Installing BigFix clients through self-update IBM

Transcription

1 Installing BigFix clients through self-update IBM

2 ii Installing BigFix clients through self-update

3 Contents Chapter 1. Installing BigFix clients through self-update Step 1: Planning the infrastructure Installing Interim Fix Step 2: Signing the masthead file Step 3: Downloading the client installers Step 4: Enabling self-update Troubleshooting Chapter 2. Advanced tasks Advanced: Assigning relays to scan groups Advanced: Caching the client installers iii

4 iv Installing BigFix clients through self-update

5 Chapter 1. Installing BigFix clients through self-update The self-update of the License Metric Tool or Tivoli Asset Discovery V7.2.2 or V7.5 agents allows you to automatically upgrade them whenever a fix pack or a new version is available. When the self-update is enabled, the agents download the installation files, and upgrade to a later version. The self-update is now enhanced with a new mode that enables the installation of the BigFix clients instead of upgrading the agents to a later version. License Metric Tool and BigFix Inventory V9 are based on a different infrastructure than their V7 counterparts and cannot use the same agents. The applications use the BigFix platform and some of its elements, such as clients. A BigFix client is the equivalent of an agent. A client must be installed on each computer that you want to monitor with License Metric Tool or BigFix Inventory V9. Installation of clients through self-update is based on the same mechanism as the normal self-update that upgrades the V7 agents to a later version. The new functionality enhances self-update by adding a new mode. If you enable this mode, each agent installs a client on its computer. If you disable it, each agent is upgraded to a later version. An installed client prepares the required infrastructure, but does not yet connect a computer to the server. A client also requires a masthead that is unique to each BigFix server and contains information about your deployment. When provided with a masthead, a client can connect to the server. In self-update, both the client installers and the masthead must be provided to the V7 server. The masthead must be copied manually, but the client installers are downloaded by using a Fixlet. After self-update is enabled, all agents from V7 automatically connect to the server, download the client installers, and install them on each computer. The clients are started and, based on the information from the masthead, connected to the server. When self-update is complete, all computers are connected to the BigFix server and can be monitored with License Metric Tool or BigFix Inventory V9 that is connected to this server. Glossary V7 server and agents License Metric Tool or Tivoli Asset Discovery for Distributed V7.2.2 or V7.5 server and agents. The self-update works similarly for both those versions. BigFix clients The agents that are used by License Metric Tool and BigFix Inventory V9 to monitor your computers. Requirements Target environment: v Install the BigFix on Windows or Linux. v Install the BigFix client on the V7 server. Note: The installation of License Metric Tool or BigFix Inventory V9 is not required to install the clients through self-update. 1

6 Source environment: v For V7.5: The server upgraded to Fix Pack 1. v For V7.2.2: The server upgraded to Fix Pack 2. Limitations Important: V7.2.2: Due to a limitation, the self-update is repeated after each 1 hour, which might significantly increase the workload on the server. When you IBM to obtain digital signatures for files that are required to complete the self-update, include information about the version of your server. You will receive a fix that solves this issue. v Self-update is not supported for the following operating systems: HP-UX 11i for PA-RISC Linux with kernel version Solaris local zones and global zones (with existing local zones) Solaris 10, if the agent was installed with -G flag by using the shell installer On all preceding operating systems, the BigFix client must be installed manually v The i5 systems are not supported by V9. You cannot install BigFix clients on those systems. v BigFix clients are installed in the default path, which cannot be changed. Step 1: Planning the infrastructure Plan your future infrastructure before starting the self-update to properly configure relays. Relays are intermediary computers that transfer information between the server and the computers that are grouped under a relay. Relays are used to distribute the network traffic and to reduce the workload on the server. Relays are recommended in the following cases: v Some agents connect to the server through proxy v You have a large environment with at least 1000 computers If the preceding cases do not apply to your environment, you do not need relays. Agents connect through proxy If some of your agents use proxy to connect to the server, consider why the agent is using the proxy and whether it is still required in your new environment. In general, agents use proxies for one of the following reasons: v Separated networks If the agents cannot connect to the server, configure a relay for those agents before the self-update. Otherwise, the agent will not connect to the server. In this case, a relay works as the equivalent of the proxy. v Security or performance If the agents can connect to the server but use proxy for security or performance reasons, you can configure a relay either before or after the self-update, because the computer will be visible to the server. To configure relays before the self-update, see: Advanced: Assigning relays to scan groups. To do it afterwards, see: Assigning relays to existing clients. 2 Installing BigFix clients through self-update

7 Installing Interim Fix Large environments A network of relays is required only for large environments. It is recommended that each computers use a designated relay. Large environments, however, do not require that you configure relays before the self-update. You can also do it afterwards on a deployed infrastructure. In the latter case, connecting the whole environment to one server without using relays, which is the case in self-update, decreases the server performance, but the server can handle this workload until you configure relays. You can choose from two options: v Configure relays before the self-update Computers can be assigned to a relay only based on the scan group that they belong to. One relay can be used for more than one scan group. This option is recommended if some of your agents use proxy to connect to the server, because the solution is the same. v Configure relays after the self-update In this option, the scan groups that your computers belong to are not important. You can select any set of computers and connect it to an existing relay. You do this in the BigFix console. To configure relays before the self-update, see: Advanced: Assigning relays to scan groups. To do it afterwards, see: Assigning relays to existing clients. To use self-update for installing the BigFix clients, you must first install Interim Fix 24 for V7.5, or Interim Fix 15 for V Those Interim Fixes modify the self-update by adding a new mode. Procedure v To upgrade V7.5 to Interim Fix 24, see Installing Interim Fix 18 and higher. The packages are TIV-ILMT-TAD4D-IF0024-server-multi and TIV-ILMT-TAD4D-IF0024-self_update-multi. v To upgrade V7.2.2 to Interim Fix 15, see Installing Interim Fix 13 and higher. The packages are TIV-ILMT-TAD4D-IF0015-server-multi and TIV-ILMT-TAD4D-IF0015-self_update-multi. Starting from Interim Fix 15, the Linux agents return more information about their operating system, which is required for self-update. After installing Interim Fix, you must wait until the information is returned by agents, which might take up to 12 hours. Run the following query on the database to check whether the agents already return complete information about their operating system. db2 connect to TLMA db2 select OS_VERSION from CUSTOM.AGENT_V where lower(os_name) = linux Correct output Linux Red Hat Enterprise Linux Server release 5.4 (Tikanga) ( el5) Incorrect output LINUX 2.6 What to do next Sign the masthead file. Chapter 1. Installing BigFix clients through self-update 3

8 Step 2: Signing the masthead file The masthead file that is used to connect your computers to the right BigFix server must first be sent to IBM to be digitally signed. The signatures are required so that the V7 agents can verify and accept the file. Before you begin If you want to configure relays, you must also sign the relay configuration files. For more information, see: Advanced: Assigning relays to scan groups. Procedure 1. Log in to the BigFix server. 2. Copy the masthead file from one of the following directories: Windows C:\Program Files\BigFix Enterprise\BES Client\actionsite.afxm Linux /etc/opt/besclient/actionsite.afxm 3. Send the actionsite.afxm file to to obtain digital signatures. The file is signed by IBM and returned with two signatures. 4. Copy the file and its signatures to the following directory on the V7 server. <WebSphere profile>\installedapps\<cellname>\lmt- TAD4D_Agent_message_handler.ear\com.ibm.license.mgmt.msghandler.web.war\ webdoc\agent\besclient\ Tip: In this folder, you can also find the Download_BES_Client.bes file that is required in the next steps. You can copy it to the computer that has the BigFix console installed. Results The masthead file is signed and copied to the V7 server. When self-update is enabled, the file is distributed to your computers to connect the clients to the BigFix server. Step 3: Downloading the client installers The installers of the BigFix clients must be downloaded to the V7 server and only then distributed to agents through self-update. You download the installers by using a Fixlet in the BigFix console. The installers already include digital signatures and can be accepted by the V7 agents. Before you begin If the BigFix server cannot access the Internet, download the client installers and cache them on the BigFix server before running the Fixlet. For more information, see: Caching the files. Procedure 1. Add the web addresses of the installers to the BigFix whitelist. Otherwise, the installers might be rejected. a. Log in to the BigFix server. b. Go to installation_dir\mirror Server\Config\. c. Edit the DownloadWhitelist.txt file. If there is no such file, create it. 4 Installing BigFix clients through self-update

9 d. Paste the following lines into the file and then save it: Import the Download BES Client Fixlet to the BigFix console. a. Go to the following directory on the V7 server: <WebSphere profile>\installedapps\<cellname>\lmt- TAD4D_Agent_message_handler.ear\ com.ibm.license.mgmt.msghandler.web.war\webdoc\agent\besclient\ b. Copy the Download_BES_Client.bes file to the computer that has the BigFix console installed. c. Log in to the BigFix console. d. In the menu bar, click File > Import. e. Select the Download_BES_Client.bes file that you copied from the V7 server. The Fixlet is imported. 3. Run the Download BES Client Fixlet against the V7 server. a. In the navigation tree of the console, click Sites > Master Action Site. b. Select the Download BES Client Fixlet. c. In the Description field, select the version of the clients, and click Take Action. Choose the same version as your BigFix, or earlier. Tip: Some operating systems, such as AIX 5.3, are supported only for earlier versions of BigFix, for example V8.2. Installers for those operating systems are also included. d. Select the V7 server as the target computer and click OK. The Fixlet downloads the client installers to the server. Results Step 4: Enabling self-update The installers were downloaded to the V7 server. The BigFix clients can now be installed on your computers. Installation of the BigFix clients through self-update is based on the same mechanism as the normal self-update that upgrades the V7 agents to a later version. The new functionality uses a separate mode. Only one mode can be enabled at a given moment. Before you begin Important: V7.2.2: Due to a limitation, the self-update is repeated after each 1 hour, which might significantly increase the workload on the server. talk2sam@us.ibm.com to obtain a fix for this issue. About this task When you switch the mode and enable the self-update, the V7 agents download the installers from the server and install an BigFix client on each computer. The clients are also connected to the BigFix server based on the information from the masthead file. The V7 agents are not removed. When the installers are deployed to an agent, its ID is saved in the database to stop the self-update for this agent. If Chapter 1. Installing BigFix clients through self-update 5

10 the installation fails, you must remove this ID from the database to be able to repeat the procedure. Procedure 1. Log in to the V7 server command-line interface. 2. Change the self-update mode to the installation of the BigFix clients. a. Enable the installation of the BigFix clients. setserverconf -k propagatebesclientonselfupdate -v true Note: To disable this mode, set this parameter to false. When you do so, the self-update returns to its normal mode where the V7 agents are upgraded to a later version. b. If you already have some BigFix clients installed, you can use the following command to overwrite them during self-update. The clients are upgraded and reconnected to the server that is specified in the signed masthead. Otherwise, the clients are omitted. setserverconf -k updatebesclientifinstalled -v true c. Restart the server. 3. Enable scheduled self-update, set the update period, and the start date. Important: Periodic self-update is disabled for this mode, because the BigFix clients must be installed only once. a. Enable scheduled self-update. setagentconf { -d scangroup -all } -k update_enabled -v 2 -s active b. Set the self-update period. For large scan groups, it is recommended to set the period to 168 hours (7 days) to give the agents enough time to update. The agents connect to the server randomly within this period. setagentconf { -d scangroup -all } -k update_interval -v hours -s active c. Set the start date. Agent self-updates are based on the local time zones in which agents are located and not the time on the server. If you schedule the agents to download and install updates at midnight (in different time zones), it will result in agents contacting the server at different times. setagentconf { -d scangroup -all } -k update_start -v YYYY-MM-DD-hh.mm -s active 4. Restart the server to refresh the parameters that are available to the agents. Without the restart, it might take up to 1 hour to refresh them with the new values. Results You started the self-update of the V7 agents. The agents now connect to the server, download the installation files and scripts that control the installation of those files. Each agent installs a BigFix client on its computer. The agents and the clients remain installed side-by-side until you remove one of them. This allows you to maintain both the V7 and the V9 environment until you switch completely to V9. The scripts also copy the masthead to the right locations and start the new clients so that they can instantly connect to the BigFix server. What to do next Log in to the BigFix console and verify that your computers are listed as clients. To see the list of clients connected to the server, in the navigation tree, click Computers. 6 Installing BigFix clients through self-update

11 Troubleshooting If you encounter problems during the self-update, check the log files, or read the explanations of the most common problems. Log files Windows C:\Windows\Temp\besClientLauncherLog.txt, or C:\Users\ Administrator\AppData\Local\Temp\2\besClientLauncherLog.txt UNIX /tmp/install_besclient_datetime.trc and /tmp/ install_besclient_datetime.trc.cmdout Commands You can check the last operation status of the self-update on each of your agents. To do this, go to the agent installation directory, for example C:\Windows\itlm, and run the following command: tlmagent -cmds The self-update is awaiting execution: The self-update was successfully completed: Problems The installation of the BigFix client failed and cannot be repeated The self-update can be completed only once for an agent, because after the installers are deployed, the agent ID is saved in the database to stop the self-update from repeating. If the installation fails on any of the agents, complete the following steps to remove the ID from the database: 1. Go to the computer for which you want to repeat the self-update. 2. Go to the V7 agent installation directory, for example C:\Windows\itlm. 3. Open tlmagent.ini, and copy the agent ID. # Agent Identifier # (Reloadable: No) agentid = Run the following query on the V7 database: db2 "delete from ADM.IEM_SELF_UPDATE where AGENT_ID= ID " Chapter 1. Installing BigFix clients through self-update 7

12 Error messages The following error messages are displayed in the ADM.EVENT table of the V7 database. You can view them by running the following query: db2 connect to TLMA db2 "select * from ADM.EVENT where source = 1 order by etime desc" Self update needs to be in time frame mode for BigFix client propagation The self-update must be set to the scheduled mode to install the BigFix clients. The periodic mode is not supported for this installation. To set the scheduled mode, run the following command in the V7 command line: setagentconf { -d scangroup -all } -k update_enabled -v 2 -s active Could not find package for file identifier: identifier The self-update deploys the right installation files to a particular operating system based on the identifier of this system. The identifier is created based on the information that is returned by the agents. All correct identifiers are stored in the besclient.properties file. In the case of this error message, the identifier stored in the properties file differs from the one shown in the message, and the self-update is unable to choose the right installation files. For example, the correct identifier of Red Hat Enterprise Linux 6 is Linux_x86_Red_Hat_6, but the error message might show Linux_x86 6, which indicates incomplete information returned by the agent. To solve this issue, ensure that the hardware scan on the agent was completed, and that the results were uploaded to the server. Information about the operating system is gathered during the hardware scan. Note: In V7.2.2, the complete information about the operating system is being returned only after installing Interim Fix 15. It might take up to 12 hours after the installation to return this information. Could not find file: filename One of the files required for the self-update is missing. All files are deployed through the Download BES Client Fixlet. Rerun the Fixlet to deploy the file again. File required for the agent self update does not exists or is in the wrong path The besclient.properties file that is required for the self-update is missing. This file is deployed through the Download BES Client Fixlet. Rerun the Fixlet to deploy the file again. 8 Installing BigFix clients through self-update

13 Chapter 2. Advanced tasks The advanced tasks are not required to complete the basic self-update. You might need them only if your BigFix server does not have Internet access, some of your agents use proxy, or you have a large environment and need to reduce the network traffic by using relays. Advanced: Assigning relays to scan groups Computers can be assigned a relay only based on the scan group that they belong to. A relay can be assigned to one scan group or more. After you complete this task, your computers will connect to the server through relays. Before you begin v Designate computers that will act as relays. v If you want to assign a relay to only those agents that use proxy, move those agents to a separate scan group. If any other agents are in this scan group, they will also be assigned this relay. Procedure 1. Install a BigFix client on each of the designated computers. 2. Set up relays. 3. Prepare relay configuration files. Each relay must have a separate set of two files, besclient.cfg and clientsettings.cfg. This is because computers running different operating systems use different files. a. Create a clientsettings.cfg file for Windows computers. For more information, see: Windows clients. b. Create a besclient.config file for UNIX computers. For more information, see: UNIX clients. 4. Send the files to talk2sam@us.ibm.com to obtain digital signatures. Important: If you configured multiple relays, you will have duplicated relay configuration files because the file names must not be changed. Group those files in different folders prior to sending them to IBM. Tip: You can send those files together with the masthead file that also must be signed to complete the self-update. For more information, see: Signing the masthead file. 5. Copy the files to the V7 server. a. Go to <WebSphere profile>\installedapps\<cellname>\lmt- TAD4D_Agent_message_handler.ear\ com.ibm.license.mgmt.msghandler.web.war\webdoc\agent\besclient\. b. Create a folder for each scan group that will use a relay. The folder name must reflect the scan group name. Replace spaces with underscores (_). For example, the Finance Department scan group must have a folder Finance_Department. c. Copy the files to each folder. 9

14 Results You set up relays for chosen scan groups. After completing the self-update, the computers will connect to those relays. What to do next Sign the masthead file. Advanced: Caching the client installers The Download BES Clients Fixlet requires Internet access to download files with the client installers. If your BigFix server cannot access the Internet, you can download those files on a different computer, and then cache them on the server. Instead of connecting to the Internet, the Fixlet then uses the cached files. Before you begin To download and cache the files, you require the Download Cacher. To download this software, go to Utilities on the BigFix wiki. Procedure 1. Go to the following directory on the V7 server. <WebSphere profile>\installedapps\<cellname>\lmt- TAD4D_Agent_message_handler.ear\com.ibm.license.mgmt.msghandler.web.war\ webdoc\agent\besclient\ 2. Choose the version of the BigFix clients to be installed, and copy the files90, files91, or files92 file to the Download Cacher directory. 3. Open the command line and navigate to the Download Cacher directory. 4. Run the following command to download all files that are included in the source file. The output directory must be created in advance. BESDownloadCacher.exe -o source_file -x output_directory For example: BESDownloadCacher.exe -o files92.txt -x downloads 5. Copy the downloaded files to one of the following directories on the BigFix server: Windows C:\Program Files\BigFix Enterprise\BES Server\wwwrootbes\ bfmirror\downloads\sha1 Linux Results /var/opt/bes Server/wwwrootbes/bfmirror/downloads/sha1 The BigFix installers are cached on the server. You can now run the Download BES Client Fixlet that downloads the installers to the V7 server. What to do next Download the client installers. 10 Installing BigFix clients through self-update