversion of a varchar data type to a datetime data type resulted in an out-of range value.
Click OK to save the configuration.
If the service account has already been created and added to the Security > Logins section of the SQL Server, check whether the Default Language of that SQL account is set to English. If it isn't, you need to make the necessary adjustments.

SQL Server Authentication

For this authentication method, you need an SQL Server user.

Important: Consider using a non-SA (system administrator) account for security reasons.

Create SQL user in SQL Server Management Studio

In the Object Explorer panel, navigate to Security > Logins.
Right-click the Logins folder and select New Login. The Login - New window is displayed.
Select the SQL Server authentication option. The window is updated accordingly.
Fill in the Login Name,Password, and Confirm Password fields appropriately.
Ensure that the Enforce password expiration and User must change password at next login options are not selected.
Important: Ensure that the Default Language is set to English. If it isn't, the website cannot start, and the Event Viewer on the machine on which Insights is installed displays the following error message: “The conversion of a varchar data type to a datetime data type resulted in an out of range value”.

If the SQL Server account has already been created and added to the Security > Logins section of the SQL Server, please check whether the Default Language is set to English. If it isn't, please make the necessary adjustments.

Permissions

Regardless of the type of user (domain or SQL) you want to connect to SQL Server, please note that you need to assign it the dbcreator Server Role BEFORE installing Insights, as the database is created during this installation process.

If security restrictions do not allow the use of the dbcreator Server Role in the service account, create the empty database in SQL Server.

The Windows installer connects to SQL Server to verify the existence of the database.

After creating the database, you need to provide the user which connects to the Orchestrator SQL database with the db_owner user mapping role, as captured in the screenshot below:

If security restrictions do not allow you to use the db_owner user mapping role with the UiPath login, grant the following:

db_datareader
db_datawriter
db_ddladmin
EXECUTE permission on dbo schema

The EXECUTE permission has to be granted by using the GRANT EXECUTE SQL command, as follows.

if Windows Integrated Authentication is used:

USE UiPath Insights
GO
GRANT EXECUTE ON SCHEMA::dbo TO [domain\)\)user]
GOUSE UiPath Insights
GO
GRANT EXECUTE ON SCHEMA::dbo TO [domain\)\)user]
GO

if SQL Server Authentication is used:
```
USE UiPath Insights
GO
GRANT EXECUTE ON SCHEMA::dbo TO [sql_user]
GOUSE UiPath Insights
GO
GRANT EXECUTE ON SCHEMA::dbo TO [sql_user]
GO
```
Note: To configure the default MAXDOP of your database, see Configure the max degree of parallelism Server Configuration Option.

</details>

Install Orchestrator and Enable the Insights Feature

Install Orchestrator and enable the Insights feature.

Navigate to Orchestrator to obtain the installation access token. For more details, see Installation key.
Note:
- Both the Orchestrator and Insights versions need to match. For example, if you run Orchestrator version 2022.4.0, you need to run the same version of Insights to establish proper communication between the two UiPath products.
- The Insights database needs to point to the same database that was created when you enable Insights during the installation of Orchestrator.
- If you have a large database, consider manually adding indexes using SQL scripts . The installation might fail during the Insights Database migration if it has to index a large set of data.

Initialize Looker on the Insights Linux Machine

Generate Looker files on the Insights Windows Machine then run the Deploy-Looker.ps1 script to copy Looker files to the Insights Linux Machine and then initialize Looker. Alternatively, you can manually run the commands.

Important: The Deploy-Looker.ps1 script is compatible with LookerPreinstallationTool.exe version 2022.4.2.

Generate Looker Files on the Insights Windows Machine

Run the LookerPreinstallationTool.exe tool to generate a ZIP file for Looker.

Download LookerPreinstallationTool.exe and run the tool on the Insights Windows machine.
Note:
The tool version must match the exact same version of Ochestrator and Insights. To download the needed version of the LookerPreinstallationTool, check the Customer Portal > Product download page or ask the support team.
Follow the initial steps to generate the ZIP file.
Select the language.
Important: If the console cannot display Chinese/Korean/Japanese correctly, please change the font of your console. For Powershell, you can right-click the title bar and select Properties and select a TrueType font (e.g., MS Gothic, MS Mincho, or NSimSun).
Validate and export the generated certificate. Make sure the hostname is fully qualified and is covered by the certificate.
Note: The certificate needs to be placed in both Personal and Trusted Root Certification Authorities folders.
(Optional) Configure and validate SMTP settings.
(Optional) Configure Windows Auth, if you use it.
Note: If you upgrade from 21.10, you can export your current dashboards, views, and settings in step 7 and migrate this information to the new Linux machine.
(Optional) Export data to continue using your previous dashboards, views and app settings in this new environment. The tool can detect if a looker_container is running on the machine. If you move your data, the current Looker password stored in _insights/LookerSecret is going to be exported and used in the new Insights Linux machine.
(Optional) Encrypt the ZIP file to protect the Looker Secret. If you completed step 7, please consider using a password to protect the ZIP file.
Type the path where you want to create the ZIP file. Otherwise, it will be created in the default path that will be displayed in the console.

Copy Looker Files to the Insights Linux Machine

Copy the ZIP file to the Insights Linux machine.

Authenticate into your Insights Linux machine.
Open an SCP session and enter a command including the ZIP file path and username and password used as your Insights Linux machine credentials by running the command below:
```
scp <path-to-Insights_Lookerfile>.zip <user@linuxhostname>:~/scp <path-to-Insights_Lookerfile>.zip <user@linuxhostname>:~/
```
Note: Consider using Powershell 7 or higher, or Putty, as previous versions (Powershell 5.1) might experience rendering issues or a blank screen.

Initialize Looker

Open Powershell and run the command below to authenticate:
```
ssh <username@hostname>ssh <username@hostname>
```
Note: After you log into the Insights Linux machine, make sure the system local time is correct. Otherwise, Looker could enter an infinite refresh loop.
Generate GPG key using the command below:
```
gpg --generate-keygpg --generate-key
```
Note: GPG key is no longer needed in all versions of installation starting with the April 2023 release (23.10.3, 23.4.6, etc.)

When prompted, enter the username, email and set a password. A Public Key is generated. Make sure that you save the public key as you will use this later.

The Public Key is used to store the Looker password and certificate generated during the Looker initialization. You can pass this public key using the -k parameter when you run looker-initialization.sh.
Unzip the Looker files by running the command below:
```
unzip <Insights_Lookerfiles_timestamp.zip> -d <installation directoryunzip <Insights_Lookerfiles_timestamp.zip> -d <installation directory
```
The installation directory for Insights is the directory out of which the script is executed. So avoid unzipping the file in your home directory. The linux standard directory would be /opt but it can be installed in a location you choose.
Run the Looker initialization script by running the command below:
```
cd <installation directory>
bash insights/looker-initialization.sh -k <Public Key>cd <installation directory>
bash insights/looker-initialization.sh -k <Public Key>
```
Note: -k <public key> is no longer needed in all versions of installation starting with the April 2023 release (23.10.3, 23.4.6, etc.)

Where <Public Key> is generated through the gpg --generate-key command.

Note: You might be asked to enter your password to save the Looker password.

Note: Script uses Sudo to do initialization and if Linux host uses dzdo instead of Sudo, the script will also use dzdo.

Note: You might get the following error Module yaml error: Unexpected key in data: static_context [line 9 col 3] during the installation. For more information about this bug, see Turn off strict validation of modulemd documents (RhBug:2004853).
This has no impact on the Insights installation.
Exit Powershell and download looker.json by running the following command:
```
scp <username@hostname>:~/insights/looker.json <path-to-save-json>scp <username@hostname>:~/insights/looker.json <path-to-save-json>
```
Replace <username@hostname> with your username and Linux hostname.

You can use cat /home/user/insights/looker.json to copy the content and create a file in the Insights Windows machine named looker.json under the deployment directory, then paste the copied content.

Important: After initialization, a file called 'looker.key' will be created in the $HOME/_insights folder. Please do not delete this file, it will be needed for future upgrades.

Note:

You can create a looker user and change the ownership of the deploy folder to the new looker user and set the deploy folder permission to 755. All files in the folder will have the 644 attribute.

Note:

Looker has the ability to kill a SQL query after a dashboard is closed, if the query hasn't completed. This can mitigate performance issues in some scenarios. If its desired for this feature to be enabled, add the below sql permission. This is optional.

use master
go
GRANT ALTER ANY CONNECTION TO sqladminuse master
go
GRANT ALTER ANY CONNECTION TO sqladmin

Insights Installation

Note:

When upgrading from a version earlier than 2021.10, users with Insights permissions are not automatically migrated to your new installation. They can be optionally migrated via the User Migration tool. If you already used the tool when upgrading to 2021.10, you do not have to re-run the user migration tool again.
The Installer will use the Windows Display Language if it is one of the following languages: en-US, fr-FR, de-DE, es-ES, es-MX, ja-JP, ko-KR, pt-BR, pt-PT, ru-RU, tr-TR, zh-CN. If the Windows Display Language is not one of these languages, then the installer will use English.

Download the InightsInstaller.msi from the Custmer Portal, selecting your version.
Run the installer as administrator using the command prompt or PowerShell console.
Navigate to the directory where your .msi installer is located. Run the Insights installer using the following command:

msiexec /i InsightsInstaller.msimsiexec /i InsightsInstaller.msi

Alternatively, you can use the following command:

.\InsightsInstaller.msi.\InsightsInstaller.msi

The Insights installer should now check the prerequisites. If all prerequisites are met, the UiPath Insights Setup Wizard shows up and guides you through the Insights installation and configuration.

Note: If the installation failed or you want to check the installation log, you can go to the %temp% or %temp%/<sessionID> folder and check the latest MSI{random chars}.LOG. This directory is nonpersistent. You can enter the command below to run the installation with the predefined log location.
```
msiexec -I "InsightsInstaller.msi" -L*V  c:\logs\interactive.logmsiexec -I "InsightsInstaller.msi" -L*V  c:\logs\interactive.log
```
Accept the License Agreement and click Next.
The Looker initialization script on your Linux host outputs a JSON file with the configuration of the instance. Please input the full filepath of the location where you stored that file on this Windows host.
Enter the Insights Window machine settings as follows:
- Insights Server URL - the hostname or the URL of the Insights Windows machine.
- Port - the port you want to use to enable the communication with the Insights Windows machine. The default port number is set to 443.
- Certificate - the Subject or Thumbprint of the SSL certificate you want to use to secure connections with Insights.
Configure the Orchestrator settings as follows:
- Orchestrator URL - the URL of Orchestrator
- Installation Token - enter the Installation Access Token you generated on Identity Server's Installation Access Token page by logging in as the host tenant. For more details, see Host administration portals.
- Separate Identity Server - If you have a separate identity server, enable this option.
  Note: You need a new Installation Access Token on every installation. The token is valid for 2 hours, after which it expires. Generate another if experiencing an installation failure.
Configure the Insights database settings as follows:
- Server Name - the name of the SQL Server machine where the Insights database is located
- Database Name - the name of the Insights database
- Authentication Type - choose one of the following authentication methods:
  Important: You must use the fully qualified domain name for the database (e.g., mysever.my.domain instead of myserver). Preferably the SQL Server must join the AD domain directly.
  - Windows Authentication - if selected, Insights connects to the database, creates tables, and runs the IIS Application Pool using the specified credentials. The installer validates the connection using the Windows credentials you are currently logged in with. If you select this option, you must specify the domain, username, and password.
  - SQL Authentication - if selected, the connection is made using SQL authentication. If using this option, the Username and Password fields become editable, and you must provide the SQL username and password used to connect to the database.
    
    Important: No authentication for SMTP is supported in Insights 2022.4, 2022.10, and 2023.4.
Configure the email settings as follows:
- Configure Email Service (SMTP) - check to configure the email service
  - Server - the SMTP hostname.
  - From - the email address to send mail messages from.
  - Username - the username of the SMTP server, if it requires authentication. For example, if you are using Gmail, fill in this field with the email address used to send messages.
    Important: Consider using SMTP with authentication, as SMTP with no authentication may not be supported in the future.
  - Password - the email account password.
  - Port - the SMTP port.
  - TLS/SSL - check to enable TLS/SSL.
    TLS/SSL Version - only visible TLS/SSL is checked. Choose between TLSv1_1 and TLSv1_2
    
    Important: No authentication for SMTP is supported in Insights 2022.4, 2022.10, and 2023.4.
Click Next to start the installation. Once the installation process is completed, click Close to exit the installer.

Post-Installation Steps

Tenant Setup

After installing Insights, you must then enable Insights for your desired tenant(s) from the Orchestrator host portal. For more details, see Enabling or disabling features.

Note: There are scenarios where the Orchestrator table dbo.tenants has the key and accountId columns in uppercase values. This typically only happens with older versions of Orchestrator (Orchestrat 18.X or lower).

Check the logs under %programdata%/UiPath Insights/Provisioning
There should be an error about the OrchestratorTenantJob failing.
Login to the Orchestrator DB using a sql client.
Check the dbo.Tenants table.
Check if the columns 'Key' and 'AccountId' are all capitalized.
If they are, making them lowercase fixes the issue.
If there is a tenant that's lowercase, try just enabling that tenant and see if the error still occurs.
To fix the issue, change the case of the fields (make sure to backup the DB before hand. Also make a note of the KEYs that are already lowercase).
- UPDATE [UiPath].[dbo].[Tenants]
- set [key] = LOWER([key]), [AccountId] = LOWER([AccountId])
To revert the change, run
- UPDATE [UiPath].[dbo].[Tenants]
- set [key] = UPPER([key]), [AccountId] = UPPER([AccountId])
- WHERE [key] NOT IN ('xx-xx-xx-xx', 'xx-xx-xx-xx');
Doing an IIS reset (or just recycling the Provisioning application pool) maybe necessary. The provisioning service tries to provision instance every 10 minutes so if this isn't done, just wait 10 minutes at most.
If the issue is still occurring, raise a ticket with UiPath and include the following
- Screenshot of the dbo.tenants table.
- The provisioning logs mentioned above.