HP Internet Usage Manager Software Installation Guide

Transcription

1 HP Internet Usage Manager Software Installation Guide Edition 16 Version 7.0 Manufacturing Part Number: N/A E1010 U.S.A. Copyright 2010 Hewlett-Packard Company All rights reserved.

2 Legal Notices The information in this document is subject to change without notice. Hewlett-Packard makes no warranty of any kind with regard to this manual, including, but not limited to, the implied warranties of merchantability and fitness for a particular purpose. Hewlett-Packard shall not be held liable for errors contained herein or direct, indirect, special, incidental or consequential damages in connection with the furnishing, performance, or use of this material. Use of this document and any supporting software media is restricted to this product only. Additional copies of the programs may be made for security and back-up purposes only. Resale of the programs, in their present form or with alterations, is expressly prohibited. Warranty A copy of the specific warranty terms applicable to your Hewlett-Packard product and replacement parts can be obtained from your local Sales and Service Office. Restricted Rights Legend Use, duplication or disclosure by the U.S. Government is subject to restrictions as set forth in subparagraph (c) (1) (ii) of the Rights in Technical Data and Computer Software clause at DFARS for DOD agencies, and subparagraphs (c) (1) and (c) (2) of the Commercial Computer Software Restricted Rights clause at FAR for other agencies. HEWLETT-PACKARD COMPANY 3000 Hanover Street Palo Alto, California U.S.A. Copyright Notice Copyright 2010 Hewlett-Packard Development Company, LP. All rights reserved. Reproduction, adaptation, or translation of this document without prior written permission is prohibited, except as allowed under the copyright laws. Additional License Restriction Oracle software programs embedded in the HP products must not be accessed directly; they may be accessed through the HP product only. Trademark Notices UNIX is a registered trademark of The Open Group. Microsoft is a U.S. registered trademark of the Microsoft Corporation. Intel and Itanium are registered trademarks of Intel Corporation in the US and other countries and are used under license. Solid Information Technology is a trademark of Solid Information Technology in the United States and/or other countries. Oracle and Java are registered trademarks of Oracle and/or its affiliates. MySQL is a trademark of Oracle Corporation and/or its affiliates, and shall not be used without Oracle s express written authorization. Other names may be trademarks of their respective owners. 2

3 Print History Ninth Edition, IUM Version 5.0, December 20, 2006 Tenth Edition, IUM Version 5.0 Feature Pack 1, July 18, 2007 Eleventh Edition, IUM Version 5.0 Feature Pack 3, April 15, 2008 Twelfth Edition, IUM Version 5.1, May 8, 2008 Thirteenth Edition, IUM Version 6.0, November 18, 2008 Fourteenth Edition, IUM Version 6.0 Feature Pack 1, June 22, 2009 Fifteenth Edition, IUM Version 6.0 Feature Pack 2, May 6, 2010 Sixteenth Edition, IUM Version 7.0, October 10,

4 4

5 Contents 1. Before Installing System Requirements Software Requirements Hardware Requirements Preparing for Installation Obtain an IUM License Install the Java Development Kit Ensure Network Access to the Configuration Server Host Self-Publishing the Configuration Server s IOR Publishing the Configuration Server s IOR using an External Server Securing IOR URL Access for IUM Hosts Background Prerequisite Steps Adding Web Server Certificate to IUM Host s Java Environment Keystore Configuring IUM Hosts to Use the Secure IOR URL Provide a Time Synchronization Mechanism Specify Path to Web Browser Create a Windows Emergency Repair Disk Installing Multiple Instances of IUM on a System Complete the Installation Worksheet Migrating IUM to MySQL Overview Migration Scenarios System Requirements Supported Platforms Licensing Before the Migration Installing the IUM MySQL Migration Toolkit Running the Database Migration Source/Target Setup Object Selection Object Mappings Manual Editing Schema Creation Data Mapping Bulk Transfer Summary Migration Troubleshooting Installing and Activating IUM Installing IUM Activating IUM Console Installation and Activation Non-root Installation on UNIX Unattended Install of IUM

6 Contents Installation Troubleshooting After Installation - Enabling the 64-Bit Version of IUM Securing IUM Upgrading IUM Planning the Upgrade Upgrade Prerequisites Replacement of Legacy Report Server Impacts Disabling Security for a 5.0 Deployment Installing the Upgrade Activating Additional Components Viewing Your License Upgrading Your License Securing IUM Security Installation Prerequisites LDAP Bind and Kerberos Authentication Kerberos Time Synchronization Installing Security Detailed Instructions Add Another Host to your Secure IUM Deployment Add Another User to your Secure IUM Deployment Choosing a Certificate Authority Security Roles and Privileges Disabling Security for a Deployment Obtaining the Latest Documentation Download IUM Documentation Unpack the Documentation Archive View the Manuals Deactivating and Uninstalling IUM Deactivating IUM Components Uninstalling IUM on Windows Uninstalling IUM on UNIX Non-root Uninstall on UNIX Unattended Uninstall of IUM Uninstalling in Console Mode

7 Before Installing System Requirements 1 Before Installing This chapter provides instructions on preparing your system for IUM installation. Please read this chapter completely before installing IUM. System Requirements This section lists basic software and hardware requirements for installing IUM. Check the IUM customer support web site for the latest and most complete information on required software and hardware ( See the IUM Release Notes for the web site address and password. Software Requirements To run IUM, you must have all of the following: One of the supported operating systems, in addition to the required patch version of the chosen operating system. Currently IUM supports: HP-UX 11.23, (PA-RISC), (IA64), and (IA64) If you are installing IUM with the JRockit installer, the HP-UX operating system is not supported. It can only be used with JDK 1.6. Red Hat Enterprise Linux 5 (x86, x86-64) Windows Server 2008 (x86, x86-64) Solaris 10 (SPARC) The Java Development Kit (JDK). See Install the Java Development Kit on page 9 for details. If you have purchased IUM with the bundled JRockit Java Virtual Machine installer, then you do not need the Oracle JDK. The Java Runtime Environment (JRE) is not sufficient. You must install the JDK. Depending on your operating system, supported database software, such as MySQL or Oracle (10g and 11g are supported). If you have purchased the HP MySQL product extension, you must stage the MySQL-7.0-<platform>.iam.zip file (where <platform> refers to either the HP-UX, Linux, Solaris, or Windows version of the MySQL product extension) in a directory on your system. By default, the IUM installer looks for this file in the same directory where you launch the IUM installer, and the file is required in order for MySQL to be installed with IUM. Product extension files can be obtained from the IUM customer support web site at See the IUM Release Notes for more information on access. Chapter 1 7

8 Before Installing System Requirements Per the licensing agreement, purchasers of the MySQL and JRockit product extensions (provided by IUM) are expressly prohibited from using these software packages for any purpose other than for IUM. Depending on your operating system, a supported web browser. On Linux only, this release requires version libstdc++.so.5 or later of the library libstdc++. Use a command like one of the following to check your current version: rpm -q libstdc++ find / -name libstdc++.so To update this library, run the updater, usually in /usr/sbin/system-config-packages. Scroll down to the System heading. Select Compatibility Arch Support, then Details on the right. Make sure compat-libstdc++ is selected, then click Update. Use one of the above commands to verify your installed version. If you plan to use IUM security, you must install or have access to an LDAP server. For example, you could use Microsoft Active Directory, the ApacheDS LDAP server, or any other LDAP server. See Chapter 6, Securing IUM, on page 83 for details. If you will not use IUM security, you do not need an LDAP server. If you plan to use the 64-bit version of IUM, make sure you have an operating system and JDK that are 64-bit. See After Installation - Enabling the 64-Bit Version of IUM on page 73 for more information. Optionally, a web server or FTP server if you want to host the IOR URL outside of the configuration server. See Ensure Network Access to the Configuration Server Host on page 10 for more information. For complete details on the IUM software requirements, see the customer support web site at You can log in to the support web site with the user name and password provided in the IUM Release Notes. Hardware Requirements Disk Space: On Windows systems, including MySQL and JRockit, approximately 600 MB (MySQL needs 80 MB). On UNIX systems (except HP-UX), at least 450 MB in /opt and 150 MB in /var/opt. MySQL typically requires 160 MB on Solaris, and up to 340 MB on HP-UX systems. Temporary Disk Space: 100 MB in /tmp on all systems, used just during installation. Ensure that you have the appropriate disk space based on the installation type (that is, if you are also installing the MySQL or JRockit product extensions). Memory: 1GB The disk space and memory (RAM) required depend upon several factors, including the number and configuration of IUM components running on the host, and the volume of usage data being processed and stored. 8 Chapter 1

9 Before Installing Preparing for Installation Preparing for Installation This section describes what you must do before installing IUM. Obtain an IUM License The IUM license file is required for both installation and activation, and must reside on all hosts in the deployment, not just the configuration server host. If you did not receive a license file when you purchased IUM, obtain the license as follows: Visit the IUM customer support web site: See the HP IUM Release Notes for login and password. Contact your local HP Sales and Service Office When requesting your license, you must make the appropriate selections for any IUM product extensions, such as MySQL or JRockit (Real Time JVM). Licensing is required in order for these product extensions to be available at the time of installation and activation. You will receive a file named license.config as an attachment. While activating IUM on the selected host, you are prompted to supply the location of the license file. To store the license file on the host: Step 1. Transfer the file to the host system. Put the file in a safe location where it will not be accidentally removed. Do not place it in an IUM product directory or it will be deleted when you uninstall. Step 2. Record the location of the license file in Table 1-2, Installation Worksheet, on page 17. During installation, you will have the opportunity to specify the location of the license file within the IUM installer (see Installing IUM on page 51, Step 8). Later, when activating, the IUM activator verifies all of your licensing options before activation can complete successfully (see Activating IUM on page 59, Step 3a). Install the Java Development Kit If you are not installing the version of IUM bundled with its own Java Virtual Machine (JRockit), you must install the JDK version 1.6.0_04 or any later 1.6-based version of the JDK before installing this release of IUM. A Java Runtime Environment (JRE) is not sufficient. If you plan to use the 64-bit version of IUM, make sure you have an operating system and JDK that has 64-bit support. See After Installation - Enabling the 64-Bit Version of IUM on page 73 for more information. You should also install any platform-specific Java patches. The Java products on HP-UX and Solaris require patches from HP and Oracle, respectively. Conversely, if you have the IUM installer included with JRockit, you do not need to install the Oracle JDK and can skip the steps below. CAUTION See the IUM Customer Support web site ( for the specific versions of Java that are supported by IUM. For the IUM customer support web site user name and password, see the IUM Release Notes. Step 1. Obtain the JDK and Java patches. Chapter 1 9

10 Before Installing Preparing for Installation Download the JDK for HP-UX from Download the JDK for other platforms from Download required Java patches for your platform, if any. Step 2. Install the JDK and required patches, if any, according to the instructions accompanying the software. During installation, IUM searches for the JDK on your system. To ensure that IUM finds the JDK, install it in the default location. Step 3. Record the location of the JDK in the Table 1-2, Installation Worksheet, on page 17. TIP If you will be using the optional IUM security module, you will have to apply encryption policies to the Java runtime environments, including any JRE or JDK used by IUM. While this can be done later when installing the security module, it is recommended to do it now while modifying your Java environment. For instructions, see Chapter 6, Securing IUM, on page 83. Ensure Network Access to the Configuration Server Host When you install IUM, you first install IUM with the configuration server on one host, then you install IUM without the configuration server on all remaining hosts. The configuration server stores and manages the configuration for your deployment. All other IUM hosts and collectors download their configuration from the configuration server when they start. All IUM processes communicate with the configuration server via CORBA interfaces. When the configuration server first starts, it writes its CORBA address (known as the Interoperability Object Reference or IOR) to a file called ConfigServer.ior, typically in C:\SIU\var\ on Windows and /var/opt/siu/ on UNIX. The name of this file is stored with the keyword IORFILE in the SIU.ini property file. This is the physical location of the IOR file. The configuration server must make its IOR (CORBA address) available to other IUM processes. IUM processes access the IOR through a URL, referred to as the IORURL. These IUM processes communicate with the configuration server using its IOR. To make this IOR available to IUM processes, use one of the following methods: Enable the configuration server to self-publish the IOR URL using an embedded HTTP server. This is the simplest method. Publish the IOR URL using an external HTTP server, FTP server, or file server. Use this method when the simpler method described above is inadequate, for example, when you have systems on different sides of a firewall. See Publishing the Configuration Server s IOR using an External Server on page 11 for details. Publish the IOR URL over a secure HTTPS connection using an external HTTP server. See Securing IOR URL Access for IUM Hosts on page 12 for details. Self-Publishing the Configuration Server s IOR The configuration server can self-publish the IOR using an embedded HTTP server. You specify this during Activation by selecting the Enable Hosting of IOR URL by Configuration Server option (see Activating IUM, Step 3a, page 61). This enables a built-in HTTP server that the configuration server uses to provide its IOR to any other IUM process that needs to communicate with the configuration server. 10 Chapter 1

11 Before Installing Preparing for Installation Figure 1-1 Publishing IOR Using Embedded HTTP Server Host A Configuration Server HTTP Server Admin Agent Collector Publishing the Configuration Server s IOR using an External Server You can publish the configuration server s IOR using an external HTTP server, FTP server, or file server. Figure 1-2 Publishing IOR Using External HTTP, FTP, or File Server Configuration Server Host A IOR HTTP / FTP / File Server Admin Agent Collector Web server: The IORFILE is an absolute path name under the document root of the web server. The IORURL is relative to the document root. For example, FTP server: The IORFILE is an absolute path name to the FTP user s home directory hierarchy. The IORURL is relative to the FTP user s home directory. You can use anonymous FTP or a specific FTP user account. The format of an FTP entry with a specific user is one of the following: ftp://<user_name>:<password>@<host_name>/<file> ftp://<user_name>:<password>@<host_name>:<port_number>/<file> The following example shows the ftp user name siu with a password siupass on a host with IP address and the file /var/opt/siu/configserver.ior : ftp://siu:siupass@ /var/opt/siu/configserver.ior You can also use anonymous ftp, which has the advantage of not requiring a user and password. In this case, the configuration server writes its IOR under the ~ftp hierarchy and the IORURL is relative to the ~ftp directory. File access (local or remote): Local Access: For example, file:/siu/var/configserver.ior Windows File Share: You must map the remote server to a local drive letter. The IORFILE is an absolute path name on the Windows share. For example, if the remote server bigserver and share share1 is mapped to the I: drive, the IORFILE is file:/bigserver/share1/siu/var/configserver.ior. The IORURL then specifies the <share path>/<share relative path> as: file:/i:/siu/var/configserver.ior. NFS (Network File System for UNIX platforms) - The IORFILE is an absolute path name to the IOR file: /var/opt/siu/configserver.ior. The IORURL specifies the absolute path name: file:/net/bigserver3/var/opt/siu/configserver.ior. Chapter 1 11

12 Before Installing Preparing for Installation The configuration server must be able to write to this file, and the configuration server and the access service (HTTP, FTP, Windows share or NFS file access) can be hosted on the same machine or run on different machines. The host admin agent is a process that runs on each IUM host and controls all other IUM processes on that host. On Windows, the host admin agent runs as a Windows service under the System account. On UNIX, the host admin agent runs as a daemon as root. The host admin agent requires access to the IOR file so it can communicate with the configuration server. On Windows, when the host admin agent is running as the default System user, the service has limited access to network resources such as shared drives. If your IOR file is on another Windows system and shared with the local system (that is, IORURL format is file:/i:/siu/var/configserver.ior where the I: drive is a shared drive), you must use an account with access to that drive, not the default System account. For more information, see the IUM Administrator s Guide. Securing IOR URL Access for IUM Hosts You can optionally set up secure HTTPS access to the IOR URL of the configuration server using an external HTTP server. This section describes how to configure secure access to the IOR URL. Background All IUM servers are based on Java. To secure the IOR URL access for the IUM configuration server, you must configure the IUM host Java environment with the appropriate SSL authentication information. The Java platform uses JSSE (Java Secure Socket Extension) to secure internet communication based on SSL. The JSSE provides a truststore (a configurable keystore database) which is used to decide what to trust. When it verifies the identities of other clients or servers, it will retrieve trusted certificate authority (CA) certificates from its truststore. Prerequisite Steps This section describes the pre-configuration steps for securing IOR URL access. Configure an external web server with HTTPS support and the correct server certificate. Refer to Publishing the Configuration Server s IOR using an External Server on page 11 for details on how to configure this. You can use either a self-signed certificate generated using the Java keytool (the keytool command tool is part of the JDK installation) or a web server certificate from a trusted Certificate Authority (CA), such as VeriSign ( To view the list of certificate authorities trusted by your installed JSSE, execute the following command located in /bin/keytool under your JDK installation directory: keytool -list -keystore <JAVA_HOME>/jre/lib/security/cacerts The following is a sample command: keytool -list -keystore /opt/java1.6/jre/lib/security/cacerts Once executed, the keytool will prompt for the password. The default password is changeit. The default truststore file cacerts is located under the <JAVA_HOME>/jre/lib/security/ directory. If you have multiple JDK installations on IUM host machines, make sure that you are using the JDK used during the IUM installation. After generating the certificate, import it to the truststore of the IUM host machine s Java environment. Refer to the following web sites for more details on keytool documentation, the certificate generation process and Tomcat web server SSL configuration. 12 Chapter 1

13 Before Installing Preparing for Installation The following sections guide you through subsequent procedures you need to perform on all the IUM host machines. Adding Web Server Certificate to IUM Host s Java Environment Keystore This section assumes that you have the web server certificate that you have used to configure the web server for HTTPS support described under Prerequisite Steps on page 12. If the web server uses a certificate signed by a certification authority (CA) trusted by JSSE, no further action is necessary. If the web server uses a certificate signed by a self-signed root certificate or one issued by a certificate authority which JSSE does not trust by default, you must configure your Java environment to accept certificates signed by this self-signed root certificate by performing the following steps: Step 1. Step 2. Copy the self-signed root certificate that you have used while configuring the web server to a location accessible to the host machine (say, RootCertificate.cer). Add the root certificate to your default keystore using the command: keytool -import -trustcacerts -alias <KEY_ENTRY_FRIENDLY_NAME> -file <ROOT_CERTFICATE_FILE> -keystore <JAVA_HOME>/jre/lib/security/cacerts For example: keytool -import -trustcacerts -alias servercert -file RootCertificate.cer -keystore /opt/java1.6/jre/lib/security/cacerts The keytool will prompt for the password. Enter the default password changeit. You can change the password if needed. Step 3. Step 4. Type yes if it prompts you with the question Trust this certificate? Verify that the certificate has been added successfully by entering the following command: keytool -list -alias <KEY_ENTRY_FRIENDLY_NAME> -keystore <JAVA_HOME>/jre/lib/security/cacerts For example: keytool -list -alias servercert -keystore /opt/java1.6/jre/lib/security/cacerts Your IUM host Java environment is now initialized for SSL support. IMPORTANT Depending on your need, add the server certificate on all IUM host machines as described above. Configuring IUM Hosts to Use the Secure IOR URL All IUM hosts must be configured to use the secure IOR URL in order to access the ConfigServer.ior file using HTTPS. This URL can be configured in the SIU.ini property file which is located in your installation directory, typically in C:\SIU\ on Windows and /etc/opt/siu/ on UNIX. The URL is stored with the keyword IORURL in the SIU.ini property file. Follow the steps below to modify the IORURL property in SIU.ini. You can choose not to modify the IOR URL of the configuration server host machine and modify only the IOR URL of all the other IUM servers running on other networked hosts. Perform the following steps on all your IUM host machines, with the possible exception of the configuration server host. Chapter 1 13

14 Before Installing Preparing for Installation Step 1. Step 2. Step 3. Stop the IUM admin agent running on the host machine, and stop the Launchpad if it is running. See the IUM Administrator s Guide for specific instructions. Open the SIU.ini file located in the base directory of your installation in a text editor and search for the keyword IORURL, for example IORURL= Change the value of IORURL keyword to the secure HTTPS URL. The format is as follows: IORURL= qualified domain name>:<port>/<ior file URI> The following example uses port 8443: IORURL= The following example uses the default port 443: IORURL= The fully-qualified domain name of the server (sys01.hp.com in the above example) must match the subject field Common Name (CN) of the web server certificate. Step 4. Step 5. Verify that all the web servers are up and running, then start the IUM admin agent on your host machine. See the IUM Administrator s Guide for specific instructions. Test the configuration by running the command: siucontrol -c showprocs Provide a Time Synchronization Mechanism Because the various IUM hosts generate time-synchronized data, you must employ a time-synchronization mechanism such as NTP (Network Time Protocol) to synchronize time on each IUM host. You must also synchronize time on systems and devices, such as routers, that generate source data containing time information to be consumed or used by IUM collectors. On HP-UX, the -XX:+UseGetTimeOfDay option is required, and is added by default by the IUM activator. If you modify your JVMOPTS configuration attribute, ensure that this time setting is still enabled. The option can be viewed and changed via the Launchpad in the host s Defaults configuration node. Also, add this option if any process spawned by the admin agent does not use the host s defaults (that is, if the JVMOPTS attribute in the process Properties configuration node does not contain %DEFAULTS%). Specify Path to Web Browser IUM invokes a web browser to display the audit and reporting interface, as well as online help. To enable the browser to launch automatically on UNIX, make sure that the mozilla executable is in your PATH environment variable. Create a Windows Emergency Repair Disk Before and after installing IUM on Windows platforms, you should back up your Windows registry and make an Emergency Repair Disk. See your Windows online help for specific instructions on how to create an Emergency Repair Disk. 14 Chapter 1

15 Before Installing Preparing for Installation Installing Multiple Instances of IUM on a System You can install multiple instances of IUM on a single system. When installing IUM, provide a unique Instance Name to the install wizard (see Step 6, Installing IUM on page 51). Each instance or copy of IUM installed on a system has a unique instance name. The instance name is used as part of the IUM installation directory. The instance name must begin with SIU, so for example, you could use SIU01, SIU02, and so forth. Use the Instance Name when installing and uninstalling IUM. On Windows systems, you specify the directory where you want IUM to be installed. On UNIX systems, IUM is installed in /opt/<instance name>/, /var/opt/<instance name>/ and /etc/opt/<instance name>/. Regarding ports that IUM uses, you can safely use the default port values for the first instance. However, when activating additional, multiple instances on the same system, you cannot accept the default port values, nor can you use the same values if you used them on a previously installed instance. Errors can occur if the same ports are used. For example, you should use unique port numbers for IOR listen, MySQL, and the web application server so they do not conflict with other IUM instances. To avoid possible port conflicts and keep your various instances organized, it is recommended that you use a port-numbering scheme that helps ensure each instance uses unique port values. As an example, for each new IUM instance, you could increment each required port value by 10 or 100. IUM also uses the Apache Tomcat web server to run certain IUM components, such as the security server, repository server and web applications (Operations Console, reporting, and so on). A known issue with Tomcat involves the installation of multiple instances of Tomcat on the same host, which results in Tomcat shutdown port conflicts. If you encounter this scenario and need to resolve this conflict, you will need to manually change the Tomcat shutdown port in each instance s server.xml file in %VARROOT%/securityserver/conf. Apache Tomcat s default shutdown ports are the following: web applications security server repository server The shutdown ports are configured using the <Server> element of the server.xml file: <Server port="8005" shutdown="shutdown"> To install additional IUM instance(s) with attention to the unique port values, follow this process: 1. Install the new IUM instance without activating it. 2. Edit and change the shutdown port in the following server.xml files: a. <INSTALL_HOME>/newconfig/server.xml (for example, for a new instance change port to 8015, then for the next instance, 8025, and so on for all server.xml files) b. <VARROOT>/securityserver/conf/server.xml (for new instance, change port to 8017) c. <VARROOT>/repositoryserver/conf/server-secure.xml (for new instance, change port to 8018) d. <VARROOT>/repositoryserver/conf/server-unsecure.xml (for new instance, change port to 8018) 3. Activate IUM and specify ports for all other IUM components according to your chosen port numbering scheme (for example, adding 10 to each port value). For more information on the server.xml file, see the IUM Administrator s Guide. Also see Activating IUM on page 59 for more on the IUM activation process. Chapter 1 15

16 Before Installing Preparing for Installation Complete the Installation Worksheet Use an installation worksheet to record your decisions about the IUM installation. You can enter information about your deployment in the sample worksheet in Table 1-2. Table 1-1 Installation Worksheet Examples Configuration Server Host: The system where the IUM configuration server is running. IUM Instance Name: The name of the IUM instance. Must begin with SIU. Hosts and Collectors: The IUM collectors in your deployment and the systems that host them. IOR File Access: The method by which an IUM host accesses the IOR file on the configuration server. For example: sys01.hp.com For example: SIU_01 Default is SIU. sys01.hp.com - RadiusCollector1 sys02.hp.com - Correlator2 sys02.hp.com - BillingOutptCollector3 sys03.hp.com - PrepaidServer1 Configuration Server Self-Published access: or Anonymous FTP access: ftp://sys01.hp.com/siu/var/configserver.ior HTTP access: Remote file access on NT: file:/i:/siu/var/configserver.ior Remote file access on UNIX: file:/net/sys01/var/opt/siu/configserver.ior Username: The username under which the IUM host admin agent server runs (as a service on Windows or as a daemon on UNIX). IUM License File Location: Java Development Kit Location: On UNIX, the default is root. On Windows, it defaults to System. On UNIX, it is typically /etc/opt/siu/license.config On Windows, typically C:\SIU\license.config For example: On UNIX: /opt/java/jdk1.6.0_04 On Windows: C:\Program Files\Java\jdk1.6.0_04 LDAP Server Location For example: Primary: ldaps://enterpriseserver.hp.com:386 Secondary: ldaps://iumserver.hp.com: Chapter 1

17 Before Installing Preparing for Installation Record information about your deployment in the worksheet below (Table 1-2 on page 17). You will be prompted for some of this information during activation. For a large deployment, you may need a more formal inventory of your deployment. Table 1-2 Installation Worksheet Configuration Server Host: The system where the IUM configuration server is running. IUM Instance Name: The name of the IUM instance. Chapter 1 17

18 Before Installing Preparing for Installation Table 1-2 Installation Worksheet (Continued) Hosts and Collectors: The IUM collectors in your deployment and the systems that host them. IOR File Access: The method by which an IUM host accesses the IOR file on the configuration server. Username: The username under which the IUM host admin agent server runs (as a service on Windows or as a daemon on UNIX). IUM License File Location: JDK Location: LDAP Server Location 18 Chapter 1

19 Migrating IUM to MySQL Overview 2 Migrating IUM to MySQL The IUM MySQL Migration Toolkit allows you to convert and migrate your Solid database to MySQL. This chapter describes the migration process. If you are installing a new instance of IUM and are not upgrading from a previous version, you can skip this chapter and go directly to Chapter 3, Installing and Activating IUM, on page 51. Overview The Solid-to-MySQL migration process takes all of your IUM data in Solid and converts it to MySQL using the IUM MySQL Migration Tool. You can use the toolkit to convert the database both when the source and target databases are present (for immediate conversion), or you can use the toolkit with only the source present and then save the database to a file for later use. When you install and activate IUM, you will be able to import this file so all components and configurations in your deployment can use the new MySQL database. For more information on installation and activation of the MySQL product extension, see Installing IUM on page 51 and Activating IUM on page 59. This document describes using the Windows version of the toolkit, in the context of a Windows environment. The following sections discuss system requirements, migration scenarios, preparing for the migration, installing the toolkit, and the step-by-step migration process. Migration Scenarios The toolkit can be executed either on the host where IUM is actually installed, or remotely. That is, you can run it on another system and then point to the system being migrated from Solid to MySQL. Due to potential platform constraints, remote migration can be more suitable, though both scenarios are equally supported using the toolkit. Accordingly, both Windows and Linux versions of the toolkit are available if you are migrating from a different platform (for more information, see Supported Platforms on page 20). Typically the migration toolkit is used when you have both your source and target databases available ( online migration), but the IUM MySQL Migration Toolkit also supports migration of the source database only, without requiring the target database to be present (an offline migration). As a result, the toolkit allows saving the database migration to files with all the necessary SQL-format statements, which can be used to import all database data. Otherwise, the migration tool can be executed when both the source and the target database are present. Before installing IUM 7.0, you should perform the Solid-to-MySQL migration first, so that the database files can be used by the activator to complete the upgrade and activation (see Step 3e, page 64 in Activating IUM ). System Requirements Since the migration toolkit can be installed and run on a remote system other than the host deployment (that is, separate from your IUM deployment), it can have different system and platform requirements than IUM. To install and run the toolkit, JRE 1.6 is required on the system that will run it. Chapter 2 19

20 Migrating IUM to MySQL Overview The supported upgrade path for migrating an IUM deployment requires IUM 6.0 as the base version, while versions prior to 6.0 are not supported (but if you are using an older version of IUM, you can also upgrade your deployment to 6.0 in preparation for an upgrade to 7.0). IUM 6.0, 6.0FP01, and 6.0FP02 can be migrated from the Solid database to MySQL, to be used with 7.0. The minimum hardware requirements to install the migration toolkit are: 60 MB of disk space to install the toolkit. For larger databases, ensure that you also have sufficient disk space to accommodate the conversion. In addition to the installation disk space, the migration toolkit requires an amount of disk space that is equal to the size of the source Solid database file (solid.db, found in the %BINROOT%/Solid/DB directory). When the migration is complete (see Summary on page 48), the exported SQL scripts will occupy disk space on your system approximately equivalent to the size of solid.db. 512 MB of RAM. A 10 Mbit/s Ethernet link to the source and target database hosts. Supported Platforms Both a Windows and Linux version of the toolkit are available, but the Windows version of the IUM MySQL Migration Toolkit has more features and includes a graphical interface (described in this chapter for demonstration purposes). Meanwhile, the Linux version uses a text/command-line interface and is not as fully-featured, since for example, it does not allow editing of SQL statements manually during the migration (nor does the Windows command-line version). On Linux, the migration toolkit installer does have a graphical interface, and can be executed using the following command: ium-db-migration-7.0-setup-linux.bin -i gui To run the text user interface and command-line interface, use the run_migration and run_migration_cli scripts, which are both available for execution in the Linux migration toolkit installation directory. The following table summarizes the platforms where you can use the migration toolkit. Table 2-1 Platform Support Operating System Hardware Platforms Installer Toolkit Interface Red Hat Linux 4, 5 i386, x86_64 Command line, graphical interface Command-line and text user interface. : Both command-line and text user interface have limited functionality compared to the Windows graphical version. SQL statements cannot be manually edited. 20 Chapter 2

21 Migrating IUM to MySQL Before the Migration Table 2-1 Platform Support (Continued) Operating System Hardware Platforms Installer Toolkit Interface Windows XP, Vista i386 Graphical interface Graphical and command-line. : Command-line does not allow manual editing of SQL statements. The migration can be done without the target database present, since the migration toolkit does not require the MySQL server or other related database software to be installed prior to the migration. If you are using your own MySQL server, MySQL version 5.1 is supported (this is also the version supported if you purchased the MySQL product extension with IUM). Licensing The IUM MySQL migration toolkit is intended for data transfer from the Solid database to MySQL, and is an extended version of the standard MySQL Migration Toolkit from Oracle. The toolkit is licensed under the GPL, the terms of which must be accepted at installation (see Figure 2 on page 23; the license is also included in the migration toolkit install directory). HP provides the source code as well as its custom additions along with the toolkit. Before the Migration Before performing the migration, it is recommended that you clone your deployment on another test system. It is also essential that you: Stop all running collectors and processes. Ensure that Solid is still running on the system being migrated - this is critical for the migration to complete successfully. Any IUM component should not have any pending transactions prior to the migration, since the toolkit does not support capturing any data still in transit. Migration is intended to occur when all collectors and processes are shut down so that there is a clean cutoff of the data. Accordingly, you must stop all currently running processes (IUM collectors, charging manager, file collection services, and so on). All database producers must be in a stopped state. Otherwise, the database migration cannot be accomplished if any collectors or other IUM processes are live and still writing to the Solid database. The quickest way to stop IUM processes is to close the Launchpad and stop the IUM admin agent. Using this method, the Solid database will still be running after shutting down the admin agent, since Solid needs to be active when you perform the migration. If you decided to shut down IUM processes individually (instead of all at once via the admin agent shutdown), ensure that you also stop the IUM management server and the web application server. Chapter 2 21

22 Migrating IUM to MySQL Installing the IUM MySQL Migration Toolkit The migration process itself is non-destructive to the source. The source data in Solid is not touched or changed during migration. Installing the IUM MySQL Migration Toolkit Before performing the migration, you must first install the IUM MySQL Migration Toolkit. This can be done on either the IUM host to be migrated, or a remote system. The instructions in this document assume the Windows version of the toolkit is being used to perform a migration for a remote system. Step 1. Before proceeding, ensure that you have JRE 1.6 installed on the system that will be used to run the migration toolkit. You will be prompted to install the JRE if you attempt to run the migration installation otherwise. Run the ium-db-migration-7.0-setup-windows.exe executable. Press Next to proceed with the installation. Figure 1 Run the Migration Toolkit installer Step 2. Acknowledge the terms of the license and press Next. 22 Chapter 2

23 Migrating IUM to MySQL Installing the IUM MySQL Migration Toolkit Figure 2 License terms Step 3. Choose your preferred installation directory and any shortcut folder options. Chapter 2 23

24 Migrating IUM to MySQL Installing the IUM MySQL Migration Toolkit Figure 3 Choose installation directory Figure 4 Choose shortcut folder options Step 4. Specify the Java Virtual Machine to be used by the installation (JRE 1.6 or higher). 24 Chapter 2

25 Migrating IUM to MySQL Installing the IUM MySQL Migration Toolkit Figure 5 Choose the JVM Step 5. Specify the path to the IUM configuration file that contains the database connections to import into the installer. Figure 6 Specify configuration file path This selection is available so you do not have to manually supply the database URL later and so the migration toolkit will have your database settings (and thereby will be available from the migration toolkit drop-down menu selections when you perform the migration). See Figure 14 on page 32 for more information. Chapter 2 25

26 Migrating IUM to MySQL Installing the IUM MySQL Migration Toolkit Figure 7 Database URL settings obtained from configuration file Step 6. After pressing Next from the previous dialog, you will be shown a pre-installation summary of your choices before the install takes place. Figure 8 Pre-installation summary Press Install to begin the installation. Once the installation is complete and its success has been confirmed, press Done. You can now proceed with performing the database migration. 26 Chapter 2

27 Migrating IUM to MySQL Running the Database Migration Figure 9 Install complete Running the Database Migration Overall the IUM MySQL Migration Toolkit functions in the same manner as the original migration toolkit provided by Oracle, except for the fact that Solid has been added as a source database to migrate, as well as the ability to migrate without the target database present. Or, if you have your own MySQL database, then you can run the migration with it as the target. If you need assistance during the migration, refer to the online help included in the toolkit. The migration comprises the following tasks, which lead you through the corresponding sections of the interface: Source/Target Object Selection Object Mapping Manual Editing Schema Creation Data Mapping Bulk Transfer Summary Source/Target Setup To start the migration toolkit, select Start -> All Programs -> IUM DB Migration Toolkit -> MySQLMigrationToolkit. The migration toolkit start-up dialog is displayed. Chapter 2 27

28 Migrating IUM to MySQL Running the Database Migration Figure 10 Migration toolkit start-up The migration toolkit checks for the correct Java version at start-up. See Migration Troubleshooting on page 50 for more information troubleshooting if you encounter Java loader errors on start-up. Press Next to begin. 28 Chapter 2

29 Migrating IUM to MySQL Running the Database Migration Figure 11 Configuration type Direct Migration is preselected for you. After pressing Next, the source database selection screen is displayed. Chapter 2 29

30 Migrating IUM to MySQL Running the Database Migration Figure 12 Select the source database From the Database System drop-down list, select Solid Jdbc. The Connection Parameters portion of the dialog will then become available, prompting you for additional information regarding the source database. 30 Chapter 2

31 Migrating IUM to MySQL Running the Database Migration Figure 13 Specify source database connection parameters Next, you must specify the stored source database connection, obtained by the migration toolkit installer from the IUM configuration file you previously imported (see Figure 6 on page 25 and Figure 7 on page 26). From the corresponding Stored Connection drop-down list, select the connection. In this example, the jdbc:solid://testbl460b:1313 selection automatically populates the associated Username and Password fields for the database connection (this is just a name used by the migration toolkit to refer to your connection, and does not represent the actual connection URI that belongs in the Connection String field). Chapter 2 31

32 Migrating IUM to MySQL Running the Database Migration Figure 14 Stored Connection selected After confirming your selections, press Next. In the succeeding dialog, you can specify the target database parameters. Ensure that the Connection String field reflects the actual, absolute path, URL, or IP address of the machine hosting the Solid database being migrated, since the default string populated here will refer to the IUM hostname (and may not correspond to the network path naming convention that your system uses to reference another network resource). For instance, if the IUM file you used to import database connections into the installer resides on a different system than the actual database connection, then the paths will be different and reflect the path of the configuration file, rather than the actual database connection. The database URL extracted from the configuration file (see Figure 7 on page 26) may not be sufficient to access the source connection. For example, in some instances, the host name will be used, which cannot be resolved from the host on which the migration toolkit is running. In such a case, edit the URL manually in the Connection String field, and specify the IP address or fully-qualified host name so that the source host is accessible by the specified IP address or host name. 32 Chapter 2

33 Migrating IUM to MySQL Running the Database Migration Figure 15 Specify the target database connection As mentioned previously, the IUM MySQL Migration Toolkit supports both scenarios, where both the source and target database are present, or where you only have the source database and want to export your database to an SQL script file for later migration. For the latter case, select No connection from the Driver drop-down list. Otherwise, to migrate online (when you have both the source and target present), specify your MySQL JDBC Driver connection parameters and follow the remainder of the migration prompts. Chapter 2 33

34 Migrating IUM to MySQL Running the Database Migration Figure 16 Select no connection as target driver At this point, you do not need to specify any target connection parameters, as the migration toolkit only creates a connection with the source database. Press Next to continue. The migration toolkit checks the source database connection and retrieves the schema information. 34 Chapter 2

35 Migrating IUM to MySQL Running the Database Migration Figure 17 Database connection established After confirming the database connection is established, press Next to begin the Object Selection portion of the migration process. Object Selection Select the source schemata extracted from your database. In the example below, this is siu20. Chapter 2 35

36 Migrating IUM to MySQL Running the Database Migration Figure 18 Select source database schemata Press Next when your source database schemata is selected. The Reverse Engineering process will then commence. 36 Chapter 2

37 Migrating IUM to MySQL Running the Database Migration Figure 19 Reverse engineering process underway After the process has completed successfully, press Next. Chapter 2 37

38 Migrating IUM to MySQL Running the Database Migration Figure 20 Reverse engineering complete You can then review and select all object types (tables, and so on) that are to be migrated, and which (if any) are to be ignored and not included in the migration. To see the details and select any objects to ignore, press Detailed Selection. By default, all labels are selected. 38 Chapter 2

39 Migrating IUM to MySQL Running the Database Migration Figure 21 Select or ignore object types Next you can adjust any Object Mapping settings. Object Mappings In the Object Mapping dialog, you can specify any schema and object mappings for the database, but for the purposes of the IUM toolkit, all the default selected parameters are sufficient for a typical migration. Chapter 2 39

40 Migrating IUM to MySQL Running the Database Migration Figure 22 Object mappings Press Next to complete this step in the migration, and continue to the Manual Editing portion of the migration. 40 Chapter 2

41 Migrating IUM to MySQL Running the Database Migration Figure 23 Object mapping migration complete Manual Editing You can perform manual edits on the data to correct any mapping errors, but if no problems were found as a result of the object mapping, you are informed of this in the next dialog (where no manual editing of SQL statements is required). Chapter 2 41

42 Migrating IUM to MySQL Running the Database Migration Figure 24 Object mappings successful You can also select Show all objects from the Filter field, then press Advanced to edit the actual SQL statements manually for each object. This can be useful for advanced users who want to have full control over the migration process and change the automatically-generated SQL statements. Next, you can proceed with the Schema Creation section of the migration. Schema Creation You can create objects and transfer the data simultaneously, where both source and target database are present, connected, and whose data will be migrated if you have your own external MySQL database. Or, for the scenario where the target is not present, you can export the database data to generated SQL scripts to be filled with data as a data dump. For the simultaneous method, it is recommended that at a minimum you save an object creation script for diagnostic purposes. The Creates.sql script file needs to be created at this point so you can provide it to the IUM activator during activation (see Step 3e, page 64 in Activating IUM ). 42 Chapter 2

43 Migrating IUM to MySQL Running the Database Migration Figure 25 Object creation options The script you specify in the Filename field represents your database schema migration script. Also, when selecting the option to create a script file, ensure that Create Objects Online is not selected. A confirmation is displayed to indicate the execution completed successfully. Chapter 2 43

44 Migrating IUM to MySQL Running the Database Migration Figure 26 Object creation options successful A further dialog displays script/object creation problems, if any. 44 Chapter 2

45 Migrating IUM to MySQL Running the Database Migration Figure 27 Object creation results Next, you can set up data transformation and data mapping options. Data Mapping As with the Schema Creation step, you can specify how you want to transfer the data, whether online, or offline by saving to an inserts file. Chapter 2 45

46 Migrating IUM to MySQL Running the Database Migration Figure 28 Bulk transfer/inserts file specification As with schema creation described in Schema Creation on page 42, and for the scenario where the data will be saved for later use, ensure that Transfer Data Online is disabled, and that you only select Create Script File for Insert Statements. Specify the path to the script file, which represents the built data migration script. After pressing Next, the bulk data transfer will commence (see Figure 29). The Inserts.sql script file needs to be created so you can provide it to the IUM activator during activation (see Step 3e, page 64 in Activating IUM ), Bulk Transfer After specifying bulk transfer and a script file for insert statements, the database transfer will proceed. This process could take some time depending on the size of your database. 46 Chapter 2

47 Migrating IUM to MySQL Running the Database Migration Figure 29 Bulk transfer in progress A confirmation will display to indicate the transfer is complete. Press Advanced to review the log and ensure there were no transfer errors. Chapter 2 47

48 Migrating IUM to MySQL Running the Database Migration Figure 30 Transfer complete Press Next to view the migration summary report. Summary Upon completion of the migration, you can view a report detailing the entire migration results. 48 Chapter 2

49 Migrating IUM to MySQL Running the Database Migration Figure 31 Final migration summary report Press Save Report to Disk to save a copy of the migration report. Press Generate Migration Script to record all input selections you made during the migration, which can be used for a further unattended migration. The creates.sql and inserts.sql scripts that you saved earlier (see Figure 25 and Figure 28) are intended for creating and populating the database objects (such as tables and indices). These script files are generated for both cases, but in the second case (during an online migration) the script files are created on the fly. The script files are standard MySQL scripts that you can process by (1) importing the creates.sql and inserts.sql files when you are upgrading and activating IUM with the MySQL product extension files, directly into the activator, or (2) using the mysql command-line utility to create and populate the database tables. For example, you can use mysql commands such as the following to import the data into MySQL: mysql -u username -p password database_name < creates.sql mysql -u username -p password database_name < inserts.sql Either method completes the upgrade process from Solid to MySQL, and makes your data available for use in IUM 7.0. See the next chapter, Chapter 3, Installing and Activating IUM, for more information on installing and activating the product. Also see Chapter 4, Upgrading IUM, on page 77 for more details on upgrading, and the IUM Administrator s Guide for more information on the mysql command-line utility. Chapter 2 49

50 Migrating IUM to MySQL Migration Troubleshooting Migration Troubleshooting Java loader issues at migration toolkit start-up. An error may appear that says, An error occurred during the initialization of the runtime system. Please make sure you have the Java Runtime Environment (JRE) 5.0 Update 8 or newer installed. This can occur if you execute the migration toolkit executable (MySQLMigrationTool.exe) directly instead of using the Windows Start menu shortcut (All Programs -> IUM DB Migration Toolkit -> MySQLMigrationToolkit). Also, if you still experience Java loader issues, ensure that the jvm.dll path contained in the run_migration.bat file is correct. For example, for JRE 1.6, and assuming the JRE is installed in C:\Program Files\Java\jre6, the path contained in this file is typically C:\Program Files\Java\jre6\bin\client\jvm.dll (the location can vary for different JRE installations). If there is a different path to another jvm.dll, the migration toolkit start-up will fail. For this case, ensure that the correct path to your JRE s jvm.dll is present. Also, before editing run_migration.bat, ensure that you first close the migration toolkit. Migration toolkit failure during large database migration. When migrating a database with a very large amount of tables (about several thousand tables), the toolkit may fail with a Java Out of Memory Exception. In this case, the command-line version of the toolkit clearly reports about out of memory problems, while the graphical version outputs the following: The schema could not be reverse engineered (error: 10008). To prevent this error, the maximum Java heap size should be increased. This can be done by adding a larger -Xmx parameter in the start-up scripts (run_migration and run_migration_cli on Linux, run_migration.bat and run_migration_cli.bat on Windows). Replace the set _JAVA_OPTIONS=-Xms64m -Xmx256m line with set _JAVA_OPTIONS=-Xms64m Xmx512m. 50 Chapter 2

51 Installing and Activating IUM Installing IUM 3 Installing and Activating IUM This chapter describes how to install and activate a new instance of IUM on a clean system. Please read this chapter completely before beginning installation. Installing IUM TIP If you downloaded the setup program from the web site or via FTP, make sure the file does not have an extra extension. Some Web browsers add a.html,.exe, or.zip extension to the file name. If this happens, rename the file to remove the extra extension. Otherwise, the installation may fail. To install IUM: Step 1. Read Chapter 1 and ensure you meet the System Requirements on page 7. Step 2. Back up your system. Step 3. Table 3-1 Copy the appropriate IUM setup program to the host system. Installation files vary depending on 32- or 64-bit support, whether or not you use the core IUM installer that assumes you are using your own JDK, versus the installers bundled with the JRockit JVM, or if you have purchased the MySQL product extension. On a UNIX system, ensure the file has executable permissions. IUM Setup Programs OS Setup Program (for use with standalone Oracle JDK) Setup Program (JRockit JVM) Windows IUM-7.0-setup-Windows.exe IUM-7.0-setup-Windows-JRockit32.exe IUM-7.0-setup-Windows-JRockit64.exe HP-UX IUM-7.0-setup-HP-UX.bin Linux IUM-7.0-setup-Linux.bin IUM-7.0-setup-Linux-JRockit32.bin IUM-7.0-setup-Linux-JRockit64.bin Solaris IUM-7.0-setup-Solaris.bin IUM-7.0-setup-Solaris-JRockit-SPARC9.bin Table 3-2 OS Windows MySQL Setup Files Setup Program MySQL-7.0-Windows.iam.zip HP-UX MySQL-7.0-HP-UX.iam.zip Chapter 3 51

52 Installing and Activating IUM Installing IUM Table 3-2 OS Linux MySQL Setup Files (Continued) Setup Program MySQL-7.0-Linux.iam.zip Solaris MySQL-7.0-Solaris.iam.zip Step 4. Execute the IUM installer program. The program searches for Java and displays the IUM Install Wizard. Step 5. Review and accept the license terms. 52 Chapter 3

53 Installing and Activating IUM Installing IUM Step 6. Specify the IUM instance ID for your new installation. The IUM installer also checks for pre-existing IUM instances on the machine, and summarizes what it finds, allowing you to choose between upgrading a previous installation, or installing a new one. In this example, previous versions of IUM were detected, but you can enter a new IUM Instance ID in the corresponding field to create a new installation. Otherwise, on a clean system with no previous IUM installs, you will just be prompted to enter the ID for the new installation. For details on an upgrade installation, see Chapter 4, Upgrading IUM, on page 77. Step 7. Next, choose the destination install directory for this instance. The install directory will be named according to your chosen Instance ID (specified in the previous step), and defaults to C:\SIU_<instance_ID> on Windows. Chapter 3 53

54 Installing and Activating IUM Installing IUM Step 8. Specify the path to the IUM license file. If you do not have a license file, visit the IUM customer support site (also see the IUM Release Notes). Also see Obtain an IUM License on page 9 for more information. Step 9. Specify whether you want to install additional IUM product extensions (for example, the MySQL database). If you are not using the embedded MySQL database (that is, you have your own database) or are not installing any other IUM product extensions, you will be taken directly to Step 10 to make your JVM selections. 54 Chapter 3

55 Installing and Activating IUM Installing IUM If you later decide to use the MySQL database included with IUM, you must re-install and re-activate so that MySQL will be present and usable in your IUM instance. If installing additional product extensions, you are prompted for the location of the these files. For example, to install the MySQL database, specify the path to the MySQL-7.0-Windows.iam.zip file that you should have already downloaded from the customer support site and placed in your install directory. Optionally, select Scan subdirectories if the install files are located in a subdirectory, so that the installer can locate them (by default the directory path specified in product extensions directory will be the directory from which you launched the IUM installer). If you have correctly staged the optional product extension for the MySQL database on your file system, after clicking next, the IUM installer will detect it and indicate this accordingly. Chapter 3 55

56 Installing and Activating IUM Installing IUM Step 10. For the IUM installer without the bundled JVM, specify the path to the chosen Java Virtual Machine. In this example, JDK 1.6.0_19 is present on the system. Otherwise, you can also specify the path to another JVM if preferred. If you are installing IUM with the bundled JRockit JVM, the Choose Java Virtual Machine dialog will prompt you regarding which JVM you want to use. 56 Chapter 3

57 Installing and Activating IUM Installing IUM In this example, the Oracle JDK was already present, and the installer defaults to this selection. However, if you purchased the JRockit JVM and want to use it, select Use the Java VM installed with this application. As shown above, the installer uses JRockit, while any other JVMs present on the system are not selected. Step 11. A summary of the installation settings is provided, to include any product extensions. Chapter 3 57

58 Installing and Activating IUM Installing IUM For a JRockit installation, the installation summary indicates the install path for JRockit (see Java VM Installation Folder entry). Click Next to start the installation with the specified settings. Step 12. Once the installation completes, you will be notified of the successful completion. Click Next to proceed with activating IUM. 58 Chapter 3

59 Installing and Activating IUM Activating IUM Step 13. Select Activate IUM if you want to proceed with activation immediately after installation, or to activate IUM later from the command line. You can launch the activator wizard at any time via the command line, activate using a activation-specific command console, or activate in silent mode. You cannot, however, use IUM without activating it. If not activating at this time, click Done. Otherwise, if you select Activate IUM and click Done, the activator wizard is opened. See Activating IUM on page 59 for activation steps. If the installation failed, check the installation log file to review and resolve the problem, and run the program again. The setup program logs its activities and results to the IUM installation directory (whether successful or not) to two log files: Internet_Usage_Manager_InstallLog.log and MySQL_InstallLog.log. Additional debugging-related log files, for both the install and uninstall processes, can be found in your home directory (for example, C:\Documents and Settings\<username> on Windows, or /root on UNIX). These files take the form of ium-install0.log.0, ium-install0.log.1, or ium-uninstall0.log0, ium-uninstall0.log1, and will remain on your system whether IUM is present or not. Activating IUM You must activate IUM before you can use the product. The activation process performs several tasks: Verifies your license file, in addition to licensing for any IUM product extensions. Configures the access path to the configuration server. Starts the host admin agent and MySQL database as daemons or services. Starts the configuration server (on the first IUM host only). Loads all configuration information into the configuration server (on the first IUM host only). Starts the management server, Operations Console, audit report server, IUM web application server, and policy server, if specified. Chapter 3 59

60 Installing and Activating IUM Activating IUM If you purchased the license for a mobile solution (GPRS, CDMA, or Prepaid Data) along with IUM, the wizard checks your license and activates these mobile components. Allows you to specify database properties, whether you are using the IUM MySQL product extension, or an external database that you provide. If you are upgrading from an earlier version of IUM (6.0 or higher), you can also point the activator to your database dump files that were generated during the migration process from Solid to MySQL. See Summary on page 48 for more information on database migration files. Step 1. Step 2. You must activate IUM on the configuration server host first. For any host (configuration server host, in addition to all other hosts in the deployment), copy your IUM license file to the system if you have not already done so. See Obtain an IUM License on page 9 for more information. To start the IUM Activation Wizard, enter the following command at the command prompt: $>activate This launches the activate command-line tool, which is typically in C:\SIU\bin on Windows or /opt/siu/bin on UNIX. By default, this command displays the Activation Wizard in graphical interface mode, also accomplished by entering activate gui. The activate tool also has a console mode that you can launch (activate console), and a silent mode for unattended activation (activate silent). The instructions below use the activate gui mode of activation. See Unattended Install of IUM on page 70 for an example of silent installation and activation, and Console Installation and Activation on page 67 for more information on console install and activation. Also see the IUM Command Reference for a complete listing of the activate tool s options and usage (whether for the gui, console and silent modes). The activate tool s console mode is a standalone activation option within activate, and is not part of, or related to the IUM Command Console (rather, activate functions in a similar manner as the secactivate, secserveractivate, and ldifgen command-line tools). For more information on the IUM Command Console, see the IUM Administrator's Guide. Step 3. Follow the instructions in the Activation Wizard by providing the activation information when prompted. Activation options can vary depending on which IUM features you have enabled in your license. 60 Chapter 3

61 Installing and Activating IUM Activating IUM a. Specify the configuration server options. Host is Config Server Enables this system to host the IUM configuration server for the deployment. Select this option only on the first IUM host. Repository Port Accept the default (8300) or specify an unused repository server port. Security Port Accept the default (8443) or specify an unused security port. Enable hosting of IOR URL by Config Server Enables the configuration server to self-publish its IOR using an embedded HTTP server. See Self-Publishing the Configuration Server s IOR on page 10. IOR Port Number Accept the default or specify an unused port number at which the configuration server can listen to requests for its IOR. Location to store Config Server connection properties (File IOR) The configuration server writes its IOR to the file C:\<Instance name>\var\configserver.ior on Windows or /var/opt/<instance name>/configserver.ior on UNIX by default. If you use one of the other ways of publishing the Configuration Server s IOR (see Publishing the Configuration Server s IOR using an External Server on page 11), specify the appropriate path name to your external HTTP, FTP, or file server. The name of this file is stored with the keyword IORFILE in the SIU.ini property file. This is the physical location of the IOR file. To make this file available to other IUM processes, you can either enable the configuration server to publish the IOR URL or copy this file to the document root of a web server, an FTP server, or some other access service. License File Specify the location of the IUM license file. Your IUM license file enables you to use only those IUM components that you purchased. The license is required for both installation and activation, and is also required for installation of all hosts, not just the configuration server host. Be sure to store your license file in a secure location. Chapter 3 61

62 Installing and Activating IUM Activating IUM b. Specify the configuration server URL. Config Server URL Specify the configuration server IOR URL. On the configuration server host, this is typically the path name of the file containing the IOR, with the file: prefix. For example, file:/c:/<instance name>/var/configserver.ior on Windows or file:/var/opt/<instance name>/configserver.ior on UNIX. On a system other than the configuration server host, this is typically the URL of the IOR hosted on the configuration server. See Ensure Network Access to the Configuration Server Host on page 10 for details. c. Specify the Host ID. Host ID Specify a unique name for this host in the IUM deployment. 62 Chapter 3

63 Installing and Activating IUM Activating IUM The host name must not be Security as this is a reserved name. The host name also cannot be. or.., and should not contain spaces or special characters. Language Enables the Launchpad to display localized text. Only English language text files currently ship with IUM. d. Specify additional applications to activate. Activate IUM Reporting Web Application Enables the IUM Reporting web application to run on this host. See the IUM Foundation Guide for details on Reporting. Activate Audit Reporting Web Application Enables the IUM Audit Reporting web application to run on this host. See the IUM Foundation Guide for details on Audit and Audit Reporting. Activate Operations Console Web Application Enables the IUM Operations Console web application to run on this host. The Operations Console is a tool for the IUM operator monitoring your IUM deployment that provides quick, easy to view status of all your charging managers, collectors and other IUM processes. See the IUM Operations Console User Guide for more information. To use the Operations Console, you must also activate the IUM Management Server as described below. While you can activate the Operations Console on any IUM server, you only need to activate the Management Server on one IUM host. Chapter 3 63

64 Installing and Activating IUM Activating IUM Operations Console Port Number Accept the default or specify an unused port number for the port on which the web application server will listen for connections. This refers to the port number used when you browse to the IUM Web Tools page at or IP address>:8159. See the Starting the Operations Console section in the IUM Administrator s Guide for more information. Activate Policy Server If you plan to use policy-based SNMP collection on this host, enables the IUM Policy Server to run on this machine. Additional configuration is required to use the Policy Server for policy-based SNMP data collection. See the IUM Component Reference for details on the DynamicSnmpEncapsulator and the PolicyServer components. e. Specify whether the database you are using for IUM is the (embedded) MySQL database, or an external database you provide and support. If you installed MySQL with IUM, the following database properties activation screen will be available. By default, the Embedded option is selected if you installed MySQL and your license includes it. You can specify the following: Embedded/Port The Embedded option is selected by default for MySQL if you installed the MySQL product extension. You can also accept the default (3306) database port number in the corresponding Port field, or specify another unused port number. Import data If migrating your database from a previous version of IUM, select this option and specify the path to the creates.sql and inserts.sql scripts that contain your migrated data. This allows you to import your data from the previous database and is used for an upgrade installation. If you are using an external database, this option is not available. For more information on database migration, see Chapter 2, Migrating IUM to MySQL, on page Chapter 3

65 Installing and Activating IUM Activating IUM External If you have the IUM MySQL product extension, but choose to use your own database, the activator allows for this flexibility. For this scenario, with the External option selected, the External Database portion of the dialog becomes available, allowing you to specify the external database settings. JDBC Driver jar file for your chosen database JDBC Driver class Database URI User name Password Chapter 3 65

66 Installing and Activating IUM Activating IUM If you installed IUM without the MySQL product extension, the activator assumes you are using your own database. Accordingly, the Embedded option is unavailable and External is selected by default, as this is the only allowable option (this state will also be indicated by the Not Installed message in the Embedded Database field). For an external scenario where IUM was installed with no database, the External Database settings are required and must be provided before proceeding with the activation. After entering all external database details, you can click Test Connection to ensure you have connectivity. f. Choose whether to activate the IUM management server. 66 Chapter 3

67 Installing and Activating IUM Console Installation and Activation Activate IUM Management Server Enables the IUM Management Server, which supports the Operations Console. To use the Operations Console, you must activate the management server on any single host in your deployment. You can activate and use the Operations Console on any or all of your IUM hosts. The Management Server does not support configuration with multiple web application servers on different hosts. g. After all activation options have been specified, a final summary of your activation settings is provided. h. After verifying the activation information, click Finish to commence activation. Step 4. Verify the installation by running the Launchpad: Windows: Select Start -> Programs -> Internet Usage Manager -> <Instance name> -> LaunchPad. UNIX: Execute /opt/siu/bin/launchpad or /opt/<instance name>/bin/launchpad. Step 5. In the Launchpad, verify that the Host Id and the Config Server processes listed in the left pane are active (green icon). If the activation failed, check the activation log file to review and resolve the problem, and run the program again. The activation program logs its activities and results to the file activate.log, typically in C:\SIU\var\log\ on Windows and /var/opt/siu/log/ on UNIX. Console Installation and Activation You can also install and activate IUM in a text-only console mode, for cases where you do not have a graphical user interface, such as X windows on UNIX. Console installation and activation however are supported on all of IUM s platforms, whether Windows or UNIX. Chapter 3 67

68 Installing and Activating IUM Console Installation and Activation When the DISPLAY environment variable is not set on UNIX systems, the IUM installer automatically switches to console mode, from the default graphical mode. Ensure that you unset the shell DISPLAY environment variable before installing in IUM console mode. To launch console installation, execute one of the following commands: On Windows systems execute the following to install: IUM-7.0-setup-Windows.exe -i console On UNIX systems execute the following: IUM-7.0-setup-<type>.bin -i console This launches a separate console window that prompts you to begin the installation. Preparing CONSOLE Mode Installation... =============================================================================== Internet Usage Manager (created with InstallAnywhere) =============================================================================== Introduction InstallAnywhere will guide you through the installation of Internet Usage Manager version 7.0. It is strongly recommended that you quit all programs before continuing with this installation. Respond to each prompt to proceed to the next step in the installation. If you want to change something on a previous step, type 'back'. You may cancel this installation at any time by typing 'quit'. PRESS <ENTER> TO CONTINUE: You can proceed with the IUM installation after agreeing to the license terms. After pressing Enter to view the entire license terms, and Y to agree, you are next prompted to specify the IUM instance ID. Additional license authorizations and restrictions applicable to your software product are found at: DO YOU ACCEPT THE TERMS OF THIS LICENSE AGREEMENT? (Y/N): y =============================================================================== Enter IUM instance ID The installer detected the following installed IUM instance IDs: SIU_60, SIU_60FP01, SIU_60FP02, SIU_70_RC2. Enter a new IUM instance ID for a new installation of IUM, or an existing instance ID if you are upgrading a previous version of IUM. IUM instance ID (DEFAULT: SIU): 68 Chapter 3

69 Installing and Activating IUM Non-root Installation on UNIX The remainder of the console installation is functionally similar to the installation options described in Installing IUM on page 51. Follow the prompts in the console to complete the installation. The progress will be displayed and you will be notified of successful completion. =============================================================================== Installing [================== ================== ================== ==================] [ ] =============================================================================== Installation Complete Congratulations. Internet Usage Manager has been successfully installed to: C:\SIU_70RC4 Next, you need to activate the product by running the following command: >C:\SIU_70RC4\bin\activate PRESS <ENTER> TO EXIT THE INSTALLER: The console installer closes after pressing Enter. Also see Uninstalling in Console Mode on page 103 for more information on performing a console-based uninstall. To activate in console mode, execute the activate console command, typically from C:\SIU\bin on Windows or /opt/siu/bin on UNIX. As with graphical-based activation, activation options are functionally similar, where you begin by specifying whether the host is a configuration server, port values, IOR and license file location, and so on. C:\SIU_70RC4\bin>activate console Is the host a Config Server?: [false]: true This IUM instance will be activated as config server. Specify the repository server port: [8300]: In the activation console, you can press enter at the prompts to accept the defaults (which are also indicated at the end of the prompt). Follow the prompts to proceed with the activation. Also see the IUM Command Reference for a complete listing of the activate tool s options and usage. Non-root Installation on UNIX This section describes how a non-root user can install IUM. Note that the root user must perform some steps as specified below to enable the non-root user to install IUM. Step 1. Step 2. Step 3. Obtain the file nonrootprep.sh from your IUM install CD or the IUM download web site. Log in as root on the system where you want to install IUM. As root, run the non-root preparation script as follows: Chapter 3 69

70 Installing and Activating IUM Unattended Install of IUM nonrootprep.sh <User name> <IUM instance name> where <User name> is the UNIX user login of the person who will install IUM and <IUM instance name> is a name you give this installation of IUM. You ll use this IUM instance name when you install IUM in a later step. Step 4. Step 5. Log in as the non-root user specified in the previous step. Install and activate IUM as described in Installing IUM on page 51. Specify the IUM instance name given in step 3 above. This installs IUM components at /opt/<instance name>/, /var/opt/<instance name>/ and /etc/opt/<instance name>/ with <User name> as the owner of the IUM directories and files. The IUM instance name is tied to the user name. Only the specified user (or the root user) can install or uninstall that IUM instance. The IUM files and directories are owned by the specified user. Use the ls -l command to see the user name. The non-root user must have proper access permissions to all the files and directories used by the collectors. Unattended Install of IUM This section describes how you can install IUM unattended. That is, you can install it non-interactively by a single command as described below. Step 1. If you are installing IUM with the configuration server and with security, you must use the interactive installation method described in Installing IUM on page 51. You can then use the method described here to install IUM on additional systems. Copy the following files from the IUM install CD or the IUM download web site to the system where you want to install IUM: install_win32.opt on Windows systems or install_unix.opt on UNIX systems. The appropriate setup program listed in Table 3-1, IUM Setup Programs, on page 51. Step 2. Modify the file install_win32.opt for Windows systems and install_unix.opt for UNIX systems as appropriate for your system. Below are the install parameters you can modify. IUM_INSTANCE_ID - Enter the name of this IUM installation instance. Instance names must start with the characters SIU. USER_INSTALL_DIR - (Windows only) The chosen installation directory. IUM_LICENSE_DIR - The path to the IUM license. Default is /root on UNIX, or C:\\ on Windows. IUM_LICENSE_FILE - The IUM license file name. Default is license.config. 70 Chapter 3

71 Installing and Activating IUM Unattended Install of IUM ADDITIONAL_COMPONENT_FILE_<#> - Path to any additional product extensions, such as MySQL, where <#> is the number of additional extensions (0-6). IUM_JAVA - Path to the JDK 1.6. Activation parameters are the following: ACTIVATE_IUM - Specify whether or not you want to activate IUM immediately after installation. true/true to activate immediately, or false/false to activate later. If ACTIVATE_IUM is set true, the following options are required. Otherwise, these options are ignored. HOSTID - Specify the HOSTID for the node to be configured, ensuring that the HOSTID is not already in use by IUM. If you want to use localhost, leave the field unchanged with the default. LANGUAGE - Specify one of four language values: 1- English (United States) (default) 2 - Japanese (Japan, SJIS) 3 - Japanese (Japan, JIS) 4 - Japanese (Japan, EUCJIS) IORURL - Enter the URL of the configuration server s IOR (CORBA address). ISREPORTSERVER - Specify whether the IUM reporting web application is to be enabled on this node. Valid values are true/true or false/false. ISAUDITREPORT - Specify whether the IUM audit reporting web application is to be enabled on this node. Valid values are true/true or false/false. ISOPSCONSOLE - Specify whether the IUM Operations Console is to be enabled on this node. Valid values are true/true or false/false. REPORTPORT - Enter the port number used by the web application server or Audit Report server. If either server is enabled, both servers use the same port. Valid values are ISPOLICYSERVER - Specify whether the IUM Policy server is to be enabled on this node. You must have a valid license for this component. Valid values are true/true or false/false. ISMANAGEMENTSERVER - Specify whether the Management server is to be activated on this node. Valid values are true/false. DBPORT - Enter the port number used by the database server. Change this value only if the default port cannot be used. Valid values are DBTYPE - Specify the type of database, whether EMBEDDED or EXTERNAL. If EXTERNAL, specify the following: JDBC_DRIVER_JAR - The path to the JDBC driver. JDBC_DRIVER_CLASS - JDBC driver class. JDBC_DRIVER_URL - The JDBC driver URL. DATABASE_USER - The database user name. Chapter 3 71

72 Installing and Activating IUM Unattended Install of IUM DATABASE_PASSWORD - Database password. If you are installing IUM with the configuration server, also modify the following: ISCONFIGSERVER - Specify whether this node is the configuration server. Valid values are true/true or false/false. If ISCONFIGSERVER set to true, all options below are required. Otherwise when set false, the below options are ignored. IORLOCATION - Enter the path where the file containing the configuration server s IOR is to be created. LICENSEFILE - Enter the name and location of your IUM license file. IORLISTEN - Specify whether the Configuration Server should host its IOR URL. If true, requires a valid port number for IORPORT. Valid values for IORLISTEN are true/true or false/false. IORPORT - Enter the configuration server IOR listen port number, where the configuration server is to serve requests for the IOR. IORLISTEN must also be set, and valid values are SECURITYHOST - Enter the IP address or fully qualified host name where the security server is running. This is typically the host where the configuration server is running. For more information about IUM security, see Chapter 6, Securing IUM, on page 83. SECURITYPORT - Enter the port number on which the security server is listening. Default is REPOSITORYHOST - Specify the host IP address on which the Repository Server is configured. Usually this is the same host as the configuration server. REPOSITORYPORT - Specify the port on which the repository server is listening. Default is Step 3. Execute a command like one of the following to install, and then activate IUM respectively: On Windows systems execute a command like the following to install: IUM-7.0-setup-Windows.exe -i silent -f C:\install_win32.opt Execute the following command to activate: <SIUHome>\bin\activate silent -file C:\install_win32.opt If installing IUM with security on Windows systems, execute a command such as the following: IUM-7.0-setup-Windows.exe -i silent -f C:\install_win32.opt Execute the following command to activate: <SIUHome>\bin\activate silent -file C:\install_win32.opt -login <user> -password <password> On UNIX systems execute a command such as the following: IUM-7.0-setup-<type>.bin -i silent -f install_unix.opt 72 Chapter 3

73 Installing and Activating IUM Installation Troubleshooting Execute the following command to activate: <SIUHome>/bin/activate silent -file install_unix.opt If installing IUM with security on UNIX systems, execute a command such as the following: IUM-7.0-setup-<type>.bin -i silent -f install_unix.opt Execute the following command to activate: <SIUHome>/bin/activate silent -file install_unix.opt -login <user> -password <password> Provide an absolute path name to the install_*.opt file. Step 4. Check the following log files for any errors: /tmp/ium_install.log and /opt/<instance name>/iuminstall.log on UNIX C:\tmp\ium_install.log and <IUM home>\ium_install.log on Windows. C:\SIU\var\log\activate.log on Windows and /var/opt/siu/log/activate.log on UNIX. The installation log files at /tmp/ium_install.log and C:\tmp\ium_install.log are overwritten with the installation of each instance. Installation Troubleshooting As mentioned previously, when the DISPLAY environment variable is not set on UNIX systems, the IUM installer automatically switches to console mode, from the default graphical mode. In addition, if JVM 1.6 is not specified in the PATH on UNIX systems, the installer can fail by default, expecting JVM 1.6 in the PATH. To avoid this however, you can run the IUM installer as the following: $>/tmp/ium-7.0-setup-hp-ux.bin LAX_VM /opt/java6/bin/java In this example, you can avoid errors by explicitly providing the path to the JVM 1.6 executable using the LAX_VM variable. After Installation - Enabling the 64-Bit Version of IUM The 64-bit version of IUM allows collectors and servers to use much larger memory space. When installing IUM, it runs in 32-bit mode by default, but you can run a 64-bit version of IUM servers on various 64-bit platforms. On 64-bit Windows and Linux operating systems, additional activation steps (as described below), are not necessary on such 64-bit platforms, where 64-bit Java is already present. As a result, you do not need to enable 64-bit mode for these platforms. Chapter 3 73

74 Installing and Activating IUM After Installation - Enabling the 64-Bit Version of IUM However, for HP-UX and Solaris, the default JVM supports both 32- and 64-bit address spaces. Consequently, with these 64-bit platforms, the IUM installation will default to 32-bit mode, and so you must follow these instructions to enable the 64-bit version of IUM. In addition, IUM can be returned to the 32-bit version by following these same steps. If you are using the TimesTen database with IUM, ensure that both IUM and TimesTen are configured to run as 32-bit or 64-bit. Moreover, you can define the directory for shared libraries by setting the LD_LIBRARY_PATH and SHLIB_PATH in the UNIX startup shutdown scripts, or you can set the java.library.path in the Host Default Properties (Actions -> Host Default Properties). See the IUM Customer Support web site at for the specific versions of Java that are supported by IUM. For the user name and password to access the web site, see the IUM Release Notes. To activate the 64-bit version of IUM, do the following: Step 1. Install IUM as described in Installing IUM on page 51. Step 2. Determine where the Java executable file is for the version of the Java JDK you have installed. On Windows, also locate the javaw.exe executable file. The following table shows sample directories. Table 3-3 The following are only typical locations of Java executables. Be sure to check the Java location before installation. Typical Locations of Java Executable Files Operating System HP-UX 32-bit HP-UX 64-bit Solaris 32-bit Solaris 64-bit Linux 32-bit Linux 64-bit Windows 32-bit Windows 64-bit Location /opt/java1.6/bin/java HP-UX uses the same Java executable for both 32- and 64-bit. /opt/java1.6/bin/java HP-UX uses the same Java executable for both 32- and 64-bit. /opt/java1.6/bin/java Solaris uses the same Java executable for both 32- and 64-bit. /opt/java1.6/bin/java Solaris uses the same Java executable for both 32- and 64-bit. /opt/java1.6_32/bin/java /opt/java1.6_64/bin/java C:\Program Files\Java\jdk1.6.0_04\bin\java.exe C:\Program Files\Java\jdk1.6.0_04\bin\javaw.exe C:\Program Files\Java\jdk1.6.0_04\bin\java.exe C:\Program Files\Java\jdk1.6.0_04\bin\javaw.exe 74 Chapter 3

75 Installing and Activating IUM After Installation - Enabling the 64-Bit Version of IUM Step 3. Step 4. Step 5. Step 6. Shut down all currently running IUM processes (other than the IUM Launchpad, configuration server, and IUM Host Admin Agent). Copy %CFGROOT%/SIUJava.ini to %CFGROOT%/SIUJava.ini.old. In the Launchpad, select the host where you are activating the 64-bit version. Select Actions -> Host Default Properties. This displays the properties that are used by default by all IUM processes running on the host. Step 7. Table 3-4 Change the JVM and JVMW properties to refer to the appropriate version of the Java executable file. On Windows, set the JVMW property to the javaw.exe file. See the table below for example settings. Sample JVM and JVMW Properties Operating System HP-UX 32-bit HP-UX 64-bit Solaris 32-bit Solaris 64-bit Linux 32-bit Linux 64-bit Windows 32-bit Windows 64-bit Sample JVM and JVMW Properties JVM=/opt/java1.6/bin/java JVMW=/opt/java1.6/bin/java JVM=/opt/java1.6/bin/java JVMW=/opt/java1.6/bin/java JVM=/opt/java1.6/bin/java JVMW=/opt/java1.6/bin/java JVM=/opt/java1.6/bin/java JVMW=/opt/java1.6/bin/java JVM=/opt/java1.6_32/bin/java JVMW=/opt/java1.6_32/bin/java JVM=/opt/java1.6_64/bin/java JVMW=/opt/java1.6_64/bin/java JVM=C:\Program Files\Java\jdk1.6.0_04\bin\java.exe JVMW=C:\Program Files\Java\jdk1.6.0_04\bin\javaw.exe JVM=C:\Program Files\Java\jdk1.6.0_04\bin\java.exe JVMW=C:\Program Files\Java\jdk1.6.0_04\bin\javaw.exe Step 8. Step 9. Click Ok to save your changes and exit the Launchpad. Shut down the IUM Host Admin Agent by executing the following command on UNIX: %BINROOT%/siucontrol -JVMargs %CFGROOT%/SIUJAva.ini.old -c stopagent On Windows, execute: net stop <SIU>_adminagentserver See the IUM Administrator s Guide for more information. Step 10. If the node is a configuration server, stop the configuration server using the following command: %BINROOT%/siucontrol -JVMargs %CFGROOT%/SIUJava.ini.old -n Configserver -c Stop Chapter 3 75

76 Installing and Activating IUM Securing IUM Step 11. Use the activatesiujava command to activate the desired mode. For example, the following activates the 64-bit version of IUM and creates 64-bit command aliases for all IUM commands in the BINROOT directory: java -jar /opt/siu/sbin/activatesiujava.jar /opt/siu -act64 The following activates the 32-bit version of IUM and creates 32-bit command aliases for all IUM commands in the BINROOT directory: java -jar /opt/siu/sbin/activatesiujava.jar /opt/siu -act32 The following just creates command aliases for all IUM commands in the BINROOT directory based on the current size setting: java -jar /opt/siu/sbin/activatesiujava.jar /opt/siu -createaliases For more information, see the IUM Command Reference and the IUM Administrator's Guide. Step 12. Restart the IUM Host Admin Agent. See the IUM Administrator's Guide for specific instructions. Securing IUM Your IUM deployment can be also be secured. For instructions on installing IUM security, see Chapter 6, Securing IUM, on page Chapter 3

77 Upgrading IUM Planning the Upgrade 4 Upgrading IUM This chapter shows you how to upgrade from a previous version of IUM to the current version. If you have a complex deployment or are migrating from an IUM release before version 6.0, you should contact an HP consultant with expertise in IUM while planning, testing, and executing the migration. Planning the Upgrade IUM supports upgrading to the current version only from version 6.0. The upgrade process may involve several preparation steps depending on your IUM deployment. Carefully consider the following guidelines before you perform an upgrade: To avoid interrupting the smooth operation of your current environment, perform the upgrade on one or more test systems first. You may need to obtain additional system and network resources for this purpose, but the effort will almost certainly be worthwhile. In addition, should not have any other in-progress activity occurring at time of the upgrade (such as creating new processes and so on). You should ensure that your deployment reflects the same version of IUM (that is, all hosts in your deployment must be upgraded to the latest version so all versions match). Back up your database before starting the upgrade, as well as your overall IUM deployment. See the IUM Administrator s Guide for more information on backup procedures. For an upgrade installation, the only data migration that IUM supports is from the prior (embedded) Solid database to MySQL. Refer to Chapter 2, Migrating IUM to MySQL, on page 19 for details related to migrating your database from Solid to MySQL, and supported IUM upgrade paths. During activation, you will be prompted for your Solid-to-MySQL migration details so you can migrate your data into the new 7.0 upgrade installation (see Activating IUM on page 59 for more information). Also, during the upgrade, the activator will migrate your IUM configuration to the target database. This process changes the database URIs and database Driver class attributes to point to the new MySQL database. If you need to return to a previous IUM version, you must uninstall IUM 7.0, reinstall the previous version, and restore the database from your backup. Record the details of your deployment, including such information as the network topology, names of hosts, collectors, session servers and other IUM processes, and any other relevant details. If you are upgrading IUM with the JRockit JVM, the JVM properties (for example, heap size or other settings in SIUJava.ini) from your previous Oracle JDK-based deployment are not understood by JRockit and will not be migrated when upgrading. To prepare for the upgrade, you should keep a record of any of these custom settings in SIUJava.ini (in addition to backing up your overall configuration), remove the old JVM settings, and then reset your custom JVM settings that correspond to JRockit after the upgrade. Any other Oracle JDK-based customizations in your pre-7.0 deployment, such as those in SIU.ini, the configuration server, or host default properties, must also be updated to the corresponding JRockit parameters. For more information on JRockit parameters and details related to migrating from the Oracle JDK to JRockit, see Chapter 4 77

78 Upgrading IUM Upgrade Prerequisites Upgrade Prerequisites This section describes steps you must take before upgrading IUM: If you are upgrading from any version of IUM earlier than version 6.0, you must first upgrade to IUM 6.0. After upgrading to 6.0, you can then follow the instructions here to upgrade to version 7.0. You must stop all running Launchpad sessions before starting the upgrade. You must first upgrade the system hosting the configuration server, then upgrade all other hosts. If you are upgrading a non-root instance of IUM, follow steps 1-4 described in Non-root Installation on UNIX on page 69. These steps are required before a non-root instance can be upgraded. When installing a new host with JRockit in a secured IUM deployment, the JRockit JVM must be upgraded to unlimited security before activation. Replacement of Legacy Report Server Impacts For an upgrade from IUM version 5.0 to 6.0, the following steps can apply since the former Report Server from earlier versions of IUM has now been replaced with the new Web Application Server (WebAppServer): Step 1. Step 2. Step 3. Before upgrading from IUM version 5.0 to 6.0, if you have made any changes to or added any files to the former Report Server (located in C:\SIU\var\webserver on Windows, or /var/opt/siu/var/webserver on UNIX), you should back up these files before upgrading. After upgrading from IUM version 5.0 to 6.0, you should reapply any Report Server (Web Application Server) changes you made in your previous installation to your new IUM 6.0 installation. After upgrading from IUM version 5.0 to 6.0, you can remove the old ReportServer directory (this is a process information directory created once the former Report Server process is started). Since the former Report Server has been replaced with the Web Application Server, the new location is C:\SIU\var\webappserver on Windows, or /var/opt/siu/var/webappserver on UNIX. Step 4. Lastly, remove the webserver directory, which is in C:\SIU\var\webserver on Windows, or /var/opt/siu/var/webserver on UNIX. If you have not modified the former Report Server in any way, or if you are not upgrading from IUM version 5.0, you can ignore steps 1 and 2, but you should perform step 3. Disabling Security for a 5.0 Deployment Before upgrading to IUM 7.0, a 5.0 deployment must first be upgraded to IUM 6.0. This section describes how to disable the IUM security module in 5.0 (in preparation for upgrading to 6.0), without removing the core IUM product. If you are upgrading from 6.0 to 7.0, however, security does not need to be disabled. CAUTION You must remove IUM security from the host with the configuration server last. 78 Chapter 4

79 Upgrading IUM Installing the Upgrade Step 1. Disable security in the configuration server by executing the following command on the IUM host system with the configuration server: $SIUHOME/bin/secureconfigserver -c off -login <user> -pw <password> Step 2. Perform the following steps on each host not running the configuration server: a. Close all IUM client applications such as the Launchpad or file service wizard. b. Stop the host admin agent by executing the net stop command on Windows: net stop SIU_AdminAgentServer Alternatively, use the Windows Services control panel. Select Start -> Settings -> Control Panel and double-click on the Services icon. Select the SIU_AdminAgentServer service. Click the Stop button. c. Remove the file C:\SIU\var\security from your system. d. Start the host admin agent service by executing the net start command on Windows: net start SIU_Adminagentserver Alternatively, use the Windows Services control panel. Select Start -> Settings -> Control Panel and double-click on the Services icon. Select the SIU_AdminAgentServer service. Click the Start button. See the IUM Administrator's Guide for more information on stopping and starting the admin agent. Step 3. Repeat the above steps a through d for the host with the configuration server. Installing the Upgrade Follow the steps described in Installing IUM on page 51. During installation, when you reach the dialog that prompts you for an IUM Instance ID (see Step 6, page 53) choose the instance ID of your previous IUM installation to upgrade. Chapter 4 79

80 Upgrading IUM Installing the Upgrade Figure 4-1 Confirm the IUM instance to upgrade This will upgrade your previous version of IUM to version 7.0 using the same instance name, and it will be available under the new Internet Usage Manager 7.0 program group after the installation. After the upgrade installation is complete, you can activate IUM according to the steps in Activating IUM on page 59. When selecting the Embedded option (see Step 3e, page 64), and with MySQL set as the database for IUM components, all existing configurations in your deployment will be updated to work with MySQL. This includes updating of all values and configurations (including templates) corresponding to MySQL. As shown in the activation parameters (see Step 3e, page 64) and for an upgrade installation where you have elected to use the IUM MySQL database you can select the Import data option and provide the path to the creates.sql and inserts.sql files that were generated by the IUM MySQL Migration Tool (see Figure 25 on page 43 and Figure 28 on page 46). For more information on migrating your database from Solid to MySQL, see Chapter 2, Migrating IUM to MySQL, on page 19. Otherwise, if you are using your own (external) database, these options are not applicable, and you must instead specify the details for your database in the External Database portion of the activator (see Step 3e, page 64). 80 Chapter 4

81 Activating Additional Components Viewing Your License 5 Activating Additional Components If you purchased and installed IUM, then later purchase a license to use additional IUM collectors or products, you receive a new license file. The new license file contains the license for the additional collectors or products. This chapter shows you how to view and upgrade your IUM license in order to activate and run additional IUM components. Viewing Your License Your IUM license file enables you to use those components that you purchased. You receive one license file for all products. When you install IUM, the license is installed into the configuration tree at /License, with the license for additional products under this root. For example, if you purchased a Mobile Product, the CDMA license is installed at /License/CDMA and the GPRS license installed at /License/GPRS. You can then activate the Mobile Solution. After installing and activating IUM, you can view your IUM license in the Launchpad by first opening the Tools -> Deployment Editor menu item. You should see a /License node in the configuration tree. If no nodes are under /License, you only have a core IUM product license. If other nodes are under /License, you have licenses for other components. For example /License/CDMA contains the CDMA license and /License/GPRS contains the GPRS license. If you purchased additional product extensions (such as MySQL or JRockit), these are available under /License/OEM. Upgrading Your License If you upgrade your IUM license to activate new collectors or if your old license is about to expire, you must obtain and install a new license file. See Obtain an IUM License on page 9 or contact your HP representative to obtain a new license file. If your license expires or is invalid for some other reason, the configuration server will stop running. You will not be able to start it until you obtain and install a new license file. The license file needs to be installed only on the configuration server host. The configuration server provides the license information for all IUM products to all IUM hosts. After you receive the new license file, install it as follows. Step 1. Step 2. Copy the new license.config file to a temporary directory. Run the updatelicense command as follows: If security is not installed: Chapter 5 81

82 Activating Additional Components Upgrading Your License updatelicense -f <license file name> If security is installed: updatelicense -f <license file name> -login <username> -pw <password> where <license file name> is the complete path and file name of the new license file, <username> is the account name of the IUM administrator and <password> is the password to that account. The updatelicense command is typically in C:\SIU\bin on Windows and /opt/siu/bin/ on UNIX. This command backs up your current license file to license.config.old and copies the new license file to the proper location (as specified in the SIU.ini file). Step 3. Restart the configuration server (or start it if it is not running). You can restart it by selecting it in the Launchpad and right-clicking it to display the Restart Config Server option. Or, also in the Launchpad, use Actions -> Restart Config Server. 82 Chapter 5

83 Securing IUM Security Installation Prerequisites 6 Securing IUM This chapter describes how to secure the communication between all IUM components and users by installing and configuring the optional IUM security module. IUM security provides a robust authentication and authorization environment based on industry standards to ensure security compliance. It lets you leverage your existing IT infrastructure and provides the ability to integrate with external authentication systems. It transparently supports multiple authentication mechanisms and transport protocols. With IUM security, you can implement role-based access control and capture activity information for auditing purposes. It provides a comprehensive and extensible declarative authorization model, and supports multiple profiles of transport layer security (TLS) combining authentication with optional data encryption. Security Installation Prerequisites Before performing the actual configuration procedures described in the next section, Installing Security on page 85, there are some background prerequisites you should be aware of first, in the areas of the security authentication mechanisms that IUM employs, such as Kerberos and LDAP bind. This installation guide assumes you have access to and knowledge of LDAP directories and tools, and does not document LDAP itself. LDAP Bind and Kerberos Authentication If you plan to install IUM security, you must have access to an LDAP (Lightweight Directory Access Protocol) server. For example, you could use Microsoft Active Directory, ApacheDS, OpenLDAP, RedHat Directory Server, or any other LDAP server. IUM stores security credentials and other security information in an LDAP server and uses the LDAP server for authentication and authorization. This section discusses what is involved when configuring your LDAP server and how it impacts configuring IUM security. IUM uses LDAP bind as the default authentication mechanism. However, if the LDAP server provides Kerberos-based authentication, IUM can be configured to use Kerberos for authentication. For example, both Microsoft Active Directory and ApacheDS support Kerberos-based authentication. Primary LDAP Server What can first be considered is a scenario that uses two Microsoft Active Directory servers: one acting as the domain controller and the other as a subdomain. The primary LDAP server is the domain controller directory (as defined in terms of Microsoft Active Directory terminology), and contains the enterprise directory of all enterprise users. This allows integration of IUM security with an enterprise security framework, and provides single sign-on with common credentials. The primary LDAP server is also the authentication server and the Master directory (or the domain controller), that will hold all the user accounts and be the original source of user authentication. Chapter 6 83

84 Securing IUM Security Installation Prerequisites IUM assumes user accounts will be managed externally from IUM. For example, they are typically created and maintained by corporate IT. IUM security takes advantage of the corporate directory infrastructure and does not require modification of the corporate directory. These instructions use ldap://<primary-dir>:<port>/ as the URI reference to your primary enterprise directory. For a secure connection, it is ldaps://<primary-dir>:<port>/. This URI is used only when the configured authentication mechanism is LDAP bind. The KDC (Kerberos Key Distribution Center) host is typically the same as the primary LDAP directory host, and the KDC port number is 88 by default. The Kerberos realm name is the domain name converted to uppercase characters. The KDC host, KDC port, and Kerberos realm name parameters are required only when using Kerberos authentication instead of the default LDAP bind authentication. When using Kerberos as the authentication mechanism, the authentication identifier must follow the Kerberos principal name format, which is <name>@<kerberos realm name>. For example, scott@example.com, where scott is the user name and EXAMPLE.COM is the Kerberos realm name. However, only the user name component is used to associate user capabilities in the secondary LDAP directory that contains IUM-specific data. In this case, the secondary LDAP directory will use scott as the identifier to associate user capabilities for the Kerberos principal name scott@example.com. Secondary LDAP Server Installing the secondary LDAP server is optional, since you can configure IUM security using a single directory. Use the following URI as the reference to your secondary enterprise directory: ldap://<secondary-dir>:<port>/ or for a secure connection: ldaps://<secondary-dir>:<port>/. The secondary LDAP directory contains IUM-specific data about IUM hosts, processes and users, including the capabilities of each user. The secondary LDAP server is the authorization server. This is the Child directory, which will be in charge of the IUM subdomain, and hold user and server authorization information. All IUM-related updates go into the secondary directory, keeping the master directory static and read-only. This is not required but can be a beneficial capability. Kerberos Time Synchronization When using Kerberos authentication, time synchronization on servers in the deployment is crucial for the proper functioning of IUM security. Since the security of Kerberos authentication is in part (pre-authentication) based upon the timestamps of tickets, it is critical to have machine times set correctly on servers exchanging data via Kerberos. A short lifetime for tickets is used to prevent attackers from performing successful brute force attacks or replay attacks. Since clock synchronization is vitally important in the security of the Kerberos protocol, if times are not synchronized, Kerberos will report authentication errors. Clients attempting to authenticate from a server with an inaccurate time setting will be rejected by the KDC in authentication attempts, due to the time difference with the KDC s time. Consequently, you should synchronize time on all the hosts with an NTP time server, so that servers using Kerberos have their time automatically synchronized. 84 Chapter 6

85 Securing IUM Installing Security Installing Security The following is the overall process for securing an IUM deployment. See the sections below for complete details. 1. Install IUM on the first host of the deployment, where the configuration server will run. See Chapter 3, Installing and Activating IUM, on page 51 for complete instructions. 2. Update the Java JVM (Java Virtual Machine). 3. Create the IUM security server directory layout properties file using a template. 4. Verify the JVM JCE jurisdiction policy in your deployment environment. 5. Run the secserveractivate command to process the directory layout properties file (external-dir.properties) and set up the directory structure for IUM. 6. Start the IUM security server. 7. Ensure all root nodes specified in the directory layout properties file are present in LDAP. 8. Generate security information for the deployment (in LDIF format) and load it into the LDAP server. 9. Activate security on the IUM host. 10. Restart the host admin agent. 11. Stop the management server after the admin agent has finished starting. 12. Secure the configuration server. 13. Restart the configuration server. 14. Start the management server. 15. Verify that the IUM installation is secure. Follow the detailed instructions in the next section to install IUM security. Detailed Instructions Take the following steps to secure the IUM deployment. Step 1. Step 2. Install IUM on the first host of the deployment where the configuration server will run. See Chapter 3, Installing and Activating IUM, on page 51 for complete instructions. Update the JVM (Java Virtual Machine). You must apply encryption policies to the Java runtime environments, including any JRE or JDK used by IUM as follows. Before overwriting the property and zip files as described here, back them up. For the JRE version 1.6, download the Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files 6 from This will download a jce_policy-6.zip file. Copy it to %JRE1.6_HOME%\jre\lib\security and unzip it. The following files will be created or will replace existing files in the directory: local_policy.jar - Unlimited strength local policy file Chapter 6 85

86 Securing IUM Installing Security US_export_policy.jar - Unlimited strength US export policy file Due to import control restrictions, the version of the JCE policy files that are bundled in the JDK environment allow strong but limited cryptography. This may impose serious limitations to IUM security modules while those are in testing. The jurisdiction policy files are available in a separate download bundle and contain no restrictions on cryptographic strengths. These files do not contain any encryption functionality since this functionality is already supported in the JDK or extension libraries such as Bouncy Castle. Refer to the README file in the bundle for additional information. If you purchased the JRockit JVM with IUM, it must also be updated with unlimited encryption. Step 3. Create the IUM security properties file that defines the directory layout, based on the provided example layout properties file. Locate the example properties file in: $VARROOT/securityserver/conf/external-dir.properties.example (or $VARROOT/securityserver/conf/external-dir.properties.active-directory.example for Active Directory) Use this file as a basis for your own properties file that you can modify as needed. $VARROOT represents the var directory where IUM is installed, for example C:\SIU\var on Windows or /var/opt/siu on UNIX. This file contains the default directory structure of the IUM security information and is shown in the diagram below. It assumes your user data is already contained in your primary enterprise directory. You must create a file based on the file external-dir.properties.example (or based on the file external-dir.properties.active-directory.example for Active Directory) to represent your directory structure. The following figure illustrates the LDAP primary and secondary server domains. Step 4. Verify the JVM JCE jurisdiction policy in your environment by executing the following command: $SIUHOME/bin/secactivate encr 86 Chapter 6

87 Securing IUM Installing Security If this command prints UNLIMITED, proceed with security server activation as described in the next step. If the command prints LIMITED, go back to step 2 to configure your JVM with the unlimited JCE jurisdiction policy. Step 5. Run one of the following secserveractivate commands to process the external-dir.properties file and set up your directory structure for IUM. See the IUM Command Reference for details on this command. LDAP Bind Authentication Commands To activate the security server with LDAP bind as the authentication mechanism, use these commands. For Microsoft Active Directory: $SIUHOME/bin/secserveractivate init -loginldapserver "ldap://primaryserver:10389/" -lookupldapserver "ldap://secondaryserver:10389/" -layout my-edited-external-dir.properties -user "CN=Administrator,CN=Users,DC=example,DC=hp,DC=com" -password "password" -force For ApacheDS: $SIUHOME/bin/secserveractivate init -loginldapserver "ldap://primaryserver:10389/" -lookupldapserver "ldap://secondaryserver:10389/" -layout my-edited-external-dir.properties -user "uid=admin,ou=system" -password "secret" -force The -layout option must point to the external-dir.properties file created in step 4. Keep in mind these points when executing secserveractivate with LDAP bind authentication: Specify the primary (authentication) LDAP server after the -loginldapserver option. Specify the secondary (authorization) LDAP server after the -lookupldapserver option. Specify the location of the my-edited-external-dir.properties file that you created in the previous step after the -layout option. Specify the user name and password of a user that has read access to the secondary LDAP server after the -user option and the -password option, respectively (this typically is not an IUM user credential). Specify the -force option to update the configuration files. Kerberos Authentication Commands To activate the security server with Kerberos as the authentication mechanism, use these commands. For Microsoft Active Directory: Chapter 6 87

88 Securing IUM Installing Security $SIUHOME/bin/secserveractivate init -krb -kdchost "<kdc host name>" -kdcport "<kdc port>" -dr "<kerberos realm name>" -lookupldapserver "ldap://secondaryserver:10389/" -layout my-edited-external-dir.properties -user "CN=Administrator,CN=Users,DC=example,DC=hp,DC=com" -password "password" -force For Apache DS: $SIUHOME/bin/secserveractivate init -krb -kdchost "<kdc host name>" -kdcport "<kdc port>" -dr "<kerberos realm name>" -lookupldapserver "ldap://secondaryserver:10389/" -layout my-edited-external-dir.properties -user "uid=admin,ou=system" -password "secret" -force The -layout option must point to the external-dir.properties file created in step 4. Keep in mind these points when executing secserveractivate with Kerberos authentication: Specify the Kerberos Key Distribution Center host after the -kdchost option. Specify the Kerberos Key Distribution Center port after the -kdcport option. Specify the Kerberos realm name after the -dr option. Specify the secondary (authorization) LDAP server after the -lookupldapserver option. Specify the location of the external-dir.properties.example file that you edited in the previous step after the -layout option ($VARROOT represents the var directory where IUM is installed, for example C:\SIU\var on Windows or /var/opt/siu on UNIX). Specify the user name and password of a user that has read access to the secondary LDAP server after the -user option and the -password option, respectively (this typically is not an IUM user credential). Specify the -force option to update the configuration files. See Kerberos Time Synchronization on page 84 for more information on time synchronization issues with Kerberos. Step 6. Start the IUM security server using the following command: $SIUHOME/bin/securityserver init The securityserver command will create a certificate authority and generate all required certificates. To ensure this takes effect, restart the securityserver as follows: $SIUHOME/bin/securityserver stop $SIUHOME/bin/securityserver start Step 7. Ensure all the root nodes specified in the directory layout properties file (external-dir.properties) are present in LDAP. For example, if the following properties were specified: 88 Chapter 6

89 Securing IUM Installing Security com.hp.usage.security.directory.config.root_context = dc=example,dc=hp,dc=com com.hp.usage.security.directory.config.group_dn_pattern = cn={group},ou=iumgroups,{rootcontext} com.hp.usage.security.directory.config.user_dn_pattern = uid={user},ou=iumusers,{rootcontext} com.hp.usage.security.directory.config.host_dn_pattern = ou={host},ou=iumhosts,{rootcontext} The following nodes must be present in the directory: dn: ou=iumgroups,dc=example,dc=hp,dc=com dn: ou=iumusers,dc=example,dc=hp,dc=com dn: ou=iumhosts,dc=example,dc=hp,dc=com If such nodes are not yet present, they can be created using an example LDIF such as below: dn: ou=iumgroups,dc=example,dc=hp,dc=com objectclass: organizationalunit objectclass: top ou: IUMGroups dn: ou=iumusers,dc=example,dc=hp,dc=com objectclass: organizationalunit objectclass: top ou: IUMHosts dn: ou=iumhosts,dc=example,dc=hp,dc=com objectclass: organizationalunit objectclass: top ou: IUMUsers For Microsoft Active Directory, such an LDIF file would look like the following: dn: CN=Groups,DC=iumtest,DC=cup,DC=hp,DC=com objectclass: container objectclass: top cn: Groups dn: CN=Groups,DC=iumtest,DC=example,DC=hp,DC=com and dn: CN=Computers,DC=iumtest,DC=example,DC=hp,DC=com may already be part of the DC=iumtest,DC=example,DC=hp,DC=com domain. Step 8. Configure the LDAP server to contain IUM security information for the deployment, and load it into the secondary LDAP server. Use the ldifgen command as described below to generate LDIF (LDAP Data Interchange Format) files with user roles, and load the LDIF files into the secondary LDAP directory. Each user role is implemented as a group, which contains the list of users who have that role. Each role meanwhile encompasses a set of privileges. Also see the IUM Command Reference for more information on ldifgen. a. Create role records in the form of LDAP group entries. Use the ldifgen command: ldifgen gen b. Create a host record for the main IUM host (where the configuration server is running) for the LDAP directory. Use an ldifgen command like the following: Chapter 6 89

90 Securing IUM Installing Security For Microsoft Active Directory LDAP server: ldifgen gen -type active-directory -host "<IUM host name>" -configsvr For ApacheDS LDAP server: ldifgen gen -type apache-ds -host "<IUM host name>" -configsvr For RedHat Directory Server: ldifgen gen -type redhat -host "<IUM host name>" -configsvr For OpenLDAP server: ldifgen gen -type open-ldap -host "<IUM host name>" -configsvr When adding a new non-configserver node in a secured deployment, you must use the ldifgen tool on a different node (that is, a pre-existing node that has been activated). c. To create a record for the management server, the operations console server, the report server, or the audit reports server (which themselves live in the web application server container) for the LDAP directory (if you have a corresponding server configured for the given host), any of the following ldifgen command parameters could be specified and combined. There can only be one configuration server, management server, operations console server, report server, and audit reports server per deployment. For Microsoft Active Directory LDAP server: ldifgen gen -type active-directory -host "<IUM host name>" -management "<management server name>" -opsconsole -reporting -auditreports For ApacheDS LDAP Server: ldifgen gen -type apache-ds -host "<IUM host name>" -management "<management server name>" -opsconsole -reporting -auditreports For RedHat Directory Server: ldifgen gen -type redhat -host "<IUM host name>" -management "<management server name>" -opsconsole -reporting -auditreports For OpenLDAP server: ldifgen gen -type open-ldap -host "<IUM host name>" -management "<management server name>" -opsconsole -reporting -auditreports d. Create a security administrative user record for the LDAP directory. Use an ldifgen command like the following, and give at least full SecurityAdmin privileges to this security administrative user. See Security Roles and Privileges on page 96 for the complete list of roles. 90 Chapter 6

91 Securing IUM Installing Security For Microsoft Active Directory LDAP server: ldifgen gen -type active-directory -user "<security admin user name>" -roles "User,SecurityAdmin" -password <password> For ApacheDS LDAP server: ldifgen gen -type apache-ds -user "<security admin user name>" -roles "User,SecurityAdmin" -password <password> For RedHat Directory Server: ldifgen gen -type redhat -user "<security admin user name>" -roles "User,SecurityAdmin" -password <password> For OpenLDAP Server: ldifgen gen -type open-ldap -user "<security admin user name>" -roles "User,SecurityAdmin" -password <password> e. Upload all $VARROOT/ldif/<user name>/user-add-<user name>.ldif files into the primary LDAP server (ApacheDS, OpenLDAP, RedHat DS), or use vendor-specific administrative tools to create required user profiles (Microsoft Active Directory, RedHat DS). f. Upload all the remaining generated LDIF files into the secondary LDAP server (in a single-directory configuration, this is the same as the primary LDAP server). This consists of the following files, depending on your hosts and users. Use the tools that came with your LDAP server to upload the LDIF files. For instance, use java -jar apacheds-tools.jar import -f <ldif file name> to upload LDIF files into the Apache DS server from the command line. $VARROOT/ldif/group-add.ldif $VARROOT/ldif/<IUM host name>/host-add-<host name>.ldif $VARROOT/ldif/<IUM host name>/configsvr-add.ldif $VARROOT/ldif/<IUM host name>/management-add.ldif $VARROOT/ldif/<IUM host name>/operationsconsole-add.ldif $VARROOT/ldif/<IUM host name>/reporting-add.ldif $VARROOT/ldif/<IUM host name>/auditreports-add.ldif $VARROOT/ldif/<user name>/user-groups-add-<user name>.ldif Step 9. Activate security on the IUM host by running the security activation command (secactivate). Use the administrative user and password you created in the previous step. For more information on the secactivate command, see the IUM Command Reference for more information. $SIUHOME/bin/secactivate.exe init -server localhost -port storepass <key store password> -force -- login -user <security admin user> -password <security admin password> -- hostkey Keep in mind the following when executing secactivate: Specify the server name of the host where the security server is running after the -server option. Specify port number 8443 after the -port option. Specify the user and password of an IUM user that has ServerAdmin privileges in the -user and -password options. Chapter 6 91

92 Securing IUM Installing Security Specify the password of the key store after the -storepass option. Double hyphens (--) separate additional commands after init (login and then hostkey). Such secactivate commands executed from the same command line with other commands such as the above require this separation. These commands can also be performed in an interactive mode: $SIUHOME/bin/secactivate.exe secactivate>init -server localhost -port storepass <password> -force secactivate>login LDAP login Username: <security admin user> Password: ***** secactivate>hostkey -force Step 10. Restart the host admin agent. You can use the following Windows commands: net stop SIU_Adminagentserver $SIUHome/bin/securityserver stop net start SIU_Adminagentserver Alternatively, use the Windows Services control panel. Select Start -> Settings -> Control Panel and double click on the Services icon. Select the SIU_AdminAgentServer service. Click the Start button. See the IUM Administrator's Guide for more information on stopping and starting the admin agent. Once the security server is activated, and IUM is restarted as shown above, the admin agent will start the security server. In addition, the admin agent will also stop the security server as part of its own shutdown. Ensure that all IUM processes are fully started before executing the next step. Step 11. Stop the management server after the admin agent has finished starting. $SIUHOME/bin/siucontrol -c stopproc -n ManagementServer -login <user> -pw <password> Step 12. Secure the configuration server by running the secureconfigserver command: $SIUHOME/bin/secureconfigserver -c on -login <user> -pw <password> Specify the user name and password of the IUM user (any user can enable the configuration server). Step 13. Restart the configuration server by using either the siucontrol command or the Launchpad. In the Launchpad, select the ConfigServer process and use the Actions -> Restart Config Server menu. Or, use the following siucontrol command: 92 Chapter 6

93 Securing IUM Add Another Host to your Secure IUM Deployment $SIUHOME/bin/siucontrol -n ConfigServer -c RestartProc -login <user> -pw <password Specify the user name and password of an IUM user that has ServerAdmin and Monitor privileges. Step 14. Start the management server. $SIUHOME/bin/siucontrol -c startproc -n ManagementServer -login <user> -pw <password> Step 15. Verify that the IUM installation is secure by verifying one or more of the following: Run the Launchpad and log in as one of the users you set up. You should see all the processes listed with the correct status. Check the host admin agent log file. No error messages should be present. Create, start or stop a demo collector. Check the host log file to make sure no errors are reported for the collector. Add Another Host to your Secure IUM Deployment Perform the following to steps to add another host to a secure IUM deployment. Step 1. Step 2. Ensure IUM is installed and secure on the first host in the deployment. This is the host where the configuration server is running. Create a host record for the IUM host for the LDAP directory. For each host in your IUM deployment, a corresponding record in the LDAP directory must be created prior to activating security. Use an ldifgen command like the following. For more details on the ldifgen command, see the IUM Command Reference. For Microsoft Active Directory LDAP server: ldifgen gen -type active-directory -host "<IUM host name>" For ApacheDS LDAP server: ldifgen gen -type apache-ds -host "<IUM host name>" This step can only be performed on the host where the security server has been activated. Step 3. The ldifgen command creates an LDIF file you must upload to your secondary LDAP server. Upload the generated LDIF file into the secondary LDAP server using the tools that came with your LDAP server. The name of the resulting LDIF file depends on the host name you provided (shown below): $VARROOT/ldif/<host name>/host-add-<host name>.ldif Step 4. Install IUM on the new host. See Chapter 3, Installing and Activating IUM, on page 51 for complete instructions. Chapter 6 93

94 Securing IUM Add Another User to your Secure IUM Deployment If you are adding another host with the embedded JRockit JVM, it should be also updated with the corresponding encryption policies described earlier in Step 2, Detailed Instructions on page 85. Step 5. Run the activate command as described in Activating IUM on page 59. The activate command is in the $SIUHOME/bin directory. activate Step 6. When the Security Host Information window is displayed as shown below, enter the requested information and click Ok. Security Server Host - Enter the IP address or host name of the system where the IUM security server is running. This is typically the host where the configuration server is running. Security Server Port - Enter the port number of the security server. This is typically port number Admin User Name - Enter the user name of an IUM user that has administrative privileges. In particular, this user must have the ServerAdmin, UserAdmin and SecurityAdmin roles. See Add Another User to your Secure IUM Deployment on page 94 for information on users and roles. Admin User Password - Enter the password for the administrative user. Step 7. Complete the activation steps as described in Activating IUM on page 59. Add Another User to your Secure IUM Deployment Take the following steps to add another user to a secure IUM deployment. Step 1. Create a user record for the LDAP directory. Use an ldifgen command like one of the following examples, and give appropriate privileges to each user. See Security Roles and Privileges on page 96 for the complete list of roles and privileges. For more information on the ldifgen command, see the IUM Command Reference. For example, the following command creates an administrative superuser by giving all privileges except security administration. For Microsoft Active Directory LDAP server: 94 Chapter 6