Share Sisense web application externally (Windows only)
Sisense dashboards can be shared easily within the same private network, but the Sisense web application is not configured to be publicly accessible by default. This page details the steps and best practices to make your Sisense instance accessible to anyone on the internet, so that dashboards can be shared with users outside of your organization and Sisense can be accessed by users not on the same local network as the Sisense server. * Note: These settings make your Sisense web application publicly accessible. Users will still need to authenticate and be shared on a dashboard to access Sisense content. Implementation Steps To access Sisense using the Sisense server's IP address (for example, "192.0.2.0"), confirm that the server has a static public IP address. Consult your IT professional, internet service provider (ISP), or hosting service for more details. To access Sisense using a subdomain/domain name (for example, "analytics.example.com"), update your DNS to point to the machine's IP. You must own and control the domain name you wish to use. Sisense does not manage or assist with domain names or their configuration. Open the inbound TCP port in your firewall. This port is 8081 by default but configurable in the installation process (https://docs.sisense.com/win/SisenseWin/installing-sisense.htm#CustomizingtheInstallation). Nominally, this can be controlled in Windows Firewall with Advanced Security, but many customers have superseding rules from their organization or hosting service. If Sisense is still not accessible over your port after opening it in Windows Firewall, confirm with your IT department whether firewall rules may be in place elsewhere. Implement a security layer using SSL to ensure that all network traffic between your Sisense server and client machines is encrypted. For steps to do so, see here: https://docs.sisense.com/win/SisenseWin/setting-up-ssl-for-sisense-windows.htm. After implementing SSL, ensure the port used (typically 443) is also open for inbound TCP connections. Once these settings are implemented, external users will be able to access Sisense by entering the Sisense DNS/IP address and port (for example, "192.0.2.0:8081" or "analytics.example.com:8081"). * Note: If you don't want users to have to enter a port (for example, "192.0.2.0" or "analytics.example"), use port 80 for http communication and 443 for https communication, as these ports will be hidden from the URL. Troubleshooting If a user is unable to connect remotely after the settings were applied, you can test the communication between the machines to understand the source of the connectivity failure by doing the following: Confirm the Sisense web application is running and accessible locally on the server Use the 'nslookup' command in the Windows Command Prompt (cmd.exe) to confirm your domain/subdomain points to the correct IP address for your Sisense server. For example, 'nslookup example.com'. Try pinging the machine's IP address in the command prompt. This will show if there is communication available between both machines. For example, 'ping 192.0.2.0'. If you are able to ping the machine, use the telnet command to ensure you are able to communicate through the required port. For example, 'telnet 192.0.2.0 8081' Further troubleshooting or review may require your IT team's assistance. Further Reading More information is available here: https://docs.sisense.com/win/SisenseWin/setting-up-your-production-environment.htm. Helpful general information about web applications and security is available from Mozilla: https://developer.mozilla.org/en-US/Apps https://developer.mozilla.org/en-US/docs/Web/SecurityHealth and Maintenance of Sisense Environment
Overview: Keeping your Sisense environment healthy and up to date is essential to a successful Sisense instance. This article contains general information about Sisense deployment and maintenance. Please reference the linked articles for additional information. Topics: Clean installation Upgrade Migration Clean installation When first deploying Sisense it is important to review the Installation guide and ensure any prerequisite programs are installed. Keep in mind that Sisense depends on particular Sisense roles and features which are discussed below. Technical Requirements: .NET Framework 4.6.1 (as of Sisense Version 7.3) Visual C++ Redistributable Packages Java Runtime Environment The software components above along with Windows roles and features responsible for running IIS will be installed automatically within Sisense installation. Installing Sisense Minimum Requirements For organizations that do not allow their server to access the internet can use the offline installer process. Installing Sisense Offline For additional information about keeping your Sisense environment clean and performing well, please refer to this article: Performance Issues Troubleshooting Upgrade Each version includes new features and enhancements as well as other improvements. Please read our release notes and check if there are any breaking changes in the version you are upgrading to. We strongly recommend upgrading a staging environment first so you can know how the upgrade will affect your users and your configuration before upgrading your production environment. Make sure to back up your current instance before the upgrade. Feel free to contact your Customer Success Manager (CSM) or our Sisense Support team if any additional consultation is needed. Upgrading Sisense Backing up Sisense Release Notes Migration Occasionally you come across a situation when you need to migrate Sisense to a different server (for example moving from Windows Server 2012 to Windows Server 2016). In general, Sisense consists of 2 parts: Back-End: The Back-end includes your ElastiCubes - where all of the data to analyze is stored Front-End: Front-end that includes dashboards and system configuration. Each each component can be migrated in several ways. For more information please reference the following article and follow the instructions specific to your Sisense version. Please contact your CSM if Sisense migration will make you go over limit on server licenses. Migrating Sisense
Reducing Windows Memory Pressure by Removing unused JVM Connectors
Reducing Windows Memory Pressure by Removing unused JVM Connectors A simple technique can reduce memory pressure on Windows Sisense versions by inactivating unused JM connectors. To do this you should search for the Sisense JVM Connectors Configuration application from the Windows Start menu. After opening the Sisense JVM Connectors Configuration application simply uncheck any connectors which are not in use and press the Save button. The amount of memory saved varies depending on which connector. On average each connector uses 2GB. So if you inactivate 5 connectors, you just saved 10 GB of memory. If you need additional help, please contact Sisense Support. PLEASE NOTE: If you cannot locate the JVM as seen in the screenshot, the executable name is "usedConnectorsEditor.bat" and it should be located in the following directory C:\Program Files\Sisense\DataConnectors\JVMContainer\bin As seen in below picture.Identifying Sisense Services
This article is a reference point for understanding Sisense services and what their purposes are. The notes column contains supplemental information about the service. Please note that this is not an exhaustive list of how you would interact with the services for each scenario. Current List of Sisense Services (as of Version 7.2) Service Name Name Purpose Notes Sisense.Broker Broker Responsible for communication between services. All micro-services utilize the Broker service. In High Availability deployments, this service is associated with RabbitMQ as well. Ensure this service is running as it is a prerequisite for other Sisense services to function. Sisense.CLRConnectorsContainer CLR Connectors Responsible for powering CLR (.NET) connectors. You may restart this service if you're having trouble with particular CLR-based connectors. Sisense.Collector Collector - Sisense Internal Monitoring Responsible for internal monitoring and collection of data about the machine and process performance. This service must be running in order to send logs for Sisense monitoring. Sisense.Configuration Configuration Manager Responsible for powering the Configuration Manager application located at http://localhost:3030 on your Sisense webserver. Also exposes APIs for other configurations. You may restart this service if you find you're having trouble getting the Configuration Manager site to load. Sisense.Discovery Discovery Responsible for saving and storing configuration changes including those made in the Configuration Manager. Typically you will leave this service alone outside of a Sisense migration. Sisense.ECMLogs ElastiCube Manager Logging Responsible for storing build logs from ECM 1.0 and ECM 2.0, PSM, APIS, etc. There should not be any reason for starting this service outside of basic configuration changes (Sisense migration, MongoDB changes, etc). Sisense.ECMS ECM 1.0 (Desktop ElastiCube Manager) Responsible for powering the Desktop ECM. You may restart this service if you're seeing issues building or accessing ElastiCubes on the desktop. Sisense.ECMServer ECM 2.0 (Web ElastiCube Manager) Responsible for powering the Web ECM. You may restart this service if you're seeing issues building or accessing ElastiCubes within Sisense Web. Sisense.Galaxy Galaxy Controls the majority of web server logic. At this time this service also controls: Emails Reporting Export to image You may choose to restart this service in the following example cases: Many API calls that failed with "api not found". User can log in but not able to navigate through dashboards upon login. Emails are not going out. Sisense.Gateway Gateway Main entry point of the Sisense system. This service routes the API between many of the microservices. By default, this services listens on port 8081 and can be changed within the Configuration Manager. You may restart this service if you are having trouble reaching the Sisense site on your designated port. Sisense.HouseKeeper HouseKeeper This service is responsible for memory management of the Sisense application. Typically there is not a need to restart or modify this service. Sisense.Identity Identity Responsible for Sisense groups, roles, users, etc. This service is responsible for authentication and user management. You may restart this service in instances where your user is unable to log in due to errors in authentication (not related to SSO authentication). Sisense.Jobs Jobs Responsible for triggering jobs including emails after a cube build, emailed reports on a schedule, etc. Typically there is not a need to restart or modify this service outside of troubleshooting scheduled jobs. Sisense.JVMConnectorsContainer JVM Connectors Responsible for powering JVM connectors. You may restart this service if you're having trouble with particular JVM-based connectors. Sisense.Orchestrator Orchestration Utilized in HA to synchronize and distribute built ElastiCubes on the build node to the query nodes. You may restart this service changing HA configuration settings. Please consult the HA documentation before restarting this service. Sisense.Oxygen Oxygen (Licensing) Responsible for communicating with Sisense to verify licensing You may need to restart this server if you are having licensing issues within the ECM or Sisense Web. Must be restarted upon license update (along with a logout and log back in). Sisense.Plugins Plugins Management Node.js service which builds plugins. Users do not need to restart this service each time they change plugins. Plugins service watches the plugins folder for changes and runs a build mechanism automatically. Sisense.QueryProxy Query Services Provides a unified way to translate and access the backend SQL Engines. Responsible for query executions, throttling, load balancing, versioning, streaming and results formatting. This service must be running in order for query execution to work. Sisense.Repository Repository Responsible for storing Sisense metadata including: Dashboards Users Data security This service maintains connection to the files contained in MongoDB This service must be running in order for users to view dashboards and log into Sisense Web. Sisense.Shipper Shipper Responsible for shipping logs to Sisense for monitoring. Reads data from C:\ProgramData\Sisense\Monitoring\LOGS folder and ships it. This service must be running in order to send logs for Sisense monitoring. Sisense.SPE Data Prep and Streaming Engine Responsible for powering: Export to Excel Preview table Data Wizard Custom tables and custom columns You should restart this service when changing configuration settings for any of the modules power by it. Sisense.StorageManager Storage Manager Responsible for storing files for file-based connectors such as CSV and Excel files Typically no need to restart or change this service. You should restart this service when changing configuration for this component such as changing the max file size or minimum hard disk space for uploading files.. Sisense.Usage Usage Service This service is responsible for saving off Sisense usage data. Typically no need to restart or change this service. You may restart this service after a change in configuration of the Usage feature. Notable services on Sisense Version 7.1 and below: Service Name Name Purpose Notes ElasticubeManagmentService ElastiCube Management Responsible for powering the Desktop ECM. This service was replaced by Sisense.ECMS and Sisense.ECMServer. You may restart this service if you're seeing issues building or accessing ElastiCubes on the desktop. Sisense.ECMLogsPersistenceService ECM Logs Responsible for storing build logs from the Desktop ECM. This service was replaced by Sisense.ECMLogs. There should not be any reason for starting this service outside of basic configuration changes (Sisense migration, MongoDB changes, etc). Sisense.Pulse Pulse Responsible for powering pulse alerts. This service was replaced by Sisense.Broker. You may restart this service if you are experiencing issues with Pulse across the board.Reverse Proxy with Nginx + SSL configuration
Reverse Proxy with Nginx + SSL configuration Nginx Reverse proxy configuration Step 1. Nginx reverse proxy server set up In this example, we are using nginx, we can install it on the same device as Sisense. To install it run 1. Install nginx for Ubuntu/Debian-like systems: sudo apt install nginx 2. For RHEL systems such a CentOS, use below: sudo yum install nginx 3. Start nginx: sudo systemctl start nginx Step 2. Nginx server configuration 1. Open the browser and go to the IP address of the server. If it's up, you will see the Nginx welcome page– this means nginx is now running on the default port 80. 2. Edit /etc/nginx/sites-enabled/default and add the next configuration under the root server config. Define correct Sisense public IP, and port in the "server {}" section: location /analytics { rewrite /analytics/(.*) /$1 break; proxy_pass http://<sisense-ip>:30845; proxy_http_version 1.1; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $remote_addr; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header Host $host; proxy_connect_timeout 36000; proxy_send_timeout 36000; proxy_read_timeout 36000; send_timeout 36000; } 3. Before you apply the settings, check that there is no syntax issue by running sudo nginx -t 4. Reload nginx with sudo /etc/init.d/nginx reload or sudo systemctl reload nginx With this configuration, Sisense will be accessed with http://<ip-or-domain-of-nginx-server>/analytics. Also if the https is configured for this nginx server, Sisense would be accessible with https://<ip-or-domain-of-nginx-server>/analytics. If on the proxy level, the HTTPS is enabled, please ensure the application_dns_name has the https prefix to ensure all traffic is used, so something like: application_dns_name: https://company.sisense.com Step 3. Sisense configuration Go to the Admin tab Click on System Management Enter Configuration and choose Web Server In the Proxy URL enter "/analytics" or "http://<ip-or-domain-of-nginx-server>/analytics" as we configured in Nginx. With "/analytics" you will be able to use multiple domains for this instance. Save it and test with a browser by entering http://<ip-or-domain-of-nginx-server>/analytics And now we can configure SSL with our Nginx server, please validate that Nginx is working properly first before moving on. SSL configuration for Nginx Step 1. Obtain self signed SSL certificates You can use a command like this sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/private/nginx-selfsigned.key -out /etc/ssl/certs/nginx-selfsigned.crt. For an explanation of what the above command does please refer to Setup SSL on Sisense (Linux version) - Link placeholder Step 2. Configure Nginx to use SSL 1. Сreate a new file named self-signed.conf. sudo vi /etc/nginx/snippets/self-signed.conf In self-signed.conf we want to add some variables that will hold the location of our certificate and key files that we generated in Step 1. Like this ssl_certificate /etc/ssl/certs/nginx-selfsigned.crt; ssl_certificate_key /etc/ssl/private/nginx-selfsigned.key; Save and close the file. 2. Now we will create a snippet file to define SSL settings. Start by creating a file like this sudo vi /etc/nginx/snippets/ssl-params.conf In this file, we need to include some SSL settings as below. ssl_protocols TLSv1.3; ssl_prefer_server_ciphers on; ssl_dhparam /etc/nginx/dhparam.pem; ssl_ciphers EECDH+AESGCM:EDH+AESGCM; ssl_ecdh_curve secp384r1; ssl_session_timeout 10m; ssl_session_cache shared:SSL:10m; ssl_session_tickets off; ssl_stapling on; ssl_stapling_verify on; resolver 8.8.8.8 8.8.4.4 valid=300s; resolver_timeout 5s; # Disable strict transport security for now. You can uncomment the following # line if you understand the implications. #add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; add_header X-Frame-Options DENY; add_header X-Content-Type-Options nosniff; add_header X-XSS-Protection "1; mode=block"; Save and close the file. 3. In this step, we need to modify the Nginx configuration to use SSL. Open up your Nginx configuration file which is usually in a location like /etc/nginx/sites-available/<yourconfig>. Before making changes to this file it is best to back it up first in case we break anything. sudo cp /etc/nginx/sites-available/yourconfig /etc/nginx/sites-available/yourconfig.bak And now we open up our current Nginx config file; vi /etc/nginx/sites-available/<yourconfig> In the first server{} block, at the beginning, add the lines below. You might already have a location {} block so leave that there server { listen 443 ssl; listen [::]:443 ssl; include snippets/self-signed.conf; include snippets/ssl-params.conf; server_name your_domain.com www.your_domain.com; //server_name can be anything location / { try_files $uri $uri/ =404; } } Lastly, we need to add another server{} block at the very bottom of the file, with the following parameters. This is a configuration that listens on port 80 and performs the redirect to HTTPS. server { listen 80; listen [::]:80; server_name default.local www.default.local; //use same name return 302 https://$server_name$request_uri; } Please note that you must add this server_name to your local desktop or laptop hosts file. In this example, I will go to my local laptop or desktop hosts file and add <ip address of nginx server> <space> <default.local> [Optional] Step 3. Adjust the firewall The steps below assume you have a UFW firewall enabled. You need to review available profiles by running sudo ufw app list You can check the current setting by typing sudo ufw status: Output Status: active To Action From -- ------ ---- Nginx HTTP DENY Anywhere Nginx HTTP (v6) DENY Anywhere (v6) We need to allow HTTPS traffic, so update permissions for the “Nginx Full” profile. sudo ufw allow 'Nginx Full' Check the update sudo ufw status Output Status: active To Action From -- ------ ---- Nginx Full ALLOW Anywhere Nginx Full (v6) ALLOW Anywhere (v6) This output above confirms the changes made to your firewall were successful. So you are ready to enable the changes in Nginx. Step 4. Enable to changes in Nginx First, check that there are no syntax errors in the files. Run sudo nginx -t The output will most likely look like Output nginx: [warn] "ssl_stapling" ignored, issuer certificate not found for certificate "/etc/ssl/certs/nginx-selfsigned.crt" nginx: the configuration file /etc/nginx/nginx.conf syntax is ok nginx: configuration file /etc/nginx/nginx.conf test is successful You can disregard the ssl_stapling warning, this particular setting generates a warning since your self-signed certificate can’t use SSL stapling. This is expected and your server can still encrypt connections correctly. If your output matches the out example above, that confirms your configuration file has no errors. If this is true, then you can safely restart Nginx to implement the changes: sudo systemctl restart nginx Step 5. Test the encryption Open up a browser and navigate to https://<server_name>, use the name you set up in Step 2C. Additional information 1. It was reported that File Manager and Grafana doesn't work with reverse proxy. To get the URLs for file manager and grafana to work, following steps should be taken: kubectl -n sisense set env deploy/filebrowser FILEBROWSER_BASEURL='/<baseurl>/app/explore' kubectl -n sisense set env deploy/filebrowser FB_BASEURL='/<baseurl>/app/explore/' kubectl -n sisense set env deploy/sisense-grafana GF_SERVER_ROOT_URL=<baseurl>/app/grafana 2. Once the reverse proxy is enabled, Sisense will still utilize IP addresses as links in their email communications. To setup correct addresses in Sisense e-mails after reverse proxy is configured: in the configuration yaml file set: update: true application_dns_name: "" and start the installation script to update parameters. After update is completed, in Sisense GUI go to Admin -> Server & Hardware -> System management -> Configuration Set the http://YOUR_PROXY_ADDRESS/analytics in the "Proxy URL" field of "Web Server" menu (or https://YOUR_PROXY_ADDRESS/analytics in case of SSL) Go to Admin -> User Management -> Users Try creating a new user or use the "Resend invitation" option for the existing one (if available) Check the inbox of that user for "Sisense account activation" The "Activate Account" link should now redirect to the http://YOUR_PROXY_ADDRESS/analytics/app/account/activate/HASH addressAmazon Machine Image - Create Sisense Instance
Introduction Amazon Machine Images (AMI) provide the information that will facilitate the generation of an instance. It serves as an application to create virtual machines. The AWS offering will allow Sisense customers to operate with effective redundancy and control. Configure The configuration provides the user a variety of different options to connect setup deployments including the option to select the region to host the virtual application. After configuration select Continue to Launch Launch Confirm the configuration selections. It is necessary to provide the various types of deployments before launching the software. Users will need to create a key pair in EC2. Select Create a key pair in EC2 Note the EC2 instance type will alter the power of the virtual machine to be launched. Select Key Pair name and select Launch AWS will confirm the deployment was a success View Instance Users can view the generated Instance through the AWS console portal Create Image The following process will create a snapshot of an EC2 instance. If the user launches an instance based off of an AMI the new instance will look like the instance that the AMI was based off of. Under the left panel select Instances, available Instances will populate the window to the right of the panel. Select the desired instance and right click following the path Image -> Create Image Select Create Image View Image Confirm the Image (snapshot) was created. Select AMIs under IMAGES on the left panel. Users should see the Image that was generated in the previous step.
