HP Insight Control for Linux 7.1 User Guide

Transcription

1 HP Insight Control for Linux 7.1 User Guide Abstract This document describes how to set up and use Insight Control for Linux to monitor and manage HP ProLiant servers that were licensed with Insight Control for Linux. This document builds on the information from the HP Insight Control for Linux Installation Guide, which you used to install and configure HP Systems Insight Manager (HP SIM) and Insight Control for Linux on the Central Management Server (CMS). This document is for system administrators who are responsible for using Insight Control for Linux to manage and monitor systems licensed for Insight Control for Linux. It is helpful to have previous experience with HP SIM and a Linux operating system. HP Part Number: Published: June 2012 Edition: 1

2 Copyright 2008, 2010, 2012 Hewlett-Packard Development Company, L.P. Confidential computer software. Valid license from HP required for possession, use or copying. Consistent with FAR and , Commercial Computer Software, Computer Software Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor's standard commercial license. The information contained herein is subject to change without notice. The only warranties for HP products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. HP shall not be liable for technical or editorial errors or omissions contained herein. Acknowlegements AMD and AMD Opteron are trademarks or registered trademarks of Advanced Micro Devices, Inc. The BalaBit name and other proprietary names and marks (syslog-ng ) are covered under by Hungarian and international copyright and trademark laws and are the property of BalaBit IT Security Ltd. Debian is a registered trademark of Software in the Public Interest, Inc. Linux is a U.S. registered trademark of Linus Torvalds. Microsoft is a U.S. registered trademark of Microsoft Corporation. Nagios, the Nagios Logo, and Nagios graphics are the servicemarks, trademarks, or registered trademarks owned by Nagios Enterprises. Novell and SUSE are registered trademarks of Novell, Inc. Red Hat and RPM are registered trademarks of Red Hat, Inc. UNIX is a registered trademark of The Open Group VMware is a registered trademark of VMware, Inc. The Xen mark is a trademark of Citrix Systems, Inc., which manages the mark on behalf of the Xen open 139 source community. The Xen mark is registered with the U.S. Patent and Trademark Office, and may also be registered in other countries. Use of the Xen mark on this product is not necessarily an indication of a relationship between or endorsement by Citrix Systems, Inc., the Xen community, or the Xen Advisory Board and the developers of this product, nor is it an indication that this product meets all the criteria for a Faithful Implementation of the Xen hypervisor set out at Warranty HP will replace defective delivery media for a period of 90 days from the date of purchase. This warranty applies to all Insight Management products.

3 Contents I Introduction Using Insight Control for Linux Overview Integration with Systems Insight Manager Insight Control for Linux extensions to HP SIM Insight Control for Linux toolboxes Insight Control for Linux command environment Internal task queuing and management Synchronized system clocks Insight Control for Linux RAM disk environment Network configuration and DHCP requirements Virtual media Managed system names How Insight Control for Linux assigns node names Viewing managed system names Connecting to HP SIM Backing up Insight Control for Linux files Security Integrated security features Validating RPM signatures Trusted certificates Managing licenses Licensing overview Adding the Insight Control for Linux license key to HP SIM Licensing virtual guests Understanding tasks and task results Task results overview Understanding task results Task results page Common task results Task instance area Stopping a task View control options and summary status area View printable report button Rerun non-complete targets button Parameters button Operation details log HP SIM standard task results format Summary status and target status area Stop button in the target status area Log button in the target status area Target details table Scalable task results format Operations table Operation controls Operation target details...40 II Deployment...42 Contents 3

4 5 Managing the Insight Control for Linux repository Introduction to the Insight Control for Linux repository Configuring a remote repository Repository contents Repository item naming conventions Registering items in the Insight Control for Linux repository Registration overview Registering operating systems Registering SPPs and PSPs Registering automated installation configuration files (Kickstart and AutoYaST) Registering Linux scripts and SPP and PSP dependency scripts Registering an ISO image Copying software to the Insight Control for Linux repository Copying RHEL into the local repository on the CMS Copying RHEL into a remote repository Copying SLES into the repository Copying SLES version 10 or 11 (DVDs) into the repository Copying SLES 10 SP4 or SLES 11 SP1 (KISO) into the repository Copying virtual machine OS into the repository Copying a custom OS into the repository Automating a custom OS installation Downloading SPPs and PSPs into the repository Downloading and copying a PSP Downloading and copying an SPP Editing and deleting registered items Editing registered items in the repository Deleting registered items from the repository Configuring network parameters for virtual media Introduction Preparing for virtual media Discovering the management processor with HP SIM Creating a user account and enabling virtual media on the management processor Licensing virtual media on the management processor Using the Define Networks tool Creating a network definition Loading a network definition Changing the parameters of a network definition Deleting a network definition Using the Network Configuration Editor Additional functions of Network Configuration Editor page Freeing an IP address stored in Network Configuration Editor Next Step Discovering systems, switches, and enclosures Discovering systems Discovering bare-metal servers using PXE Discovering bare-metal servers using virtual media Discovering running systems Assigning Insight Control for Linux licenses to discovered systems Preparing and discovering switches and enclosures Changing the boot method Next steps Setting up managed systems Populating the Insight Control for Linux repository Contents

5 8.2 Linux OS installation Setting up managed systems for monitoring Opening network ports on managed systems Resolving host names on the CMS Installing additional SPP and PSP components Configuring agents and HP SIM SSH keys Configuring console access and logging Turning on password authentication Next steps Installing operating systems on managed systems Linux OS installation overview Interactive versus unattended installations Supported operating systems Installing other Linux operating systems Using installation configuration files for unattended installations Naming conventions for installation configuration files Customizing installation configuration files Installation configuration files for custom operating systems Configuring an operating system for console redirection Prerequisites to OS installations on managed systems Additional prerequisites for certain ProLiant servers Installing RHEL on managed systems Installing RHEL using an unattended method Installing RHEL interactively Installing SLES on managed systems Installing SLES using an unattended method Installing SLES interactively Required kernel parameters for installing x86 SLES operating systems on various servers Installing VMware ESX and VMware ESXi operating systems Installing a VMware ESX or ESXi OS using a Kickstart file Installing a VMware ESX or VMware ESXi OS interactively Installing another variant of Linux on managed systems Generic procedure for installing an OS on one or more managed systems Capturing and deploying Linux images Overview of capturing and deploying Linux images File system types Precapture and postcapture scripts Predeployment, postdeployment, and final deployment scripts Prerequisites to capturing a Linux image Capturing a Linux image from a managed system Preparing for scalable deployment Deploying a captured Linux image to one or more managed system Insight Control for Linux partition wizard overview Partition wizard requirements and guidelines Using the partition wizard Installing and setting up virtual machines Installing virtual hosts Registering the virtual host with Insight Control virtual machine management Creating and installing virtual guests Guidelines for configuring a VMware ESX or VMware ESXi virtual guest Guidelines for configuring a KVM virtual guest Installing a RHEL KVM virtual guest Contents 5

6 Installing a SLES KVM virtual guest Guidelines for configuring a Xen virtual guest Obtaining virtual guest and virtual host associations Establishing monitoring for virtual hosts and virtual guests Virtual guest operations Using Insight Control for Linux to update HP ProLiant firmware Overview of updating HP ProLiant firmware Basic firmware update functionality Initial setup Updating firmware on systems known by HP SIM Updating firmware on systems during bare-metal discovery Viewing the results of a firmware update Specifying HPSUM option flags Adding or removing firmware files from the firmware tar file Firmware update time out Advanced firmware update functionality Understanding the firmware configuration file Example firmware configuration files Installing SPPs and PSPs on managed systems Overview of the SPP and PSP installation tool Required SPP and PSP components Creating a SPP or PSP dependency script SPP or PSP installation procedure ISO control operations Booting an ISO image on a server Inserting an ISO image Ejecting an ISO image Remote server controls Powering off a managed system Powering on a managed system Rebooting a managed system HP Insight Control power management Using SSH for remote server management Setting SSH credentials on managed systems Setting SSH credentials for users Running a command on multiple managed systems Using Insight Control for Linux to run commands and scripts through SSH Running an SSH command Running a Linux script III Monitoring Managing Insight Control for Linux collections Introduction to collections Populating a collection Adding servers and switches to an Insight Control for Linux collection Removing a managed system or switch from an Insight Control for Linux collection Setting up management hubs About management hubs Creating a management hub Removing a management hub Configuring monitoring services Overview of monitoring Contents

7 19.2 Configuring a self-signed Apache certificate on the CMS Starting management and monitoring services Installing Insight Control for Linux management agents Verifying successful configuration of the monitoring services Ensuring that Nagios is reporting status Summarizing service status Using graphical tools to monitor managed systems Insight Control for Linux system monitoring overview Collecting metrics through a management processor Collecting metrics through OS agents Collecting events with syslog Nagios overview Nagios documentation Launching Nagios Using Nagios Viewing network health Viewing Nagios hosts and services Displaying hosts and services that are experiencing problems Displaying network bandwidth and system use Gathering and displaying system environment data Services monitored by Nagios Understanding Nagios alert messages Understanding system event log monitoring Configuring Nagios alerts Monitoring Metrics in real time Performance Dashboard overview Performance Dashboard features Performance Dashboard requirements Interpreting the data in a ring plot Ring plot color coding Ring plot units of measure Launching the Performance Dashboard tool Using the mouse buttons to manipulate the Performance Dashboard tool Performance Dashboard tool metrics Customizing the Performance Dashboard tool metrics Using the command line to view managed system status Archiving sensor metrics on an individual basis Displaying usage, statistics, and metrics with the shownode command Displaying configuration information for a managed system Displaying all host hames associated with a managed system Using the shownode virtual command Using the shownode metrics command Displaying system sensor information Displaying processor usage and load Displaying memory Displaying paging and swap data Displaying environmental data Reporting usage information and host and service status Connecting to a remote console Console management facility overview How CMF works Accessing a remote console Serial connections on DL100 series servers Contents 7

8 22.5 Enabling telnet access to ilo management processors IV Other topics Miscellaneous topics Changing management processor credentials Changing the default port for the repository web server Increasing the number of servers that can be discovered concurrently Changing the IP address of the CMS Uninstalling Insight Control for Linux Determining the installed Insight Control for Linux version Event logging overview Understanding the event logging structure The syslog-ng.conf rules file Modifying the syslog-ng rules files Changing the number of concurrent tasks Support for HP ProLiant DL1xx series servers Configuring SNMP Setting up the DHCP server for virtual guests Uninstalling atftp and installing tftp Advanced topics Management Processor Credentials General information on Insight Control for Linux MP credentials Maintaining MP unique credentials Discovering and setting up servers with PXE deployment Discovering and setting up servers with virtual media deployment LO100 management processor credential storage Deploying WBEM provider components using Configure or Repair Agents task Logging RAM disk connections and operations V Troubleshooting and support resources Troubleshooting General troubleshooting topics Alternative booting Apache service does not start Troubleshooting CMF problems Troubleshooting configuration problems Troubleshooting connection problems Troubleshooting DHCP problems Troubleshooting discovery problems Troubleshooting firmware update problems Troubleshooting Insight Control for Linux repository problems Troubleshooting large scale deployment problems Troubleshooting licensing problems Troubleshooting monitoring problems Nagios Troubleshooting Determining the status of the Nagios service Examining Nagios log files Running Nagios plug-ins manually Using the Nagios report generator analyze mode Messages reported by Nagios A check_nrpe error occurs during management agents installation Nagios gather_all_data script reports check_nrpe errors Troubleshooting Nagios problems Troubleshooting OS installation and image deployment problems Contents

9 RHEL and SLES installations Custom OS installations Capturing Linux images Deploying Linux images Troubleshooting SPP and PSP installation failures Troubleshooting PXE Boot problems Troubleshooting the run script and run SSH command tools Troubleshooting server power control problems Troubleshooting server-to-management processor associations Maintaining server-to-management processor associations Identifying a lost server-to-management processor association Rebuilding a server-to-management processor association Repairing the association of a booted managed system running an OS Restoring the association of a bare-metal-discovered server blade Repairing the association of an unbooted managed system without an OS Establishing the association with a server after a bare metal discovery Establishing association between ilo and server Troubleshooting SNMP problems Troubleshooting SSH Troubleshooting Supermon problems Troubleshooting syslog-ng problems Troubleshooting Insight Control for Linux tool problems Troubleshooting uninstallation problems Troubleshooting virtual machine installation and setup problems Troubleshooting virtual media problems Support and other resources Information to collect before contacting HP How to contact HP Registering for software technical support and update service How to use your software technical support and update service Warranty information HP authorized resellers Documentation feedback New and changed information in this edition Related information Documents Websites Troubleshooting resources Typographic conventions A Customizing Nagios A.1 Changing the Nagios user A.2 Adjusting the Nagios configuration A.2.1 Stopping and restarting Nagios before performing maintenance operations A.2.2 Modifying the nagios_vars.ini file to change the Nagios configuration A.2.3 Changing sensor threshold values A.2.4 Rebuilding the nagios_vars.ini file for changes to take effect A.2.5 Adjusting the time allotted for metrics collection A Global service check timeout limit A.2.6 Disabling individual Nagios plug-ins A.3 Changing Nagios default settings A.4 Changing the rotation of system event logs and changing the rules file A.5 Controlling Nagios messages Contents 9

10 A.6 Modifying the Nagios password file Glossary Index Contents

11 Part I Introduction

12 1 Using Insight Control for Linux This chapter addresses the following topics: Overview (page 12) Integration with Systems Insight Manager (page 13) Insight Control for Linux extensions to HP SIM (page 13) Insight Control for Linux toolboxes (page 16) Insight Control for Linux command environment (page 17) Internal task queuing and management (page 17) Synchronized system clocks (page 18) Insight Control for Linux RAM disk environment (page 18) Network configuration and DHCP requirements (page 18) Virtual media (page 18) Managed system names (page 19) Connecting to HP SIM (page 21) Backing up Insight Control for Linux files (page 21) 1.1 Overview Insight Control for Linux is a suite of software tools that enable you to: Discover servers, switches, and enclosures Configure servers' boot method, PXE or virtual media Create network parameter definitions and apply them to servers Manage system configuration Deploy operating systems on servers Deploy Service Packs for ProLiant (SPP) and ProLiant Support Packs (PSP) to managed systems Deploy virtual operating systems on managed systems Capture a Linux OS image from a managed system and deploy it to another Manage systems (power on, power off, and reboot) Monitor managed systems Update ProLiant firmware Run a command through SSH or run a script to multiple managed systems. On many of these operations, you can specify multiple targets and Insight Control for Linux performs the operation on them simultaneously. The operating systems and other files that Insight Control for Linux deploys or runs are stored in a repository that is: A local directory on the CMS A remote directory mounted on the CMS. Insight Control for Linux uses the contents of the repository to transform a bare-metal server to a managed system. Generally, the operations for this transformation involve the following: Discovering the server and its management processor 12 Using Insight Control for Linux

13 Configuring network parameters Installing an operating system and agents from the SPP or PSP Configuring monitoring services After a server becomes a managed system, you can monitor it and manage it. 1.2 Integration with Systems Insight Manager Insight Control for Linux is a suite of software and tools that combine to provide a powerful mechanism for discovering, installing, monitoring, and managing HP ProLiant servers. Insight Control for Linux enhances the free system monitoring and system management features of Systems Insight Manager (HP SIM). The underlying foundation of Insight Control for Linux is HP SIM, with plug-in tools to perform the software installation, monitoring, and management tasks. Insight Control for Linux enables you to manage and monitor a range of objects including Linux servers, switches, and enclosures. For the version of HP SIM required, see the HP Insight Control for Linux Support Matrix. To access and use Insight Control for Linux features through HP SIM, you must apply an Insight Control for Linux license to each server you want Insight Control for Linux to manage and monitor. HP SIM and Insight Control for Linux tasks are launched from the server you configured as the CMS. 1.3 Insight Control for Linux extensions to HP SIM Table 1 lists the Insight Control for Linux features, by category, that are integrated with HP SIM. NOTE: The majority of Insight Control for Linux features only run on systems whose type is Server. The OS installation and Linux image deployment tools appear in the HP Insight Control user interface; only if servers were discovered in HP SIM. After an object of type Server is discovered, the Insight Control for Linux menu items appear in the HP Insight Control user interface. Table 1 Insight Control for Linux extensions to the HP Insight Control user interface; Menu item Options IC-Linux Configure Management Services Deploy Deploy Drivers, Firmware and Agents IC-Linux Install Agents... Options IC-Linux Configure Boot Method Options IC-Linux Define Networks Description Insight Control for Linux configuration Configures or reconfigures monitoring services (syslog-ng, pdsh, CMF, Nagios, Supermon). Use this menu item during the initial configuration of Insight Control for Linux, then any time you add or remove a managed system from the Insight Control for Linux collection. Also installs the Insight Control for Linux management agents on the selected managed systems. Deploys Insight Control for Linux management agents to selected managed systems. This functionality is incorporated in the Options IC-Linux Configure Management Services menu item. This standalone tool allows you to configure the boot method that other Insight Control for Linux tools will use. The available boot methods are PXE or virtual media. This tool performs this configuration only and no other actions. When using this tool, be sure to specify the server as the target. The Define Networks tool provides an interface through which the administrator can create and edit network definitions that can be Documented in Section 19.3 (page 154) Section 19.4 (page 156) Section 7.4 (page 76) Chapter 6 (page 59) 1.2 Integration with Systems Insight Manager 13

14 Table 1 Insight Control for Linux extensions to the HP Insight Control user interface; (continued) Menu item Options IC-Linux Network Configuration Editor Options IC-Linux Initiate Bare Metal Discovery Deploy Deploy Drivers, Firmware and Agents IC-Linux Uninstall Agents... Deploy Deploy Drivers, Firmware and Agents IC-Linux Configure SNMP on DL1xx Servers... Configure Management Processor Credentials... Tools Integrated Consoles Nagios Tools Integrated Consoles Nagios HP Graph Tools Integrated Consoles Performance Dashboard... Tools Command Line Tools Run SSH Command... Tools Command Line Tools Run Script... Tools Server Controls Power Off Server... Tools Server Controls Power On Server... Tools Server Controls Reboot Server... Options IC-Linux Manage Repository Description used by the Network Configuration Editor tool. The network definitions are used by the OS installation tools to implement booting using the virtual media mechanism. IMPORTANT: The network definitions must be created before initiating bare-metal discovery through virtual media. The Network Configuration Editor allows the administrator to apply predefined network configuration parameters to servers (with ilo-based management processors) that are booted using the virtual media mechanism. This tool allows the administrator to initiate a bare-metal discovery for servers using their already discovered management processors. It is a single page that lets you select the boot method of the server as either PXE or virtual media, then boots the server using the selected method to initiate a bare-metal discovery. Removes Insight Control for Linux management agents and associated files from selected managed systems. Configures SNMP on LO100 based systems to provide information so that the systems that HP SIM can properly identify. On ilo-based systems, the Insight Control for Linux agents provides this information. Changes the default management processor user name and password or modifies the management processor user name and password on selected target managed systems. Monitoring Launches Nagios, a monitoring tool that displays and generates alerts for all managed systems and services. Displays graphs about network bandwidth and other system usage. Displays metric data in one-second intervals for systems monitored and managed by Insight Control for Linux. System management Runs a user-specified Linux command through ssh on one or more managed systems. Runs a Linux script from the Insight Control for Linux repository on one or more managed systems. Accesses the management processor on the selected target managed system or systems to power on, power off, or reboot the managed system or systems. Repository management Enables you to register items in the repository and manage the contents of the repository. OS installation Documented in Chapter 6 (page 59) Section (page 72) Section 17.4 (page 149) Section 23.9 (page 195) Section 23.1 (page 191) Section 20.2 (page 160) Section (page 168) Section 20.8 (page 175) Section (page 144) Section (page 144) Chapter 15 (page 141) Chapter 5 (page 43) 14 Using Insight Control for Linux

15 Table 1 Insight Control for Linux extensions to the HP Insight Control user interface; (continued) Menu item Deploy Operating System Red Hat Interactive Deploy Operating System Red Hat (Kickstart) Deploy Operating System SLES Interactive Deploy Operating System SLES (AutoYaST) Deploy Operating System VMware ESX Interactive Description Starts an interactive Red Hat Enterprise Linux (RHEL) installation on one or more target managed systems. Uses a default or user-supplied configuration file to start an unattended RHEL installation on one or more target managed systems. Starts an interactive Novell SUSE Linux Enterprise Server (SLES) installation on one or more target managed systems. Uses a default or user-supplied configuration file to start an unattended SLES installation on one or more target managed systems. Performs an interactive VMware ESX installation on the target system. Documented in Section (page 95) Section (page 94) Section (page 96) Section (page 95) Section (page 98) Deploy Operating System VMware ESX (Kickstart) Performs an unattended VMware ESX installation on the target system using an automated installation configuration file to provide key specifications. Section (page 97) Deploy Operating System VMware ESXi Interactive Performs an interactive VMware ESXi installation on the target system. Section (page 98) Deploy Operating System VMware ESXi (Kickstart) Performs an unattended VMware ESXi installation on the target system using an automated installation configuration file to provide key specifications. Section (page 97) Deploy Operating System Custom or Other Interactive... Deploy Operating System Custom or Other (Unattended)... Deploy Operating System Capture Linux Image Deploy Operating System Deploy Linux Image Installs a Linux operating system distribution other than RHEL or SLES that supports network installations.the installation requires the operator to respond to prompts to enter key data, such as kernel parameters. Installs a Linux operating system distribution other than RHEL or SLES that supports network installations. When you supply key data in specific files in advance, the installation can proceed without prompts. Linux image capture and deployment Captures the Linux image from a target managed system and stores it in the repository. Deploys a previously captured Linux image to one or more target managed systems. Section 9.7 (page 99) Section 9.7 (page 99) Section 10.3 (page 109) Section 10.5 (page 113) ProLiant Service Pack (SPP) and ProLiant Support Pack (PSP) component installation Deploy Deploy Drivers, Firmware, and Agents IC-Linux Install SPP or PSP... Tools ISO Controls Boot ISO Image... Tools ISO Controls Mount ISO Image... Tools ISO Controls Eject ISO Image... Installs user-selected Linux SPP or PSP components from the Insight Control for Linux repository to target managed systems. ISO Controls Implicitly inserts an ISO image, then powers on the server to boot from that image. Makes the selected ISO image available as a locally attached device. Removes an inserted ISO image from target server or servers. Server Controls Chapter 13 (page 136) Section 14.1 (page 140) Section 14.2 (page 140) Section 14.3 (page 140) 1.3 Insight Control for Linux extensions to HP SIM 15

16 Table 1 Insight Control for Linux extensions to the HP Insight Control user interface; (continued) Menu item Tools Server Controls Power Off Server... Tools Server Controls Power On Server... Tools Server Controls Reboot Server... Diagnose Boot to Linux Rescue Mode Configure Boot to IC-Linux RAM disk Deploy Deploy Drivers, Firmware and Agents IC-Linux Update ProLiant Firmware... Description Makes a remote call to the management processor to set power status to off abruptly. Makes a remote call to the management processor to set power status to on. Makes a remote call to the management processor to set power status to off abruptly, then back to on after a set time. Maintenance, troubleshooting and diagnostics Boots a managed system to a Linux-based RAM disk environment for troubleshooting. Boots a managed system to a Linux-based RAM disk environment for troubleshooting. Initiates a firmware update on any ProLiant server licensed for Insight Control for Linux on your CMS. IMPORTANT: Servers selected for a firmware update are shut down and servers successfully updated are left powered down. Documented in Section 15.1 (page 141) Section 15.2 (page 141) Section 15.3 (page 141) Section 25.2 (page 204) Section 25.2 (page 204) Chapter 12 (page 130) 1.4 Insight Control for Linux toolboxes Insight Control for Linux is preconfigured with a pair of role-based toolboxes. A toolbox is a set of tools available in HP SIM or Insight Control for Linux. With toolboxes, you can easily grant the authorization of several tools to a user with a single command. The toolboxes and the tools they contain are: Insight Control for Linux Deploy toolbox Insight Control for Linux Manage toolbox Red Hat Interactive Boot to Linux Rescue Mode Red Hat (Kickstart) Boot to IC-Linux RAM disk SLES Interactive Configure Management Services SLES (AutoYaST) Configure SNMP on DL1xx Servers VMware ESX Interactive Install Agents VMware ESX (Kickstart) Uninstall Insight Control for Linux Agents VMware ESXi Interactive Nagios Custom or Other Interactive Performance Dashboard Custom or Other (Unattended) Device Discovery Power Off Server Capture Linux Image Modify Management Processor Credentials Power On Server Deploy Linux Image Reboot Server Run SSH Command Run Script Update ProLiant Firmware The Insight Control for Linux Deploy toolbox contains the tools you need to install, capture, and deploy images remotely. The Insight Control for Linux Manage toolbox is for those who only monitor and manage the health of the managed systems. If you want to create a user who can access related set of tools using these toolboxes, use the following commands after creating the new Linux user account for them: $ mxuser a username d "Manager Account" p none $ mxauth a u username R "Insight Control for Linux Manage" n "*" 16 Using Insight Control for Linux

17 For information on creating administrator accounts, that is, non-root accounts with the privileges required to access and use HP SIM, see the HP Insight Control for Linux Installation Guide. 1.5 Insight Control for Linux command environment Table 2 lists the Insight Control for Linux commands that you can run from the command line on the CMS or on any management hub, with the exception of the pdsh command. Table 2 Insight Control for Linux commands Command console headnode nodename nrg pdsh shownode Description Enables access to the serial consoles of managed systems. Returns the name of the CMS. Displays the Insight Control for Linux internal name for the CMS or managed system on which it is run. Uses data that Nagios collects to generate reports, including an analysis of the state of Insight Control for Linux collections. Runs a command or commands on the CMS across multiple managed systems in parallel. This command has a variety of subcommands that provide information about managed systems. Enter shownode --help for a list of the subcommands. Manpage console(8) headnode(1) nodename(1) nrg(8) pdsh(1) shownode(1) For more information about an individual command, see the corresponding manpage, if one is available. Use the man command to view manpages from the command line, as follows: # man command_name 1.6 Internal task queuing and management Because some Insight Control for Linux tasks, especially OS installation tasks, might take a long time to complete, Insight Control for Linux uses an internal task engine for task queueing and load balancing. The task engine provides the following benefits: Only one Insight Control for Linux task is run against a given target managed system at any one time. Insight Control for Linux tasks are run against a given target managed system in the order in which you started them. Regardless of the number of selected target managed systems, the load that the Insight Control for Linux tasks imposes on the CMS is controlled so that performance and usability of the CMS is unaffected. You might notice that when you run an Insight Control for Linux tool against multiple target managed systems, the task is completed on some managed systems before the task is started on other managed systems. You might also notice that tasks proceed at a faster or slower rate on some target managed systems. This is considered normal behavior. All output, logging, and control of Insight Control for Linux tasks is integrated into the Tasks & Logs View Task Results screen. A time out of five days is in effect for an OS installation using Kickstart or AutoYaST files so that tasks do not hang indefinitely. You can change the number of Insight Control for Linux tasks that can be run concurrently. For information, see Section 23.8 (page 195) 1.5 Insight Control for Linux command environment 17

18 1.7 Synchronized system clocks When using Insight Control for Linux, and especially when using Insight Control for Linux tools to install operating systems on managed systems, to capture and deploy Linux images, HP recommends that you keep system clocks up to date and synchronized. Synchronization is required for the Console Maintenance Facility to access a managed system using SSH. Capturing an image from a managed system or deploying an image to a server whose system time is incorrect can cause a large number of error messages when the image is deployed. These messages do not affect the deployment, but they can add significant time delays to the deployment. To avoid this and other problems, always synchronize the clock on the CMS and your managed systems. IMPORTANT: If you decide to implement NTP, make sure the NTP ports are open on your firewall. The default ports for NTP are UDP:123 and TCP: Insight Control for Linux RAM disk environment The Insight Control for Linux RAM disk environment is a fully-functioning operating environment in memory that is used to support discovery, registration, and configuration of HP ProLiant servers equipped with Integrated Lights Out (ilo) or, for some servers, LO100i, management processors. For a list of servers that Insight Control for Linux supports, see the HP Insight Control for Linux Support Matrix. The RAM disk's operating environment is enhanced to support HP ProLiant servers and Insight Control for Linux. The RAM disk environment is initiated when an HP ProLiant server initiates a network boot (PXE or virtual media) from a CMS that is installed with the SystemImager Insight Control for Linux boot RPMs. The operating mode of the RAM disk is determined by kernel command line parameters passed as part of the PXE boot process. IMPORTANT: HP recommends that Insight Control for Linux deployment and capture facilities be used in a trusted network environment because of inherent insecurity with the PXE boot protocol. The PXE boot protocol is insecure because of its design. The CMS cannot verify the identity of a system booting into the RAM disk. Also, the booting managed system cannot verify the identity of the host from which it receives the RAM disk. Virtual media is provided as a secure alternative to PXE. 1.9 Network configuration and DHCP requirements Supported network configurations and DHCP requirements are documented in the HP Insight Control for Linux Installation Guide. You can use the virtual media mechanism (see Virtual media (page 18)) as a simpler and more secure alternative to PXE booting. However, to use virtual media, network parameters must be configured and applied with the Define Networks and Network Configuration Editor tools. For information on these tools, see Chapter 6 (page 59) Virtual media Virtual media is a mechanism that allows a server with an ilo-based management processor to boot a Virtual CD (that is, a bootable ISO image) over the network in much the same way that it would be loaded from a CD or DVD. Virtual media is a secure alternative to PXE. Commands are sent to the management processor to specify where the ISO image can be found on the CMS. 18 Using Insight Control for Linux

19 When the system is powered on, the bootable image is loaded from the CMS by way of the management processor. Virtual media does not use DHCP. The system boots a custom RAM disk that includes the predefined network configuration information (for example. the IP address, Net Mask, Gateway, and so on). Insight Control for Linux provides tools that let you define the network information parameters, edit those network parameters, and initiate bare-metal discovery Managed system names Insight Control for Linux command line commands recognize managed systems by the following name types. Managed system name type Host name Fully qualified host name Insight Control for Linux internal name Description The name assigned to the managed system when the Linux OS was installed on it, if a name was assigned. HP SIM recognizes managed systems by this host name. The managed system host name with the domain name appended, for example, earth.example.com. In this document, example.com is the domain name used in command and screen examples. The internal name Insight Control for Linux assigns to a managed system. The Insight Control for Linux name naming convention is {collection name}{0 9999}, where: collection name is the Insight Control for Linux default or user-defined name you assigned as the collection name during the Insight Control for Linux installation process is a number that is arbitrarily assigned to the managed system during the Insight Control for Linux installation process. Numbers are assigned sequentially. For example, if the collection name is icelx, the Insight Control for Linux internal names are icelx1, icelx2, icelx3, and so on. For a description of how internal names can change when managed systems are added to or removed from the Insight Control for Linux collection, see Section (page 19) How Insight Control for Linux assigns node names Insight Control for Linux internal names are assigned when you configure or reconfigure management services through the following menu item: Options IC-Linux Configure Management Services This task creates a nodenumbers file which stores the associations of managed systems to their internal name. The location of this file is /opt/hptc/database/etc/collection_name, where collection_name refers to the Insight Control for Linux collection for the managed systems. In general, if you add new managed systems to the Insight Control for Linux collection, the new managed systems are assigned with the next available name. For example, if the internal names icelx1, icelx2, and icelx3 are already assigned to three managed systems, the new managed system is assigned the internal name icelx4, and so on. If a managed system is removed from the collection, its internal name is not reused unless it is for the same managed system when it is added back. You can influence internal node numbering by understanding and editing or creating the /opt/hptc/database/etc/collection_name/nodenumbers file, where collection refers to the collection for the managed systems. The internal node name is generated by concatenating the name of the collection and the node number Managed system names 19

20 When you run the Options IC-Linux Configure Management Services task, it determines if this file exists: If the file does not exist, it creates the file and assigns numbers based on the managed systems and the current numbering scheme. The Central Management Server is always node number 1. If the file already exists, the configuration task reads the nodenumbers file and assigns the node numbers according to the file contents. If there are any new managed systems, they are added to the list automatically. Servers that Insight Control for Linux no longer manages remain in the list. Removing a managed system does not change the numbering scheme. If you want to reuse a node number, remove it from this file and reconfigure the Insight Control for Linux Management Services with the Options IC-Linux Configure Management Services menu item. There are three fields in each non-blank or non-comment line in this file; they are: number name GUID Where: number name GUID Is the node number of the managed system. This number must be nonnegative. Is the name HP SIM uses to identify the managed system, for example, mars. Is the globally unique identifier for that managed system. This field is optional but, if provided, it overrides the name field. This is particularly effective if you want to ensure that a specific managed system always has the same internal node name, even if it is renamed. You can obtain the GUID for a given managed system with the following command: $ mxnode -ld nodename grep GUID GUID: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx The following rules apply: The managed systems can be listed in any order in the file; that is, order does not matter. The configuration task reorders the file. You are allowed to have gaps in the numeric sequence. If a number is repeated with different names or GUIDs, only the first instance in the file is used. Subsequent entries with that number are lost. If two entries have the same GUID, only the first entry is used. Comment lines begin with a nonnumeric character, usually #, in the first field. Blank lines and comments are ignored and, thus, are not preserved. The following is an example of an edited nodenumbers file: # Nodenumbers file 1 earth xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx 3 mercury 4 mars 5 pluto nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn The configuration task assigns these managed systems internal node names as follows: earth mercury mars pluto icelx1 icelx3 icelx4 icelx5 Where icelx is the collection name. 20 Using Insight Control for Linux

21 Viewing managed system names After the Configure Management Services task is run, you can list the managed systems with their associated names; use the shownode info command as described in Section (page 182) Connecting to HP SIM To log in and connect to HP SIM, follow these steps: 1. Open a browser window. 2. Enter the web address of the Central Management Server using any of the following address formats: The web address consists of the following: The fully qualified host name of the CMS or the IP address of the CMS management interface. The CMS management interface is the Ethernet adapter (the NIC) that is used for communication between the CMS and the managed systems. The default HP SIM port, port 280 For example, if the fully qualified host name of the CMS is mercury.example.com, enter the following web address: 3. When the login screen appears, enter the HP SIM administrator user name or root and the associated password to log in to HP SIM Backing up Insight Control for Linux files The following table contains a list of user files and directories that must be backed up in order to regenerate your customized installation, if needed. Table 3 Insight Control for Linux files and directories to back up Files and directories to back up /opt/repository/* /opt/hptc/cmf/cmf.conf /opt/mx/icle/icle.properties /opt/mx/icle/config/network_map.xml /opt/hptc/nagios/etc/templates/* /opt/hptc/syslog-ng/etc/syslog-ng/syslog-ng.conf /etc/dhcpd.conf /etc/hosts /etc/snmp/snmpd.conf Reason Supported and custom operating systems, boot images, captured images, installation configuration scripts, dependency scripts, and the Firmware Update file are located in this directory. This file contains the configuration data for the Console Management Facility. This file contains Insight Control for Linux configuration values. This is the database for the network configuration parameters. This directory holds critical information used by Nagios. This file contains the configuration data for the syslog-ng utility. Required only if the CMS is also a DHCP server. Static table for host names. Configuration file for the Net-SNMP SNMP agent Connecting to HP SIM 21

22 You also must back up HP SIM configuration files to restore your configuration. For more information on these HP SIM configuration files, see the following white paper: Backing up and restoring HP SIM or greater data files in an HP-UX and Linux environment 22 Using Insight Control for Linux

23 2 Security 2.1 Integrated security features This section describes features that are integrated into HP SIM and Insight Control for Linux to make them secure. Security features are also discussed in context of the associated topic throughout this document. Browser Connections HP SIM enforces a secure connection to the web browser. User Names and Passwords The following is a list of user names and passwords on your CMS that permit access only to authorized users: Linux root password Permits access to the root account on the CMS, which has privileges to perform any administrative task. HP SIM user name and password A user with administrative privileges who can launch and use HP SIM and Insight Control for Linux to manage and monitor systems. Management processor user name and password Allows access to the serial console ports of the managed systems. Nagios administrator password Grants access to launch and use the Nagios system and network monitoring application. Directory access The following two directories are accessible to nonroot users: /opt/hptc /opt/repository HP recommends that you do not create guest and other nontrusted user accounts on the CMS so that users cannot access, add, or delete files in these directories. Firewalls Insight Control for Linux works with a firewall if you open the appropriate ports. HP recommends that you use a firewall. Secure Shell Secure Shell (SSH) is the preferred method to access managed systems. Typically, you use the ssh command to get a login shell or to run commands. Insight Control for Linux and most modern Linux distributions provide the OpenSSH suite, which includes the ssh command. OpenSSH implements both ssh1 and ssh2 protocols; ssh2 is the preferred default protocol. RSA, RSA1 and DSA host keys are supported. The keys used to identify hosts are 1024-bit RSA keys, and a 256-bit AES key is used for encrypting communication. The diffie-helman-group1-sha key is used. The defaults should be sufficient but, if your environment requires different key configurations, see the following web address for information on their proper configuration: Integrated security features 23

24 The SSH service also enables file transfer with the scp or sftp commands over the same port as SSH. pdsh Keys The pdsh command uses public host keys to authenticate remote hosts and supports public key authentication to authenticate users. cmfd Keys The console command uses SSL keys to connect to the console management facility daemon (cmfd) for console access. secure boot mechanism Virtual media support is provided as the secure boot mechanism. PXE booting provides no authentication or encryption. Data used to authenticate either the CMS or a managed system, or used to setup login credentials on a management processor must be secured. This information is secured with the virtual media mechanism. Specifically, the data includes the SSH public key and any certificates needed to secure the communication between the CMS and the managed system. An auxiliary RAM disk that can be appended to the normal Insight Control for Linux RAM disk is created for this purpose. This auxiliary RAM disk is used in one of two ways: It becomes part of the virtual media ISO boot image when booting a managed system using virtual media. It is added in the pxelinux.cfg boot configuration file when booting by PXE. HTTPS Communication between the CMS and a managed node is performed using HTTPS. Digital signature HP software, firmware, drivers, applications, and other executables are delivered with an electronic cryptographic signature. This electronic signature gives you an industry standard method to verify the integrity and authenticity of the code you received before you deploy it. This digital signature is then used in a signature verification process to verify and validate the following: To verify and validate the authenticity of the code. That HP created the code in question. To verify and validate integrity of the code. That the code in question was not altered since it was originally signed. For the procedure to validate RPMs, see Validating RPM signatures (page 25). Privilege elevation Insight Control for Linux monitoring operations do not work when HP SIM is configured for privilege elevation. However, Insight Control for Linux OS installation and image capture and deployment operations, which are not affected by HP SIM privilege elevation, will work. Access to system monitoring information HP recommends the use of a trusted network environment because metric data that Nagios collects from Supermon and mond is not encrypted. 24 Security

25 Issues relating to scalable deployment The scalable deployment feature of Insight Control for Linux uses HTTP to transfer a Linux image from the CMS to a group leader and FTP to transfer that image from the group leader to individual servers. There is no mechanism for verifying the identity of the server providing the image; neither method protects from a man in the middle attack. Standard Linux deployment, which uses SSH to push an image to the target systems is a less scalable but more secure method than large scale deployment. HP recommends the use of a dedicated management LAN for large scale Linux deployments. For more information on scalable deployment, see Section 10.4 (page 110) Logging RAM disk connections and operations With a few minor modifications, you can log who has connected to the RAM disk. For more information, see Logging RAM disk connections and operations (page 201). 2.2 Validating RPM signatures The RPMs for Insight Control for Linux, Insight Control virtual machine management, and Insight Control power management are digitally signed with a private key. You have the option of using the public key shipped on the Insight Control for Linux ISO image to validate and verify the RPMs. Although this verification process is optional for you, it ensures that HP is the creator of the code and that the code was not modified since it was signed. For more information on validating RPM signatures, see the HP Insight Control for Linux Installation Guide. 2.3 Trusted certificates Insight Control for Linux conforms to the security features of HP SIM. There is a Trusted Certificates tab under Options Security Credentials Trusted Systems. By selecting that tab, you access a web page that allows you to determine how SSL/HTTPS connections are handled; there are two options, depending on the button selected: Always Accept This button is preselected by default. The CMS establishes SSL connections with managed systems without validating them against certificates in the HP SIM trusted certificate list. Require When this button is selected, the CMS only establishes SSL connections with managed systems whose certificates are represented in the HP SIM trusted certificate list. When performing any operation that communicates with an ilo-based management processor, Insight Control for Linux has the ability to verify whether the target ilo is a trusted system, meaning that it is presenting a certificate that Insight Control for Linux trusts. To enable this security mechanism, make sure the Require radio button is selected. Use the Import button to import the ilo s self-signed certificate. You can obtain the ilo s self-signed certificate by connecting to the ilo using your browser. In Microsoft Internet Explorer for Windows Vista, for example: 1. Select Page Security Report. 2. Select View Certificates. 3. Select the Details tab. 4. Select the Copy to File... button. 5. In the Certificate Export Wizard, select the Base-64 encoded X.509 (.CER) radio button and proceed to save your file. This is the file that you specify in HP SIM when you select the Importbutton. 2.2 Validating RPM signatures 25

26 You must repeat this procedure for every ilo whose certificate you want to add to the HP SIM trust storage. An alternate method is to automate this procedure by using a script to extract the ilo's certificate and add it to the HP SIM trusted certificate list. The following is an example of a script that accepts a series of ilo certificates and adds them to the HP SIM trust store. #!/bin/sh # # Get certificate for each ilo passed in as an argument # and add it to the HP SIM trust store. # for i in $@ do echo \ openssl s_client -connect ${i}:443 2>&1 \ sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' mxcert -t - if [ $? -ne 0 ]; then echo "Unable to retrieve certificate for $i" exit 1 else echo "Added certificate for $i" fi done 26 Security

27 3 Managing licenses This chapter describes the following topics: Licensing overview (page 27) Adding the Insight Control for Linux license key to HP SIM (page 27) Licensing virtual guests (page 28) 3.1 Licensing overview The licenses for the Insight Control power management and Insight Control virtual machine management are bundled with the Insight Control for Linux license. The ilo Advance remains as a separate license. Insight Control for Linux uses the HP SIM License Manager as its licensing model. Every server you want to monitor and manage with Insight Control for Linux requires an Insight Control for Linux license to be applied to it. HP BladeSystem enclosures and switches do not require an Insight Control for Linux license. When you are using Insight Control for Linux, licenses are locked as they are with HP SIM. License association is done at the server level. Licenses are locked immediately when the license is assigned to a server. After the license is locked, it cannot be removed or moved to another server. IMPORTANT: Exercise caution when assigning an Insight Control for Linux license, particularly when assigning licences to multiple targets. Only servers require this license. Licensing any other device, such as a management processor, wastes a license needlessly; licenses are difficult to remove after they are assigned. 3.2 Adding the Insight Control for Linux license key to HP SIM The HP Insight Control for Linux Installation Guide described how to add the Insight Control for Linux license key to HP SIM. Thus, if you followed those instructions, there is no need to do anything. However, whenever you purchase an additional Insight Control for Linux license from HP. You must apply an Insight Control for Linux license to the systems you want to manage. Use the following procedure to add the Insight Control for Linux license key to HP SIM. These activation instructions can also be found at the following website: 1. Select the following menu item from the HP SIM GUI: Deploy License Manager Select the Insight Control for Linux product. 3. Select Manage Licenses Select the Insight Control for Linux license. 5. Select Apply Licenses Select the servers to which you want to apply a license. 7. Select Apply. 8. Select Next. 9. Select the servers to which you want to apply a license. 10. Select Apply Licenses Now Licensing overview 27

28 3.3 Licensing virtual guests When a virtual host (VM host) is licensed for Insight Control for Linux, all guests of that VM host are considered licensed for Insight Control for Linux as well, provided that the virtual guests are properly associated with their virtual host. You can license a virtual machine guest (VM guest) without licensing its host or you can license it in addition to licensing its host, in either case unnecessarily consuming licenses. Athough a VM guest that inherits its license from its host does not appear as licensed under the License Manager, it is considered as licensed when configured with the Options IC-Linux Configure Management Services task. If you want to select specific VM guests to monitor, you must manually add the VM guests to the {collection_name}_servers subcollection and specify no for the Auto-populate option. NOTE: Insight Control for Linux can only monitor those VM guests if their associated VM host has an Insight Control for Linux license. 28 Managing licenses

29 4 Understanding tasks and task results This chapter addresses the following topics: Task results overview (page 29) Understanding task results (page 29) Task results page (page 29) Common task results (page 31) HP SIM standard task results format (page 34) Scalable task results format (page 38) 4.1 Task results overview HP SIM and Insight Control for Linux enable you to manage systems by scheduling and running tasks. You can run many tasks, such as Linux OS installation, image capture, and image deployment tasks, immediately or you can schedule them to run in the future. Regardless of whether you run a task immediately or schedule it to run at a later date, task results are available as follows: When you run a task by selecting the Run Now button, the Task Results page for that task appears automatically, which enables you to follow the progression of the task from start to finish. When you schedule a task or select a Run Now button to run a task immediately, you can access the task results screen from the Tasks & Logs View Task Results menu item. When you schedule a task, you can use the Tasks & Logs View All Scheduled Tasks... or Tasks & Logs View Task Results menu items to view the results of a specific task. This chapter describes how the task results screen was customized for tasks that run Insight Control for Linux tools.for details about managing and viewing HP SIM tasks, see the HP Systems Insight Manager online help. 4.2 Understanding task results Task percent complete is the number of completed targets divided by the number of total targets. The percent complete of individual targets is not considered in the calculation. The auto-refresh of the different sections of the task results screen might happen at slightly different times. As a result, you might see more up-to-date information in one section than you do in another. This is only temporary and is fixed in a subsequent auto-refresh. 4.3 Task results page Figure 1 illustrates the Task Results page, which opens when you select Run Now to run a task or use Tasks & Logs View Task Results to view task results. When you run an Insight Control for Linux task, you have the option to view the task results in the standard HP SIM view, which is target based, or in an Insight Control for Linux scalable view, which is based on operation, not target. 4.1 Task results overview 29

30 Figure 1 Task results page Table 4 lists the components of the Task Results page. Table 4 Components of the Task Results page Component Task Instance Results Use SIM Standard Task Results Format radio button Use Scalable Task Results Format radio button Description Provides the status of the running task or the task that is selected in the task list log at the top of the page. This option is only offered when you run an Insight Control for Linux task. Selecting this radio button provides a target oriented view that enables you to view the list of targets on which a task is run. This option is the standard task results format that all HP SIM tasks use. HP SIM tasks are always in HP SIM standard format, so you do not have a choice. The target oriented task results format is illustrated in Figure 6 (page 35). This format is unique to Insight Control for Linux tasks and is only available as an option when you run an Insight Control for Linux task. Available in HP SIM standard view, scalable view, or common to both views Common Common Common 30 Understanding tasks and task results

31 Table 4 Components of the Task Results page (continued) Component Summary Status: Operation Details Log Target Details Table Operations Table Show Completed Targets option Show Pending Targets option Target Details - {Task_Name} table Description Selecting this radio button provides an operation oriented format that enables you to view the status of each operation in a task as it completes on each target. This format is particularly useful when you are running an Insight Control for Linux task on many targets, for example, when you are installing a Linux OS on many servers at once. An example of the operation oriented task results is illustrated in Figure 9 (page 39). Status icons that summarize the overall status of the task. Provides the output log information for a single operation. Lists task operation status for a selected single target. Provides a list and current status of all operations within an Insight Control for Linux task. This option affects the targets in the Target Details - {Task_Name} table. Selecting this option reports the status of the targets that the task completed on. This option affects the targets in the Target Details - {Task_Name} table. Selecting this option shows the targets that the task has not yet started on. Provides the status of a selected operation on all targets on which the task was run. Available in HP SIM standard view, scalable view, or common to both views Common Common HP SIM View Scalable View Scalable View Scalable View Scalable View 4.4 Common task results This section describes the common sections of the Task Results page regardless of the format you elect to use Task instance area Figure 2 illustrates the top portion of the Task Results page, which provides basic information about a task, including its name, its identification (ID) number, starting and ending times, the target or targets that the task was run on, the user who ran the task, and the task duration. Figure 2 View of task instance Stopping a task When you select the Stop button in the Task Instance area, the task status is immediately set to Cancelled. The stop process attempts to cancel the task for all targets with non-terminal statuses, regardless of whether or not they have begun running. The stop operation does not affect targets that have already reached a terminal status. 4.4 Common task results 31

32 In Insight Control for Linux, it might not be possible to cancel a task immediately after you select the Stop button because an operation might be at a point on a target where it cannot be interrupted. This can result in a task changing from the Cancelled state to a Complete or Failed state because the cancel operation could not be processed in time. A task End Time is initially set to the time when you select Stop. This time is updated to the time the task finished stopping on all running and pending targets when the final task status is Cancelled. Or, this time is updated to the time that the task finished when the final task status is Complete, Some Failures, or Failed. If a task takes a long time to cancel, the task level information might stop refreshing (although the target and operation information continues to refresh). If this is the case, you might not see the accurate task status or end time. Do one of the following if you believe that task results are not being refreshed: If the task level information has stopped refreshing and you are viewing task results information for only that one task, select Tasks & Logs View Task Results and select your task from the lists of tasks. If you are viewing the View Task Results screen, switch to another task and back to the original task to refresh the task status View control options and summary status area As illustrated in Figure 3, when you run an Insight Control for Linux task, you can elect to view task results in the HP SIM standard format (the default), which reports tasks results based on target, or you can elect to view task results in a scalable view, which reports task results based on the operations contained within a particular task. The Summary status: area provides a graphical summary of the task on one line. Figure 3 View of the summary status area View printable report button Selecting the View Printable Report button opens a new window. If a task was run on a single target, the report is displayed immediately. If the task was run for multiple targets, you have the option to display the report for the selected target on the Task Instance Results screen or to view the report for all targets of the task. The printable report screen does not refresh automatically; it always displays the status information current at the time you selected the View Printable Report button. The following information on the printable report: A Print link in the top right corner All task level results All parameters displayed in the Parameters pop-up window Target level results, including: All information displayed in the target status table 32 Understanding tasks and task results

33 All target details, including all information displayed in the operation status table and the log for each operation TIP: If you select All Systems for the report, the target level results are displayed for all targets, each separated by a line Rerun non-complete targets button The Rerun Non-Complete Targets button is enabled only when the following conditions exist: At least one target for the task has a Failed or Cancelled status. All targets for the task are in a Terminal state. That is, no targets for the task are in the Pending, Running, or Cancelling state. If an Insight Control for Linux tool does not support a task to be rerun, the Rerun Non-Complete Targets button is not available. When you select the Rerun Non-Complete Targets button, the Verify Target Systems screen is displayed, and the targets that had a Failed or Cancelled status from the original task are preselected. You have the option to add more targets or remove preselected targets. When you navigate through the task, the values selected in the original task are automatically reselected. Again, you have the option to modify or retain these values Parameters button The Parameters button opens a new window that provides the following information: A summary of the task level information The values that were run as part of the task, which are known as the Parameters These values apply to the task as a whole and are the same for all targets on which the task was run. Figure 4 provides an example of the task parameters that were used during a RHEL OS installation. Figure 4 Task parameters window Operation details log As illustrated in Figure 5, the Operation Details Log contains the results from executing the selected operation on the selected target. 4.4 Common task results 33

34 Figure 5 View of the operation details log 4.5 HP SIM standard task results format This section describes the portions of the Task Results page that are specific to the HP SIM Standard Task Results Format, which is the default view. Figure 6 illustrates the HP SIM Standard Task Results format. The figure shows the task results for an instance of a Red Hat Kickstart OS installation task running on three target servers. The task results are displayed for the server named calisto, and you can watch the task operations as they are being started and finished on that server. To see how the task is progressing on the other two servers, you select another server. 34 Understanding tasks and task results

35 Figure 6 HP SIM standard task results format Summary status and target status area Figure 7 illustrates the Summary status: area and target status area, which provide the overall status of a task on each target. Figure 7 View of the summary status and target status areas Table 5 describes the information displayed in the Summary status: area. 4.5 HP SIM standard task results format 35

36 Table 5 Description of target status area Column heading Target Name Status Description Name of the target managed system on which the task was run. The status of a target is computed from the status of its operations. Non-terminal target status Terminal target status Cancelled Pending: All operations can have the Pending status. Running: At least one operation has the status Running. A percent complete is also displayed. The percent complete for a target is the number of operations with the status Complete divided by the total number of operations for the task. The percent complete for a target does not consider in the calculation the percent complete of individual operations. Complete: All operations can have the status Complete. Failed: At least one operation has the status Failed. Occurs when you select the Stop button for a target or task. This is considered a non-terminal state if an operation for the target has the status of Cancelling. In this case, the execution of the task for the target is in the process of being cancelled. A target with the non-terminal Cancelled status might end in the terminal status Complete, Failed or Cancelled. A target status that goes to Complete or Failed means that the cancel operation could not be processed before the task completed for that target. Cancelled becomes a terminal state when an operation changes status from Cancelling to Cancelled. Any operations that follow the Cancelled operation have their status changed from Pending to Not Executed. At this point, the end time for the target is displayed. Start time End time Exit Code, Stdout and Stderr This is the time at which the execution of the task for this target began. This time might not be the same as the time when you select Run Now, and it might not be the scheduled time. Start time for the target is different from the task submit time, if another Insight Control for Linux task is already running for this target or the total number of Insight Control for Linux tasks exceeds the configured limits. If the target has a status of Pending, the value of the Start Time column for that row is blank. This is the time at which the execution of the task for this target completed, regardless of whether the outcome was successful. This time is the same as the end time for the last operation for the target. If the target has a status of Pending or Running, the value of the End Time column for that row is blank. If this target has a status of Cancelled, but it has an operation that is in the Cancelling state, the value of this column for that row is blank. These columns are visible in the Target Status Table on the standard HP SIM Task Instance Results screen, but they are not relevant to Insight Control for Linux tasks Stop button in the target status area The Stop button is enabled only when the selected target is in a non-terminal state. Selecting this button opens a confirmation window. If you select OK, an attempt is made to stop the task execution on the selected target; all other targets are unaffected. For more information about stopping tasks, see Section (page 31). 36 Understanding tasks and task results

37 Log button in the target status area When you select the Log button, a new window opens that displays the log for all operations for the task, including the following information: A summary of the task level information The information displayed in the target status table for the selected target A block of information for each operation in the task, including the log The log screen does not auto-refresh. It always shows the status information that was current at the time you selected the Log button. The Log button is disabled when the selected target is in the Pending state, because no log information is available to be displayed. Pending operations do not have a log Target details table Figure 8 illustrates the Target Status table, which lists the status for all targets on which a task was run. Figure 8 Target details table The Target Details table lists the status for all operations for the target selected in the Target Status table. The operations are shown in the table in the order in which they run. This table cannot be resorted. The operations for all targets of a task are the same and are in the same order. All tasks for the same Insight Control for Linux menu items have the same operations. Table 6 describes the information displayed in the Target Details table. Table 6 Description of target details table Column heading Operation Name Status Non-terminal operation status Description The name of the operation Pending: If this is the first operation, execution of the task for the target has not started. For any other operation, Pending means that one or more of the preceding operations has a non-terminal status. Running: This operation is being run. A percent complete is also displayed. Only one operation for a target can be run at a time. Operations for a target run sequentially. Cancelling: An operation enters this state either as a result of selecting the Stop button for the target or for the task. This means an attempt is being made to cancel the operation An operation with a Cancelling status might end in the terminal status Complete, Failed or Cancelled. If an operation status goes to Complete or Failed, it means that the operation could not be cancelled before the operation completed execution. If an operation could not be cancelled, the cancel occurs between operations. If there is a subsequent operation, its state is Cancelled. 4.5 HP SIM standard task results format 37

38 Table 6 Description of target details table (continued) Column heading Description NOTE: When an operation has a status of Cancelling, the target status is Cancelled, but the end time is empty for both the operation and the target. Terminal operation status Complete: The execution of the operation completed as expected. Failed: The operation was not successful. Cancelled: You pressed the Stop button for the target or task and this operation was the last one run or the next one to run. Not Executed: All operations following an operation with the Failed or Cancelled status have a status of Not Executed. This indicates that no part of the operation was executed. Start time End time This is the time at which the execution of this operation began for the target. If an operation has a status of Pending, the value of the Start Time column for that row is blank. This is the time at which the execution of the operation completed for the target, regardless of whether the result was successful. If the operation has a non-terminal status, the value of the End Time column for that row is blank 4.6 Scalable task results format This section describes the portions of the Task Results page that are specific to the Scalable Task Results Format. This option is only available when you run Insight Control for Linux tasks, such as Linux OS installation, image capture, or image deployment, on target servers. Task results are reported based on operations within the task and are not based on the target server the task was run on. To view task results based on operation, you must select the Use Scalable Task Results Format radio button. This view is most useful when you are running a task on many targets at the same time because it consolidates operation status on the target group as a whole rather than by individual target. Figure 9 illustrates the Scalable Task Results format for a single task instance of a Linux image capture. The task results are based on the operations within the task. Task results are reported by operation as the task runs on the target servers. The task results screen shows the percent complete of each operation contained in the task, and shows the results on the target servers as a group. 38 Understanding tasks and task results

39 Figure 9 Scalable task results format Operations table Figure 10 illustrates the Operations table, which lists individual operations within a task and provides the status of the entire operation as it starts and completes on each target. The important thing to know is that operation status represents the status of the operation on every target. Reporting operation status by job means this: if an operation is complete on 15 targets but is not started on 5 targets, the overall status of that operation is Pending because it is not complete on all 20 targets. Similarly, if an operation within a task is successful on 19 out of 20 targets but fails on 1 target, the overall status for the operation is Failed. Figure 10 View of the operations table 4.6 Scalable task results format 39

40 Table 7 lists the information displayed in the Operations table. Table 7 Description of the operations table Column heading Operation Name Status Completed Successfully Systems Being Processed Failed or Cancelled System Description The name of the operation that is run as a component of an Insight Control for Linux task. Complete: The operation has successfully completed on all targets. Running: The operation has started but it is not yet complete on all targets. Pending: The operation has not yet started. Cancelling: you have cancelled the task by selecting the Stop button for the target or for the task. Failed: The operation was not successful on at least one target. Indicates the number of targets that have successfully completed the operation. Indicates the number of targets the operation is still running on. Indicates the number of targets that have not successfully completed the operation. This is not an indication of targets that are still processing Operation controls Figure 11 illustrates the operation control options. To view the progress of a specific operation, select the operation in the Operations table. You can select Show Completed Targets to see the list of targets on which the operation is completed, select Show Pending Targets to see the list of targets on which the task has not yet started, or select both. Figure 11 Operation controls Operation target details Figure 12 illustrates the Operation Target Details table, which provides the overall status of a selected operation on every target on which it was run or is running. The operation control buttons described in Section (page 40) control the targets for which operation status is reported. Figure 12 View of the operation target details Table 8 lists the information displayed in the Operation Target Details table. 40 Understanding tasks and task results

41 Table 8 Description of the operation target details table Column heading Target Name Status Start time End time Description The name of the target on which the operation was run on or is running on. Complete: The operation has successfully completed on the targets. Running: The operation has started but it is not yet complete on all targets. Pending: The operation has not yet started. Cancelling: you have cancelled the task by selecting the Stop button for the target or for the task. Failed: The operation was not successful on the target. This is the time at which the operation began for the target. If an operation has a status of Pending, the value of the Start Time column for that row is blank. This is the time at which the operation successfully completed on the target, regardless of whether the result was successful or not. 4.6 Scalable task results format 41

42 Part II Deployment

43 5 Managing the Insight Control for Linux repository This chapter provides an overview of the Insight Control for Linux repository and how to perform activities related to it. The following topics are addressed: Introduction to the Insight Control for Linux repository (page 43) Registering items in the Insight Control for Linux repository (page 46) Copying software to the Insight Control for Linux repository (page 52) Editing and deleting registered items (page 57) 5.1 Introduction to the Insight Control for Linux repository The Insight Control for Linux repository is the directory on the CMS where vendor-supplied Linux OS installation files, Kickstart and AutoYaST installation configuration files, boot images, SPPs, PSPs, firmware, and user-defined scripts are stored for automated network installation or deployment to managed systems. Although firmware files are stored in the repository, they are not registered there. For information on firmware files, see Chapter 12 (page 130). IMPORTANT: access. The repository is accessible through a web server interface that allows anonymous The repository is located in the /opt/repository directory on the CMS. However, you can store operating system distributions in a remote location, which is described in Section (page 44). The following directories are provided so that you can store software (for example, RPMs) that is not related to Insight Control for Linux or HP SIM: contrib local This directory is provided for software from other vendors and contributors. This directory is provided for your own software. HP recommends at least 10 GB of space for the repository. Although the size of the repository varies by what you are storing, 10 GB is enough space to store the following: Two Linux operating systems Two captured Linux images Two SPPs or two PSPs Several script files Several Kickstart or AutoYaST installation configuration files The total amount of space required in the repository varies based on the number of operating systems you choose to have available at any given time and the size and total number of captured images you maintain. If you plan to store a large number of supported operating systems or capture and store many Linux images, the repository might need considerably more than 10 GB of space. You cannot use a symbolic link to access the /opt/repository directory, but you can mount a separate disk on that location if you require large amount of disk space for your repository. Run repository management tasks from the Options IC-Linux Manage Repository menu item. The act of registering an OS with the Manage Repository tool creates the required directory structure in the repository, which you populate with vendor-supplied installation media. As part of the registration process, Insight Control for Linux creates two directories based on a name you supply, which is where you copy the vendor-supplied installation and kernel files. 5.1 Introduction to the Insight Control for Linux repository 43

44 After an OS is registered with the repository, manually copy the vendor-supplied installation media to the appropriate directories in the repository. The media can be a physical CD or DVD, or it can be an.iso image. You must expand the.iso image into flat files. IMPORTANT: Be aware that repository management tasks do not follow typical authorization models. All HP SIM users can select, add, delete, or modify all Insight Control for Linux repository items regardless of their user authorizations Configuring a remote repository When you register an OS in the Insight Control for Linux repository, you have the option to register the OS in a local or remote repository. The standard practice is to choose the local repository, which stores the installation media and files in the /opt/repository directory on the CMS. However, if you have already invested in a server that houses installation media and related files, it is possible to configure Insight Control for Linux to use the remote server to store operating systems. IMPORTANT: Only OS installation files can be served from a remote repository because during the vendor supplied installation programs, you have the option to specify a web address where the RPMs are being served. Insight Control for Linux is simply making use of the functionality that Red Hat and Novell supply. All other repository items, including OS installation kernel and RAM disk files, Kickstart and AutoYaST files, SPPs and PSPs, must reside in the local repository on the CMS and are served by the web server and TFTP server on the CMS. Requirements A remote repository must meet the following requirements: OS installation files must be organized in the structure described in this document. The remote repository server must be accessible using HTTP from the boot NIC of the managed system being installed. You can fulfill this requirement by locating the managed systems on the same network as the remote repository server, as illustrated in Figure 13. Figure 13 Remote repository on the same network Alternatively, you can configure the CMS to act as a gateway, allowing the managed systems to access remote resources while using only its management interface, as illustrated in Figure 14. Configuring the CMS to act as a gateway is beyond the scope of this document. Instead, see the vendor-supplied Linux OS documentation, specifically any information related to IP forwarding and IP tables-based masquerading. 44 Managing the Insight Control for Linux repository

45 Figure 14 Remote repository using the CMS as a gateway Repository contents Table 9 lists the classes of items that are stored in the repository. Table 9 Repository item types Name ISO PSP SPP Supported OS Custom OS Captured Image Boot Image Installation Configuration File Linux Script PSP Dependency Script SPP Dependency Script Firmware Update File Description ISO image An OS-specific bundle of ProLiant optimized drivers, utilities, and management agents. An OS-specific bundle of ProLiant optimized drivers, utilities, firmware, and management agents. Vendor-supplied installation files for supported versions of RHEL or SLES. Vendor-supplied installation files for an unsupported Linux OS (a custom OS) A compressed archive of captured Linux images from managed systems. The kernel and RAM disk files required for network booting and installation. These repository entries are created automatically in association with a supported or custom OS. However, you must manually add the files into the repository. Kickstart or AutoYaST installation configuration files that automate a supported or custom operating system installation. An optional user-provided script for running commands on managed systems through SSH. Scripts can be run at any time, before image deployment (a Precapture script), or after image deployment (a Postcapture script). Deploy these scripts to managed systems through the Tools Command Line Tools Run Script... menu item. An optional user-provided script that runs during a PSP deployment to a managed system. An optional user-provided script that runs during a SPP deployment to a managed system. A file named firmware-files.tar that contains the firmware files downloaded or copied from the HP ProLiant Smart Update Firmware DVD in order to upgrade a server's firmware. For more information, see Section 12.2 (page 130). 5.1 Introduction to the Insight Control for Linux repository 45

46 The items listed in Table 10 are preregistered and reside in the repository after you install Insight Control for Linux. The default contents include sample RHEL Kickstart and SLES AutoYaST installation configuration files and an example PSP or SPP dependency script. Table 10 Default repository contents Item type SPP and PSP Dependency Scripts Installation Files Installation File Installation File Directory name examples example_dependency.sh rh061 rh061-management-hub rh061 virt-host-kvm rh061 virt-guest-kvm sll04 sll04-management-hub sll04 virt-host-xen sll04 virt-guest-xen esx040 Description Provides sample SPP and PSP dependency scripts that install RPM dependencies on the managed systems; the SPP and PSP installation processes require the RPM dependencies. Provides version-specific RHEL Kickstart installation configuration files, including customized installation files for management hubs, virtual hosts, and virtual guests. In this example, rh061 indicates RHEL Version 6 Update 1. Provides version-specific SLES AutoYaST installation configuration files, including customized installation files for management hubs, virtual hosts, and virtual guests. In this example, sll04 is for SLES Version 10 Service Pack 4. Provides a version-specific automated installation configuration file for VMware ESX Repository item naming conventions Repository item names cannot contain spaces, cannot be blank, and must use only the following characters: Lowercase letters a through z Uppercase letters A through Z Numbers 0 (zero) through 9 Hyphens (-), periods (.), and underscores (_) Choose a unique name for each item you register in the repository, regardless of where it is stored in the repository. 5.2 Registering items in the Insight Control for Linux repository This section provides an overview of the Insight Control for Linux repository and describes how to register software items in the repository. The following topics are addressed: Registration overview (page 46) Registering operating systems (page 47) Registering SPPs and PSPs (page 49) Registering automated installation configuration files (Kickstart and AutoYaST) (page 50) Registering Linux scripts and SPP and PSP dependency scripts (page 51) Registration overview To make operating systems, Kickstart and AutoYaST installation configuration files, boot files, captured Linux images, SPPs, and PSPs available in the repository for installation and deployment to managed systems, you must first register the item in the Insight Control for Linux repository. Firmware files are not registered in the Insight Control for Linux repository. When you register an item in the repository, it becomes available as a selection for the Insight Control for Linux installation and deployment tools. The item type determines the tool that makes the item available for selection. 46 Managing the Insight Control for Linux repository

47 5.2.2 Registering operating systems Registering a supported version of RHEL or SLES, a supported virtualization OS, or a variant of a Linux OS to make the operating systems available for automated or interactive installations is a simple process: you register the OS in the repository, copy the vendor-supplied installation files to the repository, and copy the appropriate boot files to the associated boot target directory. To register an OS in the repository, follow these steps: 1. Select the following menu item from the Insight Control user interface: Options IC-Linux Manage Repository 2. Select New. 3. From the Item Type drop down list, select either Supported OS or Custom OS. NOTE: The VMware ESX and ESXi operating systems use revision numbers that have multiple sub-versions, for example ESX4.0 U2, that are not matched exactly when registering the operating system into the repository. Thus, when registering a VMware ESX and ESXi operating system in the repository, for the Operating System drop-down menu, select the VMware ESX or ESXi operating system that most describes the OS. For example, use ESX4.0 both for VMware ESX4.0 U2. Be sure to enter the full version (using the same example, ESX4.0 U2) for the Name and Description fields in step Select Next. 5. Indicate where to host the OS: Select Local if the repository is located on the CMS. The default location is the /opt/ repository directory. Select Remotely if the repository is located on a remote web-accessible server. 6. Select Next. 7. Supply the information listed in Table 11 for the OS you are registering. The information you provide differs for supported and custom operating systems. Table 11 OS registration information Registration information Name Description OS Version and Type Path via HTTP Description A unique name for this OS consisting of the following: Lowercase letters a through z Uppercase letters A through Z Numbers 0 (zero) through 9 Hyphens (-), periods (..), and underscores (_) HP recommends that you keep this name fairly short, perhaps a maximum of 15 characters. You can register multiple instances of a given OS but the names must be unique. The value you supply in this text box is used to create the directory name in the repository where you copy the OS installation files. Text that describes the OS you are registering. From the drop down list, select the OS type and version you are registering. Supply a path when the OS is served from a Remotely hosted repository. This path is not required if the OS is being served locally. Supply for supported OS, custom OS, or both Both Both Supported Both 5.2 Registering items in the Insight Control for Linux repository 47

48 Table 11 OS registration information (continued) Registration information Version Architecture Kernel name RAM disk name Description Enter the full web address (using the IP address) to the OS installation media, such as For repository entries for SLES 10 and SLES 10 SP1, you must verify if the remote installation media use CD1,CD2, directories; otherwise use a directory named DVD1. If the SLES OS uses the media subdirectories, the value you enter for the Path via HTTP must include the first directory name, such as or If you do not include the media subdirectory, the installation fails. NOTE: This item does not apply to VMware ESXi. Data for VMware ESXi is not transferred through HTTP; instead, it is loaded from the /opt/ repository/boot directory using PXE or virtual media. The OS version. The hardware architecture, such as X86_64. The name of the kernel boot file. If you do not supply a kernel name, vmlinuz is the default file name. In the context of a custom OS, the file name might be different name. You must examine the installation sources to determine what the OS has named them. The name of the RAM disk boot file. If you do not supply a kernel name, initrd.img is the default file name. In the context of a custom OS, the file name might be different. You must examine the installation sources to determine what the OS has named them. Supply for supported OS, custom OS, or both Custom Custom Custom Custom 8. Select Save. 9. View the summary information, which provides the paths where you copy the vendor-supplied OS installation files. For example: Item Name RHEL6U1-x64 has been updated. Path on disk: /opt/repository/os/rhel6u1-x64 Path via HTTP: /os/rhel6u1-x64 Boot target path on disk: /opt/repository/boot/rhel6u1-x64boot Notice: You may now upload the Operating system, kernel, and RAM disk images if you have not done so yet. IMPORTANT: Write down or cut and paste into a file the directory names provided in the Path on disk and Boot target path on disk fields. You must know these paths to copy the related file(s) to the correct location. If you lose this information, go back and edit the item in the repository. Select Save without changing any information and the confirmation screen is displayed again. The summary information provides the directories created in the repository under /opt/ repository where you copy the vendor-supplied installation files. For a locally hosted supported OS, an OS version-specific directory is created under /opt/repository/os and an OS version-specific directory is created under /opt/repository/boot. For a remotely hosted supported OS, a directory is only created under /opt/repository/ boot because this is the only location where you copy OS installation files. 48 Managing the Insight Control for Linux repository

49 10. Select OK to return to the Manage Repository screen. Two new items appear in the table. One item is of the type Supported OS and the other is of the type Boot image. The Boot image item type is added for you automatically. Its name is the same as the supported OS with the word Boot appended. The option to add a Boot image item type is never available because this item type is always associated with a Supported OS item type, and thus, it is created automatically for you. After OS registration, the next task is to copy the vendor-supplied OS installation files into the repository, which is described in Copying software to the Insight Control for Linux repository (page 52) Registering SPPs and PSPs A Service Pack for ProLiant or a ProLiant Support Pack (PSP) provides the agents and drivers for use on HP servers. Certain agents must be installed on managed systems so that HP SIM and Insight Control for Linux can properly monitor and manage them. The SPP and PSP software components listed in Table 19 (page 136) install the required agents on the managed systems and are required for proper management of the managed systems. These components are installed automatically when Insight Control for Linux installs a supported Linux OS using a installation configuration file, but you can install additional components. To make the PSP available for installation to managed systems, you must register and create a PSP repository item and copy the PSP file into the appropriate subdirectory in the repository. Likewise, to make the SPP available for installation to managed systems, you must register and create an SPP repository item and copy the SPP file into the appropriate subdirectory. The SPP or PSP repository item must be properly associated with the appropriate operating systems so that, during an OS installation, Insight Control for Linux can acquire the required components. TIP: Before you register an SPP or a PSP, consider either copying or downloading the SPP or PSP as described in Section (page 56). To register an SPP or a PSP in the repository, follow these steps: 1. Select the following menu item from the Insight Control user interface: Options IC-Linux Manage Repository 2. Select New. 3. From the Item Type pull down list, select SPP or PSP. 4. Select Next. 5. Select the appropriate radio button to designate Is this an SPP or PSP? 6. Supply the following information about the SPP or PSP: Name Description PSP version Operating Systems Provide a unique name and description of the SPP or PSP. Because the value you supply for the Name field is used to create the SPP and PSP directory in the repository (SPPs and PSPs reside in the same directory), the name cannot contain spaces, cannot be blank, and must use only the following characters: Lowercase letters a through z Uppercase letters A through Z Numbers 0 (zero) through Registering items in the Insight Control for Linux repository 49

50 Hyphens (-), periods (.), and underscores (_) Enter a descriptive name but do not use the SPP or PSP tar.gzip file name, which can be quite long. Provide the version number of the SPP or PSP that you copy to the repository. For the supported versions, see the HP Insight Control for Linux Support Matrix. For PSPs, the version number must be in the form of N.NN, for example, 9.0x. For SPPs, the version number must be in the form of NNNN.NN.N, for example, Associate the SPP or PSP to the operating systems it supports. Use the Ctrl-Left Mouse Button key combination to select all the operating systems that the SPP or PSP supports. The SPP or PSP must be properly associated with all operating systems it supports so that Insight Control for Linux installation tools can determine the SPP or PSP file from which to extract the required components during an OS installation. 7. Select Save. 8. View the summary information, especially the SPP or PSP path on disk: which provides the location where you download the SPP or PSP. Item Name SPP has been updated. SPP or PSP path on disk: /opt/repository/psp/spp Notice: You may now upload the SPP or PSP file if you have not done so yet. IMPORTANT: Write down or copy and paste into a file the path displayed in the SPP or PSP path on disk field. 9. Select OK to return to the Manage Repository screen. To download an SPP or a PSP into the repository, see Section Registering automated installation configuration files (Kickstart and AutoYaST) To support a completely unattended Linux OS installation, both Red Hat, Inc., distributors of Red Hat Enterprise Linux (RHEL), and Novell, distributors of SUSE Linux Enterprise Server (SLES), use an installation configuration file that contains all the parameters necessary to complete the installation without user interaction. An installation configuration file also enables unattended VMware ESX virtualization OS installation. Many custom operating systems, particularly those derived from either RHEL or SLES operating systems, support an installation configuration mechanism as well. For more information about using and creating installation configuration files for unattended installations, see Chapter 9 (page 87). To register an installation configuration file in the repository, follow these steps: 1. Select the following menu item from the Insight Control user interface: Options IC-Linux Manage Repository 2. Select New. 3. From the Item Type drop down list, select Installation configuration file (Kickstart/AutoYaST). 4. Select Next. 5. Supply the following information about the file: A unique name for the installation configuration file. Because the value you supply as the name is used to create a directory in the repository, the name cannot contain spaces, cannot be blank, and must use only the following characters: Lowercase letters a through z Uppercase letters A through Z 50 Managing the Insight Control for Linux repository

51 Numbers 0 (zero) through 9 Hyphens (-), periods (.), and underscores (_) Do not append.cfg to the file name. Description of the file. From the drop down list, select the registered operating systems to which the configuration file is applied during an unattended OS installation. Use the Ctrl-Left Mouse Button key combination to select multiple operating systems. Optionally, associate the configuration file with a custom OS. It is your responsibility to apply the commands in the installation task to retrieve it. 6. Select Save. 7. View the summary information, especially the path information, which provides the details of the repository registration including the directory and path created in the repository. Item Name: MyConfig Installation configuration path on disk: /opt/repository/instconfig/myconfig/myconfig.cfg Installation configuration path via Notice: You may now upload the configuration file if you have not done so yet. IMPORTANT: Write down or copy and paste into a file the path displayed in the Installation configuration path on disk or Installation configuration path via http: (for remotely hosted repositories) field because this is the location in the repository to which you copy the installation configuration file. 8. Select OK to return to the Manage Repository screen Registering Linux scripts and SPP and PSP dependency scripts The difference between a Linux script and an SPP or a PSP dependency script is that scripts that are registered in the repository as an SPP or PSP Dependency Script item type are made available for use during the SPP or PSP installation. Scripts that are registered in the repository as a Linux script item type are: Run manually on managed systems with the Tools Command Line Tools Run Script... menu item Deployed before and after the capture of a Linux image from a managed system Deployed before and after the deployment of a captured Linux image to a server. To register a script in the repository, follow these steps: 1. Select the following menu item from the Insight Control user interface: Options IC-Linux Manage Repository 2. Select New. 3. Next to the Item Type field, select either Linux script or SPP or PSP dependency script. 4. Select Next. 5. Supply a name and description for the script. The script name must end with a.sh extension. Because the value you supply for the script name is used to create the script directory in the repository, the name cannot contain spaces, cannot be blank, and must use only the following characters: Lowercase letters a through z Uppercase letters A through Z Numbers 0 (zero) through Registering items in the Insight Control for Linux repository 51

52 Hyphens (-), periods (.), and underscores (_) The name of the file you copy to the repository must be the same as the name of the item registered. For information about the importance of choosing unique names for items you are registering in the repository, see Section (page 46). 6. Select Save. 7. View the summary information, which includes the directory and path where you upload the script. Unlike other items in the repository, the name of the script file you upload to this path is not important, except that it must end in a.sh extension. If multiple files are named *.sh in this directory, only the first script detected is used. 8. Copy the script to the newly-created directory to make it available for deployment. 9. Select OK to return to the Manage Repository screen Registering an ISO image To register an ISO image in the repository, follow these steps: 1. Select the following menu item from the Insight Control user interface: Options IC-Linux Manage Repository Select New. 3. Select the ISO image item type from the drop-down menu. 4. Select Next. 5. Select the radio button to indicate where the ISO image is currently hosted: either Locally on the CMS or Remotely on a remote HTTP server. 6. Select Next. 7. Supply a name and description for the ISO image. The name of the file you copy to the repository must be the same as the name of the item registered. For information about the importance of choosing unique names for items you are registering in the repository, see Section (page 46). 8. If you selected the Remotely radio button, enter the URL of the ISO image in the Path via HTTP field. For example: 9. Select Save. 10. View the summary information, which includes the directory and path where you upload the ISO image. 11. Copy the ISO image to the newly-created directory. The ISO image is registered and copied to the directory /opt/repository/iso/. 12. Select OK to return to the Manage Repository screen. 5.3 Copying software to the Insight Control for Linux repository This section describes how to copy software items to the directories in the repository to make them available for installation. After you register an OS in the repository, you must copy the vendor-supplied installation files and boot files to the OS-specific directories under the /opt/repository/os and /opt/ repository/boot directories. The OS distribution medium can either be a series of CDs, DVDs, or.iso files. Proceed to one or more of the following sections, depending upon the Linux OS you are copying to the repository: Copying RHEL into the local repository on the CMS (page 53) 52 Managing the Insight Control for Linux repository

53 Copying RHEL into a remote repository (page 53) Copying SLES into the repository (page 53) Copying virtual machine OS into the repository (page 56) Copying a custom OS into the repository (page 56) Downloading SPPs and PSPs into the repository (page 56) Copying RHEL into the local repository on the CMS The OS directory and the boot target directory where you copy the installation files were provided to you during the OS repository registration process described in Section (page 47). You were instructed to record the paths to these directories. For example, if you are copying OS installation files for RHEL Version 6 Update 1, the directory name is similar to this: /opt/repository/os/rhel6u1-i386 The boot target directory name is similar to this: /opt/repository/boot/rhel6u1-i386boot To copy vendor-supplied installation files for supported versions of RHEL into the repository, follow these steps: 1. Copy the contents of the first installation disk (CD or DVD) directly into the OS-specific directory in the repository (for example, /opt/repository/os/rhel6u1-i386). 2. If a second installation disk exists, copy the contents of the second installation disk into the same directory. If any file names are the same, it is safe to override them. 3. Repeat the copy operation until you have copied all installation files to the same directory in the repository. 4. Copy the kernel and RAM disk boot files to the related boot target directory (for example, /opt/repository/boot/rhel6u1-i386boot). The kernel and RAM disk boot files are located in the isolinux subdirectory of the installation disk. The kernel file name is vmlinuz and the RAM disk file name is initrd.img. You must use these file names Copying RHEL into a remote repository To copy supported versions of RHEL into a remotely hosted repository, follow these steps: 1. Copy the vendor-supplied OS installation files to the remote server so that they can be accessed by the HTTP path specified when you registered the OS in the repository. The structure under the remote directory must have the same structure as it would have if the files were in the local repository on the CMS. See Section (page 53) for that directory structure. 2. Copy the kernel and RAM disk files to the same location in the local repository as specified in step 4 in Section (page 53). Kernel and RAM disk files must always be available in the local repository on the CMS in the boot target directory, even if the OS is hosted remotely Copying SLES into the repository Copying SLES version 10 or 11 (DVDs) into the repository The OS directory and the boot target directory where you copy the installation files were provided to you during the OS registration process described in Section (page 47). If you are copying installation files for SLES Version 10 Service Pack 4, the repository directory names for the installation and boot files are similar to this: 5.3 Copying software to the Insight Control for Linux repository 53

54 /opt/repository/os/sles10sp4-x64 The boot target directory name is similar to this: /opt/repository/boot/sles10sp4-x64boot There are three DVDs that comprise SLES Version 11. Only the first DVD must be copied to the repository. DVD2 contains source files; DVD3 contains the documentation. Each service pack release for SLES Version 10 has already applied all patches to the installation media. To copy vendor-supplied SLES Version 10 OS installation files into the repository, follow these steps: 1. Count the number of installation media discs (CD or DVD) that were shipped with the SLES Version 10 distribution. 2. For each installation disc, create a sequentially numbered directory under the OS-specific directory in /opt/repository/os/ in the repository. Follow these guidelines to create the subdirectory names: Use capital letters for the directory name The directory name must be one of the following: CDn for CD media or DVDn for DVD media. Even if there is only one installation disk, the subdirectory name must include a number, for example: CD1 or DVD1. The following example creates the subdirectories for DVD media. In the case of CD media, the subdirectories are named CD1, CD2, and so on. Example 1 Repository directory structure for SLES OS installation files on CD or DVD For SLES 10 SP3, SLES 10 SP4, SLES 11 SP1, and SLES 11 SP2: (This example shows the subdirectories for SLES 11 SP1) # cd /opt/repository/os/sles11sp1-x64 mkdir DVD1 3. Copy the contents of the installation DVD into its own DVD1 directory. If you have installation CDs, copy the contents of the first CD into the CD1 directory, the second CD into CD2, and so on. 4. Copy the kernel and RAM disk boot files to the related boot target directory. The kernel file name is linux and the RAM disk file name is initrd. On the SLES media, the kernel and RAM disk files are located in an architecture-specific subdirectory named boot/i386/loader or boot/x86_64/loader on the first SLES installation disc Copying SLES 10 SP4 or SLES 11 SP1 (KISO) into the repository Recently, certain updates to SLES distributions are available for download in a driver kit ISO image, or KISO. The OS directory and the boot target directory where you copy the installation files were provided to you during the OS registration process described in Section (page 47). If you are copying installation files for SLES Version 11 Service Pack 1, for example, and you named the distro as SLES11SP1 x64, the repository directory name for the installation files would be: /opt/repository/os/sles11sp1-x64 The boot target directory name would be: /opt/repository/boot/sles11sp1-x64boot 54 Managing the Insight Control for Linux repository

55 1. Visit the following web address to determine the appropriate link: Choose the appropriate link: For your server For your server's architecture For the version of the SLES operating system Read the install-readme.html file to verify the selection and for installation instructions. 2. Download the KISO image from the SUSE web address: # wget Using the example of the SLES 11 SP1 for the ProLiant G7 servers with the x86_64 architecture: # wget hp-proliant-g7-sle11-sp1-x86_64.iso 3. Mount the KISO image. # mount -o sles-distro-name.iso /mnt Using the same example: # mount -o hp-proliant-g7-sle11-sp1-x86_64.iso /mnt 4. Create the addon directory. This directory must be at the top level of the distribution; that is it must be subordinate to /opt/repository/os/sles-os-name. # mkdir /opt/repository/os/sles-os-name/addon For example: # mkdir /opt/repository/os/sles11sp1-x64/addon 5. Copy the KISO image to the addon directory: # cp -a /mnt/* /opt/repository/os/sles-os-name/addon/ For example: # cp -a /mnt/* /opt/repository/os/sles11sp1-x64/addon/ 6. Change directory to the boot directory of the SLES distribution: # cd /opt/repository/os/sles-os-name/boot/*/loader For example: # cd /opt/repository/os/sles11sp1-x64/addon/boot/*/loader 7. Copy the the RAM disk file, initrd, and the kernel file,linux: # cp initrd linux /opt/repository/boot/sles-os-nameboot/ For example: # cp initrd linux /opt/repository/boot/sles11sp1-x64boot/ 8. HP recommends that you edit the AutoYaST file template for the operating system to remove the parameters that load the kernel-sources and kernel-syms packages. NOTE: When the SLES operating system is installed, this kernel flag is automatically added to the kernel append line: addon= 5.3 Copying software to the Insight Control for Linux repository 55

56 5.3.4 Copying virtual machine OS into the repository The procedure for copying virtual machine OS into the repository depends on the virtual machine software: For VMware ESX, the process is identical to copying a RHEL operating system to the repository. For more information, see Copying software to the Insight Control for Linux repository (page 52). For VMware ESXi, copy the contents of the media to the /opt/repository/boot/vm_nameboot directory, where vm_name is the name of the directory for the VMware ESXi virtual machine OS.For example, for ESXi version 4.0, the directory would be /opt/repository/boot/esxi4.0boot. Data for VMware ESXi is not transferred through HTTP; instead, it is loaded from the /opt/repository/boot/vm_nameboot directory using PXE or virtual media. For Xen, no additional action is required because the RHEL or SLES distribution accounts for it Copying a custom OS into the repository The Insight Control for Linux installation tools enable the installation of almost any OS that supports either the PXE boot protocol or virtual media and provides kernel and RAM disk files that contain the drivers for the target managed system installed. Similar to the process for copying the vendor-supplied installation files for a supported OS, you copy the installation sources to the Path on disk and copy the kernel and RAM disk files to the Boot target path on disk that custom OS registration process supplied to you Automating a custom OS installation HP recognizes that different versions of Linux have different installation configuration files (for example RHEL distributions have Kickstart files while SLES distributions have AutoYaST files) and that different Linux distributions accept different kernel parameters in the boot loader configuration file. You can now control this content by using special scripts; Insight Control for Linux calls these scripts at various points when your custom OS installation runs. You can find example scripts for CentOS and Debian installations under the /opt/repository/instconfig/custom/ examples directory. NOTE: If you want to perform an automated custom OS installation (for a custom OS that was registered with the repository in a version of Insight Control for Linux before V6.0), you must create the /opt/repository/instconfig/custom/os_name directory manually. Insight Control for Linux automatically creates this directory when a custom OS is registered with the repository. However, in versions of Insight Control for Linux before V6.0, automated custom OS installations were not supported; that directory would not exist. For full information on custom OS installations using Insight Control for Linux, see the white paper titled Installing a Custom Operating System with HP Insight Control for Linux Downloading SPPs and PSPs into the repository This section provides the procedures for downloading SPPs and PSPs, and copying them into the Insight Control for Linux repository. IMPORTANT: Each /opt/repository/psp/* directory must contain only unzipped SPP files or PSP zip files. If other files reside in the directory, the SPP or PSP agents might not be installed on target servers during an Insight Control for Linux OS deployment operations. 56 Managing the Insight Control for Linux repository

57 Downloading and copying a PSP 1. Open a browser to the HP Support Center website: 2. Select the Support & Drivers tab near the top of the page. 3. Select Drivers & Software. 4. Enter your server model (for example, DL360 G7) in the Enter a product name/number text box, then click Search. NOTE: If more than one server model matches the value you entered in the For product text box, select the appropriate server model from the search results. 5. Select the appropriate Linux OS and version from the list of available operating systems. 6. Scroll down the page until you see HP ProLiant Support Pack under the category Software - Support Pack. 7. Select the DOWNLOAD button. 8. Enter your HP Passport User ID and Password. 9. Save the *.tar.gz file. 10. When prompted, select Save to save the *.tar.gz file to the SPP or PSP path on disk directory that was created when you registered the PSP in the repository (for example: /opt/ repository/psp/rhel6.1 x64). Do not extract the PSP from this *.tar.gz file, because the installation process does it for you Downloading and copying an SPP 1. Open a browser to the HP Support Center website: 2. Select the Support & Drivers tab near the top of the page. 3. Select Drivers & Software. 4. Enter your server model (for example, DL360 G7) in the Enter a product name/number text box, then click Search. NOTE: If more than one server model matches the value you entered in the For product text box, select the appropriate server model from the search results. 5. Select the appropriate Linux OS and version from the list of available operating systems. 6. Scroll down the page until you see HP Service Pack for ProLiant under the category Application - System Management. 7. Select the Obtain software link. 8. Enter your HP Passport User ID and Password. 9. Save the *.zip file. 10. Extract the SPP from the *.zip file. The SPP is a complete and bootable ISO image. 11. Move the ISO image file to the SPP or PSP path on disk directory that was created when you registered the SPP in the repository (for example: /opt/repository/psp/spp ). 5.4 Editing and deleting registered items This section addresses the following topics: Editing registered items in the repository (page 58) Deleting registered items from the repository (page 58) 5.4 Editing and deleting registered items 57

58 5.4.1 Editing registered items in the repository You can edit selected information for repository items after the registration process is complete. Editing the name of a repository item does not change the associated file or directory names, and changes only the name that the user interface displays. You can change the path to a remotely hosted repository item. To edit an item in the repository, follow these steps: 1. Select the following menu item from the Insight Control user interface: Options IC-Linux Manage Repository 2. Select the item you want to edit and select Edit. 3. Change the item information. 4. Select Save. 5. Select OK at the bottom right of the screen to apply the change. 6. Select OK again to refresh the screen and see your change Deleting registered items from the repository NOTE: Deleting an item from the repository does not delete the corresponding directory in the /opt/repository directory nor does it delete the files that you might have copied to that directory. If you want to delete or move the directory and files, delete or move them manually after you first perform the following procedure. To remove an item from the repository, follow these steps: 1. Select the following menu item from the Insight Control user interface: Options IC-Linux Manage Repository 2. Select the item or items you want to delete and select Delete. TIP: If you plan to retain a supported or custom OS, never delete its related boot image. Doing so causes the definition of the OS to become invalid. The only way to remedy this is to also delete the corresponding OS from the repository and reregister it. 3. Select OK to confirm the deletion or select Cancel to stop the deletion when the following is displayed: Are you sure you want to delete the following items from the repository? 4. Select OK at the bottom right of the screen to complete the deletion process. The following message appears: The selected items have been deleted 5. Select OK again to refresh the screen and remove the item from the table. 58 Managing the Insight Control for Linux repository

59 6 Configuring network parameters for virtual media Topics include: Introduction (page 59) Preparing for virtual media (page 60) Using the Define Networks tool (page 63) Using the Network Configuration Editor (page 66) Next Step (page 70) 6.1 Introduction Virtual media is a mechanism available only for systems with an ilo-based management processor. Virtual media allows a system to boot an ISO image over the network; it is the alternate boot mechanism to PXE. When you perform an Insight Control for Linux operation (such as, a bare-metal discovery, a capture of a Linux OS image, a deployment of an image, or install an operating system) on a server that was configured to use virtual media, a bootable ISO image file is created in the /opt/ repository/iso directory on the CMS. The bootable ISO image file contains the previously configured network parameters and is used to configure the boot NIC on the target server. When the server is booted, the ilo is instructed to mount the bootable ISO from the CMS using HTTPS port by default. After the ilo mounts the bootable ISO file, the server s bootable NIC is configured and all subsequent network activity, (for example, an OS installation) is performed through the boot NIC. If the server s NIC was configured to PXE boot, it is possible that, even though the server failed to boot using virtual media, it may still boot using PXE, depending on your DHCP server configuration. IMPORTANT: When using Virtual media, the server's ilo connects to port (HTTPS) on the CMS to obtain the ISO image. That port must be opened on the CMS or the server does not boot as expected and the task does not complete successfully. If the HTTPS port on the CMS is closed, the server does not boot as expected. You can specify an alternate port by editing the /opt/mx/icle/icle.properties file to set the following parameter: REPOSITORY_HTTPS_PORT=port-number Where port-number is the number of the alternate port. If port (HTTPS) on the CMS (or an alternate port that you specified) is closed and if DHCP is configured in your environment, the server can fail to boot using virtual media and boot using PXE boot instead. Virtual media requires initial preparation, which is described in Preparing for virtual media (page 60) Using virtual media requires that you predefine network configuration parameters so that they are incorporated into the ISO image. Insight Control for Linux provides two tools, Define Networks and the Network Configuration Editor, to enable you to specify the network configuration parameters for servers that are not PXE-booted. IMPORTANT: Use these tools to define the network configuration parameters before running any other tool that uses virtual media, especially Initiate Bare Metal Discovery. 6.1 Introduction 59

60 Usually, network configuration is performed in two stages: In the first stage, you define the network configuration parameters and store them under a network name. You can have as many network name definitions as you want. In the second stage, you use the Network Configuration Editor to apply the predefined network names to the server's management processor. These tools are discussed in Using the Define Networks tool (page 63) and Using the Network Configuration Editor (page 66), respectively. 6.2 Preparing for virtual media Preparing for virtual media consists of three activities: Discovering the management processor with HP SIM (page 60) Creating a user account and enabling virtual media on the management processor (page 61) Licensing virtual media on the management processor (page 63) NOTE: If a server's NIC is on a private (physical) network, but the server's ilo is on a public (physical) network, you must edit the /opt/mx/icle/icle.properties file so that the ilo can mount the bootable ISO image file from the CMS. Add the following line to the icle.properties file: VIRTUAL_MEDIA_REPOSITORY_IP=CMS_ext_IP Where CMS_ext_IP is the external IP address of the CMS Discovering the management processor with HP SIM 1. Using HP SIM, begin the process of discovering the management processor by selecting Options Discovery Select New... The window expands to accommodate additional parameter fields: 60 Configuring network parameters for virtual media

61 3. Select either the Discover a group of systems or Discover a single system button. There is a slight difference in the window for these two choices. The Discover a group of systems choice is in the illustration. 4. Enter a descriptive name in the Name text field. The descriptive name must be either listed in the CMS's hosts file or known to the CMS's name server. Otherwise, enter an IP address. 5. Ensure that the Schedule check box is not checked. 6. If you chose Discover a group of systems, enter the names or IP addresses of the management processors you want to discover in the Ping inclusion ranges, system (hosts) names, and/or hosts files field. If you chose Discover a single system, enter the name or IP address of the management processor you want to discover in the Enter the system's name or IP address: field. 7. Select Save to save your discovery task. 8. Select Run Now to begin the discovery of the management processors. On successful completion, the management processors appear under All Systems and All Management Processors on the left-hand side of the window. Now you can use the Network Configuration Editor to define the network parameters for the server associated with the management processor Creating a user account and enabling virtual media on the management processor You must create a user account on the management processor, if one doesn t already exist. The user name and password must match the management processor user name and password you 6.2 Preparing for virtual media 61

62 specified when you installed Insight Control for Linux. The ilo is capable of supporting multiple user accounts; if your ilo was already configured with other user accounts you can just add another user account. IMPORTANT: Do not use multi-byte characters or the following characters in the user name and password for ilo user accounts: & (ampersand) < (left angle bracket) > (right angle (at sign) ` (back quote) $ (dollar sign) " (double quote) % (percent sign) NOTE: If you forgot the user name and password you entered for the management processor when you installed Insight Control for Linux or if you want to change them, select Configure Management Processor Credentials and specify the new Default Management Processor Credentials. Be aware that a user account must exist on the ilo; the account is required to enable setting up new credentials. For more information on management processor credentials, see Management Processor Credentials (page 198). 1. Log into the management processor, then select User Administration on the left side of the window. 2. Set the user name for the account. 3. Enter and confirm the password. 4. Set the Virtual Media radio button to Allowed. 5. Select Save User Information. NOTE: Do not disconnect your browser from this management processor address. You might need it to license virtual media, which is described in the next section. 62 Configuring network parameters for virtual media

63 6.2.3 Licensing virtual media on the management processor Your ilo Advanced license key activates ilo Advanced features. For the latest instructions, which may supersede those shown below, see the following website: These instructions assume the network client has a network connection to the ilo-based management processor. To install the ilo Advanced license and enable the ilo Advanced functionality using a supported web browser: 1. Log in to ilo-based management processor with a user ID that has the Configure ilo Settings privilege. 2. Select Administration, then click Licensing. 3. Enter the 5 x 5-character license key in the space provided. 4. Select Install. The End User License Agreement (EULA) confirmation displays. The EULA details are available with the license kit. 5. Select OK to accept the terms of the EULA enclosed with this product. The licensed features are now enabled. HP recommends you retain the license key for future reference. The license key is required for technical support and future upgrades. For activation of ilo Advanced Pack functionality on groups of ilo-based management processors, use the HP Lights-Out Configuration Utility. Details on this scripting utility and activation using the command line interface are located in the HP Integrated Lights-Out Management Processor Scripting and Command Line Resource Guide on the HP website: Select Manuals, and search for ilo, ilo 2, ilo 3, or ilo4. This license entitles you to the ilo Advanced features in the current version of ilo firmware at the time of activation. To download the latest firmware and also learn more about ilo features and capabilities, visit You may now disconnect from the management processor. 6.3 Using the Define Networks tool The Define Networks tool enables you to preset network configuration settings called a network ; the defined network corresponds to a subnet where servers will reside. You assign these network settings to the servers in the Network Configuration Editor. The advantages of the Define Network tool include the following: You assign the parameters only once. Network parameters can be assigned to multiple servers. If you want, you can allow for automatic IP address assignment to servers. Assigning a network to a server, instead of entering all the network configuration parameters, saves time and effort. If a network parameter changes, you only need to update the named network. The parameters that you enter are validated for correctness. The virtual media deployment functions enable the use of the information from the Define Networks and Network Configuration Editor tools. Thus, the servers assigned with these tools must be set for Virtual media. To define the network configuration parameters, start the Define Networks tool by selecting the Options IC-Linux Define Networks... menu item. You can also start this tool from the Network Configuration Editor. 6.3 Using the Define Networks tool 63

64 Figure 15 Define networks tool The parameters in the Define Networks tool include the following: Available Networks This is a list of the network definitions. When you create a new network definition, its name is displayed in this list after pressing Save. When a network name in the Available Networks list is selected and you select the Load button, its network parameters are displayed in the appropriate fields; you can select only one network at a time. Network Name The Network Name field is located beneath the Available Networks list. Enter an arbitrary name for your network definition in this text field. The network name does not need to match the DNS name for this subnet. Base Address Enter the base address of the subnet 1 with zeroes for the host number, for example, This parameter is required, and is used to validate IP addresses. Network Mask Enter the netmask for the subnet, for example, This parameter is required. Gateway Enter the IP address of the server that is the default gateway for this network. DNS Domain(s) Optionally enter the DNS domain suffix and search list for this subnet. The first entry in this field represents the DNS suffix used to create a fully qualified domain name. Additional entries are added to the DNS search list. IP Address Range If you want to have IP addresses assigned automatically, you can enter a range of IP addresses in this optional field. Specify the range with a hyphen, for example: See your network network administrator for this information. 64 Configuring network parameters for virtual media

65 You can enter a comma-separated list of ranges, for example: , If you want to assign IP addresses manually, leave this field blank. SNMP Server(s) Optionally enter a list of SNMP servers. These entries are reserved for future use. Name Server(s) Optionally enter a comma-separated list of DNS Name server IP addresses for this subnet. NTP Server(s) Optionally enter a comma-separated list of NTP servers. Next IP Address in range This read-only field displays the next IP address that is automatically defined when IP addresses are assigned automatically. Time Zone Optionally select a time zone for this subnet from this drop-down list. If you invoked this window from the Network Configuration Editor, then closing this window automatically updates the fields of the Network configuration editor. The following procedures describe how to create, load, update, and delete a network definition. You can perform these actions over and over, without closing the window Creating a network definition 1. Enter a unique name for the network definition in the Network Name text field. 2. Enter the Base Address; this is a required entry. 3. Enter the value of the network mask in the text field reserved for that parameter; this is a required entry. 4. Optionally enter any other network parameters you need. 5. Select the Save button. A dialog box reports success or failure. If successful, the Available Networks list is updated Loading a network definition 1. Choose the network definition from the Available Networks list. 2. Select the Load button. The Define Networks tool displays the name of the network definition in the Network Name text field and its defined network parameters in the appropriate fields Changing the parameters of a network definition 1. Choose the network definition from the Available Networks list. 2. Select the Load button. 3. Change the parameters as needed. 4. Select the Save button. The network definition is overwritten with the new parameters Deleting a network definition 1. Choose the network definition from the Available Networks list. 6.3 Using the Define Networks tool 65

66 2. Select the Delete button. Unless there are any systems that had this network applied to them, the network definition is erased and its name is removed from the Available Networks list. 6.4 Using the Network Configuration Editor Use the Network Configuration Editor to assign networking parameters (that you defined with the Define Networks task) to the servers that will be booted using the virtual media mechanism; this ensures that the server's network is set up properly. These network parameters are similar to those that DHCP would normally set; virtual media does not use DHCP. IMPORTANT: Before attempting an Insight Control for Linux bare-metal discovery, capture, deployment, or OS installation, define the network parameters for any server that uses the virtual media mechanism instead of PXE. Use the following procedure to apply network configuration parameters to target systems. 1. Run the Network Configuration Editor by selecting the Options IC-Linux Network Configuration Editor menu item. 2. Select the target MPs, that is, the corresponding ilo-based MPs that correspond to the servers. Ensure that HP SIM already discovered the MPs. NOTE: If you selected a single target MP that is not an ilo-based MP, the tool does not let you proceed and displays No in the Tool launch OK? field of the Verify Target Systems window. If you selected several target MPs, the Network Configuration Editor accepts only the ilo-based MPs. If you selected a collection (for example, All Management Processors), the Network Configuration Editor cannot exclude any MPs that are not ilo-based. As a consequence: There is a delay while the Network Configuration Editor attempts to collect data from these non-ilo MPs These MPs cannot perform any virtual media functions. 3. Verify the target or targets, then select Run Now. The Network Configuration Editor page appears. 66 Configuring network parameters for virtual media

67 Figure 16 Network Configuration Editor page 4. For each MP, optionally verify it by moving the mouse pointer over the Management Processor Name field, but do not select it. The MP's serial number and IP address are displayed to help you identify it. 5. Each target MP is listed in a table. You have the option of: Selecting individual target MPs. Click the checkbox in the left column of the individual target MP. Selecting all the target MPs listed. Click the checkbox in the table header, in the left column, as shown here: 6. For individual targets: Enter a unique name (in the Server Host Name field) for the server associated with the selected MP enter a unique name for the server associated with the MP. NOTE: Even though a server might have more than one NIC, you can only specify one name for the server. For multiple targets: Use the following procedure to assign a sequence of server host names to multiple targets (for example, twenty servers to be named sage00 to sage19): a. Click the Auto Name Hosts button. A dialog box opens. 6.4 Using the Network Configuration Editor 67

68 b. Enter the base name for the server names. For the example, the base name would be sage. c. Enter Iterator Start Value. For the example, that value would be 01 to ensure a leading zero. The number of digits that you enter for the value for the iterator determines whether the host names generated have leading zeroes. For example, if you entered comp for the base name and 001 for the iterator, the first available host name would be comp001, the next would be comp002, and so on. d. Click the Apply button to apply the host names to all the servers associated with selected targets. 7. The Port/MAC Address column offers a list (a drop-down menu) of the MAC addresses of the embedded NICs in the server associated with the target. IMPORTANT: booting. The MAC address you select determines which network interface is used for Either: Choose a MAC address from the drop-down menu or Choose Add New MAC from the drop-down menu then enter the MAC address in the text field. NOTES: The Network Configuration Editor automatically displays the MAC addresses of the embedded NICs for servers with ilo 2 and ilo 3, and ilo 4 MPs with a prefix of E-1/, E-2/, and so on before each MAC address. Do not specify the E-# prefix when you enter a new MAC address in the Network Configuration Editor. The Network Configuration Editor also shows the MAC addresses for the Mezzanine cards on the server blades with a prefix of M-1/, M-2/, and so on, provided that the server blade has been powered on at least once before so that the Onboard Administrator discovers the MAC addresses. The MAC addresses shown are for embedded NICs only. NICs on expansion cards are not listed. The information in the remaining columns correspond to the network interface you select. 8. Select the defined network. If a predefined network configuration does not exist, you can create one using the Define Networks button For multiple assignments: a. Select the name of a predefined network from the Default Network drop-down menu. These network definitions were saved with the Define Networks tool. b. Click the Apply Network button. The Network Configuration Editor populates the Network and Server IP Address fields with the network name for each selected target. For individual assignments: In the Network field, select a predefined network configuration for the server associated with the target. 68 Configuring network parameters for virtual media

69 Selecting a network from this list assigns that network to the NIC represented by the MAC address selected in the Port/MAC Address column. This automatically assigns the next IP address available in the IP address range of the network and assigns the other network values (that is, the gateway, the name server, the domain, and the net mask) for that network to the NIC. If the IP address range was not specified, this field is blank and you must specify the IP address within the selected network here. 9. Perform the appropriate action: If the predefined network configuration (from the Define Networks task) did not specify a range of IP addresses, the Server IP Address field is blank. Enter an IP address. If the predefined network configuration did specify a range of IP addresses, but all the IP addresses were used, the Server IP Address field is blank. Perform one of the following: Restart the Define Networks task to increase the range of IP addresses, then continue from the previous step to reapply the network. Enter an IP address in the Server IP Address field. If the predefined network configuration did specify a range of IP addresses and an IP address is available, the Network Configuration Editor displays the network name in the Server IP Address field. The Network Configuration Editor populates the IP address from the range when the network parameters are saved. 10. Select Save to save the network parameters on a disk file. Additional functions available on the Network Configuration Editor page are described in Additional functions of Network Configuration Editor page (page 69) Additional functions of Network Configuration Editor page The Network Configuration Editor page features additional functions. Under the table of management processors and their associated data, there are a row of buttons, which are defined as follows: Default Network Define Networks Apply Network Auto Name Hosts This drop-down menu allows you to select a predefined network definition that is applied to the selected targets when the Apply Network button is selected. The Define Networks opens the Defining Networks window so that you can add, delete or modify network definitions. Selecting this button has the same effect as selecting the default network for each of the selected targets individually. Selecting this button opens a dialog box in which you can specify a base name and a start value called an iterator. These values are combined to form the host name for servers. For example, if you entered comp for the base name and 1 for the iterator, the first available host name assigned would be comp1, the next would be comp2, and so on. The number of digits that you enter for the value for the iterator determines whether the host names generated have leading zeroes. For example, if you entered comp for the base name and 001 for the iterator, the first available host name would be comp001, the next would be comp002, and so on. TIP: Ensure that the base name and iterator that you specify respects the names of servers. Otherwise, the new auto name might replace a current server name, even if the existing names fit the pattern. 6.4 Using the Network Configuration Editor 69

70 Save Reload Reinitialize In this dialog box, select Apply to set these values and close the dialog box. Selecting Cancel closes the dialog box without taking action. Selecting this button saves the settings for the selected targets to disk. Selecting this button loads the settings for the selected target with the values stored in the disk file. Any changes that you did not save are lost. Selecting this button clears the data, including saved data, for the selected targets; the management processors is queried again for data. This feature is useful for hardware changes, for example, replacing a physical server with another Freeing an IP address stored in Network Configuration Editor The Network Configuration Editor distributes IP Addresses from a range that you specify when you define a network. It stores the network range and the assigned IP addresses in the /opt/mx/ icle/config/network_map.xml file. If a managed system is deleted from HP SIM, that managed system and its IP address assignment is not removed from the network_map.xml file, and the IP address is not released. You have the following two methods for releasing the IP address: Use this procedure before the node is deleted: 1. Run the Network Configuration Editor with the management processor as its target. 2. Assign the managed system a blank IP address. 3. Select Save. This releases the address and the managed system can be deleted. Edit the network_map.xml file to remove the entry for the managed system. 6.5 Next Step After you have defined and applied the network parameters to the servers that are booted through virtual media, proceed to Chapter 7 (page 71) to discover the server or servers. 70 Configuring network parameters for virtual media

71 7 Discovering systems, switches, and enclosures This chapter addresses the following tasks, which you must complete in the following order when you are configuring and setting up Insight Control for Linux: 1. Discovering systems (page 71) 2. Assigning Insight Control for Linux licenses to discovered systems (page 74) 3. Preparing and discovering switches and enclosures (page 75) 4. Changing the boot method (page 76) 7.1 Discovering systems A server must first be discovered before HP SIM or Insight Control for Linux can manage and monitor it. Discovery is the process of finding servers in the management domain so that they can be managed from the CMS. NOTE: To discover or identify a server that becomes a managed system, HP SIM requires that the SNMP read community string must be set to public in the global credentials for that server. The value public is the default value. Use the Options Security Credentials Global Credentials menu item to verify or set this parameter. There may be additional read community string settings in addition to public, but public must be specified. If you need to add another read community string, select Add to add another one, but do not remove public. The system discovery process depends on whether the server is installed with a supported Linux OS (a running system) or not. Use the appropriate procedure to discover systems: Discovering bare-metal servers using PXE (page 71) Discovering bare-metal servers using virtual media (page 72) Discovering running systems (page 73) Discovering bare-metal servers using PXE This section describes the discovery process for bare-metal servers. NOTES: You can update a server's firmware automatically as part of the bare-metal discovery process. For information on enabling this feature, see Section (page 132). You can initiate a one-time PXE boot, or set the server to always PXE boot before booting from the local hard disk. Either method is acceptable. For the servers to PXE boot the Insight Control for Linux RAM disk, you must have configured DHCP as described in the HP Insight Control for Linux Installation Guide. For a description of the Insight Control for Linux RAM disk environment, see Section 1.8 (page 18). Powering on the server and initiating a PXE boot causes the server to boot the Insight Control for Linux RAM disk, which automatically contacts the CMS, discovers the server and management processor, and sets the user name and password on the management processor. 7.1 Discovering systems 71

72 The following items are individual methods to discover a bare-metal server to be booted using PXE. Choose the one that applies. Use the Initiate Bare Metal Discovery tool described in Section (page 72). Be sure to select the PXE radio button in step 4. If you need information on discovering an ilo, see Discovering the management processor with HP SIM (page 60). Power on the server, watch the console, and press the F12 key when prompted to initiate a one-time PXE boot. Power on the server, watch the console, and press the F9 key to enter the BIOS Setup Utility and change the default boot order to place the PXE boot before the hard disk. For HP BladeServers c-class, use the HP Onboard Administrator (OA) on the server to one-time boot using PXE, or permanently change the boot order to place the PXE boot before the hard disk. Then, power on the server blade. For supported HP ProLiant DL100 Series Servers, you can use HP SIM to discover the DL100 Series server's management processor or you could set the node to PXE reboot and power it on. Insight Control for Linux can discover the server's management processor in the same manner that it discovers ilo-based MPs. You can also run the following commands to perform a bare-metal discovery on the server: # ipmitool -H host-name-cp -I lanplus -U username -P passwd chassis power off # ipmitool -H host-name-cp -I lanplus -U username -P passwd chassis power status # ipmitool -H host-name-cp -I lanplus -U username -P passwd chassis bootdev pxe # ipmitool -H host-name-cp -I lanplus -U username -P passwd chassis power on Where host-name-cp lanplus username passwd Designates the console port of the host. Specifies the lanplus interface. For more information, see ipmitool(1). Indicates the name of the user account. Indicates the password for the user account. The server is automatically powered off when the discovery process completes. At this point, the server appears in the HP SIM All Servers collection and the associated management processor appears in the HP SIM All Management Processors collection. When HP SIM correctly identifies the server, a new task named Bare Metal Discovery Post Processing appears in the Task Results list, which you can view with the Tasks & Logs View Task Results menu item Discovering bare-metal servers using virtual media The Initiate Bare-Metal Discovery tool allows you to perform a discovery of a bare-metal server. Figure 17 Initiate Bare-Metal Discovery tool 72 Discovering systems, switches, and enclosures

73 IMPORTANT: Ensure that HP SIM has discovered the MP. Use the HP SIM Options Discovery... menu item Credentials for the MP will be from default MP credentials unless otherwise specified. Passwords for management processors either must be known to Insight Control for Linux or already set to global values. You can also use the Initiate Bare-Metal Discovery tool to discover bare-metal systems through PXE or virtual media. If you are using virtual media, you can only use this tool for bare-metal discovery of an ilo-based management processor. Furthermore, before using this tool, you must first discover the server's ilo and define the network configuration definitions using the Network Configuration Editor. For more information on defining the network configuration and discovering the ilo, see Chapter 6 (page 59). For information on the Network Configuration Editor, see Using the Network Configuration Editor (page 66). Follow these steps to perform a bare-metal discovery: 1. Run the Initiate Bare-Metal Discovery tool by selecting Options IC-Linux Initiate Bare Metal Discovery. 2. Select the management processor for the server you want to discover as the target and select Next>. You can select multiple management processors to discover multiple servers. 3. Verify the target and select Next>. 4. Select the Virtual Media radio button. 5. Select Run Now. 6. When HP SIM correctly identifies the server, a new task named Bare Metal Discovery Post Processing appears in the Task Results list, which you can view with the Tasks & Logs View Task Results menu item. Allow the task to run to completion. 7. The server appears in the HP SIM All Servers collection and the associated management processor appears in the HP SIM All Management Processors collection. NOTE: You can also use this tool to initiate a bare-metal discovery of a server that are PXE-booted. Select the PXE radio button in step 4. The target system must be the management processor for the server Discovering running systems NOTES: This section applies only to systems with ilo-based management processors. For servers with LO100 management processors, after you discover the server with HP SIM, run the Configure SNMP on DL1xx Servers task described in Section 23.9 (page 195). Steps 1 and 2 of the following procedure do not apply to systems running VMware ESXi. To discover servers that are already installed with and running a supported Linux OS that you do not want to shut down or reinstall, follow these steps: 1. Install the SPP or PSP version on the system to be discovered. To determine the appropriate version, see the HP Insight Control for Linux Support Matrix. You can install all or some 7.1 Discovering systems 73

74 components of the SPP or PSP, but at a minimum, you must install the components, listed in Table 19 (page 136), which HP SIM requires. To download an SPP or a PSP or obtain the associated HP ProLiant Support Pack User Guide, follow the instructions in Section (page 251). 2. On the system to be discovered, use the following command to configure SNMP: # /sbin/hpsnmpconfig 3. Repeat steps 1 and 2 for every installed system to be discovered. When you are finished, proceed to step 4 in this procedure. 4. Select the following menu item to discover the server and its management processor. You can discover the server and management processor by name or by IP address range. Options Discovery If the management processor credentials do not match the default credentials you specified during the Insight Control for Linux installation process, use the following menu item to register the management processor credentials with HP SIM: Configure Management Processor Credentials For more information on management processor credentials, see Management Processor Credentials (page 198). NOTE: An ESXi system fails discovery if the ilo credentials do not match the root credentials. 7.2 Assigning Insight Control for Linux licenses to discovered systems You can apply a license to a server now or when running any of the deployment tasks, which are discussed in Chapter 9 (page 87) and in Chapter 10 (page 104). You must apply an Insight Control for Linux license to the discovered systems you want to monitor with Insight Control for Linux: NOTES: When you apply the Insight Control for Linux license, the license is locked immediately when it is assigned to the server. Before Version 6.0, the license was assigned, but locked later during an Insight Control for Linux operation (for example, installation or setting up monitoring). Exercise caution when assigning an Insight Control for Linux license, particularly when assigning licenses to multiple targets. Only servers require this license. Licensing any other device, such as a management processor, wastes a license needlessly; licenses are difficult to remove after they are assigned. 1. Select the following menu item from the Insight Control user interface: Deploy License Manager Select Insight Control for Linux. 3. Select Manage Licenses Select Add Licenses Enter the Insight Control for Linux license key. 6. Select Process. 7. Select Add Licenses Now Select the products you want to add. 9. Select Add Licenses Now Select OK. 74 Discovering systems, switches, and enclosures

75 7.3 Preparing and discovering switches and enclosures To discover switches and HP BladeSystem enclosures for Insight Control for Linux monitoring, follow these steps. Skip this task if the configuration does not contain enclosures or switches or you do not want to monitor them with Insight Control for Linux. 1. If one or more HP BladeSystem enclosures are present, go to each enclosure and set the Onboard Administrator (OA) user name and password credentials. Insight Control for Linux uses these credentials to log in to the OA to collect environmental data for the enclosure. NOTE: If you want to use a management processor password that has fewer than 8 characters, you must change the minimum password length by connecting to the MP using a browser. Otherwise, an Insight Control for Linux bare-metal discovery hangs. HP recommends setting the OA credentials to match the default management processor credentials you specified during the Insight Control for Linux installation process. Using the same user name and password eliminates the need for you to also manually set the credentials in the HP SIM database. For more information on management processor credentials, see Management Processor Credentials (page 198). However, if you decide that you do not want to use the same credentials on the OA as the management processor credentials, you must also run the following command to add the OA credentials to HP SIM: # mxnodesecurity -a -p icelx_mp_svc_acc -c OA_username:OA_password -n OA_name In the previous command line: Replace OA_username:OA_password with your OA user name and password separated by a colon (:). Replace OA_name with the name of the OA, which you can determine by selecting on +All Enclosures in the left pane of the HP Insight Control user interface; and finding the OA name. 2. Use the following menu item from the HP Insight Control user interface; to discover the enclosures and switches: Options Discovery... a. Select New... b. In the Ping inclusions range text box, enter the IP addresses or host names of the OAs and switches to be discovered, one entry per line. c. Enter a name for this new discovery task. Do not use any special characters, such as the apostrophe, in the name. d. Select Save. e. Deselect the box next to Schedule. f. Select Run Now to start the discovery process. 3. To configure Insight Control for Linux to monitor switches, follow these steps to add the switch or switches to the {collection_name}_switches subcollection manually. NOTE: You do not have to manually add enclosures to the collection because Insight Control for Linux automatically populates the {collection_name}_enclosures subcollection when you start the Insight Control for Linux monitoring services (which you are instructed to do in Section 19.3 (page 154)). a. Select Customize... in the left pane of the HP Insight Control user interface;. b. Scroll to the name column to Systems Managed by Insight Control for Linux. c. Select the plus sign (+) to expand it. d. Scroll to the Insight Control for Linux collection. e. Select the plus sign (+) to expand it. 7.3 Preparing and discovering switches and enclosures 75

76 f. Scroll to the {collection_name}_switches subcollection. g. Select the radio button next to the {collection_name}_switches subcollection. h. Select Edit... i. Select a switch listed in the Available Items column, and use >> to move it to the Selected Members column. j. Select OK to add the switch to the Insight Control for Linux {collection_name}_switches subcollection. k. Repeat the last two steps for every switch you want to monitor. 7.4 Changing the boot method Insight Control for Linux provides you with a means to change the boot method of a server. Suppose the boot method of a system is PXE, but you want to change its boot method to virtual media. IMPORTANT: If you change a managed system's boot method from PXE to virtual media, make sure that you set the managed system's network information in the Network Configuration Editor, otherwise deployment operations fails. For more information on this tool, see Using the Network Configuration Editor (page 66). You can use this tool to change the boot method with the following procedure: 1. Select Options IC-Linux Configure Boot Method Select and verify the target system or systems. 3. Select Run Now from the Verify Target Systems window. The Configure Boot Method window opens. 4. Select the boot method, either individually or for all the target systems Individually: Select the radio button in the PXE column or Virtual Media column for each system. For all target systems: You can select the boot method for all the systems listed by selecting the check box in the PXE or Virtual Media column heading. 5. Select Save. NOTE: Exiting the window before selecting Save, leaves the boot method for the system or systems unchanged. 76 Discovering systems, switches, and enclosures

77 7.5 Next steps If you are configuring Insight Control for Linux for the first time, proceed to Chapter 8 (page 78) to install and set up your managed systems. 7.5 Next steps 77

78 8 Setting up managed systems This chapter is an overview on setting up managed systems for Insight Control for Linux monitoring. This chapter addresses the following tasks, which you must complete in this order: 1. Populating the Insight Control for Linux repository (page 78) 2. Setting up management hubs (page 151) 3. Linux OS installation (page 78) 4. Setting up managed systems for monitoring (page 78) 8.1 Populating the Insight Control for Linux repository If you plan to use Insight Control for Linux to install operating systems on managed systems, you must populate the Insight Control for Linux repository with Linux OS installation files, Service Packs for ProLiant (SPPs), and ProLiant Support Packs (PSPs). Skip this task if you are not using Insight Control for Linux to install operating systems, SPPs, or PSPs on managed systems. IMPORTANT: The repository has its own web server that allows anonymous access to the repository directory structure. This is a requirement for automated installation procedures. HP recommends that no confidential data be stored in the repository (including captured images) unless all systems on the network can be trusted with access to the repository. Use the instructions in Chapter 5 (page 43) to complete the following tasks: 1. Register one or more Linux operating systems with the Insight Control for Linux repository. 2. Copy vendor-supplied Linux OS installation files to the repository. 3. Register SPPs and PSPs with the repository. 4. Copy SPPs and PSPs into the repository. 5. Copy installation configuration files into the repository. For more information, see Section 5.2 (page 46). 8.2 Linux OS installation If one or more servers that you intend to monitor and manage with Insight Control for Linux does not have an installed supported OS, you must install one. If the servers you plan to configure as managed systems are already installed with a supported Linux OS, skip this task. To install a Linux OS from the Insight Control for Linux repository to one or more managed systems, follow the instructions in Chapter 9 (page 87). When the operating systems are installed on the managed systems, continue with Section 8.3 (page 78). 8.3 Setting up managed systems for monitoring When managed systems are running a supported Linux OS, you must configure those systems so that Insight Control for Linux can monitor them. Follow these steps to set up each managed system to be monitored by Insight Control for Linux: 1. Opening network ports on managed systems (page 79) 2. Resolving host names on the CMS (page 79) 3. Installing additional SPP and PSP components (page 80) 4. Configuring agents and HP SIM SSH keys (page 80) 5. Configuring console access and logging (page 83) 6. Turning on password authentication (page 85) 78 Setting up managed systems

79 8.3.1 Opening network ports on managed systems The network ports listed in Table 12 are used for communication between the managed systems and the CMS. These ports must be open to network traffic. If you used Insight Control for Linux to install an OS and you used a configuration derived from a supported template, the firewall is enabled by default and Insight Control for Linux opens the ports listed in Table 12 automatically. If you do not use a supported template for the OS configuration, the firewall is not opened automatically. You must follow the instructions in the vendor-supplied documentation for your OS to open the required ports that are not already open if you did not use Insight Control for Linux to install the OS on a managed system. Table 12 Open ports on managed systems Port number Service Protocol Inbound or outbond 22 ssh TCP Inbound 80 http TCP Inbound 161 SNMP TCP/UDP Inbound 162 SNMP trap listener UDP Outbound 427 Server location TCP Inbound 514 syslog-ng UDP Inbound 2301 cpq-webm TCP Inbound 2381 compaq-https TCP Inbound 2709 mond TCP Inbound 5666 nrpe TCP Inbound 5989 WBEM TCP Both Default Insight Control for Linux repository web server 1 TCP Inbound 1 If you changed the default port during installation, you must open that port instead, and you must update the associated configuration files. The port designated for the repository web server must be opened on managed systems that run VMware ESX. In addition to the standard ports, Insight Control for Linux also opens a few more ports dynamically for outgoing traffic. Because the outbound ports are chosen at the start of the agents, the ports might vary between instances, and thus the exact port numbers differ Resolving host names on the CMS To ensure proper Nagios notification of syslog reported problems, the syslog-ng service running on the CMS must be able to recognize the managed systems that posted the syslog event. The syslog or syslog-ng services on each managed system uses the /bin/hostname command output to identify itself in the syslog entry. If the CMS cannot resolve the host name in the syslog entry, syslog-ng cannot identify which managed system generated the syslog event. As a result of not being able to resolve the host name, syslog-ng logs the event in the consolidated log as belonging to localhost/localhost. Because localhost does not match the host name known by HP SIM, Nagios does not send out syslog notifications for this managed system. To ensure that the CMS can resolve the host name that is appended to all syslog events that originate from managed systems, follow these steps: 1. Determine the managed system's name by running the hostname command on the system: 8.3 Setting up managed systems for monitoring 79

80 # /bin/hostname If the node does not report a host name, set one or configure DHCP to assign one. DHCP configuration information is located in the HP Insight Control for Linux Installation Guide. 2. On the CMS, run the mxgethostname command with the host name obtained in the previous step. For this example, the host name is venus: # mxgethostname -n venus If the CMS recognizes the host name, command output is similar to the following: Host name: venus.example.com DNS Name: venus.example.com If the mxgethostname command does not return any results, do the following: Verify that the managed system has a valid IP address. Verify that the IP address is registered in a DNS server. Add the IP address and host name to the /etc/hosts file on the CMS. Verify that network is configured correctly and the managed system can access it. 3. Ensure that your managed system has only one active network connection per subnet. Multiple active network connections to the same subnet can cause a variety of problems, including DNS resolution issues and the changing of systems host names. Be particularly mindful when using full-height HP BladeSystem c-class ProLiant Server Blades. Typically, these ServerBlades have two network connections to each interconnect module in the chassis, which can inadvertently result in two connections to the same network. In this case, configure the ServerBlade or the interconnect module to prevent multiple connections to the same network Installing additional SPP and PSP components This task is optional. Insight Control for Linux does not automatically install the complete set of SPP or PSP and ESX agents. If you install VMware ESX virtual machine OS, you must run Configure Configure or Repair Agents if you want to install the ESX agents. If you used Insight Control for Linux to install a Linux OS on one or more managed systems, Insight Control for Linux installed the SPP and PSP components listed in Table 19 (page 136) onto the managed systems. These components are required to enable HP SIM management capabilities. If you want to install additional components of the SPP or PSP on each managed system now, follow the procedure in Chapter 13 (page 136) Configuring agents and HP SIM SSH keys Follow this procedure to configure agents and configure HP SIM SSH keys on target managed systems: 1. Select the following menu item from the Insight Control user interface Configure Configure or Repair Agents If you have not specified a target system, select and verify the target system. NOTE: If the managed system is a DL100 Series server that is running a supported operating system, but that OS was not installed with Insight Control for Linux, first select Deploy Deploy Drivers, Firmware and Agents IC-Linux Configure SNMP on DL1xx servers and run this task before continuing with the remaining steps. For more information, see Section 23.9 (page 195) 2. Optionally select Install Linux PSP or ESX agents. 80 Setting up managed systems

81 Figure 18 Installing providers and agents 3. Select Next>. 4. Review the settings for Configure or Repair Agents, as shown in Figure 19. Insight Control for Linux requires you to make settings in the Configure SNMP and Configure secure shell (SSH) access authentication sections of this screen. 8.3 Setting up managed systems for monitoring 81

82 Figure 19 Settings for configure or repair agents 5. Make the following settings to configure SNMP: Select Set read community string and enter the value for your network configuration. NOTE: To discover or identify a server that becomes a managed system, HP SIM requires that a SNMP read community string must be set to public in the global credentials for that server. There may be additional read community string settings in addition to public, but public must be specified. Select Send traps to refer to this instance of HP SIM. You can optionally set Send a sample SNMP trap to this instance of HP SIM, but it is not required. 6. Make the following settings to configure SSH: Select Configure secure shell (SSH) access authentication. Select Host based authentication. 7. Unselect all the other sections on this screen unless your environment uses those particular protocols or features. 8. Select Next and the Enter Credentials screen appears. 82 Setting up managed systems

83 9. Select the Use the following credentials for all systems radio button and supply the managed system credentials, which is typically the root user name and password. 10. Select Run Now. Selecting a protocol that is not supported in your environment causes an error and a task reports its status as failed. Even if this happens, it is possible that the SNMP and SSH settings required for Insight Control for Linux were configured correctly. Look at the task results to verify this. This task must complete successfully before you can continue Configuring console access and logging This task is optional. However, serial console access and logging are not available until you complete this task. When you configure the monitoring features of Insight Control for Linux on the CMS, the Console Management Facility (CMF) is configured automatically. CMF captures, logs, monitors, and enables you to connect directly to the serial console on each of your Insight Control for Linux managed systems directly from the CMS. This is a very helpful management and debugging tool because many system errors and alerts are output only to the system's console. With CMF, all serial console activity is logged on the CMS. Thus, if a problem occurs, you can go back through the logs to help determine what events occurred and when the events occurred. For more information on CMF, see Chapter 22 (page 187). Configuring Managed Systems for Console Monitoring Each system BIOS provides two serial ports to the OS: COM1, which appears to the Linux OS as ttys0, and COM2 which appears as ttys1. Sometimes there are more than two ports, but you can ignore them. The ROM Based Setup Utility, which can be accessed from the console at system power up, has settings for the embedded serial port and the virtual serial port. For each of these ports, you choose which OS serial port it is associated with. For information on how to update a RHEL Kickstart file or a SLES AutoYaST file to configure the operating system to redirect its output to its serial port, see Section (page 92). For example, if the virtual serial port is assigned to COM1 in the BIOS, the OS must be configured to use ttys0 as its system console. If the virtual serial port is associated with COM2, the OS must use ttys1 as its console. Therefore, configuring the managed system is a two-step process: Step 1: Make the appropriate association on the system BIOS. Depending on how you decide to configure your system, you might not need to do anything. As a general rule, the factory default system BIOS settings are as follows. If these default settings are suitable, you do not need to access the BIOS on each managed system: On HP BladeSystems, the virtual serial port is assigned to COM1 On non-blade servers, the virtual serial port is assigned to COM2 Step 2: Configure the OS to use the correct serial port. By default, Linux is not configured to use any serial port as its console. NOTE: If you specify the console assignment (for example, console=ttys0) when you install RHEL 5, RHEL 6, SLES 10, or a SLES 11 operating system on a managed system, console redirection will be configured you; for more information, see Configuring an operating system for console redirection (page 92)). For Xen installations, you must configure the managed system as described in the remainder of this section. 8.3 Setting up managed systems for monitoring 83

84 If you are installing Xen on a managed system or if you do not specify the console assignment, you must modify several files on each managed system for serial console monitoring to function, provided that the BIOS is configured as described in step 1 above. These files are: /boot/grub/menu.lst /etc/inittab /etc/securetty NOTE: The following procedure assumes that COM1 is assigned to the virtual serial port in the BIOS, thus, ttys0 is being used. If your virtual serial port is assigned to COM2, substitute ttys1 for ttys0 in this procedure. 1. Use a text editor to add the appropriate line to the /etc/inittab file: For RHEL5, SLES10, and SLES11 operating systems: co:2345:respawn:/sbin/agetty ttys ,38400,19200,9600 vt100 NOTE: For RHEL 6 operating systems, the /etc/inittab file is unchanged. For a Xen virtual host: S0:12345:respawn:/sbin/agetty -L console vt Save your changes and exit the text editor. 3. Use a text editor to add the appropriate line to the /etc/securetty file (if this line is not already in the file): For RHEL5, SLES10, and SLES11 operating systems: ttys0 NOTE: For RHEL 6 operating systems, the /etc/securetty file is unchanged. For a Xen virtual host: console 4. Save your changes and exit the text editor. 5. Use a text editor to add console=ttys0 to the default entry in the /boot/grub/menu.lst file (if this entry is not already in the file). NOTES: The /boot/grub/menu.lst file might be a symbolic link to the /boot/grub/ grub.conf file. The entries differ depending whether the managed system is a virtual host or not. For managed systems that are not virtual hosts: Look for the default= attribute and add either console=ttys0 for HP BladeSystems or console=ttys1 for non-blade systems to the default entry. This example is for a BladeSystem server: default=3 # This entry (no. 3) added by ProLiant HBA install script # in package cpq_cciss rhel6 title HP ELsmp root (hd0,0) kernel /vmlinuz elsmp ro root= \ 1 /dev/volgroup00/logvol00 rhgb \ quiet clock=pmtmr pci=nommconf console=ttys0 2 initrd /HP-initrd ELsmp.img 84 Setting up managed systems

85 1 The backslash (\) in this example indicates line continuation. Do not enter a backslash character in your file. 2 Add console=ttys0 here. Make sure you enter the number zero, not the letter O. For managed systems that are virtual hosts: Look for the default= attribute, add com1=115200,8n1 console=com1 to the kernel entry for HP BladeSystems, and add console=ttys0 to the module entry. For example: default=0 timeout=5 splashimage=(hd0,0)/grub/splash.xpm.gz hiddenmenu title Red Hat Enterprise Linux Server ( el5xen) root (hd0,0) kernel /xen.gz el5 com1=115200,8n1 console=com1 1 2 module /vmlinuz el5xen \ 3 ro root=/dev/volgroup00/logvol00 rhgb \ quiet console=ttys0 4 module /initrd el5xen.img title Red Hat Enterprise Linux Server-base ( el5) root (hd0,0) kernel /vmlinuz el5 \ ro root=/dev/volgroup00/logvol00 rhgb quiet initrd /initrd el5.img 1 For HP BladeSystems, add com1=115200,8n1 here. For non-blade systems, add com2=115200,8n1. Make sure you enter zeroes, not lowercase letter Os and that you enter ones, not lowercase letter Ls. 2 For HP BladeSystems, add console=com1 here. For non-blade systems, add console=com2. 3 The backslash (\) in this example indicates line continuation. Do not enter a backslash character in your file. 4 Add console=ttys0 here regardless whether you are using COM1 or COM2; this is a requirement of Xen. Make sure you enter the number zero, not the letter O. 6. Save your changes and exit the text editor. 7. After all three files are modified, reboot the system for the changes to take effect. After you make these changes, all system start up and shut down messages are directed to the serial console you selected and are not directed to the graphics display. Therefore, the system boot appears to be different. This is expected and normal behavior. To view the system console, use the CMF utilities on the CMS. For more information about using CMF, see Chapter 22 (page 187) Turning on password authentication This task is required only on managed systems that are installed with a supported version of SLES, but you did not use a configuration file derived from the Insight Control for Linux installation templates to install its OS. Otherwise, skip this task. If a managed system is installed with SLES, password authentication must be turned on in order to set up the HP SIM SSH keys When you use Insight Control for Linux tools to install SLES on a managed system, Insight Control for Linux automatically edits the /etc/ssh/sshd_config file and turns on password authentication in this file. However, if you did not use the Insight Control for Linux tools to install a SLES OS on a managed system, you must manually edit the /etc/ssh/sshd_config file to turn on the PasswordAuthentication attribute as shown in Example Setting up managed systems for monitoring 85

86 Example 2 Excerpt from sample /etc/ssh/sshd_config file # To disable tunneled clear text passwords, change to no here! #PasswordAuthentication yes #PermitEmptyPasswords no PasswordAuthentication yes 8.4 Next steps If you are installing and configuring Insight Control for Linux for the first time, proceed to Chapter 19 (page 154) to configure Insight Control for Linux monitoring services. 86 Setting up managed systems

87 9 Installing operating systems on managed systems This chapter addresses the following topics: Linux OS installation overview (page 87) Using installation configuration files for unattended installations (page 88) Prerequisites to OS installations on managed systems (page 92) Installing RHEL on managed systems (page 94) Installing SLES on managed systems (page 95) Installing VMware ESX and VMware ESXi operating systems (page 96) Installing another variant of Linux on managed systems (page 99) Generic procedure for installing an OS on one or more managed systems (page 101) 9.1 Linux OS installation overview The Insight Control for Linux installation tools enable you to install a Linux OS to one or more target managed systems. The process for installing a Linux OS on one server is the same as the process for ten servers or a hundred servers. Linux OS installation tasks are launched from the following HP SIM menu: Deploy Operating System IMPORTANT: Installing a Linux OS on a managed system erases data on the managed system. Before you begin, be sure that you have captured or backed up any data you want to retain. Preserving user data on volumes other than the principle target volume is not guaranteed. Presume that data on primary and secondary volumes is erased. Insight Control for Linux uses the task scheduling features of HP SIM so that you can run software installation operations immediately or run the operation at a user-defined scheduled date and time. See Chapter 4 (page 29) for information about understanding task results. For DL100 Series servers, you can observe the installation through a serial console connection. For more information, see Section 22.4 (page 188). For ilo based servers, you can observe the installation through a remote console Interactive versus unattended installations Insight Control for Linux allows you to install an OS interactively or unattended: An interactive installation method means that the Insight Control for Linux OS installation tools reboot the selected target server or servers into the native installation application of the OS, which requires step-by-step user interaction to provide responses to the OS installation process. An unattended installation method reads RHEL Kickstart and SLES AutoYaST installation files, which contain the responses to the OS installation process. This method requires no user interaction. Insight Control for Linux OS installation tools give you the option to launch the following types installation sessions: Table 13 Types of Installation Sessions Installation RHEL SLES Interactive Red Hat Interactive SLES Interactive Unattended Red Hat (Kickstart) SLES (AutoYaST) 9.1 Linux OS installation overview 87

88 Table 13 Types of Installation Sessions (continued) Installation Custom or Other VMware ESX VMware ESXi Interactive Custom or Other Interactive VMware ESX Interactive VMware ESXi Interactive Unattended Custom or Other (Unattended) VMware ESX (Kickstart) For more information about using Kickstart and AutoYaST files for unattended installations, see Section 9.2 (page 88). IMPORTANT: To use Kickstart or AutoYaST files that HP provides to perform unattended installations of a supported OS, you must first register the SPP or PSP in the Insight Control for Linux repository and copy the file to the appropriate location in the repository. The SPP or PSP registered in the repository must be associated with an OS that is of the same type, version, release, sub-version and architecture as the OS being installed. You do not select the SPP or PSP during the OS installation, but it is used as part of the installation process. For more details on how SPPs and PSPs are involved in the OS installation process and how to do an unattended installation without providing the SPP or PSP, see Chapter 13 (page 136) Supported operating systems Several versions of operating systems, including virtualization operating systems, are supported for remote installation on managed systems. See the HP Insight Control for Linux Support Matrix for the specific list of supported OS on managed systems Installing other Linux operating systems The Insight Control for Linux installation tools install almost any Linux OS (including a custom operating system or a variant Linux operating system): That either supports PXE boot protocol or provides a mechanism for assigning an IP address to an ilo-based server (either through kernel parameters or an automated installation configuration file) so that virtual media can be used. That provides kernel and RAM disk files that contain the drivers for the target system to be installed. To install a Linux OS, other than RHEL or SLES, use either the Deploy Operating System Custom or Other Interactive or Deploy Operating System Custom or Other (Unattended) menu item. For more information on installing a custom OS, see the white paper titled Installing a Custom Operating System with HP Insight Control for Linux. 9.2 Using installation configuration files for unattended installations To use the Deploy Operating System Red Hat (Kickstart) or SLES (AutoYaST) remote OS installation features of Insight Control for Linux, you must do the following: Use the default template files that HP supplies to create customized Kickstart or AutoYaST files to enable unattended installation of a supported Linux OS. 88 Installing operating systems on managed systems

89 NOTES: The template file is written for 64-bit installations. If you want to install a 32-bit, you will need to modify the installation and configuration file accordingly. The AutoYaST templates that HP supplies use DHCP for hostname/dns configuration. If there are multiple interfaces configured through DHCP, then the operating system can select any of them as the host name during the installation. In that case, the host name the OS chose might not correspond to the interface that you want the system to be known as. Register the Kickstart or AutoYaST file or files in the repository. Copy the Kickstart or AutoYaST files or files to the appropriate directory in the repository. IMPORTANT: HP provides a default set of basic Kickstart and AutoYaST installation configuration files for each supported OS. HP recommends copying and using the default installation configuration files as templates to create customized installation configuration files that are suitable for your environment. Familiarize yourself with the contents and usage comments in the configuration file templates, and use them to make versions that are appropriate for your own environment. Some default templates specify port 60000, the default web server repository port number, by that number. If you use a repository web server port that is different from that default value, ensure that any Kickstart or AutoYaST installation configuration file you create from these templates has the correct port number for the repository web server port for your environment. Be aware that the default installation configuration files provided for RHEL and SLES installations are configured such that all partitions on all disks of a managed server are erased. If this is not acceptable behavior, remember to change this behavior when you create your customized file. The default Kickstart and AutoYaST files automatically extract and install the RPMs listed in Table 19 (page 136) from the associated SPP or PSP. The SLES 10 SP3 virtual host AutoYaST configuration file that Insight Control for Linux provides is valid only for the x86_64 processor architecture; it includes the kernel-xen package. For the i386 processor architecture, this must be replaced with the kernel-xenpae package. Kickstart and AutoYaST installation configuration files that are read during an unattended OS installation operation must be located in the Insight Control for Linux repository in the /opt/ repository/instconfig directory and use the naming conventions described in Section Naming conventions for installation configuration files The default installation configuration files and their associated directories under /opt/ repository/instconfig follow these naming conventions: The files are stored in OS- and version-specific directories that use the following naming convention: {abbreviated_os_type}{version}{update_or_servicepack}[-{special}]. 9.2 Using installation configuration files for unattended installations 89

90 The following table provides a few examples: OS version SLES Version 10 Service Pack 4 SLES Version 11 Service Pack 1(for Management Hubs) SLES Version 11 Service Pack 1 (for Xen Virtual Hosts) SLES Version 11 Service Pack 1 (for Xen Virtual Guests) RHEL Version 5 Update 7 RHEL Version 5 Update 7 (for Management Hubs) RHEL Version 6 Update 1 (for KVM Virtual Hosts) RHEL Version 6 Update 1 (for KVM Virtual Guests) VMware ESX Version 4.1 Directory name in /opt/repository/instconfig sll04 sl111 management-hub sl111 virt-host-xen sl111 virt-guest-xen rh057 rh057 management-hub rh061 virt-host-kvm rh061 virt-guest-kvm esx041 The associated installation configuration files are stored in the OS-specific directory under /opt/repository/instconfig and use the same naming convention. For example, rh061.cfg is the Kickstart installation configuration file associated with RHEL Version 6 Update 1, and it is located in the /opt/repository/instconfig/rh061 directory. Installation configuration files that you customize are stored under directories that match the name you give them in the repository. For example, Myrh061.cfg is your customized Kickstart installation configuration file associated with installing a RHEL Version 6 Update 1 OS, and it is located in the /opt/ repository/instconfig/myrh061 directory. Installation configuration files for installing a virtual host are named according to the format osver-virt-host, where osver indicates the operating system version, for example rh057. Likewise, installation configuration files for installing a virtual guest follow a similar format: osver-virt-guest Customizing installation configuration files As part of the installation process for supported operating systems, Insight Control for Linux provides macros that are replaced with appropriate settings, making it possible to use a single installation configuration file for multiple operating systems, hardware combinations, or both. These macros are enclosed inside a double set of percent sign symbols (%%). Insight Control for Linux interprets and expands the macros before the configuration file is ultimately passed to the OS installation process. Successful installation with Insight Control for Linux requires properly using these macros as part of your installation configuration file. To ensure successful installations, HP recommends that you understand what these macros do and use a provided file as a template for your own installation configuration files. 90 Installing operating systems on managed systems

91 Table 14 Insight Control for Linux macros for installation configuration files Macro name %%agentinstall%% %%simidentify%% %%completion%% %%keyskip%% %%neturl%% %%driverinstall%% %%password%% %%network%% %%ramdiskup%% Description This macro is unique to Insight Control for Linux. During installation, it expands into a shell script that downloads the SPP or PSP components from the CMS and installs only the packages that HP SIM and Insight Control for Linux need to be able to monitor the managed system properly. Include this macro on any installation configuration file used to install a system that Insight Control for Linux will manage. IMPORTANT: If the agents are not installed, over time HP SIM may drop most of the original information about the system, such as MAC addresses and IP addresses, from its database, and Insight Control for Linux tools will fail to complete successfully. This macro is unique to Insight Control for Linux. This macro expands to a shell script that puts the trapsink directive in the SNMP configuration to direct the system to sent a cold-start trap to the CMS when the server is rebooted. This macro expands into a shell script that contacts the CMS over HTTP to inform it that the installation is complete. This is the last macro that runs. Include this macro on any installation configuration file used to install a system that Insight Control for Linux will manage. NOTE: The server might not be completely booted, but it is finished with the installation process and completes the boot process. This macro is used to install RHEL Version 5 only. During the installation process, you are prompted to register the OS and enter a key. This option replaces the keyskip yes option, which skips the registration screen and continues with the installation. Specifies the location of the installation media. This macro is substituted with the network address based on the repository that was selected during the installation task. For example, is inserted for a RHEL Version 6 Update 1 i386 installation. This macro is unique to Insight Control for Linux. During installation, it expands to a shell script that downloads and installs certain drivers from the registered SPP or PSP. These drivers are required to support the HP servers whose network controllers are not yet supported by vendor distributions. Include this macro on any installation configuration file that installs a system that contains one of these advanced network controllers. This macro is unique to Insight Control for Linux. It expands to the MD5 hash of the root password that was specified during Insight Control for Linux installation. This macro is unique to Insight Control for Linux. For an OS installation using virtual media, this macro is replaced with the network parameters so that the network can be configured automatically. For an OS installation using PXE, this macro has no meaning because PXE acquires its network parameters from DHCP. This macro is unique to Insight Control for Linux. This macro sends a message to the CMS letting it know that the operating system's RAM Disk has finished loading and is ready to begin the installation. 9.2 Using installation configuration files for unattended installations 91

92 9.2.3 Installation configuration files for custom operating systems You can upload installation configuration files for unsupported operating systems into the Insight Control for Linux repository. However, the OS installation process does not have a built-in mechanism for linking the installation configuration files to a given installation. Instead, during the unattended OS installation, you are prompted to provide the necessary commands to reference an installation configuration file in a kernel append line that is used to network boot the server. The mechanisms for automatically linking configuration files are tied to the specific syntax used for a given OS. Providing this capability programatically restricts the use of the Custom OS installation tool, removing a significant amount of flexibility that the tool was designed to provide Configuring an operating system for console redirection The Insight Control for Linux cmfd daemon, which runs on the CMS and management hubs, captures the console output from managed systems and stores it in a file named /hptc_cluster/adm/logs/cmf.dated/current/console_name.log, where console_name identifies the managed system. For more information, see Section 22.1 (page 187). By default, the operating system directs its output to the graphics console. By specifying console=ttys0 or console=ttys1 (for virtual serial port assignments COM1 or COM2, respectively) in the kernel append line when you install a RHEL 5, RHEL 6, SLES 10, or SLES 11 operating system on a managed system 2, console access will automatically be configured for you during the OS installation. No other configuration is necessary. However, for Xen installations or if you do not want to specify the console assignment in the kernel append line, you need to configure the operating system as described in Configuring console access and logging (page 83). 9.3 Prerequisites to OS installations on managed systems To successfully install a Linux OS on a managed system, the following prerequisites must be met: HP SIM and Insight Control for Linux are installed and configured on the CMS. The target managed system or systems and their management processors were discovered and are associated with each other in HP SIM You have set the user name and password on the management processors. For more information about setting or changing management processor credentials, see Section 23.1 (page 191). For more information on management processor credentials themselves, see Management Processor Credentials (page 198). You registered the supported OS in the repository and you have copied the vendor-supplied source installation files to the repository path the OS registration process created. You copied the vendor-supplied boot target files to the repository path the registration process created. You registered the Kickstart or AutoYaST configuration files in the repository and you copied the files to the repository, to enable unattended installations. You registered the SPP or PSP in the repository and associated it with the OS, and you manually copied the associated SPP or PSP file to the repository path the registration process created. If you are installing a 32-bit operating system on a managed system that has more than 64 GB of memory, be sure to specify the mem=60gb kernel option in the kernel append line during installation. Additional prerequisites might apply for specific servers. See the following section, if it applies to your environment. 2. Generic procedure for installing an OS on one or more managed systems (page 101) describes the procedure for installing operating systems on managed systems. 92 Installing operating systems on managed systems

93 9.3.1 Additional prerequisites for certain ProLiant servers Some server/operating system combinations require an updated boot RAM disk (initrd). These servers are identified in the HP Insight Control for Linux Support Matrix. To perform a RHEL Kickstart or SLES AutoYaST installation on these servers, you must replace the initrd supplied with the standard Red Hat Linux or SUSE Linux distribution with a customized initrd provided by HP. Download the customized initrd from the web address that corresponds to the server and operating system. These initrd files have additional support for the servers; you can use them to install the corresponding OS on the other hardware platforms as well. Recent SLES operating systems use a driver kit ISO image, which might include an updated kernel. NOTE: A customized initrd is required when installing a RHEL or SLES operating system on a series Gen8 server configured with a B320i or B120i RAID controller. Table 15 Download web address for customized initrd files and Driver Kit images Operating system Architecture Download address Red Hat Enterprise Linux RHEL 5.4 RHEL 5.5 RHEL 5.6 RHEL 5.7 RHEL 5.8 RHEL 6 RHEL 6.1 RHEL 6.2 x86 x86_64 x86 x86_64 x86 x86_64 x86 x86_64 x86 x86_64 x86 x86_64 x86 x86_64 x86 x86_64 ftp.hp.com/pub/softlib2/software1/pubsw-linux/p /v62036 ftp.hp.com/pub/softlib2/software1/pubsw-linux/p /v62035 ftp://ftp.hp.com/pub/softlib2/software1/pubsw-linux/p /v68232 ftp://ftp.hp.com/pub/softlib2/software1/pubsw-linux/p /v68229 ftp://ftp.hp.com/pub/softlib2/software1/pubsw-linux/p /v68234 ftp://ftp.hp.com/pub/softlib2/software1/pubsw-linux/p /v68230 ftp://ftp.hp.com/pub/softlib2/software1/pubsw-linux/p /v78508 ftp://ftp.hp.com/pub/softlib2/software1/pubsw-linux/p /v78503 ftp://ftp.hp.com/pub/softlib2/software1/pubsw-linux/p /v77026 ftp://ftp.hp.com/pub/softlib2/software1/pubsw-linux/p /v77023 ftp://ftp.hp.com/pub/softlib2/software1/pubsw-linux/p /v68235 ftp://ftp.hp.com/pub/softlib2/software1/pubsw-linux/p /v68231 ftp://ftp.hp.com/pub/softlib2/software1/pubsw-linux/p /v78506 ftp://ftp.hp.com/pub/softlib2/software1/pubsw-linux/p /v78504 ftp://ftp.hp.com/pub/softlib2/software1/pubsw-linux/p /v78681 ftp://ftp.hp.com/pub/softlib2/software1/pubsw-linux/p /v78680 SUSE Linux Enterprise Server SLES 10 SP3 SLES 10 SP4 x86 x86_64 For systems without RAID x86 system configured for RAID 1 x86_64 system configured for RAID 1 ftp://ftp.hp.com/pub/softlib2/software1/pubsw-linux/p /v68242 ftp://ftp.hp.com/pub/softlib2/software1/pubsw-linux/p /v68241 Not required; see Copying SLES 10 SP4 or SLES 11 SP1 (KISO) into the repository (page 54) Copy the KISO into the repository; see Copying SLES 10 SP4 or SLES 11 SP1 (KISO) into the repository (page 54) Then download and install this customized initrd file for the RAID driver: ftp://ftp.hp.com/pub/softlib2/software1/pubsw-linux/p /v78501 Copy the KISO into the repository; see Copying SLES 10 SP4 or SLES 11 SP1 (KISO) into the repository (page 54) 9.3 Prerequisites to OS installations on managed systems 93

94 Table 15 Download web address for customized initrd files and Driver Kit images (continued) Operating system SLES 11 SP1 SLES 11 SP2 Architecture For systems without RAID x86 system configured for RAID 1 x86_64 system configured for RAID 1 x86 x86_64 Download address Then download and install this customized initrd file for the RAID driver: ftp://ftp.hp.com/pub/softlib2/software1/pubsw-linux/p /v78500 Not required; see Copying SLES 10 SP4 or SLES 11 SP1 (KISO) into the repository (page 54) Copy the KISO into the repository; see Copying SLES 10 SP4 or SLES 11 SP1 (KISO) into the repository (page 54) Then download and install this customized initrd file for the RAID driver: ftp://ftp.hp.com/pub/softlib2/software1/pubsw-linux/p /v78164 Copy the KISO into the repository; see Copying SLES 10 SP4 or SLES 11 SP1 (KISO) into the repository (page 54) Then download and install this customized initrd file for the RAID driver: ftp://ftp.hp.com/pub/softlib2/software1/pubsw-linux/p /v78285 ftp://ftp.hp.com/pub/softlib2/software1/pubsw-linux/p /v77039 ftp://ftp.hp.com/pub/softlib2/software1/pubsw-linux/p /v For servers configured with an HP SmartArray B120i or B320i RAID controller that is enabled in the BIOS. Before you can use Insight Control for Linux to install Linux on these servers, you must: Download the files and place the customized, HP-provided initrd and the kernel into the appropriate directories under /opt/repository/boot, overwriting the original initrd supplied with the distribution of the corresponding Linux operating system. For example, to download the initrd and kernel for a SLES 11 SP1 (x64) operating system, the steps would resemble the following: # mount options Image_name /mnt/ # cp /mnt/boot/x86_64/loader/initrd /opt/repository/boot/sles11sp1-x64boot/ # cp /mnt/boot/x86_64/loader/linux /opt/repository/boot/sles11sp1-x64boot/ Ensure that you have the correct SPP or PSP in the repository. For information on the supported versions, see the HP Insight Control for Linux Support Matrix. Specify a Kickstart or AutoYaST file derived from the templates specifically for the server from the Insight Control for Linux Repository when installing the OS. 9.4 Installing RHEL on managed systems This section describes the two methods for installing RHEL to one or more managed systems: Installing RHEL using an unattended method (page 94) Installing RHEL interactively (page 95) Installing RHEL using an unattended method An unattended RHEL installation uses an ASCII format configuration file called the Kickstart installation configuration file. This file provides responses to the installation process and eliminates the need for you to manually enter your responses. For more information about installation configuration files, see Section 9.2 (page 88). Follow the generic Linux OS installation procedure in Section 9.8 (page 101) to launch an unattended RHEL Kickstart installation. 94 Installing operating systems on managed systems

95 9.4.2 Installing RHEL interactively An interactive installation method requires interaction with the RHEL installation user interface. Other than PXE booting from the selected OS release, update, and architecture, Insight Control for Linux provides no other automated configuration service with this interactive method. You must interact with the OS installer through the selected console type. An interactive installation also affords the most opportunity for you to customize and select specific packages and groups of packages during installation and provides even greater control over the default configuration of the managed system. NOTES: During installation, when specifying the HTTP setup, you are prompted for the IP address of the CMS and the path name for the RHEL installation. For example: Where: CMS-IP-addr CMS-port path-name is the IP address of the CMS is the port number of the repository web server that you specified when you installed Insight Control for Linux. The factory default value is is the path name of the directory containing the RHEL distribution; this path name is relative to /opt/repository, for example, enter /os/ RHEL6U1-x64 for the full path name /opt/repository/os/ RHEL6U1 x64. To launch an interactive RHEL installation, follow these steps: 1. Select the following menu item from the Insight Control user interface: Deploy Operating System Red Hat Interactive 2. Follow the generic OS installation procedure in Section 9.8 (page 101). 3. After the installation is complete, go to the system console and manually install the SPP or PSP. You can install the entire contents of the SPP or PSP, but at a minimum, you must install the components listed in Table 19 (page 136), which HP SIM requires. If you do not install these components of the SPP or PSP, you lose the ability to manage the system with Insight Control for Linux. 9.5 Installing SLES on managed systems This section describes the two methods for installing SLES to one or more managed systems: Installing SLES using an unattended method (page 95) Installing SLES interactively (page 96) NOTE: When you use Insight Control for Linux installation tools to install SLES on a managed system, Insight Control for Linux automatically edits the /etc/ssh/sshd_config file and turns on password authentication in this file. Turning on password authentication is required to set up the HP SIM SSH keys on a managed system that is installed with SLES Installing SLES using an unattended method An unattended SLES installation relies on an XML format installation configuration file called the AutoYaST file to feed user selections to the SLES installer during installation, thus eliminating the need for you to make these selections manually. For more information about installation configuration files, see Section 9.2 (page 88). Follow the generic OS installation procedure in Section 9.8 (page 101) to launch an unattended SLES AutoYaST installation. 9.5 Installing SLES on managed systems 95

96 9.5.2 Installing SLES interactively An interactive installation requires interaction with the SLES installation process. Other than booting from the selected OS release, service pack, and architecture, Insight Control for Linux provides no other automated configuration services with this interactive method. You must interact with the OS installer through the selected console type. An interactive installation also affords the most opportunity to customize and select specific packages and groups of packages during installation and provides greater control over the default configuration of the system. To launch an interactive SLES installation, follow these steps: 1. Select the following menu item from the Insight Control user interface: Deploy Operating System SLES Interactive 2. Follow the generic OS installation procedure in Section 9.8 (page 101). 3. After the installation is complete, go to the system console and manually install the SPP or PSP. You can install the entire contents of the SPP or PSP, but at a minimum you must install the components listed in Table 19 (page 136); HP SIM requires these components. If you do not install these components, you lose the ability to manage the system with Insight Control for Linux Required kernel parameters for installing x86 SLES operating systems on various servers You must provide the appropriate boot parameter to install an x86 (that is, 32-bit) SLES 10 SP3 or SLES 10 SP4 operating system on the following servers: IMPORTANT: Only the 12-core version of these servers are affected. They are equipped with the AMD SR5690 NB (PCI-E Gen2 and HT3) and AMD SP5100 SB (PCI-E Gen2 link to SR5690) chip sets. The servers are: BL465c G7 SL165s G7 DL165 G7 BL685c G7 SL165z G7 DL385 G7 DL685 G7 Use the following table to determine the boot parameter to enter in the Kernel append line text field. For this operating system: SLES 10 SP3 (x86) SLES 10 SP4 (x86) SLES 11 SP1 (x86) Use this kernel boot parameter: pci=nomsi pci=nomsi Not applicable 9.6 Installing VMware ESX and VMware ESXi operating systems The Insight Control for Linux installation tools enable you to install a virtualization OS to one or more target systems. 96 Installing operating systems on managed systems

97 IMPORTANT: Installing a virtualization OS on a system erases data on that system. Before you begin, be sure that you have captured or backed up any data you want to retain. Preserving user data on volumes other than the principle target volume is not guaranteed. Presume that data on primary and secondary volumes is erased. The tasks for installing the virtualization OS are launched from the following HP SIM menu: Deploy Operating System Installing a VMware ESX or ESXi OS using a Kickstart file NOTE: The installation configuration file (also known as the Kickstart file) template for VMware ESX and ESXi assumes that the repository port has the default value If you selected a different TCP port number for the repository web server when you installed HP Insight Control for Linux, you must edit the installation configuration file template before using it. Specifically, you must change all references of port to the correct TCP port number for your installation. To install VMware ESX on one or more target managed systems, follow these steps: 1. Select the following menu item from the Insight Control user interface: Deploy Operating System VMware ESX (Kickstart) 2. Do one of the following to select and verify that the servers in the target list are the servers you want to install an OS on: Proceed to the next step if the target list is correct. Select Add Targets... or Remove Target to modify the list, if the list is incorrect. If no servers are in the list, do the following: a. Select Collection. b. Select All Servers from the drop down menu. c. Select View Contents to display and select from the list of available servers. d. Select Apply when you have selected all servers. 3. Select Next> when the list of servers is correct. 4. Apply an Insight Control for Linux license if a license is not already applied to one or more targets. 5. Select the virtualization OS to install and select Next>. Only the virtualization OS that applies to your installation is available for you to select from the menu. IMPORTANT: The list contains only those virtualization operating systems that are registered in the repository and copied to it. If you select a virtualization OS that was registered, but the installation files were not copied to the repository, a validation error appears. 6. Select the Kickstart file and select Next>. For more information about custom installation configuration files, including the macros that HP optimized, see Section 9.2 (page 88). 7. Specify the kernel append line to add additional kernel command line parameters. The kernel append line is added to the end of the installation RAM disk kernel line. 8. Optionally, you may set the root account password at this step. 9.6 Installing VMware ESX and VMware ESXi operating systems 97

98 If you want the target system to use the default root password (root), select the Use Default Root Password option. To set a root password other than the default, select the Specify Root Password option, enter the root password, and verify the entry. HP recommends setting a strong root password on all your severs. 9. Do one of the following to start the installation: Select Run Now to launch the installation operation immediately. Select Schedule to schedule the installation to occur in the future. 10. Examine the Task Results window to follow the progress of the installation operation and the related task states Installing a VMware ESX or VMware ESXi OS interactively NOTE: Installating a VMware ESXi OS that uses virtual media takes longer because throughput rates for virtual media are lower than for standard networking. To install either VMware ESX or VMware ESXi OS on one or more target managed systems, follow these steps: 1. Select the menu item: Deploy Operating System VMware ESX Interactive or Deploy Operating System VMware ESXi Interactive 2. Do one of the following to select and verify that the servers in the target list are the servers you want to install an OS on: Proceed to the next step if the target list is correct. Select Add Targets... or Remove Target to modify the list, if the list is incorrect. If no servers are in the list, do the following: a. Select Collection. b. Select All Servers from the drop down menu. c. Select View Contents to display and select from the list of available servers. d. Select Apply when you have selected all servers. 3. Select Next> when the list of servers is correct. 4. Apply an Insight Control for Linux license if a license is not already applied to one or more targets. 5. Select the virtualization OS to install and select Next>. Only the virtual machine OS that applies to your installation is available for you to select from the menu. 98 Installing operating systems on managed systems

99 IMPORTANT: The list contains only those virtualization operating systems that are registered in the repository and copied to it. If you select a virtualization OS that was registered, but the installation files were not copied to the repository, a validation error appears. 6. Specify the kernel append line to add additional kernel command line parameters. The kernel append line is added to the end of the installation RAM disk kernel line; however, you do not need to provide any information. 7. Do one of the following to start the installation: Select Run Now to launch the installation operation immediately. Select Schedule to schedule the installation to occur in the future. 8. Examine the Task Results window to follow the progress of the installation operation and the related task states. 9. Use a remote console to interact with the installation software. You are asked to supply information for the installation. 10. Use VMware vsphere applications to modify the following configuration options: password add host to cluster virtual switches port groups NFS partitions iscsi partitions NTP vmotion For more information on VMware vsphere applications, see the HP Insight Control Virtual Machine Management User Guide. NOTE: When performing an ESXi installation using virtual media, to facilitate the installation, Insight Control for Linux does not automatically remove the ISO image that was created. This ISO image contains the RAM Disk and removing the ISO image while RAM disk is loaded causes the installation to fail. HP recommends, if disk space is a concern, that you remove the ISO image manually. The ISO image is named using the server's Globally Unique IDentifier (GUID). Use the following procedure to locate and remove the ISO image. 1. Run the following command to obtain the server's GUID: # mxnode -ld server_name grep GUID GUID: GUID_number 2. Use the following commands to remove the ISO image: # cd /opt/repository/iso # rm -f GUID_number*.iso 9.7 Installing another variant of Linux on managed systems The Insight Control for Linux Custom or Other OS installation tool provides the flexibility to boot any network-bootable kernel and RAM disk, not necessarily just those that the supported operating systems provided. This installation tool installs an alternative version of Linux or boots into a user-provided RAM disk environment. 9.7 Installing another variant of Linux on managed systems 99

100 The general use of the Custom or Other installation tool is not officially supported because you, and not Insight Control for Linux, must manage most of the boot and installation process. Also the agents that HP SIM requires for long term monitoring and manageability of your managed systems are not provided in SPPs or PSPs and thus are not installed automatically. The purpose of the Custom or Other installation tool is to provide you with the ability to extend the capabilities of Insight Control for Linux beyond the officially supported operating systems installed by the supported OS installation tools. Because a managed system that is installed through the Custom or Other installation tool does not include the required SPP or PSP agents, HP recommends that you use static IP addresses (configured in the OS or by DHCP) to allow HP SIM to, at a minimum, maintain a relationship between the server and its discovered entry in the All Systems collection (and others). Here are the steps you need to take to install a variant of Linux OS on a managed system. For additional information, see the white paper titled Installing a Custom Operating System with Insight Control for Linux. 1. Register your custom OS in the Insight Control for Linux Repository: Options IC-Linux Manage Repository... For information on registering an OS, see Registering operating systems (page 47) Registering a custom OS automatically creates three directories in the Insight Control for Linux Repository: /opt/repository/instconfig/custom/myos /opt/repository/custom/myos /opt/repository/boot/myosboot Where MyOS is the name of the custom OS. 2. Copy the operating system files and boot files into the newly-created directories. For more information, see Copying a custom OS into the repository (page 56) 3. Create the following scripts, as needed: Script auto_config boot_stanza encrypt_passwd extra_files create_iso Description Required for an unattended installation, this script performs macro substitution so that a working copy of your installation configuration file has the actual values required for your installation. This script constructs a boot stanza that specifies your kernel and RAM disk, which enables your boot loader to boot your custom OS. This script is required for an unattended installation and for an interactive installation that uses virtual media to boot, because the target system's static IP address needs to be specified in the kernel parameters. This script accepts a password from StdIn and outputs the encrypted password through StdOut, allowing you to encrypt the root password of the target server for an unattended installation. This script is used for an installation using virtual media that requires additional files, in addition to the kernel and RAM disk, to boot.an ESXi OS is an eample of an operating system that requires additional files to boot. This script is used expressly for an installation using virtual media where the OS requires an alternate directory structure. Insight Control for Linux provides example auto_config, boot_stanza, and encrypt_passwd scripts for the CentOS 5 and Debian 5 operating systems; they are located in the /opt/repository/instconfig/custom/examples/ directory in the subdirectories named for the OS. HP recommends that you use these examples as templates for your own scripts. 100 Installing operating systems on managed systems

101 TIP: When you create a script, make sure that it is executable by the root user. 4. Copy the scripts to the /opt/repository/custom/myos directory. 5. For unattended installations, register the installation configuration script with the Insight Control for Linux Repository: For information on registering an installation configuration file, see Registering operating systems (page 47) 6. Select the Deploy Operating System Custom or Other menu item to begin the installation. The remainder of the installation procedure is described in Section 9.8 (page 101). 9.8 Generic procedure for installing an OS on one or more managed systems Before you begin, make sure you have completed all prerequisites to OS installation listed in Section 9.3 (page 92). To install a Linux OS to one or more target managed systems, follow these steps: 1. Select the following menu item from the Insight Control user interface: Deploy Operating System 2. Select the menu item that reflects the OS type and installation method you want to use. Your choices are: Red Hat Interactive Red Hat (Kickstart) SLES Interactive SLES (AutoYaST) Custom or Other Interactive Custom or Other (Unattended) 3. Do one of the following to select and verify that the servers in the target list are the servers you want to install an OS on: Proceed to the next step if the target list is correct. Select Add Targets... or Remove Target to modify the list, if the list is incorrect. If no servers are in the list, do the following: a. Select Collection. b. Select All Servers from the drop down menu. c. Select View Contents to display and select from the list of available servers. d. Select Apply when you have selected all servers. 4. Select Next> when the list of servers is correct. 5. Apply an Insight Control for Linux license if a license is not already applied to one or more targets. 6. Select the OS to install and select Next>. The operating systems that are available for you to select are only those that apply to the OS installation you selected from the menu. IMPORTANT: The OS list contains only those operating systems that are registered in the repository whose associated vendor-supplied installation files were copied to the repository. If you select an OS was registered, but the installation files were not copied to the repository, a validation error appears. 9.8 Generic procedure for installing an OS on one or more managed systems 101

102 7. If you are performing an unattended installation, select the installation configuration file (either a Kickstart or AutoYaST file) for the OS type and version you are installing, and select Next>. Otherwise, skip this step. When you register an installation configuration file, you identify which operating systems it applies to. This association feeds into the list of configuration files that are available for a particular installation operation. For more information about custom installation configuration files, including the macros that HP customized, see Section 9.2 (page 88). 8. Specify the kernel append line to add additional kernel command line parameters. The kernel append line is added to the end of the installation RAM disk kernel line: If you are performing an interactive installation, you do not need to provide any information. Proceed to the next step. If you are using a Kickstart or AutoYaST file to perform an unattended installation of an unsupported OS, provide the following parameters: ksdevice to specify the network interface that obtains the installation configuration file ks to specify the path to the installation configuration file (the path on disk value you recorded when you registered the custom OS installation configuration file) For example: ksdevice=eth0 ks= In the previous kernel append line, is the IP address of the CMS management interface, is the TCP port on which the repository web server is listening, and /instconfig/directory/filename.cfg is the path to the configuration file. 9. Optionally, for unattended installations using a Kickstart or AutoYaST file, you may set the root account password at this step. If you want the target system to use the default root password (root), select the Use Default Root Password option. To set a root password other than the default, select the Specify Root Password option, enter the root password, choose the password encryption option, enter the root password, and verify the entry. IMPORTANT: HP recommends setting a strong root password on all your severs. If you select Don t encrypt password (not recommended), the password will be stored in clear text in the Kickstart or AutoYaST file, which opens a security vulnerability. HP strongly recommends against selecting this option. 10. Do one of the following to start the installation: Select Run Now to launch the OS installation operation immediately. 102 Installing operating systems on managed systems

103 Select Schedule to schedule the OS installation to occur in the future. 11. Examine the Task Results window to follow the progress of the installation operation and the related task states. 9.8 Generic procedure for installing an OS on one or more managed systems 103

104 10 Capturing and deploying Linux images This chapter addresses the following topics: Overview of capturing and deploying Linux images (page 104) Prerequisites to capturing a Linux image (page 106) Capturing a Linux image from a managed system (page 109) Preparing for scalable deployment (page 110) Deploying a captured Linux image to one or more managed system (page 113) Insight Control for Linux partition wizard overview (page 116) 10.1 Overview of capturing and deploying Linux images NOTES: Insight Control for Linux does not support capture and deployment of: VMware ESX or VMware ESXi host images RHEL 6 systems installed with Software RAID SLES 10 systems installed with Software RAID The RAM disk hardware discovery operation presents the SMART ARRAY controllers in a different order from the hardware discovery method in the SLES 10 SP3 operating system, which can result in a deploy operation writing the OS image to the wrong disk. If two or more systems are sharing a SAN, any deployment operation attempts to re-create the partitions on the SAN. Insight Control for Linux does not preserve them; even SANs mounted as permanent data disks would be recreated. The Deploy Operating System menu provides the ability for you to capture a Linux image from a managed system and deploy that image to one or more target managed systems. IMPORTANT: Captured images are stored in a directory accessible through a web server interface that allows anonymous access; captured images are deployed using SSH. Therefore, any user on the network can retrieve captured images in the Insight Control for Linux repository. HP recommends that captured images do not contain confidential data if the network is untrusted. Insight Control for Linux supports options that allow you to adjust and customize captured and deployed images. For information on scripts that you can use before and after capturing a Linux image, see Section (page 105) and Section (page 106). Capturing a Linux image is useful if you want to replicate the OS environment from one managed system to one or more managed systems to maintain a consistent environment on all managed systems. The capture operation reboots the managed system where the image is captured to the Insight Control for Linux RAM disk environment. After the OS image is captured, the system is rebooted back to its installed OS. The Insight Control for Linux image deployment tool provides an integrated Partition Wizard to enable you to modify the deployed images disk layout, file system selection, and logical volumes. Using the Partition Wizard during image deployment requires an in-depth understanding of Linux, kernel modules, and the grub boot loader. 104 Capturing and deploying Linux images

105 NOTE: To account for the time it may take to capture or deploy a very large image over a slow network, a time out of five days is in effect for capturing or deploying a Linux image so that you can determine if an operation hangs. HP recommends that you check your task results to verify the status of any running jobs File system types Table 16 lists the supported and unsupported file system types on the source and target managed systems for Linux image capture and deployment tasks. Table 16 File system support matrix for image capture and deployment Supported file system types Unsupported file system types ext2 ext3 Journaling File System (JFS) ext4 VMware file system (VMFS) ReiserFS Logical Volume Manager (LVM) extended partitions XFS NOTE: Insight Control for Linux does not support capture and deployment of RHEL 6, SLES 10, and SLES 11 systems installed with Software RAID Precapture and postcapture scripts Precapture scripts provide a streamlined ability to prepare or sanitize (that is, to remove confidential data) a managed system s image before capturing it. You can use a Postcapture script to undo what a Precapture script does, or to perform some other action afterward. Precapture and Postcapture scripts are Linux shell scripts; for more information on adding, removing and managing them, see Section (page 51). The Precapture, Postcapture scripts run in the Insight Control for Linux RAM disk. The managed system's file system is mounted as read/write in the RAM disk under the /mnt/target mountpoint. If your scripts manipulate any files on the managed system, remember to specify /mnt/target in the path; otherwise you are only manipulating the RAM disk files. You can use any script that is registered and copied to the repository. Insight Control for Linux also creates the /tmp/variables.txt file on a managed system, which contains hardware specific information about the server. The script can source this file (. /tmp/variables.txt) to load information determined by the RAM disk about the current operating environment. The /tmp/variables.txt file contains shell variables of the form VARIABLE="value". The most important variables are: HOSTNAME DOMAINNAME DEVICE IPADDR NETMASK NETWORK BROADCAST GATEWAY GATEWAYDEV IMAGESERVER 10.1 Overview of capturing and deploying Linux images 105

106 The script is run in a chroot environment so there is no need to configure paths relative to the Insight Control for Linux environment. For information on how these scripts can be used, see the comments in the example scripts provided with Insight Control for Linux Predeployment, postdeployment, and final deployment scripts Like the Precapture and Postcapture scripts, the Predeployment, Postdeployment, and Final Deployment scripts enable you to prepare or sanitize a captured image easily, but in this case before deploying it. You can use a deployment script to undo what a Precapture or Predeployment script did, or to perform some other action afterward. A Predeployment script is run on the managed system before the image is deployed in the Insight Control for Linux RAM disk. A Postdeployment script is run on the managed system in the Insight Control for Linux RAM disk after the image is deployed. Final Deployment scripts are similar to Postdeployment scripts in that they run after the deployment has finished, except that they are run in the environment of the newly-deployed operating system. These scripts are optional; the default behavior is to not run any script. Predeployment, Postdeployment, and Final Deployment scripts are Linux shell scripts; for more information on adding, removing and managing them, see Section (page 51). NOTE: The Predeployment and Postdeployment scripts run in the Insight Control for Linux RAM disk. The managed system's file system is mounted as read/write in the RAM disk under the /mnt/ target mountpoint. If your scripts manipulate any files on the managed system, remember to specify /mnt/target in the path; otherwise you are only manipulating the RAM disk files. You can use any script that is registered and copied to the repository. Insight Control for Linux also creates the /tmp/variables.txt file on a managed system, which contains hardware specific information about the server. The script can source this file (. /tmp/variables.txt) to load information determined by the RAM disk about the current operating environment. The /tmp/variables.txt file contains shell variables of the form VARIABLE="value". The most important variables are: HOSTNAME DOMAINNAME DEVICE IPADDR NETMASK NETWORK BROADCAST GATEWAY GATEWAYDEV IMAGESERVER The Final Deployment script performs a chroot command into the managed system's file system as a final step in the deployment operation. The script is run in a chroot environment so there is no need to configure paths relative to the Insight Control for Linux environment Prerequisites to capturing a Linux image Table 17 lists the image deployment requirements of the source and target managed systems. 106 Capturing and deploying Linux images

107 Table 17 Source and target deployment requirements Item Server type Memory Number of NICs Storage controllers Disks Disk partition layout Disk space Requirement The hardware models of the source and target managed systems must be the same. For example, if you capture an image from an HP ProLiant BL460 Gen8 server, you can only deploy that image to another BL460 Gen8 server. Differences in the amount of memory on the source and target managed systems are permitted. Differences in the number of NICs on the source and target managed systems are permitted. However, NICs must be of the same type. Storage controllers must be of the same type on the source and target managed systems. For example, an image captured from a managed system using local storage cannot be deployed to a managed system using Fibre Channel storage. The target system needs to have at least as many disks as the source system. During image deployment, Insight Control for Linux attempts to recreate the original partition scheme on the destination system. If the destination system requires a different disk layout, you can use the Partition Wizard to specify the disk partitioning scheme on the target system. For more information about the Partition Wizard, see Section 10.6 (page 116). The target system must have enough space to hold the image. IMPORTANT: You must ensure that the captured image kernel supports the selected file system types, including the Logical Volume Manager (LVM). It is especially important that the initial RAM disk of the captured image (initrd*.img) has file system support for the selected /boot and / (root) partitions, because the Deploy Operating System Deploy Linux Image... task do not remake the initial RAM disks. It is possible to remake the initial RAM disk as part of a post-installation script. HP recommends that you follow these guidelines before you capture the Linux image from a managed system: Do not capture the image on a system that has sensitive information on it. Before capturing an image from a Xen virtual host, stop all its virtual guests. For information on the virtual machine operations, see HP Insight Control Virtual Machine Management User Guide. Set up a suitable disk partitioning scheme on the source system during the initial OS installation and select the Use partition scheme from image option when you deploy the captured image. Ensure that the system clock on the CMS and the managed systems are synchronized before you capture or deploy a Linux image. For more information about how unsynchronized system clocks can affect an image deployment, see Section 1.7 (page 18). When deploying a captured image to a managed system other than the one from which it was originally captured, HP recommends ensuring that your source node obtains its IP address and host name from DHCP instead of hard-coding those values because Insight Control for Linux automatically modifies the network configuration of the new managed system to prevent address and name collisions. These modifications include: Removing or commenting any hard-coded host name references. Disabling any network interfaces that were assigned a static IP address. Replacing the source system's MAC addresses with the target system's MAC addresses in relevant configuration files Prerequisites to capturing a Linux image 107

108 If you must use static addresses and host names, create a Postdeployment script capable of setting these values. For SLES images, change the hard links to soft links before capturing the image. SLES relies on the use of hard links within its file system, and the tar command that captures the image captures those hard links. If a partitioning scheme is used during deployment that distributes files to multiple file systems (like separate /usr and /var partitions), the tar command does not allow hard links to be established across separate file systems. This generates an error, causing the task to fail. Follow these guidelines when you capture a Linux OS from a managed system with multiple disks: Each disk you want to capture must have at least one partition. Disks mounted with no partitions are not supported. You must modify the /etc/fstab file to include the mount points of all partitions on the disks you want to capture. Because disks are repartitioned during an image deployment operation, you must ensure that the contents of the disks you want to capture are listed correctly in the /etc/fstab file. For a capture operation to be successful, the dump field for each partition to be captured must be set to 1. The dump field is the fifth field in the standard mount line. Setting this field to 1 enables the partition to be captured, and setting this field to 0 (zero) bypasses the capture. Example 3 provides an example of a sample /etc/fstab file. In Example 3, two additional serial SCSI disks are located on the source system (/dev/cciss/c0d1 and /dev/cciss/c0d2), and the system disk resides on /dev/cciss/c0d0. IMPORTANT: For the capture operation to be successful,/dev/cciss/c0d1 and /dev/cciss/c0d2 must be partitioned, and the dump flag must be set to 1. Example 3 /etc/fstab file entries for a managed system with multiple disks /dev/cciss/c0d0p1 swap swap defaults 0 0 /dev/cciss/c0d0p2 / reiserfs acl,user_xattr 1 1 Proc /proc proc defaults 0 0 sysfs /sys sysfs noauto 0 0 debugfs /sys/kernel/debug debugfs noauto 0 0 usbfs /proc/bus/usb usbfs noauto 0 0 devpts /dev/pts devpts mode=0620,gid=5 0 0 /dev/cciss/c0d1p1 /Disk1 ext3 defaults 1 0 /dev/cciss/c0d2p1 /Disk2 ext3 defaults 1 0 Using the last line in Example 3 as a sample, the following table describes each field in the mount line for device /dev/cciss/c0d2p1. Field position Description Example Device name Default mount point File system type Mount options /dev/cciss/c0d2p1 /Disk2 ext3 defaults 108 Capturing and deploying Linux images

109 Field position 5 6 Description Dump option fsck option Example 1 0 The following example does not include the contents of /scratch in the captured image (because the dump flag is set to 0). During the image deployment operation, the disk is repartitioned and /scratch is an empty file system. /dev/sdc1 /scratch ext3 defaults Capturing a Linux image from a managed system IMPORTANT: Remember that captured images are retrieved through a web server interface that allows anonymous access. Therefore, any user on the network can retrieve captured images in the Insight Control for Linux repository. HP recommends that captured images do not contain confidential data if the network is untrusted. Make an effort to expunge such data from the system to be captured. To capture a Linux image from a managed system, follow these steps: 1. Ensure that you have following the image capture preparation tasks described in Section 10.2 (page 106). 2. Select the following menu item from the Insight Control user interface: Deploy Operating System Capture Linux Image 3. Do one of the following to select the managed system from which you want to capture its image: If no managed system is in the list, do the following: a. Select Collection. b. Select All Servers from the drop down menu. c. Select View Contents to display and select from the list of available servers. d. Select Apply when you have selected a server. Select Next> if the target list is correct. Select Add Targets... or Remove Target to modify the list, if the list is incorrect. 4. Select Apply when the list is correct. 5. Select Next. 6. Specify the following information about the captured image: Name Description The name you supply is used as a prefix to the directory where the image is stored. Because the repository item names are used to generate Linux file names, image names cannot contain spaces, cannot be blank, and must use only the following characters: Lowercase letters a through z Uppercase letters A through Z Numbers 0 (zero) through 9 Hyphens (-), periods (.), and underscores (_) Using any other special characters in the image name might cause errors during image capture process and result in a task failure Capturing a Linux image from a managed system 109

110 TIP: For information about the importance of choosing unique names for items in the repository, see Section (page 46). The name you supply is appended with a unique identifier and the date and time when the task occurred. The image is stored as a gzipped tar file in the /opt/repository/image/ {prefix_date_and_time} directory on the CMS. 7. Select a Precapture script, a Postcapture Script, or both. A Precapture script is run on the managed system before the image is captured. A Postcapture script is run on the managed system after the image is captured. The default behavior is to not run either type of script. 8. Do one of the following: Select Run Now to launch the image capture operation immediately. Select Schedule to schedule the image capture operation to occur in the future. 9. Monitor the Task Results window to follow the progress of the deployment operation and the related task states. 10. Select the following menu item from the Insight Control user interface to view the task results: Tasks & Logs Task Results NOTE: After an image is captured from a managed system, a sanity size check is performed on the captured image to verify that it is valid. By default, if the captured image size is less than 1,000,000 bytes, the image is considered invalid, because most operating systems yield an image size greater than that. Typically an image size less than 1,000,000 bytes indicates that an error occurred that prevented Insight Control for Linux from capturing the image. You can change the minimum image size threshold by editing the /opt/mx/icle/ icle.properties file to change the value of the CAPTURE_IMAGE_MIN_SUCCESS_SIZE variable; for example: CAPTURE_IMAGE_MIN_SUCCESS_SIZE= Setting the CAPTURE_IMAGE_MIN_SUCCESS_SIZE variable to zero overrides the sanity check and the image size is not checked Preparing for scalable deployment Scalable deployment is an optional feature that allows you to deploy a Linux image to a large number of servers (at least 32) in a short amount of time. However, you must inform Insight Control for Linux which servers are connected to which switch or enclosure beforehand. As illustrated in Figure 20, the CMS is connected to other servers through enclosures and switches (for BladeServers and non-bladeservers respectively). The BladeServers within an enclosure and the servers connected to a switch form network groups. Each network group has at least one server that acts as the group leader. 110 Capturing and deploying Linux images

111 Figure 20 Network groups example The concept behind a scalable deployment is to transfer an OS image tar file from the CMS to the group leader in each network group. After the image tar file is completely transferred, the group leader transfers the image to each of the remaining servers in the network group. The advantage to this concept is that all network traffic is kept local to the switch or enclosure. All the network groups operate in parallel without network traffic from one group affecting any other group. The procedure to associate managed systems in a discovered enclosure with a network group differs from the procedure to associate managed systems connected to a particular switch with a network group: For Enclosures When an enclosure is discovered, its managed systems are added to the All Enclosures collection. For information on discovering an enclosure, see Section 7.3 (page 75) Run the netgroup command as follows to generate the netgroups.conf file for a discovered enclosure: Generate the netgroups.conf file with the following command: # /opt/hptc/bin/netgroup --ofile /opt/mx/icle/netgroups.conf NOTE: This does not create a collection for the network group. Verify the collection entry for the group by examining the netgroup.conf file. It has an entry similar to the following: enclosurea=n121 n[ ] n133 For Switches 1. Select Customize... in the System and Event Collections panel. This figure shows the location with a red arrow Preparing for scalable deployment 111

112 The Customize Collections window appears. 2. Select New... in the Customize Collections window. A new section titled New Collection appears at the bottom of the Custom Collections window. 3. Select the Choose members individually radio button. 4. Select All Servers from the Choose from: menu. This action populates the Available Items: list with the available servers. 5. Perform the following steps for each switch you have: a. Determine which server is the group leader for the servers in a switch or enclosure. This step and the next determine the group leader for a network group because the first server chosen is determined to be the group leader. b. Use the >> button to move the group leader from the Available Items: list to the Selected Members: list. c. Select the remaining servers that are connected to the same switch or enclosure. You can use Ctrl-Left Mouse for multiple selections. d. Use the >> button to move the selected servers from the Available Items: list to the Selected Members: list. e. Repeat the last two steps (5c and 5d) as needed. 112 Capturing and deploying Linux images

113 f. Select Save As Collection... The Save As Collection portion appears. g. Enter a name for this network group. The name is used only to associate the managed systems in the network group. h. Select Existing collection: and choose the Network Groups menu item. i. Select OK to continue. j. Generate the netgroups.conf file with the following command: # /opt/hptc/bin/netgroup --ofile /opt/mx/icle/netgroups.conf k. Examine the netgroup.conf file to verify the collection entry for the group. If the name of the group is Switch1 and the servers that comprise it are n1, n3, n4, and n5, the netgroups.conf file contains a line similar to the following: Switch1=n1 n3 n4 n5] By default, scalable deployment images one leader per network group, up to 16 groups at a time, and each leader can, in turn, image 16 managed systems at a time within its network group. If you want to change this behavior, edit the /opt/mx/icle/icle.properties file to add any of the following variables, as needed. You do not need to restart Insight Control for Linux for these changes to take effect. Table 18 Scalable deployment environment variables Variable LSD_NUM_LEADERS_PER_GROUP LSD_MAX_LEADERS_AT_ONCE LSD_MAX_DOWNLOADERS_PER_LEADER Description Number of leaders per network group. Number of leaders imaged concurrently. Number of managed systems that a leader can image concurrently. Default value The number of group leaders that start imaging concurrently depends on the values of LSD_NUM_LEADERS_PER_GROUP and LSD_MAX_LEADERS_AT_ONCE variables. For example, if the value of LSD_NUM_LEADERS_PER_GROUP is 1 and the value of LSD_MAX_LEADERS_AT_ONCE is 16 (these are their default values), then 16 leaders (each in a different network group) start imaging concurrently. If, however, the value of LSD_NUM_LEADERS_PER_GROUP is 2, the leaders in the first 8 network groups start imaging concurrently because each group has 2 leaders and the maximum leaders at once is set to 16. After the image is downloaded from the CMS, the leader starts to image the managed systems in its network group. The leader images as many managed systems as the value of the LSD_MAX_DOWNLOADERS_PER_LEADER variable. If there is more than one leader in the network group, each leader images as many managed systems as the value of LSD_MAX_DOWNLOADERS_PER_LEADER. A leader does not reboot until all the managed systems in its network group are imaged, failed, or cancelled Deploying a captured Linux image to one or more managed system Insight Control for Linux enables you to deploy a captured Linux image from one managed system to one or more managed systems. The Deploy Linux Image... task shuts down the managed systems and reboots them. The RAM disk starts the image deployment Deploying a captured Linux image to one or more managed system 113

114 IMPORTANT: HP recommends that, if you are deploying the image to a software RAID array or an LVM volume, that you wipe the disk or disks that will receive the image. Before deploying a 64-bit OS image to an AMD Opteron 6200 server, add the following entry to the /opt/mx/icle/icle.properties file before deploying the image: EXTRA_KERNEL_PARAMS=acpi=off To determine if your server is an AMD Opteron 6200 server, see the HP Insight Management Support Matrix or the HP Insight Control for Linux Support Matrix. To deploy a captured image to one or managed systems, follow these steps: 1. Select the following menu item from the Insight Control user interface: Deploy Operating System Deploy Linux Image Do one of the following to select one or more target managed systems: If no servers are in the list: a. Select Collection. b. Select All Servers from the drop down menu. c. Select View Contents to display a list of available managed systems in the collection. d. Select one or more managed systems from the list. e. Select Apply. f. Select Next> after you verify that the managed systems list is correct. Select Next> if the target list of selected managed systems is already correct. Select Add Targets... or Remove Target to modify the list, if the list of selected managed systems is incorrect. 3. Apply an Insight Control for Linux license to the managed systems that are not licensed. 4. Select Next> when all selected managed systems are licensed. 5. Select the distribution method. The choices are: Standard Deploy Linux Image Select this method for deploying an image to 32 or fewer managed systems or if you have not prepared for scalable deployment. Scalable deployment Select this method for deploying an image to more than 32 managed systems and you have prepared for scalable deployment. IMPORTANT: You must assign servers to network groups before you can use the Scalable Deployment method. See Section 10.4 (page 110) for more information. The captured image of a 32-bit OS must be smaller than 2 GB so that you can use scalable deployment. You must use the Standard Deploy Linux Image method instead. You can use scalable deployment for deploying captured images of a 32-bit operating system that is larger than 2 GB in size or of a 64-bit operating system without regard to size. 6. Select Next>. 7. Select an image to deploy, then select Next>. 8. Specify whether or not you want to modify the disk partition layout on the imaged systems: Select the Use partition scheme from image option if you want to apply the disk partition layout from the captured image to the target managed systems. Select Next>. 114 Capturing and deploying Linux images

115 Select the Create partition scheme from wizard option if you want to customize the disk partition layout on the target managed system, and the following table appears: Figure 21 Existing disk partition scheme See Section 10.6 (page 116) for a general overview of the Partition Wizard and how to use it to edit disk partitions and volume groups. Select Next> after you have completed customizing the disk partition layout. 9. Optionally select any or all of the following types or scripts (one of each): Predeployment script Postdeployment script Final Deployment script For information on these scripts, see Section (page 106). 10. To start the image deployment, do one of the following: Select Run Now to launch the image deployment operation immediately. Select Schedule to schedule the image deployment operation to occur in the future. 11. Monitor the Task Results window to follow the progress of the image deployment operation and the related task states. During a deployment, most messages are written to /tmp/rct-debug.log on the target server. If deployment does not complete, use the console to examine this file. For example, if the source managed system has two disks, but the target server only has one disk, you might see the following message in /tmp/rct-debug.log: yyyy/mm/dd time: Waking up yyyy/mm/dd time: Capturing GrubBootLoader loader yyyy/mm/dd time: Image Service gendeploycmds yyyy/mm/dd time: gendeploycmds Failed : Message = target does not have enough drives for the image 10.5 Deploying a captured Linux image to one or more managed system 115

116 10.6 Insight Control for Linux partition wizard overview The Insight Control for Linux Partition Wizard is a generic hybrid of the Red Hat and Novell Partition Wizards. The Partition Wizard does not have logic to examine the managed systems on which it is used, thus you must have prior knowledge of the storage hardware. The Partition Wizard enables you to capture an image with one partition scheme and then to deploy the image to one or more managed systems with a more customized partition scheme. An example of this might be a default installation where the file system was installed with a / (root) and swap partition. You could capture this image and later deploy it to multiple servers as /, swap, /opt, /usr, and /var without having to manually manipulate the image. The Partition Wizard user interface provides a representation of the disk partition layout to be applied to the target server before laying down the image. Because the Partition Wizard does not know about the storage media, it works with a generic representation that was created to describe the storage media. The Partition Wizard is designed to work with the ext3, ReiserFS, Swap, and LVM file system types Partition wizard requirements and guidelines If you use the Partition Wizard to specify a customized disk layout, be aware of the following requirements: The /boot directory or partition (depending on how the source managed system was installed) should remain in the same relative location in the deployed image. In SLES, the default is to place the entire root (/) partition as the second partition (partition 1) on the drive (this includes the /boot directory.) In RHEL, the default is to create a partition with a mount point of /boot as the first partition (partition 0) on the drive, and a separate root (/) partition in an LVM elsewhere. In both of these examples, when you deploy the captured image, you must ensure that the /boot directory or partition remains in the same numbered partition. You are free to resize these as required, however, do not change their location. RHEL places the root partition in a logical volume group named VolGroup00 by default. If you use the Partition Wizard to build a custom partitioning layout and choose to place the root partition in a logical volume group (LVM), you must place it into a logical volume group named VolGroup00. Do not rename this LVM. If you used a custom Kickstart installation configuration file to install the initial system, and you specified a different default logical volume group name, you must use the same name in the Partition Wizard. The mechanism used to capture a Linux image (the tar command) preserves any hard links that exist within your file system. When you deploy an image and use the Partition Wizard to create a complex disk layout (for example, including separate /, /boot, /usr, and /var file systems), you might experience difficulties as the image extraction attempts to re-create the captured hard links that cross file systems. Should this occur, the deployment fails. If you plan to use separate partitions, before capturing the image, replace any hard links with symbolic links. This is particularly an issue with SLES because it specifically uses a hard link to link a file in /etc and /usr/share, potentially crossing file system boundaries. If you plan to deploy an image using different file system types than were originally used to install the source managed system, you must ensure that support for the new file system is built into the OS (kernel module, and file system tools packages) before capturing the image. 116 Capturing and deploying Linux images

117 If you are capturing and deploying a reiserfs or an ext3 partition type, ensure that the mount points are set, as required. Partition types swap and lvm do not have mount points. The Partition Wizard permits you to proceed without specifying mount points for the reiserfs and ext3 partition types, and it does not detect the missing mount points. This might cause the deployment to fail, and the failure is indicated in the Task Results. The Partition Wizard does not save entered values for reuse. If you used the Partition Wizard to create a partition scheme, then use the <Previous button to return to the Partition Wizard page two or more times, the partition scheme you created is lost and the default partition scheme is displayed again. You must re-create the partition scheme. Likewise, If you are rerunning a task and had used the Partition Wizard to create a partition scheme, the partition scheme you previously created is lost; you must re-create the partition scheme. Ensure that the selected boot partition matches the boot partition in captured image. If you use the Partition Wizard to specify a different disk partitioning scheme, the bootable partition (typically /boot or /) must be the same partition as in the captured image. This is typically the first partition (partition 0) for RHEL distributions, but the second partition (partition 1) for SLES distributions. If you use the Partition Wizard to change the storage layout for RHEL image deployments using logical volumes, ensure that the first volume group is named VolGroup00. This value is coded into the initial RAM disk (initrd*.img) to activate logical volumes, and Deploy Linux Image does not remake the initial RAM disks. It is possible to remake the initial RAM disk as part of a post-installation script. Do not to allocate more storage than is available on the disk or is within a defined volume group. This can be best accomplished by always defining a partition (or logical volume if using LVM) that uses the available space or is growable. You must ensure that the partitions and logical volumes are sized properly to fit within the free space. Partitions used for logical volumes must be in the first four disk partitions. If there are five or more partitions, the logical volume must be in the first three disk partitions. This limits the maximum number of partitions that can be used for volume groups to three (if only four partitions are created) or two (if more than four partitions are created). IMPORTANT: requirements. A deployed image might not boot if you do not follow these guidelines and If you cannot meet the requirements or you are not experienced with Linux, kernel modules or grub, HP recommends that you deploy an image using the partitioning scheme in the image itself rather than using the advanced Partition Wizard. For additional limitations or restrictions regarding the use of the Partition Wizard, see the HP Insight Control for Linux Release Notes Using the partition wizard Storage drives are defined as disks and partitions are called partitions. A shortened form of this is seen in the Volume Group dialog where the Disk has a capital letter D followed by the disk number. For example, for /dev/sda or /dev/hda is would be D0. Partitions follow the same syntax as disks and are named P1 for partition 1. For example, D1:P1 represents /dev/sdb2 or /dev/hdb2. This syntax follows a similar syntax to the Red Hat grub boot loader Insight Control for Linux partition wizard overview 117

118 The initial Partition Wizard table is divided into two sections: Hard Drives, the top of the table that shows the physical devices, and Volume Groups, the bottom part of the table that shows logical volumes: The Hard Drives section represents the physical media on the server. You must have prior knowledge about the hardware in order to add the correct number if disks. You can add a maximum of 16 disks to the Hard Drives section along with a maximum of 16 partitions per disk. When you create a partition, you must specify the mount point and size specification. The fill to maximum available size radio button uses the remainder of the disk space and eliminates the need to specify a size. The Insight Control for Linux RAM disk environment examines the disk and creates a partition for the remaining space. The Volume Groups section is where you create volume groups. To create a volume group, select the Volume Groups row and select Add. If an LVM partition is not available, a message is displayed. In this case, you must add a partition with the file system type set to LVM, which creates a physical volume (PV) device to be used in a volume group. When you create a volume group, you must specify the name of the logical volume and choose which partitions (physical volumes) to use. By default, you can only select available LVM partitions. If at any time the PV device for a volume group is deleted, the Partition Wizard prompts you to verify that you want to delete the associated volume group. You have the following options: Select OK to create an empty volume group and return later to define the logical volumes. Select Add to create a logical volume. You create logical volumes by either editing an volume group or while creating a volume group. From within the Volume Group dialog box, select Add and define the logical volume parameters. You must specify the logical volume group name, mount point, and size. You cannot exceed the maximum available PV size when you create a logical volume. 118 Capturing and deploying Linux images

119 11 Installing and setting up virtual machines This chapter addresses the following tasks, which you must complete in this order: 1. Installing virtual hosts (page 119) 2. Registering the virtual host with Insight Control virtual machine management (page 120) 3. Creating and installing virtual guests (page 121) 4. Obtaining virtual guest and virtual host associations (page 127) 5. Establishing monitoring for virtual hosts and virtual guests (page 128) 6. Virtual guest operations (page 128) NOTES: By default, CPU virtualization enhancements are disabled in HP servers. For servers to be used for virtualization, especially for fully virtualized guests, change the following BIOS setting on the server accordingly; for example: Advanced options Processor Options... Intel(r) Virtualization Technology. Advanced options Processor Options... AMD Virtualization. These enhancements are required for virtualization using Xen and are recommended for VMware ESX and VMware ESXi virtualization operating systems. The BIOS settings in your server might vary slightly. The following BIOS setting needs to be enabled for VMware ESX and VMware ESXi virtualization operating systems: Advanced options Processor Options... No-Execute Memory Protection By default, this option is set to Disabled. Installing ESXi 5.0 using PXE from a CMS running a SLES 10 operating system requires the use of tftp instead of atftp; ESXi 5.0 contains very large boot files that atftp cannot manage. Only tftp or atftp can be installed, not both. For information on uninstalling atftp and installing tftp, see Uninstalling atftp and installing tftp (page 196) Installing virtual hosts The next step is to install the operating system that enables a physical server to act as a virtual host. HP provides templates for the installation configuration files for virtual hosts; use a copy of the configuration file, edited for your environment. These templates are located in the Insight Control for Linux repository; the text -virt-host identifies them; for example: rh061 virt-host-xen rh061 virt-host-kvm sll04 virt-host-xen esx040 Xen Kickstart for RHEL Version 6 Update 1 with Virtualization Host KVM Kickstart for RHEL Version 6 Update 1 with Virtualization Host Xen AutoYaST for SLES Version 10 Service Pack 4 with Virtualization Host Installation configuration file for VMware ESX Use these templates to create your own installation configuration files, suited to your environment. Remember to register your installation configuration files in the Insight Control for Linux Repository. For information on which virtualization operating systems Insight Control for Linux supports, see HP Insight Control for Linux Support Matrix. The steps to install a virtual host are: 1. Discover the physical host. The host must appear as a managed system that HP SIM recognizes Installing virtual hosts 119

120 2. Set the Global Sign-In credentials for the virtual host with the Options Security Credentials Global Credentials... menu item. 3. Install the operating system with virtualized configuration on the physical server of your choice. Chapter 9 (page 87) describes the steps for using Insight Control for Linux to install a Linux operating system. 4. Run Options Identify Systems... to verify the installation. The next step is to register the virtual host with the virtual machine management Registering the virtual host with Insight Control virtual machine management IMPORTANT: Before a host can be registered, either through the VM Host registration menu item or with the Configure Configure or Repair Agents... task, the sign-in credentials must be specified either as global credentials, discovery credentials, or system credentials. Otherwise, no credentials are set and the following error message is returned during Insight Control virtual machine management registration: No valid working Sign-in credentials were found for the system in HP SIM. Check the Sign-in credentials by going to Options->Security->Credentials->System Credentials After the operating system is installed on the virtual host, use the following procedure to register the virtual host with the Insight Control virtual machine management: 1. For hosts running VMware ESX or VMware ESXi only: Add the host name to the vcenter application. For more information on the vcenter application, see HP Insight Control Virtual Machine Management User Guide. 2. Run the Configure Configure or Repair Agents... task on the virtual host: NOTE: This step does not apply to VMware ESXi. The WBEM providers (agents) are embedded in VMware ESXi purchased from HP. Ensure that the Install Linux PSP or ESX Agents and Register VM Host check boxes are checked in the Install Providers and Agents screen. For information on configuring the agents, see Section (page 80). 120 Installing and setting up virtual machines

121 3. Examine the system page for the virtual host with Tools System Information System Page... task to verify that Insight Control virtual machine management is configured correctly. Locate the System Subtype row under Product Description. The description should contain the text Virtual Machine Host Creating and installing virtual guests Generally this section discusses how: To create the virtual guest: HP suggests that you use the vcenter application for VMware ESX and VMware ESXi. HP suggests that you use the virt-manager utility for Xen and KVM. To install and configure an operating system that runs on the virtual guest. You must address the requirements for memory, disk storage, MAC addresses, network information, and the installation media URL (which links to the Insight Control for Linux repository). If you intend to use DHCP, you must set up the DHCP server for the virtual guests. For more information, see Setting up the DHCP server for virtual guests (page 196). This section provides information for creating a VMware ESX virtual host, a VMware ESXi virtual host, or a Xen virtual host Guidelines for configuring a VMware ESX or VMware ESXi virtual guest You will need the vcenter application to create a virtual guest. For more information on this application, see the HP Insight Control Virtual Machine Management User Guide. For information on licensing virtual guests, see Section 3.3 (page 28). This section describes one possible method to create and configure a VMware ESX or VMware ESXi guest. There are many other ways to accomplish the same result. Use the following guidelines for configuring a VMware ESX or VMware ESXi virtual guest: 1. Use vcenter to create a VM guest machine on a VMware ESX or VMware ESXi host. vcenter is accessed using the vsphere Client application running on any Windows system with network access to the vcenter host. In this step, select the operating system to be installed on the VM guest. 2. Make a bootable ISO image visible to the managed host: a. Obtain or create an ISO image for the operating system you want to install on the VM guest. b. Make this ISO image visible to the vcenter server. To achieve this, use FTP to transfer the ISO image to the vcenter, or map a shared drive/folder containing the ISO image onto the vcenter system. c. Browse to the datastore associated with the VMware ESX or VMware ESXi host system, then add the ISO made visible in the previous step (2b) into the vcenter datastore. NOTE: Alternatively, you can create an NFS backed datastore that makes the bootable ISO visible directly to the managed host. For more information, see the VMware documentation. 3. Select the ISO image in the datastore as the CD or DVD image for the VM guest to be installed, and select to connect it at power on. 4. Verify that the VM guest is configured to enter the BIOS on the next boot; if it is not in that state, change it. When in the BIOS, change the boot order to boot from the CD or DVD first. This ensures that the system boots from the CD or DVD before the other choices. 5. Open the console of the VM guest Creating and installing virtual guests 121

122 6. Boot the VM guest, and proceed through an interactive install. 7. Perform a network installation using an installation configuration file from the Insight Control for Linux repository. Be sure to specify any required kernel parameters. The following is an example of the response to the boot prompt. boot: linux ks= ksdevice=device Where: cms port os_specifier device For example, Is the fully-qualified IP address of the CMS Is the port used Specifies the operating system to be installed on the virtual guest, for example, RHEL6U1-i386 or SLES11SP1-i386/DVD1. Some releases of SLES may specify CD1 instead of DVD1. Is the network device to connect to the network. boot: ks= ksdevice=eth1 NOTE: This example is written on two lines for ease of display; the actual entry would be on a single line. 8. To monitor a virtual guest, it must be assigned a well-known IP address. This can be either the static IP address that you entered when you installed the virtual guest or, if you used DHCP, the fixed IP address that maps to the MAC address you establish. For more information, see Section (page 196). 9. The time to complete the installation depends on the operating system and network performance Guidelines for configuring a KVM virtual guest This section describes one possible method to create and configure a KVM virtual guest. There are other ways to accomplish the same result. You will need the virt-manager utility and an X window session to create a virtual guest. Be sure to consult the documentation for the virt-manager utility For information on licensing virtual guests, see Section 3.3 (page 28). IMPORTANT: The RHEL Kickstart and SLES AutoYaST configuration template files for virtual guests are delivered with a hard-coded root password, which poses a security issue if used without modification. For secure installations, HP recommends that you install the virtual guest operating systems in a manner that keeps the root password secure, such as an interactive installation, or use a Kickstart or AutoYaST file that is properly protected on the local host. Secure installations should not store the root password on the CMS Installing a RHEL KVM virtual guest Use the following guidelines for configuring a KVM virtual guest: Verify that the Kickstart file for the virtual guest resides in the /opt/repository/instconfig/osver-virt-guest-kvm directory on the CMS, where osver indicates the operating system version, for example, rh057. The format of the Kickstart file name is osver-virt-guest-kvm.cfg If you need to customize the Kickstart file, do so before proceeding. Open an xterm window or a remote desktop connection to the virtual host. Run the virt-manager utility on the virtual host to create and name a new machine. 122 Installing and setting up virtual machines

123 TIP: Match the machine name to the host name in a virtual machine map. See Section (page 196). Ensure that the localhost (QEMU) is connected. If the localhost entry is missing, select File Add Connection, then select QEMU/KVM as the hypervisor, specify that the connection is Local, and select Connect. If the localhost entry exists but is not connected, right-click on the localhost entry and select Connect. Start the procedure by selecting New. Specify a unique name for the virtual guest. Select Network Install. When prompted for the URL, enter: Where: CMS Is the fully-qualified IP address of the CMS IMPORTANT: The port for this server must be 80, which is the default. os_specifier Specifies the operating system to be installed on the virtual guest, for example, RHEL6U1-i386. Under URL options, specify a URL that links to virtual guest configuration file in the Insight Control for Linux Repository: IMPORTANT: The port for this server must be 80, which is the default. Select the option so that virt-manager automatically detects the operating system based on the installation media. Otherwise, you need to select the OS type and the version. The default value for the memory setting is adequate. However, if you have sufficient memory, you can increase this value to 1024 to improve the virtual guest machine performance. When creating a disk image for the virtual guest machine, the default storage setting for the guest is sufficient unless you know that the applications you want to run need additional storage. Select Advanced options to configure the NIC correctly as a bridge. Select br0 or br1, as appropriate. To determine which one to select, run the ifconfig command on the KVM host and select the bridge that has the assigned IP address you want. Select the option to enter a fixed MAC address and enter the MAC address for the virtual guest. For more information, see Section (page 196) After the last entry, the installation begins and should proceed to completion. You can monitor its progress by opening the virtual guest console under virt-manager; locate the guest with the name you entered and select Open to open its console. Monitor the virtual guest installation until it completes and the virtual guest machine reboots. If it does not restart, either: Click Run on the console window or Locate the virtual guest by name in virt-manager, then right-click and select Run to start it. The virtual guest will boot and become operational Creating and installing virtual guests 123

124 Installing a SLES KVM virtual guest Use the following guidelines for installing a SLES KVM virtual guest: Verify that the AutoYaST file for the virtual guest resides in the /opt/repository/instconfig/osver-virt-guest-kvm directory on the CMS, where osver indicates the operating system version, for example, sl111. The format of the AutoYaST file name is osver-virt-guest-kvm.cfg Installing a SLES KVM virtual guest requires an ISO. Download the ISO and copy it to the KVM virtual host. If you need to customize the AutoYaST file, do so before proceeding. Open an xterm window or a remote desktop connection to the virtual host. Run the virt-manager utility on the virtual host to create and name a new machine. TIP: Match the machine name to the host name in a virtual machine map. See Section (page 196). Ensure that the localhost (QEMU) is connected. If the localhost entry is missing, select File Add Connection, then select QEMU/KVM as the hypervisor, specify that the connection is Local, and select Connect. If the localhost entry exists but is not connected, right-click on the localhost entry and select Connect. Start the procedure by selecting New. Choose the option that states that you need to install an operating system. Specify the OS type that will run on the virtual guest. Select SUSE, then the OS version that matches the ISO image you copied to the KVM virtual host. In the Summary window: Specify a unique name for the virtual guest. The default value for the memory setting is adequate. However, if you have sufficient memory, you can increase this value to 1024 to improve the virtual guest machine performance. When creating a disk image for the virtual guest machine, the default storage setting for the guest is sufficient unless you know that the applications you want to run need additional storage. Select Network Adapters to configure the NIC correctly as a bridge. Highlight the bridge setting, then select Edit. Select br0 or br1, as appropriate. To determine which one to select, run the ifconfig command on the KVM host and select the bridge that has the assigned IP address you want. Select the option to enter a fixed MAC address and enter the MAC address for the virtual guest. For more information, see Section (page 196) When you are satisfied with the settings in the Summary window, apply the changes, and select Operating System Installation. Be sure that Virtual Disk is selected and that you select + Add. In the Virtual Disk window, select Browse to specify the location of the ISO image on the virtual host. You will need to double-click File System in the navigation bar on the left. 124 Installing and setting up virtual machines

125 Accept the default values for the Power Off, Reboot, and Crash options. Before you select OK to start the installation, be advised that you have 20 to 30 seconds to specify that an Installation is to be performed on subsequent screens. If the timeout elapses, the virtual guest attempts to boot from the hard disk. The following needs to occur within this time: The virtual guest console should open automatically after you select OK. If it does not, locate the virtual guest's name in the virt-manager utility, right-click on it, and select Open to open the monitoring console. The virtual guest loads the kernel as it starts, and the Boot from Hard Disk will be highlighted in the window. Use the cursor keys to select Installation. When you are ready, select OK to start the installation. For the Boot Options, enter network parameters and the AutoYaST file, for example: netsetup=dhcp,all netwait=30 autoyast= NOTE: line. This example is shown on two lines for clarity, enter these boot options on the same After pressing Enter, the installation begins and should proceed to completion. You can monitor its progress by opening the virtual guest console under virt-manager; locate the guest with the name you entered and select Open to open its console. Monitor the virtual guest installation until it completes and the virtual guest machine reboots. If it does not restart, either: Click Run on the console window or Locate the virtual guest by name in virt-manager, then right-click and select Run to start it. The virtual guest will boot and become operational. If SSH does not function, check the NIC by using the ping command: # ping virtual_guest_name Check that the configured MAC address matches the DNS/DHCP entry. The virt-manager command might display MAC addresses beginning with 00:16:3e, but configure the NIC to start with 52:54:00 instead. You can adjust the MAC address by running these commands on the KVM virtual host: 1. Use the following command to shut down the virtual guest: # virsh shutdown virtual_guest_name Watch the console to determine that the virtual guest is completely shut down. 2. Edit the MAC address with the virsh edit command: # virsh edit virtual_guest_name Save your changes and exit the editor. 3. Restart the virtual guest: # virsh start virtual_guest_name Guidelines for configuring a Xen virtual guest This section describes one possible method to create and configure a Xen virtual guest. There are many other ways to accomplish the same result. You will need the virt-manager utility and an X window session to create a virtual guest. Be sure to consult the documentation for the virt-manager utility 11.3 Creating and installing virtual guests 125

126 For information on licensing virtual guests, see Section 3.3 (page 28). IMPORTANT: The RHEL Kickstart and SLES AutoYaST configuration template files for virtual guests are delivered with a hard-coded root password, which poses a security issue if used without modification. For secure installations, HP recommends that you install the virtual guest operating systems in a manner that keeps the root password secure, such as an interactive installation, or use a Kickstart or AutoYaST file that is properly protected on the local host. Secure installations should not store the root password on the CMS. Use the following guidelines for configuring a Xen virtual guest: Verify that the Kickstart or AutoYaST file for the virtual guest resides in the /opt/repository/instconfig/osver-virt-guest-xen directory on the CMS, where osver indicates the operating system version, for example, rh057. The format of the Kickstart or AutoYaST file name is osver-virt-guest-xen.cfg. If you need to customize the Kickstart or AutoYaST file, do so before proceeding. Open an xterm window or a remote desktop connection to the virtual host. Run the virt-manager utility on the virtual host to create and name a new machine. TIP: Consider matching the machine name to the host name in a virtual machine map. See Section (page 196). Select the Paravirtualized option for the virtualization method. The installation media URL (also called the Network URL) for the operating system must link to the Insight Control for Linux Repository: Where: CMS port os_specifier Is the fully-qualified IP address of the CMS Is the port used Specifies the operating system to be installed on the virtual guest, for example, RHEL6U1-i386 or SLES11SP1-i386/DVD1. Some releases of SLES may specify CD1 instead of DVD1. For example, For a RHEL Kickstart file, specify a URL that links to its location in the Insight Control for Linux Repository: Where: osver Specifies the operating system version, for example rh057. For a SLES AutoYaST file, place a copy of the AutoYaST file from the Insight Control for Linux Repository in the /tmp directory, use the text editor of your choice to modify this file to edit the root password if needed, and specify the path to the file in /tmp: # cd /tmp # wget # chmod 0600 osver-virt-guest.cfg # vi osver-virt-guest.cfg Where: osver Specifies the operating system version, for example sl Installing and setting up virtual machines

127 The SLES AutoYaST file is located in /tmp/osver-virt-guest.cfg. Specify the Simple file option for the storage space assignment. Select an available physical device for the connection to the Host Network, for example, peth0. To monitor a virtual guest, it must be assigned a well-known IP address. This can be either the static IP address that you entered when you installed the virtual guest or, if you used DHCP, the fixed IP address that maps to the MAC address you establish. For more information, see Section (page 196). The time to complete the installation depends on the operating system and network performance. Monitor the progress of the installation in the xterm window or in the remote console window Obtaining virtual guest and virtual host associations Use the following procedure to obtain an association between the virtual host and the virtual guest. NOTE: During the discovery of the virtual host, HP SIM identifies the virtual guests from the perspective of the virtual host, assigning the name {virtual-host-name}_{virtual-guest-name}. During the discovery of the virtual guest, HP SIM becomes aware of the host name and IP address given to the virtual guest during OS installation. When a virtual host or a virtual guest is discovered and the virtual guest information from a corresponding virtual guest or virtual host discovery is available, HP SIM associates the newly discovered guest with the existing guest using the operating system host name as the managed system name. For example, consider a virtual host named vh on which a virtual guest named vg is created. When the OS is installed, vg obtains the name pluto. After discovery of both the virtual host and virtual guest, HP SIM accepts the association and renames vh_vg to pluto. 1. Determine if HP SIM lists the virtual guest under the virtual host. Examine the appropriate system collection under System and Event Collections. If HP SIM does not list the virtual guest, run Options Identify Systems Power on the virtual guest from HP SIM, by selecting the virtual guest node then selecting Tools Virtual Machine Start Virtual Machine. Wait until the virtual guest boots. 3. Run the ping command from any system to verify the virtual guest is up and running. Specify the well-known IP address for the virtual guest. 4. From HP SIM, perform an OS discovery of the virtual guest: a. Select Options Discovery, specifying the virtual guest. b. Select New. c. Specify the virtual guest by either its well-known IP address or its host name. d. Enter root for the User name: text field. e. Enter the root password in the Password: and Confirm Password: text fields. f. Select OK. g. Select Save. h. Select Run Now. If this procedure fails to associate the virtual guest with the virtual host: 1. If the guest credentials are incorrect then HP SIM creates, in the list of systems, a system for the IP address or host name specified in the discovery task with a system type of Unknown. 2. Rerun the Options Identify Systems... task to identify the virtual guest Obtaining virtual guest and virtual host associations 127

128 11.5 Establishing monitoring for virtual hosts and virtual guests NOTE: Insight Control for Linux does not support monitoring of VMware ESXi virtual hosts or virtual guests running Microsoft Windows Configuring a virtual host or a virtual guest for monitoring is the same procedure as for real managed systems. In short, the procedure consists of the following Insight Control for Linux menu items: 1. Configure Configure or Repair Agents... on the virtual guest. Ensure that the Configure secure shell (SSH) access authentication check box is checked. For an illustration, see Figure 19 (page 82). 2. Run Options IC-Linux Configure Management Services. The virtual hosts and virtual guests can now be monitored with Insight Control for Linux. Now you can perform additional Insight Control virtual machine management operations. For information on Insight Control virtual machine management operations, see HP Insight Control Virtual Machine Management User Guide Virtual guest operations For VMware ESX and ESXi, and Xen virtualizations, the HP Insight Control Virtual Machine Management User Guide provides information on using the Insight Control virtual machine management controls and tools, including the following: Starting or resuming a virtual machine guest: Tools Virtual Machine Start Virtual Machine Shutting down or stopping a virtual machine guest: Tools Virtual Machine Stop Virtual Machine CAUTION: If you shut down or stop a virtual machine guest, unsaved data is lost. Suspending or pausing a virtual machine guest: Tools Virtual Machine Suspend Virtual Machine Resetting or restarting a virtual machine guest: Tools Virtual Machine Restart Virtual Machine For KVM virtualizations, HP recommends using the virt-manager, virsh, and other, KVM-specific commands to manage the virtual guests from their KVM hosts, where these tools are typically installed. For example: Starting or resuming a virtual machine guest: # virsh start virtual_guest_name Shutting down a virtual machine guest gracefully: # virsh shutdown virtual_guest_name CAUTION: If you shut down a virtual machine guest, unsaved data is lost. Suspending a virtual machine guest: # virsh suspend virtual_guest_name Moves a virtual machine guest out from its suspended state: # virsh resume virtual_guest_name 128 Installing and setting up virtual machines

129 NOTE: For specific commands, see the virsh(1) and virt-manager(1) manual pages that accompany your KVM distribution Virtual guest operations 129

130 12 Using Insight Control for Linux to update HP ProLiant firmware This chapter addresses the following topics: Overview of updating HP ProLiant firmware (page 130) Basic firmware update functionality (page 130) Advanced firmware update functionality (page 134) 12.1 Overview of updating HP ProLiant firmware Keeping firmware up to date is a challenging but necessary task. Each ProLiant server usually has several devices that require regular firmware updates, which can create a burden. HP offers tools that help simplify this task. These tools are distributed on the HP Smart Update Firmware DVD, which is available for download at Insight Control for Linux has additional tools that enable you to integrate the HP ProLiant Firmware Smart Update Firmware DVD onto your Insight Control for Linux CMS, then use Insight Control for Linux to update the firmware on a system, either on demand from the HP Insight Control user interface;, or automatically, when a system is discovered using the Insight Control for Linux bare-metal discovery feature. You can configure your CMS to perform basic firmware updates in just a few simple steps. Basic firmware updates means that when a firmware update is run, all devices on the server are automatically updated to the latest version of the firmware that was available on the Smart Update Firmware DVD you chose to download. For those administrators who require more control of what firmware is allowed to be installed on which servers, Insight Control for Linux provides advanced firmware configuration features that allow the administrator to specify exactly which firmware sets are allowed to be installed on a per-server basis. The instructions in this section are divided into basic and advanced sections. IMPORTANT: Firmware updates initiated through Insight Control for Linux are done off line. A running system is shut down for the update. When the firmware update is complete, the system is left powered off. If you want to boot the system afterwards, you must power on the server using the Insight Control for Linux Power On Server tool Firmware updates are run using the HP Smart Update Manager (HPSUM) tool from the HP ProLiant Smart Update Firmware DVD. All firmware updates are run using the hpsum command's --silent option, which means that the update is not interactive. The firmware files you provided are scanned, and any devices that can be updated are updated. For more information on how the hpsum command works and available command line options, see the HP Smart Update Firmware DVD User Guide, which you can download from the following web address: Basic firmware update functionality Basic firmware update functionality is designed to provide an easy to set up and easy to use way of updating firmware for people who simply want to keep their firmware up to date. Just download the latest Smart Update Firmware DVD, install it into the Insight Control for Linux repository, and run the update. 130 Using Insight Control for Linux to update HP ProLiant firmware

131 Initial setup Before you can initiate a firmware update on a server, you must download and prepare the firmware files and tools that do the work. Insight Control for Linux uses the HP Smart Update Firmware DVD or Service Pack for ProLiant (SPP) for all firmware updates. Downloading and installing these files is a one time setup operation, although when new versions of the HP Smart Update Firmware DVD or SPP become available, update the tools on your CMS. Here are the procedures for setting up firmware updates from the HP Smart Update Firmware DVD and SPP, respectively: HP Smart Update Firmware DVD You must copy the firmware files and tools into the Insight Control for Linux repository from the HP Smart Update Firmware DVD before you can update the firmware with the following procedure: 1. Obtain the latest version of the HP Smart Update Firmware DVD. You can either download the Smart Update Firmware DVD from under the Software and Drivers pages or you can order the DVD. 2. Use the appropriate command to mount the Smart Update Firmware DVD; the media dictates the command you use. Two examples are: # mount /dev/cdrom /mnt # mount o loop /tmp/fw _ iso /mnt 3. Create a tar file based on the contents of the /hp/swpackages directory of the Smart Update Firmware DVD and store it in the repository at /opt/repository/firmware/ firmware-files.tar. This is the default firmware file name and must be used unless you are using the advanced firmware features described in Section 12.3 (page 134). Use the following commands to create the firmware tar file: # cd /mnt/hp/swpackages # tar --exclude "*\.exe" --wildcards -c -v \ -f /opt/repository/firmware/firmware-files.tar. The initial setup is complete after your firmware tar file is created. HP Service Pack for ProLiant 1. Use the spp-firmware-to-tar command to extract the firmware files from the SPP ISO that you already registered in the Insight Control for Linux repository and downloaded. For example: # /opt/hptc/bin/spp-firmware-to-tar \ --sppfile=/opt/repository/psp/spp /spp _ iso Created /opt/repository/firmware/firmware-spp tar For more information on registering an SPP, see Registering SPPs and PSPs (page 49) For more information on downloading and copying an SPP, see Downloading SPPs and PSPs into the repository (page 56) 2. Change directory to the firmware directory in the repository. # cd /opt/repository/firmware 3. Create a symbolic link, firmware-files.tar, that points to the firmware file created in the first step. For example: # ln -sf firmware-spp tar firmware-files.tar # ls -l firmware-files.tar lrwxrwxrwx 1 root root 26 datestamp firmware-files.tar -> firmware-spp tar Updating firmware on systems known by HP SIM From the CMS, you can initiate a firmware update on any ProLiant server licensed for Insight Control for Linux. Select the servers you want to update and run the firmware update tool with the Deploy Deploy Drivers, Firmware and Agents IC-Linux Update ProLiant Firmware menu item Basic firmware update functionality 131

132 You are asked to verify the targets and license any unlicensed nodes. On the next screen, you optionally can enter option flags for the hpsum command. For normal operation, do not enter anything in this screen, however, if you want to specify any option flags for the HPSUM command, enter them in the text field provided. For more information on the hpsum command's option flags, see Section (page 132). Select Run Now to start the update process or Schedule to schedule it for a later time. Any running servers selected for firmware update are shut down to run the update, and all servers that are successfully updated are left powered down Updating firmware on systems during bare-metal discovery With Insight Control for Linux, you can update the firmware on a server automatically as part of the bare-metal discovery process. This is a convenient way to ensure all the hardware added to your environment has the latest firmware. To enable this feature, edit the Insight Control for Linux properties file, /opt/mx/icle/ icle.properties, and add the following line: RUN_HPSUM_ON_BARE_METAL_DISCOVERY=true It is not necessary to restart HP SIM for these changes to take effect. In addition, if you want to run the hpsum command with option flags, add an additional line to the file that looks like this: HPSUM_FLAGS=parameters Where parameters indicates the hpsum command's option flags you want to use. For example: HPSUM_FLAGS=--downgrade For more information on the hpsum command's option flags, see Section (page 132) Viewing the results of a firmware update The results of a firmware update are captured in the Insight Control for Linux task results. The task results appear immediately after a firmware update is initiated with the Run Now button, or you can view them later with the Tasks and Logs View Task Results menu item. You can also view bare-metal discovery updates this way. The firmware results are displayed in the Operation Details section when you select the step labeled ProLiant Firmware Update (if enabled). This log details the setup of the firmware update and displays the HPSUM detail log file. This log file shows exactly which firmware components were updated and the version they were updated to Specifying HPSUM option flags By default, the firmware update procedure runs the command hpsum --silent without any other options. This updates all firmware on a server only if the firmware files in the tar file are newer. HPSUM has many option flags that enable you to customize its operation. However, only a few have any effect with the --silent option. The option flags most commonly used with Insight Control for Linux are: --force:rom --rewrite --downgrade --dryrun Force a firmware update on all devices. This works only for single target devices like BIOS and ilo, but not multiple target devices like NICs. This allows firmware of the same version to be overwritten. This allows firmware to be downgraded to a lower version. This option enables you to verify which firmware is updated but does not perform an update. Insight Control for Linux always inserts the --silent option. It is not necessary to specify it. For more information on HPSUM option flags, see the HP Smart Update Manager User Guide. 132 Using Insight Control for Linux to update HP ProLiant firmware

133 Adding or removing firmware files from the firmware tar file HP continuously releases new firmware for devices, and these new releases are usually in the next revision of the Smart Update Firmware DVD. However there might be times when you want to use this new firmware before the next DVD is released. There also might be times when you do not want to update the firmware on a specific device, and so you do not want that device s firmware file in the firmware tar file. To make changes to the collection of firmware files that are used for automatic firmware updates, you must extract the contents of the firmware tar file, add and remove what you want, and create a new tar file. This procedure requires 300 to 400 MB of temporary disk space: 1. Create a temporary directory for the contents of the tar file. # mkdir /tmp/fw-temp 2. Extract the contents of the tar file: # cd /tmp/fw-temp # tar xf /opt/repository/firmware/firmware-files.tar 3. Add or remove the required firmware files. Here are some examples; all these examples are performed from the temporary directory for the firmware, /tmp/fw-temp: # Copy latest firmware from /root cp /root/cp scexe. # Download latest ilo firmware direct from hp.com wget ftp://ftp.hp.com/pub/cp scexe # Remove system BIOS so it won t get updated rm CP scexe NOTE: When downloading new firmware files or removing older files, Insight Control for Linux uses only the files designated as Linux Online Flash Component; these files end with the.scexe extension. Be sure you are manipulating the correct file types. The HP Smart Update Firmware DVD has an index so you know exactly which firmware files are for which devices. 4. Re-create the firmware tar file: # cd /tmp/fw-temp # tar cf /opt/repository/firmware/firmware-files.tar. 5. Remove the temporary directory and its contents. # rm rf /tmp/fw-temp Firmware update time out Firmware update times out before completion After Insight Control for Linux initiates a firmware update, it waits for the RAM disk to signal that the firmware update has completed. If, for some reason (such as lost communication with the RAM disk), Insight Control for Linux does not receive that notification, the firmware update task eventually times out. The default value is 900 seconds (15 minutes), which should be sufficient for most situations, However, you can modify this value to account for special situations when fifteen minutes is not enough time to complete the firmware update. To modify the firmware update timeout, edit the /opt/mx/icle/icle.properties file. The FW_UPG_WAIT_TIMEOUT parameter controls the length of the firmware update timeout; that line in the file resembles the following: 12.2 Basic firmware update functionality 133

134 FW_UPG_WAIT_TIMEOUT=900 Determine the value (in seconds) that is appropriate for your installation and assign it to the FW_UPG_WAIT_TIMEOUT value Advanced firmware update functionality Insight Control for Linux incorporates advanced firmware update options if you require more control over exactly which versions of firmware should be installed and on which systems. For example, perhaps you do not want to run firmware updates on production servers, but you want your research and development servers updated with the latest packages. Or perhaps you want a group of servers to have different firmware versions from the rest. Insight Control for Linux has a simple and flexible method for controlling this Understanding the firmware configuration file A firmware configuration file controls the advanced firmware update features of Insight Control for Linux. It is a plain text file you create and store in the Insight Control for Linux repository at the following location: /opt/repository/firmware/firmware-config.txt When a server initiates an Insight Control for Linux firmware update, it checks for the presence of this file in the repository. If the file does not exist, a normal firmware update is performed as described in the Section 12.2 (page 130). If the file is found, it is scanned for a reference to the server being updated. If a reference is found, it is acted upon. The configuration file contains one line for each server requiring customized firmware. Each line has the following format: system=firmware-filename Where system Is one of the following: 1. A host name 2. An IP address 3. A MAC address 4. The text string default These system values are given in precedence order, from highest to lowest. firmware-filename Is one of the following: The name of a firmware tar file located in the firmware repository that was customized as described in Section (page 133) to have only the particular firmware and versions you want for this system. The reserved word skip, which indicates not to update this system's firmware. When the configuration file is scanned for a match to the server, the firmware-filename is assigned to the server defined by the system value or, for the reserved word skip, the server's firmware is not updated. If the same server is described two or more times in the file, the precedence of the system value determines the action. For example, in the following excerpt, all three lines describe the same server, but the firmware.tar file (and only that file) is assigned because the server is described by its host name, which has the highest precedent: =prodfirmware.tar server1=firmware.tar 01:00:ab:67:45:ff=latest-firmware.tar 134 Using Insight Control for Linux to update HP ProLiant firmware

135 IMPORTANT: Ensure that system values are unique in the file. For example, there should not be two identical MAC addresses in the same configuration file. Wildcards are not supported in the configuration file. MAC addresses are case insensitive and must be separated by colons (:) Example firmware configuration files The following are examples of configuration files: Example 1 prod-server-1=production-firmware.tar prod-server-2=production-firmware.tar =skip 01:00:ab:67:45:ee=latest-firmware.tar In this example, the two production servers need to be at very specific firmware revisions, so a special firmware tar file was created which only contains firmware that has passed the proper testing. The skip flag is used with the IP address of a very old server running old software, which should never have its firmware updated. The MAC address is the MAC address of a new prototype server which always needs the latest revisions as soon as possible, so a separate firmware tar file was created for that system. Lastly, there is no default line, so any servers not specifically listed in this file perform a normal firmware update using the default firmware tar file, production-firmware.tar. Example 2 08:00:2b:c4:aa:1f=firmware-files.tar devel-server1=new-device-fw.tar default=skip In this example, the first server (listed by MAC address) uses the normal firmware update tar file. It needs to be listed here because entry default=skip means that any server not specifically listed in this file is skipped and does not have its firmware updated. The development server requires the very latest firmware, and that file is probably updated regularly. Example 3 default=alt-firmware.tar This very simple file means that every system that initiates a firmware update uses an alternate firmware tar file instead of the default Advanced firmware update functionality 135

136 13 Installing SPPs and PSPs on managed systems This chapter addresses the following topics: Overview of the SPP and PSP installation tool (page 136) Required SPP and PSP components (page 136) Creating a SPP or PSP dependency script (page 137) SPP or PSP installation procedure (page 138) 13.1 Overview of the SPP and PSP installation tool The Insight Control for Linux SPP and PSP installation tool enables you to install any or all SPP or PSP components on one or more managed systems. PSPs contain OS-specific bundles of HP ProLiant optimized drivers, utilities, and management agents. SPPs also contain firmware. The Insight Control for Linux SPP and PSP installation tool is available from the HP Insight Control user interface;: Deploy Deploy Drivers, Firmware, and Agents Install SPP or PSP... NOTE: The Deploy Deploy Drivers, Firmware and Agents IC-Linux Install SPP or PSP... task cannot be used on managed systems running VMware ESX or VMware ESXi. Use the Configure Configure or Repair Agents... task to deploy VMware ESX agents. The WBEM providers (agents) are embedded in VMware ESXi purchased from HP. The Insight Control for Linux SPP and PSP installation tool is provided as a way for you to install SPP or PSP components in addition to the components that are installed automatically. IMPORTANT: The SPP and PSP installation tool requires that SSH credentials are entered into HP SIM for the target managed systems. Thus, enter the SSH credentials for the target managed systems if you have not already done so. Select the following menu item from the Insight Control user interface and update the SSH Settings: Options Security Credentials System Credentials... For more information on setting SSH credentials, see Chapter 16 (page 142) 13.2 Required SPP and PSP components When you use Insight Control for Linux to install an OS to a managed system, the required SPP and PSP components listed in Table 19 are installed automatically. This table correlates the package name, the RPM name (where version is the version information), and the installed agent. Table 19 Required SPP and PSP components Server types Package name RPM Agent HP ProLiant Gen8 series servers only Agentless Monitoring Service for HP ProLiant Gen8 Systems hp-ams-version hp-ams 1 HP ProLiant Gen8 series, HP ProLiant G7 series, and earlier, supported HP ProLiant servers HP System Health Application and Command Line Utilities HP ProLiant Channel Interface 2 HP OpenIPMI Device Driver HP SNMP Agents hp-health-version hp-ilo-version hp-openipmi-version hp-snmp-agents-version hp-health hp-ilo hp-openipmi hp-snmp-agents 136 Installing SPPs and PSPs on managed systems

137 1 This agent is installed on servers with ilo 4 management processors. While HP SIM requires hp-ams so that it can use embedded features of the ilo 4 management processor, Insight Control for Linux does not use it. If you want to use only the hp-ams agent on your ilo 4 based servers, you must manually remove the other agents. The Agentless Management Service (AMS) will be responsible for sending all host operating system-specific to the ilo 4 firmware. 2 This component is only required for RHEL5 and SLES10 operating systems. NOTE: as such. The RPMs for these SPPs and PSPs are OS- and platform-specific and are usually named 13.3 Creating a SPP or PSP dependency script Some utilities contained in the SPP or PSP have RPM dependencies that must be met for them to install correctly. For PSPs, these dependencies are documented in the HP ProLiant Support Pack User Guide. TIP: For instructions on how to obtain the HP ProLiant Support Pack User Guide, see Section (page 251). Insight Control for Linux does not automatically resolve these dependencies. If you plan to install an SPP or a PSP on your managed systems, you must ensure that the required RPMs are installed first. Otherwise, the PSP installation fails One way to solve this problem is to install the appropriate packages at installation time. If you are using Insight Control for Linux installation tools to install your managed system, you can simply modify the Kickstart or AutoYaST file and add the required packages to the list of software to be installed. If the managed system is already installed, Insight Control for Linux provides mechanisms called SPP dependency scripts and PSP dependency scripts, which can automatically install required RPMs on a managed system just before an SPP or a PSP is installed. SPP and PSP dependency scripts are shell scripts that are run as part of the Deploy Deploy Drivers, Firmware, and Agents Install SPP or PSP... task. For an SPP or a PSP dependency script to be called during the SPP or PSP installation process, you must register it; the script appears in the /opt/repository/pspscript/ example_dependency.sh directory on the CMS. A remote repository cannot host an SPP or a PSP dependency script. You must use the default example_dependency.sh script in the /opt/repository/ pspscript/example_dependency.sh directory as a template for your customized script, which you must register. SPP and PSP dependency scripts are stored in the same location. Do not modify the example_dependency.sh script. The default example_dependency.sh script does not perform any actual tasks. It only contains comments with helpful suggestions about how to create a real dependency script. Remember that the items in the Insight Control for Linux repository are served to the managed systems through HTTP over the default repository web server port (usually port 60000). Therefore, in your dependency script, include code to install required packages directly from the repository web server. Example 4 provides an example of a simple PSP dependency script that installs the kernel-devel RPM for RHEL6 Update 2 from the repository web server located at IP address This script assumes that RHEL6 U2 was already registered and copied to the repository. Example 4 Simple PSP dependency script #!/bin/sh # Install the required RPM rpm -i 13.3 Creating a SPP or PSP dependency script 137

138 http// :60000/os/rhel6esu2-x64/redhat/rpms/kernel-devel el.x86_64.rpm # Exit with 0 status - a non zero status will generate an error exit 0 SPP dependency scripts and PSP dependency scripts have the same form and function. Managed systems are rebooted when the SPP or PSP installation script is finished, regardless of the outcome of the SPP or PSP installation. The reboot is required so that HP SIM can continue to properly manage the managed system ensures that all drivers and agents are properly started. IMPORTANT: If an errata kernel is installed on the managed system, ensure that the SPP or PSP package you want to install supports the errata kernel version SPP or PSP installation procedure Begin the installation process after you have done the following: Created the SPP or PSP dependency script. Registered it in the Insight Control for Linux Repository, and Copied the dependency script to the /opt/repository/pspscript/ example_dependency.sh directory. Procedure 1. Use HP SIM to select the target server or servers. TIP: Ensure that all target servers run the same version of the same OS. 2. Select Deploy Deploy Drivers, Firmware, and Agents Install SPP or PSP Verify the target system or systems, then click Next>. 4. In the License unlicensed systems window, assign a license to any unlicensed target server, then click Next>. 5. Select the Service Pack for ProLiant or the ProLiant Support Pack that you want to install from the list shown in the Select the SPP or PSP window. The SPP or PSP you choose must be appropriate for the operating system on all the target systems; the operating system are listed in the left column. Click Next>. 6. Select the software components from the list shown in the Select the software components window, then click Next>. 7. In the Select the SPP or PSP dependency script window, select a dependency script to install additional RPMs that the installer requires. If you do not want to install a dependency script, choose None. For more information on PSP dependency scripts, see the HP ProLiant Support Pack User Guide. Click Next>. 8. In the Edit the SPP or PSP configuration file window, edit the configuration parameters to customize the installation or configuration of SPP or PSP software components. This step is optional. Use the down arrow key to scroll through the list of parameters. By default, configuration parameters are prefixed with a pound sign (#) to comment them out. 138 Installing SPPs and PSPs on managed systems

139 NOTE: For a list of PSP configuration parameters and their descriptions, see the HP ProLiant Support Pack User Guide. For instructions on how to obtain this document, see Section (page 251). You must ensure that any changes made to the configuration parameter set are valid. No verification of the configuration parameters is performed. The configuration values you specify here are not saved. To preserve them, use a text editor to cut and paste them from this window into a file. 9. Select Run Now to launch the SPP or PSP installation immediately. Or, select Schedule to schedule the installation to occur in the future 10. Monitor the Task Results window to follow the progress of the operation and the related task states. Select the Log button if you want to view the output log. 11. Select the following menu item from the Insight Control user interface to view the task results: Tasks & Logs Task Results If the SPP or PSP installation completed successfully on a target managed system for all selected components, the final state of the task on that system is Complete. If any selected software components did not install successfully on the target managed system for any reason, including package dependency failures, the final state of the task on that system is Failed. Review the log carefully because it contains important SPP or PSP installation results. If any of the components failed to install because of RPM dependency requirements, you must resolve the RPM dependencies and run the Install SPP or PSP... tool again. If the tool fails, the end of the log file provides details about what went wrong SPP or PSP installation procedure 139

140 14 ISO control operations ISO Controls allow you to boot from an ISO image, insert an ISO image, and eject an ISO image on ilo-based managed systems. You can use this functionality to perform interactive OS installations from OS distribution ISOs, including Windows. The ISO image must be registered in the Insight Control for Linux repository before you can perform these operations. For information on registering an ISO image, see Registering an ISO image (page 52). The topics in this section are: Booting an ISO image on a server (page 140) Inserting an ISO image (page 140) Ejecting an ISO image (page 140) 14.1 Booting an ISO image on a server This procedure implicitly inserts an ISO image, then powers on the server to boot from that image. 1. Use HP SIM to select the target servers. 2. Select Tools ISO Controls Boot ISO Image... Insight Control for Linux displays a list of the ISO images that are registered in the Insight Control for Linux repository. 3. Select an ISO image from the list. 4. Select Run. The target server or servers boots the ISO image, if the ISO image is bootable Inserting an ISO image 1. Use HP SIM to select the target server or servers. 2. Select Tools ISO Controls Insert ISO Image... Insight Control for Linux lists the ISO images registered in its repository. 3. Select Run. The ISO image is inserted on the target server or servers. Typically the application running on the target server will automatically detect the inserted ISO image and mount it Ejecting an ISO image 1. Use HP SIM to select the target server or servers. 2. Select Tools ISO Controls Eject ISO Image Select an ISO image from the list. 4. Select Run. The ISO image is ejected on the target server or servers. 140 ISO control operations

141 15 Remote server controls The menu items on the Tools Server Controls menu enable you to remotely manage power control on a physical managed system. IMPORTANT: Be aware that the Insight Control for Linux server controls operate by contacting the management processor of the server directly and executing the requested power function. That means that servers are powered off or cycled abruptly without a graceful shutdown. If you use these tools on a server with a running operating system, that operating system is powered down without running the normal shutdown commands. This chapter addresses the following topics: Powering off a managed system (page 141) Powering on a managed system (page 141) Rebooting a managed system (page 141) HP Insight Control power management (page 141) 15.1 Powering off a managed system NOTE: Before powering off a virtual host, perform a graceful shutdown on all its virtual guests. Use the Tools Server Controls Power Off Server... option to power off one or more target managed systems. This task makes a remote call to the management processor to set power status to off Powering on a managed system Use the Tools Server Controls Power On Server... option to power off one or more target managed systems. This task makes a remote call to the management processor to set power status to on Rebooting a managed system Use the Tools Server Controls Reboot Server... option to reboot one or more target managed systems. The reboot operation reboots the server by using the power off functionality of the management processor, waiting a predetermined amount of time, and using the power on functionality of the management processor. These operations require the management processor credentials to be set in order to perform power control. For more information on management processor credentials, see Management Processor Credentials (page 198) HP Insight Control power management Insight Control for Linux incorporates the Insight Control power management plug-in to HP SIM. Insight Control power management is an integrated power monitoring and management application that provides centralized control of server power consumption and thermal output. It enables you to reduce the amount of power and cooling required for ProLiant servers. For more information on Insight Control power management, see the following web address: Powering off a managed system 141

142 16 Using SSH for remote server management Insight Control for Linux provides several ways for you to access a managed system through SSH. This chapter addresses the following topics: Setting SSH credentials on managed systems (page 142) Setting SSH credentials for users (page 142) Running a command on multiple managed systems (page 143) Using Insight Control for Linux to run commands and scripts through SSH (page 144) 16.1 Setting SSH credentials on managed systems Before you can run a task that uses SSH, you must use the following menu item from the HP Insight Control user interface; to set SSH credentials on managed systems: Options Protocol Settings System Protocol Settings For more information about using this menu item to set SSH credentials, see the HP Systems Insight Manager online help Setting SSH credentials for users When you enter credentials for a managed system in HP SIM, the username specified in those credentials is the username that will always be used to execute tasks on the managed system regardless of the username you used to log into HP SIM. Thus, if you create a non-root user account in HP SIM to restrict access for certain people, but the credentials stored in HP SIM are for root on the target servers, then the non-root user in HP SIM still has root access to those target systems. Through HP SIM and Insight Control for Linux tools, a user could interact with a target managed system with permissions greater than those assigned to their user account on the target managed system. This is possible with the Insight Control for Linux menu items that leverage SSH credentials. The following Insight Control for Linux menu items require SSH credentials to be configured: Tools Command Line Tools Run SSH Command... Tools Command Line Tools Run Script... Deploy Deploy Drivers, Firmware, and Agents Install SPP or PSP... The following Insight Control for Linux menu items use the SSH credentials if they are available, but the task can proceed using other methods if the credentials are not available: Deploy Operating System Red Hat Interactive Deploy Operating System Red Hat (Kickstart) Deploy Operating System SLES Interactive Deploy Operating System SLES (AutoYaST) Deploy Operating System VMware ESX Interactive Deploy Operating System VMware ESX (Kickstart) Deploy Operating System VMware ESXi Interactive Deploy Operating System Custom or Other Interactive Deploy Operating System Custom or Other (Unattended) Deploy Operating System Deploy Linux Image The following menu item uses the SSH credentials if they are available, otherwise the task uses another method. However, if you want an orderly shut down of the managed system, HP recommends that you configure SSH credentials: 142 Using SSH for remote server management

143 Deploy Operating System Capture Linux Image On the Task Results screen, the Task Instance Results always shows the user who launched the task. This might not be the credentials used for the task execution. Because different target managed systems can have different users specified in the SSH settings, the same task can run on different targets as different users Running a command on multiple managed systems The open source Parallel Distributed Shell (pdsh) command is a multi-threaded remote shell client that runs commands on multiple managed systems in parallel. You can specify all, a given number of, or only certain managed systems on which to perform the command or commands that are passed as arguments to the pdsh command. The pdsh command can use three forms of managed system names. By default, the pdsh shell can issue 32 simultaneous remote commands at a time. You can override this default with the -f option. The pdsh shell relies on SSH transport mechanism. Ensure that SSH is properly installed on the system; changes to the SSH configuration can cause the pdsh shell to fail. Although the pdsh shell can use several remote shell services, including rsh and ssh, the security settings for Insight Control for Linux make ssh the shell of choice. The syntax of the pdsh command is: pdsh -[options] "command_to_run" Use the pdsh --help option to view command-line options. IMPORTANT: Do not pass a command that requires interaction as an argument to the pdsh command. Prompting from the remote system can cause the command to hang. pdsh Command Examples The -a option runs the uptime command on all managed systems: # pdsh -a "uptime" eris: 08:46:53 up 17:45, 0 users, load average: 0.05, 0.05, 0.00 mars: 19:03:14 up 17:44, 0 users, load average: 0.04, 0.04, 0.00 earth: 14:35:14 up 17:44, 0 users, load average: 0.01, 0.02, 0.00 mercury: 09:29:03 up 20:29, 2 users, load average: 0.06, 0.10, 0.09 pluto: 14:24:51 up 17:45, 0 users, load average: 0.01, 0.04, 0.00 The -w option enables you to specify a range of managed systems or a specific managed system. Command line # pdsh -w icelx[1-5] hostname earth: earth.example.com eris: eris.example.com mercury: mercury.example.com mars: mars.example.com pluto: pluto.example.com # pdsh -w mercury uptime Description Runs the hostname command on the first five managed systems in the collection. IMPORTANT: You must use the Insight Control for Linux internal name (which is based on the Insight Control for Linux collection name) when you specify a range of managed systems. In the example, icelx is the Insight Control for Linux internal name. Runs the uptime command on a specific managed system. In the example, mercury is the real host name For more information, see pdsh(1) and the following website: Running a command on multiple managed systems 143

144 16.4 Using Insight Control for Linux to run commands and scripts through SSH The following menu items enable you to run a script or command through SSH to one or more managed systems: Tools Command Line Tools Run SSH Command... Tools Command Line Tools Run Script Running an SSH command The Tools Command Line Tools Run SSH Command... runs a command on a target managed system. This tool operates on the target system by opening a secure shell (SSH) connection to it, running the command, capturing Stdout and Stderr from the command, capturing the return code from the command, and closing the SSH connection. To run a command on a managed system, you must first define SSH credentials (that is, login and password) for the target system or systems into HP SIM with Options Security Credentials System Credentials... Select the following menu item from the Insight Control user interface to update the SSH Settings for one or more target managed systems: Options Protocol Settings System Protocol Settings IMPORTANT: Any HP SIM user that has access to this tool can run any command on the target managed system with the privileges of the user you entered into the System Protocol Settings page. If you entered the root user and password into the System Protocol Settings, any HP SIM user with access to this tool also has root privileges on the target managed system. To run an SSH command on one or more managed systems, follow this procedure: 1. Before you begin, ensure that the command you intend to run does not leave any open file descriptors upon completion (including called scripts). Open file descriptors might prevent the SSH connection from closing properly and might cause the task to remain in a Running state indefinitely. 2. Select the following menu item from the Insight Control user interface: Tools Command Line Tools Run SSH Command Select one or more target managed systems. 4. Enter the command you want to run. Enter multiple commands on one line and separate each command with a semicolon (;). The maximum length of a command is 255 characters. 5. Select Run Now to run the command immediately. Or, select Schedule to schedule the task to occur in the future 6. Select the following menu item from the Insight Control user interface to view the task results: Tasks & Logs View Task Results... From the Task Results page, view the log for the command, which includes Stdout and Stderr from the command. The return code from the SSH command controls the final state of the task. If the return code from the command indicates failure, the task is in a Failed state. If the return code from the command indicates success, the task is in a Complete state Running a Linux script The Tools Command Line Tools Run Script... menu item remotely runs a Linux script in the Insight Control for Linux repository by opening a secure shell (SSH) connection to one or more managed systems. This Insight Control for Linux tool captures Stdout and Stderr from the script, captures the return code from the script, and closes the SSH connection. 144 Using SSH for remote server management

145 The Run Script... task feeds the command lines in the script to an SSH instance on the target system. The script is a series of command lines to be run on the target system using SSH. The Linux script you run must be located in the Insight Control for Linux repository in the /opt/ repository/script directory. You must ensure that the Linux script does not leave any open file descriptors upon completion (including scripts you might have called). Open file descriptors can prevent the SSH connection from closing properly, which might cause the task to remain in a Running state indefinitely. To run a Linux script on managed systems, you must first define SSH credentials (that is, login and password) for the target systems into HP SIM with Options Security Credentials System Credentials... To run a Linux script on one or more managed systems remotely, follow these steps: 1. Select the following menu item from the Insight Control user interface: Tools Command Line Tools Run Script Do one of the following to select and verify that the managed system in the target list: Select Next> if the target list is correct. Select Add Targets... or Remove Target to modify the list if the list is incorrect. 3. Select Apply when the list is correct. 4. Select Next. 5. Select the Linux script you want to run. 6. Select Next. 7. Select Run Now to run the Linux script immediately. Or, select Schedule to schedule the task to occur in the future 8. Select the following menu item from the Insight Control user interface to view the task results: Tasks & Logs View Task Results... From the Task Results page, you can view the log for the script, which includes Stdout and Stderr from the script. The return code from the script controls the final state of this task for a given target system. If the return code from the script indicates failure, the task is shown with a Failed state. If the return code from the script indicates success, the task is in a Complete state Using Insight Control for Linux to run commands and scripts through SSH 145

146 Part III Monitoring

147 17 Managing Insight Control for Linux collections This chapter addresses the following topics: Introduction to collections (page 147) Populating a collection (page 148) Adding servers and switches to an Insight Control for Linux collection (page 148) Removing a managed system or switch from an Insight Control for Linux collection (page 149) 17.1 Introduction to collections The Insight Control for Linux installation process creates an HP SIM collection specifically for Insight Control for Linux. The Insight Control for Linux collection identifies the systems and related objects (servers, switches, and HP BladeSystem enclosures) that Insight Control for Linux can monitor and manage. A collection enables you to easily designate and track managed objects, and the Insight Control for Linux collection is divided into subcollections of managed objects based on object type. The default Insight Control for Linux collection name is icelx, but you can override the default name during the Insight Control for Linux installation process. The collection name also represents a virtual prefix for referencing managed systems when using Insight Control for Linux commands. For example, the default collection name icelx enables you to reference managed systems using condensed canonical notation such as icelx[1-15] where icelx1 through icelx15 are the internally assigned names for the managed systems in the icelx collection. When you open HP SIM, the Insight Control for Linux collection and its subcollections are listed in the left frame under Systems Managed by Insight Control for Linux. For more information about HP SIM collections, see the &HP Systems Insight Manager User Guide;. Table 20 lists the specific subcollections that Insight Control for Linux manages. Table 20 Insight Control for Linux subcollections Object type Subcollection name Description How populated Server {collection_name}_servers Properly licensed servers placed in this subcollection are enabled for Insight Control for Linux advanced monitoring and management. Populated either manually or automatically by entering Yes in the Auto-populate field when running the Options IC-Linux Configure Management Services task; the Auto-populate option places all managed systems with an Insight Control for Linux license into the collection. Console Port {collection_name}_console_ports Provides access to the management processor on each managed system. Populated automatically when you run the Options IC-Linux Configure Management Services task, with the associated console ports of any servers listed in the Servers collection. Enclosures {collection_name}_enclosures If the hardware configuration contains HP blade servers and enclosures, this collection provides access to the enclosures. Populated automatically when you run the Options IC-Linux Configure Management Services task, with any enclosures, known to HP SIM, that also contain blade 17.1 Introduction to collections 147

148 Table 20 Insight Control for Linux subcollections (continued) Object type Subcollection name Description How populated servers that Insight Control for Linux manages. Switches {collection_name}_switches Insight Control for Linux monitors all switches placed in this subcollection. Populated manually only. Management Hubs {collection_name}_management_hubs This subcollection contains all the servers that are designated as management hubs. If no management hubs are created, this collection contains only the CMS by default. Populated manually. For information, see Section 18.2 (page 151) 17.2 Populating a collection An Insight Control for Linux collection is populated with objects automatically or manually. Automatic population of a collection occurs when you run the Options IC-Linux Configure Management Services menu item to start monitoring services and enter yes in response to the Auto-populate {collection_name}_servers with all licensed servers? option. The following objects are added to the collection: All licensed servers are added to the {collection_name}_servers subcollection. All enclosures associated with each licensed system are added to the {collection_name}_enclosures subcollection. All management processors associated with licensed servers are added to the {collection_name}_console_ports subcollection. Manual population of a collection occurs when you use the Customize... link in the left pane of HP SIM to add or remove objects to the Insight Control for Linux {collection_name}_servers or {collection_name}_switches subcollections. Section 17.3 (page 148) and Section 17.4 (page 149) describe how to add and remove managed objects (servers and switches) in an Insight Control for Linux collection. IMPORTANT: Any time you use the Customize... option in HP SIM to edit the managed objects in an Insight Control for Linux collection, you must run the Options IC-Linux Configure Management Services option to reconfigure the Insight Control for Linux management services Adding servers and switches to an Insight Control for Linux collection To add one or more servers or switches to an Insight Control for Linux collection, follow these steps: 1. Use the instructions in Chapter 7 (page 71) and Chapter 8 (page 78) to perform the following tasks to prepare servers: Discover the server or servers. Make sure you follow the appropriate discovery process because the procedure differs for bare-metal servers and servers that already have a supported Linux OS installed on them. Deploy a Linux OS to the server if it does not have an OS installed. Set up the server or servers for monitoring: Open required firewall ports Resolve server host names on the CMS 148 Managing Insight Control for Linux collections

149 Install the complete ProLiant Support Pack (optional) Configure SNMP and SSH keys Configure console access and logging 2. Add the servers or switches to the Insight Control for Linux collection: a. Select Customize... in the left pane of the HP Insight Control user interface;. b. Scroll down the name column until you see Systems Managed by IC-Linux. c. Select the plus sign (+) to expand it. d. Scroll down until you see your Insight Control for Linux collection. e. Select the plus sign (+) to expand it. f. Scroll until you see the Insight Control for Linux subcollections. g. Do one of the following: If you are adding a server to the collection, select the radio button next to the {collection_name}_servers subcollection. If you are adding a switch to the collection, select the radio button next to the {collection_name}_switches subcollection. TIP: For more information about editing collections, see the HP SIM online help. h. Select Edit... i. Depending on the object you are adding, select a server or a switch listed in the Available Items column, and use >> to move it to the Selected Members column. j. Select OK to add the server or switch to the appropriate Insight Control for Linux subcollection. k. Repeat the previous two steps (j and i) for every new server or switch you want to monitor. 3. Select the following menu item from the Insight Control user interface to reconfigure the Insight Control for Linux management services to recognize the new managed object or objects and to install the Insight Control for Linux Management Agents: Options IC-Linux Configure Management Services NOTE: This step removes non-licensed servers, VMware ESXi virtual hosts, and Microsoft Windows guests from the collection Removing a managed system or switch from an Insight Control for Linux collection NOTE: For information on removing a management hub, see Removing a management hub (page 153) If you want Insight Control for Linux to stop monitoring a managed system or switch, follow these steps to delete a managed system or switch from the Insight Control for Linux collection: 1. Select the following menu item from the Insight Control user interface to remove the management agents from the managed systems that you no longer want Insight Control for Linux to monitor and manage: Deploy Deploy Drivers, Firmware and Agents IC-Linux Uninstall Agents... NOTE: Run Uninstall Agents... only if you are removing a managed system. Omit this step if you are removing a switch Removing a managed system or switch from an Insight Control for Linux collection 149

150 2. Remove the managed systems or switches from the Insight Control for Linux collection: a. Select Customize... in the left pane of the HP Insight Control user interface;. b. Scroll down the name column until you see Systems Managed by IC-Linux. c. Select the plus sign (+) to expand it. d. Scroll down until you see your Insight Control for Linux collection. e. Select the plus sign (+) to expand it. f. Scroll down until you see the Insight Control for Linux subcollections. g. Do one of the following: If you are removing a managed system from the collection, select the radio button next to the {collection_name}_servers subcollection. If you are removing a switch from the collection, select the radio button next to the {collection_name}_switches subcollection. NOTE: There is no need to edit the {collection_name}_enclosures or {collection_name}_console_portscollections. TIP: For more information about editing collections, see the HP SIM online help. h. Select Edit... to edit the collection. i. Depending on the object you are removing, select a managed system or a switch listed in the Available Items column, and use >> to move it to the Selected Members column. j. Select Remove to remove the managed system or switch from the appropriate Insight Control for Linux subcollection. k. Repeat the previous two steps for every managed system or switch you want Insight Control for Linux to stop monitoring. 3. Select the following menu item from the Insight Control user interface to reconfigure the Insight Control for Linux management services: Options IC-Linux Configure Management Services 150 Managing Insight Control for Linux collections

151 18 Setting up management hubs 18.1 About management hubs A management hub is an aggregation point for management activities. Insight Control for Linux uses management hubs to distribute the management load across multiple servers. HP recommends creating multiple management hubs if you plan to monitor over 256 managed systems. You have the option of choosing any physical server to act as a management hub; you can elect to use the CMS as a management hub or not. If you do not specify a management hub, the CMS becomes the sole management hub by default. IMPORTANT: HP recommends the use of physical servers for use as management hubs. Only servers running a supported version of RHEL or SLES (that is, supported as a CMS) can act as management hubs. Furthermore, the operating systems of the CMS and the management hub must have the same architecture (32-bit or 64-bit) although they can have different OS types (RHEL or SLES). Each managed system is assigned to a management hub automatically when you run Options IC-Linux Configure Management Services. Figure 22 illustrates this structure. Figure 22 Management hub aggregation HP recommends that you create at least one management hub for every 256 servers. For example, if you plan to monitor 1000 servers, create a minimum of 4 management hubs. The management hub also runs the Supermon aggregator (supermond) and Nagios (nagios_monitor) services Creating a management hub Use the following procedure to create a management hub; you can perform Steps 2 and 3 in reverse order, but both must be done before step Determine which server or servers you want to act as a management hub About management hubs 151

152 2. Install the operating system for that server using the appropriate Kickstart or AutoYaST file; this file has the form *-management-hub.cfg to ensure that the required RPMs are installed. For specific information on installing operating systems, see Chapter 9 (page 87). 3. Add the server to the {collection_name}_management_hubs collection as follows: a. Select Customize... in the System and Event Collections panel. This figure shows the location with a red arrow. The Customize Collections window appears. b. Scroll down the list to access Systems Managed by IC-Linux in the Customize Collections window and select the + icon. The list expands. c. Select the + icon in the + icelx line. The list expands again. d. Select the icelx_management_hubs line and select Edit... A new window resembling the following opens. 152 Setting up management hubs

153 There are two text fields, Collection name and Choose from, and two lists, Available items and Selected Members. e. Select All Servers from the Choose from: menu. This action populates the Available Items: list with the available servers. f. Select the server from the Available Items: list. You can use Ctrl-Left Mouse for multiple selections. g. Use the >> button to move the selected servers from the Available Items: list to the Selected Members: list. h. Select OK. i. Select OK to close the dialog box that indicates the collection was saved successfully Removing a management hub You can remove a server from the {collection_name}_management_hubs subcollection and change it from a management hub to a managed system with the following procedure: 1. Run the Uninstall Agents menu item designating the management hub you want to remove as the target. Select Deploy Deploy Drivers, Firmware and Agents IC-Linux Uninstall Agents... to initiate this task. 2. Use the Customize Collections to remove the management hub from the icelx_management_hubs collection. 3. Rerun the Options IC-Linux Configure Management Services task. For information on collections, see Managing Insight Control for Linux collections (page 147) 18.3 Removing a management hub 153

154 19 Configuring monitoring services This chapter describes how to configure Insight Control for Linux monitoring services. In addition to an Section 19.1 (page 154), this chapter addresses the following tasks, which you must complete in this order: 1. Configuring a self-signed Apache certificate on the CMS (page 154) 2. Starting management and monitoring services (page 154) 3. Installing Insight Control for Linux management agents (page 156) 4. Verifying successful configuration of the monitoring services (page 156) 19.1 Overview of monitoring The monitoring services that Insight Control for Linux provides consider a wide array of metrics to understand the health and status of a remote host. All these metrics are periodically archived for historical analysis. These metrics include CPU usage, memory usage, load averages, swap, and many others. Insight Control for Linux also monitors the hardware sensors of remote hosts if they have a supported management processor, such as an ilo 3 or an ilo 4. For IPMI-based and ilo-based management processors (MPs), credentials must be supplied to log into them. These credentials and the response from the MP are sent encrypted over the network through an SSL channel Configuring a self-signed Apache certificate on the CMS The Nagios monitoring tool in Insight Control for Linux requires a secure configuration for the Apache web server. RHEL Version 5 is shipped with an Apache self-signed certificate so there is no need to create one. If the CMS does not already have a self-signed certificate, follow these steps: 1. Create the certificate: # /opt/hptc/config/sbin/create_apache_certificate gconfigure If you need assistance answering the certificate configuration questions, see the req(1) and openssl(1) man pages for more information. 2. Restart the Apache service: For SLES, run the following commands: # /etc/init.d/apache2 stop # /etc/init.d/apache2 startssl For RHEL Version 4, run the following commands: # /etc/init.d/httpd stop # /etc/init.d/httpd start If you encounter problems starting the Apache service, see Section 25.3 (page 204) Starting management and monitoring services This task configures the target server or servers with advanced monitoring and management features such as Nagios and Performance Dashboard. The Options IC-Linux Configure Management Services menu item performs the following operations: It populates the Insight Control for Linux collection. It configures and starts the management and monitoring services. 154 Configuring monitoring services

155 It also deploys the Insight Control for Linux management agents to all servers in the {collection_name}_servers subcollection. For information on managing subcollections, see Chapter 17 (page 147). Insight Control for Linux monitors only the objects in these collections: Either all licensed servers are automatically added to the {collection_name}_servers subcollection or only the servers in the {collection_name}_servers collection, depending your response on the Auto-populate option. The management processors associated with the licensed servers are automatically added to the {collection_name}_console_ports subcollection. All blade enclosures associated with the licensed servers are added to the {collection_name}_enclosures collection automatically. NOTES: Because Insight Control for Linux does not support monitoring for ESXi hosts, Microsoft Windows servers, or Microsoft Windows VM guests, they are automatically excluded from the {collection_name}_servers collections regardless of whether or not they have an Insight Control for Linux license. When an ESX host is installed with Insight Control for Linux, SSH is automatically configured. However, if the ESX host was not installed through Insight Control for Linux, you must enable ssh on the managed system because ssh is off by default. Follow these steps to enable ssh: 1. Use the text editor of your choice to edit the /etc/sshd/sshd_config to allow root remote login; change this line to resemble the following: PermitRootLogin yes Save the file and exit the text editor. 2. Restart the ssh service: # /etc/init.d sshd restart IMPORTANT: This task requires that HP SIM SSH keys be successfully configured on all managed systems. For more information, see Section (page 80). To start the monitoring and management services and automatically populate the Insight Control for Linux collection, follow these steps: 1. Run the HP SIM Configure Configure or Repair Agents... task on the managed systems that you want to monitor. 2. If you want to monitor only a subset of servers, move those servers into the {collection_name}_servers subcollection manually. Remember to specify No for the Auto-populate option in step Select the following menu item from the Insight Control user interface: Options IC-Linux Configure Management Services NOTE: The Task Results window always reports completion even if there were errors. Monitor the Stdout and Stderr output under the respective tabs to determine if Configure Management Services reported any errors. 4. In the text field to the right of the Auto-poplulate {collection_name)_servers with all licensed servers? of the Specify Parameters window, enter the appropriate response: Enter yes if you want Insight Control for Linux to monitor all the licensed servers that HP SIM recognizes Starting management and monitoring services 155

156 Enter no if you want Insight Control for Linux only to manage and monitor only the servers that you manually put in {collection_name}_servers collection. TIP: Populate your collections manually before proceeding. 5. Select Run Now. This task can take several minutes to configure services. The Stdout tab shows the scripts that are running, and Done appears when this task is complete. 6. When processing is complete, select the following menu item to review the log files to determine if the operation was successful: Tasks & Logs View Task Results 7. Select the Stdout and Stderr tabs on the tasks results screen to see more information. Review the output in the Stdout and Stderr tabs and proceed if no errors are found Installing Insight Control for Linux management agents The Insight Control for Linux management agents are deployed to all managed systems to gather monitoring data from managed systems. Doing so enables Nagios and Supermon to collect data from managed systems. This deployment is performed automatically as part of the Options IC-Linux Configure Management Services task. If you add or remove managed systems, you need to rerun the Configure Management Services task, which will also reinstall the management agents. Otherwise, the configuration would no longer be valid for monitoring with Nagios. You can deploy the Insight Control for Linux management agents manually at any time to reinstall agents on a managed system. For example, in case the agents failed to install during the Options IC-Linux Configure Management Services task or if you reimaged a managed system that you want to monitor. IMPORTANT: This task requires that HP SIM SSH keys be successfully configured on all managed systems. For more information, see Section (page 80). Use the following procedure if you need to reinstall the management agents. For example, you would need to reinstall them because you installed a new operating system on a managed system. 1. Select the following menu item from the Insight Control user interface: Deploy Deploy Drivers, Firmware and Agents IC-Linux Install Agents Select the {collection_name}_servers subcollection as the target. 3. Select Next. 4. When processing is complete, select the following menu item to review the log files to determine if the operation was successful: Tasks & Logs View Task Results 5. Select the Stdout and Stderr tabs on the tasks results screen to see more information. Review the output in the Stdout and Stderr tabs and proceed to Section 19.5 (page 156) if no errors are found Verifying successful configuration of the monitoring services To verify successful configuration of the monitoring services, HP recommends that you perform the following tasks: 1. Ensuring that Nagios is reporting status (page 157) 2. Summarizing service status (page 157) 156 Configuring monitoring services

157 3. Ensure that the pdsh command can run a command across all the managed systems. For example: # pdsh -a uptime pluto: 3:22pm up 0:49, 1 user, load average: 0.47, 0.47, 0.40 charon: 11:02am up 0:49, 1 user, load average: 0.38, 0.36, 0.36 poseidon: 9:46am up 1 day 4:46, 3 users, load average: 1.10, 1.23, Verify that the nrpe daemon is working on all the managed systems with the following command: # /opt/hptc/nagios/libexec/gather_all_data --verbose write 4048, 2, 2, eth1 to db => icelx2 (charon.example.com) write 4048, 2, 2, eth1 to db => icelx4 (pluto.example.com) write 4048, 2, 2, eth1 to db => icelx1 (poseidon.example.com) 5. Ensure that the vars.ini file is synchronized across all the managed systems # /opt/hptc/nagios/libexec/check_nagios_vars --update Vars OK on nodes icelx[1-2,4] Ensuring that Nagios is reporting status Start Nagios to ensure that it is reporting system status: 1. Select the following menu item from the Insight Control user interface: Tools Integrated Consoles Nagios 2. When prompted, log in as the same user you specified when you logged into HP SIM and enter the associated password. 3. Do one of the following: If the collection contains fewer than 100 managed systems, use the Service Detail view to obtain an overview of system status. It lists the Nagios hosts and shows their status. If the collection contains more than 100 managed systems, use the Service Problems view to obtain a more practical overview. If you need more information about how to use Nagios, see Chapter 20 (page 159) Summarizing service status The nrg command uses data collected by Nagios. On the CMS, run the nrg --mode summary command from the command line to display a summary of defined Nagios services and the state of those services. For example: # nrg --mode summary Apache HTTPS Server 1-Ok 0-Warn 0-Crit 0-Pend 0-Unk configuration 3-Ok 0-Warn 0-Crit 0-Pend 0-Unk Configuration Monitor 1-Ok 0-Warn 0-Crit 0-Pend 0-Unk Enclosure Status 1-Ok 0-Warn 0-Crit 0-Pend 0-Unk Enclosures Collection Monitor 1-Ok 0-Warn 0-Crit 0-Pend 0-Unk Environment 3-Ok 0-Warn 0-Crit 0-Pend 0-Unk Host Monitor 1-Ok 0-Warn 0-Crit 0-Pend 0-Unk IP Assignment - DHCP 1-Ok 0-Warn 0-Crit 0-Pend 0-Unk Load Average 2-Ok 1-Warn 0-Crit 0-Pend 0-Unk Management Settings Monitor 1-Ok 0-Warn 0-Crit 0-Pend 0-Unk Nagios Monitor 1-Ok 0-Warn 0-Crit 0-Pend 0-Unk NodeInfo 2-Ok 1-Warn 0-Crit 0-Pend 0-Unk Sensor Collection Monitor 1-Ok 0-Warn 0-Crit 0-Pend 0-Unk Supermon Metrics Monitor 1-Ok 0-Warn 0-Crit 0-Pend 0-Unk Switch Data Collection 1-Ok 0-Warn 0-Crit 0-Pend 0-Unk Syslog Alert Monitor 1-Ok 0-Warn 0-Crit 0-Pend 0-Unk Syslog Alerts 4-Ok 0-Warn 0-Crit 0-Pend 0-Unk System Event Log 3-Ok 0-Warn 0-Crit 0-Pend 0-Unk System Event Log Monitor 1-Ok 0-Warn 0-Crit 0-Pend 0-Unk System Free Space 2-Ok 1-Warn 0-Crit 0-Pend 0-Unk Totals: 32-Ok 3-Warn 0-Crit 0-Pend 0-Unk 19.5 Verifying successful configuration of the monitoring services 157

158 If Warnings Are Reported If one or more warnings are reported in the Warning column, use the analyze option to obtain an analysis of the problem. When possible, the command output provides potential corrective action or the reasons for a given state. For example: # nrg --mode analyze Nodelist Description neptune <Load Average - STALE> If 'data is state', then look at the status of the 'Supermon Metrics Monitor'on either the controlling management_hub or on the management_server node as they collect and report the data for these entries. neptune neptune <NodeInfo - STALE> Data may be stale, look at the status of the Supermon Metrics Monitor as it provides the status for this service. The data can be stale if the hub is failing to communicate with the master or if supermon & mond are not collecting the data from the specific node. <System Free Space - Warning> Thresholds defined in nagios_vars.ini have exceeded the warning levels for any of the locally monitored file systems, /, /var, or /tmp. 158 Configuring monitoring services

159 20 Using graphical tools to monitor managed systems This chapter addresses the following topics Insight Control for Linux system monitoring overview (page 159) Nagios overview (page 160) Using Nagios (page 163) Services monitored by Nagios (page 171) Understanding Nagios alert messages (page 173) Understanding system event log monitoring (page 174) Configuring Nagios alerts (page 174) Monitoring Metrics in real time (page 175) 20.1 Insight Control for Linux system monitoring overview Insight Control for Linux provides a complete monitoring environment for administrators focused on Linux. Insight Control for Linux monitoring combines best-in-class technologies and open source packages that Linux administrators commonly use. The prominent packages for Insight Control for Linux monitoring are: Nagios Nagios is a commonly used open source system and network monitoring application infrastructure. It is a graphical web-based application that provides a variety of system statistics that you use to monitor the health of managed systems. You can configure Nagios to monitor hosts and services that you define. Hosts and services report data returned through plug-ins. These scripts typically return an ok, warning, or critical exit status (0, 1, or 2, respectively) and an informational message on stdout. If problems occur, Nagios alerts you using predefined methods such as , SMS, or by invoking site specific notification tools. Round Robin Database Tool The Round Robin Database (RRD) Tool is the open source industry standard, high performance data logging and graphing system for time series data. Supermon A highly scalable, high-speed monitoring system. Supermon provides all required system statistics to the Nagios subsystem. The data that Supermon collects includes system performance sensor and environment data, such as fan, temperature, and power supply status. This data is collected on a regular basis. syslog and syslog-ng The syslog service runs on each managed system and captures log information. Performance Dashboard Tool The Performance Dashboard tool displays metric data refreshed in one-second intervals in a graphic ring plots. Insight Control for Linux gathers data using the platform specific management processor, ilo or IPMI, as well as OS provided metrics such as load average, nodeinfo, system free space, and so on. Other information such as syslog alerts is obtained from the /hptc_cluster/adm/logs/ consolidated.log consolidated log file Insight Control for Linux system monitoring overview 159

160 NOTE: Insight Control for Linux does not support monitoring of virtual hosts running VMware ESXi, and does not support servers or virtual guests running Microsoft Windows Collecting metrics through a management processor Insight Control for Linux supports management processors using the ilo or IPMI protocols for gathering sensor and system event log information. To access a system s management processor, you must configure the management processor credentials in HP SIM. For more information on management processor credentials, see Management Processor Credentials (page 198). The Environment and System Event Log (SEL) services access the management processor to gather sensor and SEL information. Insight Control for Linux automatically configures systems to collect this data Collecting metrics through OS agents Insight Control for Linux installs two small management agents on each managed system to collect operating system metrics: the Supermon mond daemon and the Nagios Remote Plugin Executor, nrpe. The mond daemon is used for local OS metrics collection. Insight Control for Linux uses the nrpe plug-in only for control operations (reconfiguration requests), not for periodic data collection. The Insight Control for Linux agents are built to be generic. These agents can be deployed to any Linux platform. Insight Control for Linux can monitor any x86-based Linux platform that can run the agents Collecting events with syslog Insight Control for Linux configures syslog or syslog-ng on each host to forward events to a global syslog-ng log aggregator running on the CMS. The resulting information is saved on the CMS or on a management hub in the /hptc_cluster/adm/logs/consolidated.log file. This information is periodically scanned by the Nagios Syslog Alert Monitor plug-in and is verified for known patterns defined in the /opt/hptc/nagios/etc/syslogalertrules file. This information is collected without the need for any Insight Control for Linux specific agents on Linux platforms. Each managed system runs the syslogd or syslog-ng daemon (RHEL runs syslogd; SLES runs syslog-ng) and passes events of priority warning or higher to its corresponding management hub; management hubs also run the syslogd or syslog-ng daemon and pass their own events to the master management hub aggregator. Each management hub runs the syslogng_forward service, and writes the events it receives from its managed systems to the /hptc_cluster/adm/logs/aggregator_nodename.log file, where nodename is the node name of the management hub. If so configured, the management hubs forward their clients' events to the master management hub. The highest level management hub produces a consolidated log file, /hptc_cluster/adm/logs/consolidated.log Nagios overview Insight Control for Linux uses the Nagios open source application to gather and display system statistics, such as processor load and disk usage. Nagios watches hosts and services and alerts you when problems occur or are resolved. The design of the Nagios application incorporates the concept of a plug-in; that is, an independent file that extends the Nagios application. This design enables the development of service checks, which are use to examine system and network services. Nagios, as provided with Insight Control for Linux, is configured with system and network service checks already in place for your system; these network service checks are automatically configured for each managed system. 160 Using graphical tools to monitor managed systems

161 Nagios obtains its sensor and metric data from the Supermon open source monitoring application, which is integrated with the Insight Control for Linux. Figure 23 illustrates the interaction of these tools. Figure 23 System monitoring tools integration The mond and syslog daemons run on every managed system. The Supermon service manages requests for mond daemons that run on a subset of systems. The Nagios master runs its check_metrics plug-in periodically, which causes Supermon data collection and storage into the database. The syslog daemons on the managed systems report events to the syslog-ng service. The managed systems are configured to forward their syslog events to the syslog-ng service on the CMS Nagios documentation For more information about Nagios, see the following sources: Nagios documentation: Nagios features: Additional information on Nagios is commercially available. The following website lists documents that describe Nagios and its use for system and network administration: Nagios overview 161

162 Launching Nagios To launch Nagios, you must have a valid certificate for the Apache service. To configure an Apache certificate, see Section 19.2 (page 154). Select the following menu item from the Insight Control user interface to launch Nagios: Tools Integrated Consoles Nagios The Nagios main window shown in Figure 24 appears when you launch Nagios. Figure 24 Nagios main window From the Nagios main window, you can choose any of the menu options on the left navigation bar. The Nagios menu options offer various views of the managed systems. After you choose an option, Nagios prompts for a login name and a password. This login and password were established when you installed and configured Insight Control for Linux. Insight Control for Linux provides plug-ins that monitor these views and other system statistics. The full list of view and menu options includes the following: General Home Documentation Current Status Tactical Overview Map 162 Using graphical tools to monitor managed systems

163 Hosts Services Host Groups Summary Grid Service Groups Summary Grid Problems Services (Unhandled) Hosts (Unhandled) Network Outages Reports Availability Trends Alerts History Summary Histogram Notifications Event Log HP Graph System Comments Downtime Process Info Performance Info Scheduling Queue Configuration NOTE: The term Hosts on the Nagios window refers to any object with an IP address, not just managed systems. Keep this in mind when using the Nagios application Using Nagios This section describes how to use the Nagios monitoring views to monitor managed systems Viewing network health Select the Tactical Overview menu option to obtain an overall view of the managed systems. Figure 25 shows an example of this view Using Nagios 163

164 Figure 25 Nagios tactical overview The top of the window provides information about the network. It provides the number of network outages and information on the network health in terms of the Nagios hosts and Nagios services. The next portion of the window contains information about the Nagios hosts. It reports the number of hosts that are down, unreachable, up, and pending. In Figure 25, two hosts are down. Select the link in that box to open the Host Status Details window for that host, which identifies the hosts and provides status information about them. The standard Nagios Tactical Overview display uses the color red to highlight Disabled services. To illustrate, in Figure 25, in the Active Checks column, the message 21 Services Disabled is displayed on a red field. 164 Using graphical tools to monitor managed systems

165 A disabled service is a configuration status, not an error condition. Insight Control for Linux takes advantage of the Nagios passive check feature to optimize and to minimize data collection and reporting across large numbers of managed systems. NOTE: HP recommends that administrators do not enable these services because they are not meant to run under normal conditions and causes Nagios to generate false alerts. Nagios services are described in the next portion of the window Viewing Nagios hosts and services When the hardware configurations contains dozens of managed systems, the Service Detail view provides a good view of the Nagios hosts and their corresponding Nagios services. Select Problems Services (Unhandled) in the Nagios menu to open this view. Figure 26 is an example of a portion of the Nagios Service Detail view. It is truncated, showing the Nagios services for the CMS. Figure 26 Nagios service detail view Figure 27 illustrates the display of Nagios hosts that are virtual hosts Using Nagios 165

166 Figure 27 Nagios service detail view The Status column displays any problems that might be occurring. To display the status of a service, select the link for the service in the Service column to open the Nagios Service Information view shown in Figure Using graphical tools to monitor managed systems

167 Figure 28 Nagios service information view Displaying hosts and services that are experiencing problems The Service Problems view, which is accessed by selecting Problems Services (Unhandled) in the Nagios menu, is useful for configurations with hundreds of systems. It identifies the Nagios hosts that are experiencing problems, and it shows only the corresponding Nagios services with status that is not OK, which enables you to monitor only those Nagios hosts that need attention. Figure 29 shows the Nagios Service Problems view Using Nagios 167

168 Figure 29 Nagios service problems view Select the link that corresponds to a Nagios host to open the Nagios Host Information view for that Nagios host. You can also use the Nagios report generator, nrg, to obtain an analysis of Nagios services: # nrg --mode analyze For more information and examples of its use, see nrg(8) Displaying network bandwidth and system use The RRDtool software tool is integrated into Insight Control for Linux to create and displays graphs about the network bandwidth and other system usage. Select HP Graph in the Nagios menu to access this information. The view shown in Figure 30 (page 169) provides an example of the default overview of the CMS (host name mercury) with graphs for server allocation, CPU usage, memory, and Ethernet traffic. The view shown in Figure 31 is attached to the overview view and provides a smaller detailed CPU usage graphs for each managed system. The HP Graph also features a CPU temperature graph. To access this graph, select temperature from the Metrics menu at the top of the window. 168 Using graphical tools to monitor managed systems

169 Figure 30 HP Graph default overview display Figure 31 HP Graph detail display of managed systems If you want to display the graphical data for a selected Nagios host (a Nagios host can be a virtual host), select an item in the menu in the upper left-hand side. Figure 32 (page 171) shows the graphs for one managed system, osmone. The following menus and menu items control the information you can display for a managed system: The Metric menu influences the information shown in the graphs. This menu offers the following choices: bytes in Reports the rate of data received on network devices on the managed system. bytes out cpu idle Reports the rate of data transmitted on network devices on the managed system. Indicates how much of the managed system's CPU set was available for other tasks Using Nagios 169

170 cpu iowait cpu system cpu usage load average mem buffers mem shared mem used swap info Reports the percentage of time the system was waiting for I/O to complete or to handle an interrupt. Shows how much of the CPU time was spent on system-level tasks. Reports how much of the managed system's CPU set was spent in the user, system, and nice states. This is the default view. Reports the 1, 5, and 15 minute load averages. Shows how much of the managed system's memory is allocated to system-wide memory buffers. Reports the amount of memory shared among applications. Reports the percentage of memory in use for all activities, for example, code, buffers, and shared memory. Reports the amount of swap space available and the amount of swap space in use. The Last menu specifies the length of the sample data. The choices are as follows: 1 hour 6 hours 1 day 1 week 12 hours 2 days 2 weeks 1 month 2 hours 1 year The Sorted menu specifies how to sort the detail graphs. The options are as follows: ascending Displays those managed systems with the greatest data first. by hostname descending Displays the managed systems by host name regardless of the data. Displays those managed systems with the least data first. The System Details link opens the Nagios Service Status Details for All Hosts window. Selecting the Get Fresh Data button in the top right-hand corner updates the graph with any available new data. NOTES: The detail graphs for a system show the graphs for a specified metric on all Nagios hosts. The detail graphs for a Nagios host show metrics for that Nagios host. Certain graphs might appear empty because the data graphed is an insignificant percentage of the total. This can occur because the measurements under normal operation can often be 1% or less of the total. This can be the case for mem buffers and mem shared, for instance. 170 Using graphical tools to monitor managed systems

171 Figure 32 HP Graph host display for one managed system Gathering and displaying system environment data Insight Control for Linux provides plug-ins that monitor the environment data on each managed system such as temperature and fan speed, which can be indicators of possible system failure. To display environment data, select the Service Problems menu item in the left frame of the Nagios main window to open the Service Status for All Hosts window. You can also use the shownode metrics sensors command to display environmental data. See Section (page 183) for more information Services monitored by Nagios Services, also referred to as plug-ins, typically gather information for many managed systems at a time and apply the information to Nagios through the Nagios FIFO (passive checks) on a managed system basis. Nagios plug-ins are located in the /opt/hptc/nagios/libexec directory on the CMS. Table 21 lists each Nagios plug-in service that runs on the CMS. The items in the Service Name column correspond to the Service column of the Nagios Service Detail View and Service Problems View windows, which are shown in Figure 26 (page 165) and Figure 29 (page 168), respectively Services monitored by Nagios 171

172 Table 21 Nagios monitoring plug-ins running on the CMS Service name Apache HTTPS Server Configuration Monitor IP Assignment DHCP Management Settings Monitor Nagios Monitor Sensor Collection Monitor Supermon Metrics Monitor Switch Data Collection Syslog Alert Monitor System Event Log Monitor Enclosure Collection Monitor Plug-in name check_http check_node_config check_procs check_nagios_vars check_nrpe check_metrics check_metrics switch_poller check_syslogalerts check_selmon check_enclosures Function/Description Monitors the Web server providing the Nagios Web interface. Periodically generates and updates configuration information for managed systems. Watches the DHCP service on the CMS. Watches the /opt/hptc/etc/sysconfig/vars.ini file and reports if the file is not synchronized across managed systems. Watches the Nagios master and Nagios monitor systems on the CMS and reports on the status of the Nagios master and monitor daemons. Gathers environmental data for managed systems. Gathers (predetermined) Supermon metrics for the managed systems. It collects loadave, environmental, and system information data and stores it in the round-robin database (RRD). Gathers switch status and metrics through SNMP. Watches for patterns in the /opt/hptc/nagios/etc/ syslogalertrules file. The Syslog Alerts Nagios service reports individual per-system results. Monitors the hardware event log and issues alerts based on patterns in the /opt/hptc/nagios/etc/selrules file. The Syslog Alerts Nagios service reports individual per-system results. Gathers sensor data for HP BladeSystem Enclosures. Enclosures are represented as hosts in the Nagios web interface. Table 22 lists the services that are monitored on every managed system. Table 22 Services monitored on managed systems Service name Environment 1 Load Average 2 NodeInfo 2 Syslog Alerts 1 System Event Log 1 Function/Description Provides per-system sensor reporting and alerts. It reports on an individual managed system's sensor status. Depending on the system type, all available live sensors are reported. Provides per-system load average information and alerts. It reports a single managed system's most recently collected load average. Alerts are generated based on thresholds defined in the /opt/hptc/nagios/etc/nagios_vars.ini file. Provides per-system process, user, and disk statistics. It reports and alerts based on an individual managed system's process counts, total, user, zombie processes, and system uptime. Alerts are generated based on thresholds defined in the /opt/hptc/ nagios/etc/nagios_vars.ini file. Links to any consolidated log messages that match patterns in the /opt/hptc/ nagios/etc/syslogalertrules file. Links to any System Event Log messages that match patterns in the /opt/hptc/ nagios/etc/selrules file. 172 Using graphical tools to monitor managed systems

173 Table 22 Services monitored on managed systems (continued) Service name Function/Description The System Event Log is collected through the management processor, either an ilo or an IPMI BMC. System Events are hardware-related alerts such as memory errors, power supply faults, and so on. System Free Space 2 Configuration 1 Displays the system free space in /root, /tmp, /var, and /hptc_cluster. This data is compared to thresholds defined in the nagios_vars.ini file. Reports static system configuration information for a single system such as server type, memory, and processors. Swap Info Reports total swap space, amount of swap space used, free swap space, and page cache per server. 1 This information is collected without agents, thus it is available for any host that Insight Control for Linux monitors. 2 This service uses mond to collect its data Understanding Nagios alert messages Insight Control for Linux provides several value-added plug-ins that can generate alert messages based on patterns provided by data sources, such as syslog and the Hardware System Event logs. These plug-ins use a common syntax to describe patterns and status to report on matches. The rules that trigger alarms are configured in the following files: /opt/hptc/nagios/etc/selrules Contains patterns for alerting on System Event Log messages. You can modify the selrules file as follows: Add a rule to this file for a new alert. Modify the corresponding rule to change an alert. Comment out a rule to remove the corresponding alert. /opt/hptc/nagios/etc/syslogalertrules Contains patterns for alerting on consolidated log entries. /opt/hptc/nagios/libexec/sensordata.dat Contains patterns for alerting based on sensor results. Nagios uses to send formatted alerts. The following is the default format of a Nagios alert: Type: PROBLEM 1 State: return code 2 Service: service 3 Host: system 4 Address: IP Address 5 Info: message output 6 Date/Time: date and time 7 Elapsed: time 8 Number: number 9 1 Valid values are PROBLEM or RECOVERY. 2 The Nagios plug-in return code; the values for this code are as follows: 0 OK 1 Warning 20.5 Understanding Nagios alert messages 173

174 2 Critical other Unknown 3 The name of the Nagios service description. For more information, see the corresponding /opt/hptc/nagios/etc/templates/*_template.cfg template file. 4 The alert applies to this host name. 5 The IP address of the host. 6 The message text generated from the plug-in. In the following example, <iclx47> indicates that the Nagios monitor running on iclx47 collected this data. The message is from the plug-in associated with the Nagios service for the System Event Log, in this case, the /opt/hptc/nagios/libexec/check_sel log file. <iclx47> Power Unit Power Redundancy Redundancy Lost 7 A date and time stamp indicating when the cause for the alert happened. 8 Indicates how much time the message waited in the nand queue before it was mailed. 9 The nand sequence number. The nand daemon receives and batches messages that Nagios generates and sends them by Understanding system event log monitoring The firmware on HP servers captures platform-specific events to track hardware states and changes. The events are stored in a System Event Log. Information in the System Event Log varies, but it typically contains information including, but not limited to, the following: Memory ECC errors Power supply failures Voltage problems Insight Control for Linux is configured to alert you of errors that indicate failure or pending failure of a component. Log information is regularly read, archived, and used to generate Nagios alerts based on the rules defined in the /opt/hptc/nagios/etc/selrules file. Event logs are accessed through the management port. They require platform- and protocol-specific user authentication and network access to the console port. System Event Log history is captured in /hptc_cluster/adm/logs/sel/sel-xxx.log, where xxx represents the name of the individual managed system. The standard logrotate functionality manages logs. For more information, see logrotate(8) Configuring Nagios alerts Nagios sends by default to the nagios user. The simplest method to forward alerts is to log in as the Nagios user and to create a.forward file in the Nagios user's home directory (usually /home/nagios) to redirect alert messages from Nagios to another account. This method assures that the permissions on the.forward file are correct. TIP: Ensure that the sendmail utility is running. Edit the /opt/hptc/nagios/etc/contacts.cfg file to customize the Nagios configuration to specify whom to contact. The main portion of this file is shown here: # 'nagios' contact definition define contact{ contact_name alias service_notification_period 174 Using graphical tools to monitor managed systems nagios Nagios Admin 24x7

175 host_notification_period 24x7 service_notification_options w,u,c,r host_notification_options d,u,r service_notification_commands notify-by- ,notify-by-epager host_notification_commands host-notify-by- ,host-notify-by-epager pager } Changing the values for and pager to reflect the system name enables Nagios to send notification through the sendmail utility. For example, change to Nagios can generate a large number of messages. See Section A.5 (page 262) for information about how to use the open source Nan utility to control the number of messages Nagios sends Monitoring Metrics in real time This section describes how to use the Insight Control for Linux Performance Dashboard tool to display real time metrics. The following topics are addressed: Performance Dashboard overview (page 175) Performance Dashboard features (page 175) Performance Dashboard requirements (page 176) Interpreting the data in a ring plot (page 176) Launching the Performance Dashboard tool (page 177) Using the mouse buttons to manipulate the Performance Dashboard tool (page 178) Performance Dashboard tool metrics (page 178) Customizing the Performance Dashboard tool metrics (page 179) Performance Dashboard overview The Insight Control for Linux web-based Performance Dashboard tool displays actual metric data in real time for the managed systems, that is, servers that Insight Control for Linux monitors and manages. Data refreshes at one second intervals, and you can dynamically select the metrics you want to display for the managed systems. The Performance Dashboard tool receives its data from Supermon and displays the data in the form of a ring plot, similar to a pie chart. Running the Performance Dashboard tool slightly affects the system performance of the CMS and the managed systems Performance Dashboard features The Performance Dashboard tool provides the following features: Monitors and displays metrics data for all or user-selected managed systems in the icelx_servers subcollection Reports data for up to 100 systems in a single ring plot Creates multiple ring plots when the hardware configuration has more than 100 systems Offers a large selection of predefined metrics Refreshes metrics data every second Extends monitoring capabilities by launching Nagios directly from the ring plot Provides a quick launch capability, which runs relevant Insight Control for Linux tasks on a target managed system directly from the ring plot 20.8 Monitoring Metrics in real time 175

176 Allows user customized and predefined metrics Performance Dashboard requirements The servers you want to monitor must fulfill the following requirements for using the Performance Dashboard tool; the servers must be: Licensed for Insight Control for Linux Configured to use Insight Control for Linux monitoring services, as described in Chapter 19 (page 154) Interpreting the data in a ring plot Each segment, or slice, of a Performance Dashboard ring plot represents data for one managed system. Each metric is shown in its own ring plot, and each managed system has its own segment of the ring plot. The ring plots are arranged in rows and columns based on the window size and the number of ring plots displayed. Figure 33 illustrates the Performance Dashboard tool's default view, the percent of CPU load. The center dial shows the current value. Figure 33 Performance Dashboard default view: percent of CPU load Figure 34 illustrates three ring plots that are displaying the CPU load (percentage), system uptime (in days) metrics, and a partial view of the free root file system space (percentage). The center of the ring shows the current value for the metric as well as the minimum, average, and maximum values of the selected managed systems.table 23 (page 178) describes how to use the mouse buttons to display additional metrics. 176 Using graphical tools to monitor managed systems

177 Figure 34 Monitoring three metrics using Performance Dashboard Ring plot color coding The colors that the Performance Dashboard ring plot segments use represent the following: Light Gray means that a managed system is actively reporting data. Pink represents the actual value of the metric. Dark Gray means that a managed system is not reporting data and might be down. In that case, select the Left Mouse on the managed system to launch the Nagios application focused on that managed system to investigate further Ring plot units of measure If a metric's unit of measure is a percentage, as is the case for the CPU load metric, the ring plot starts at 0 (zero) and ends at 100 percent. If a metric's unit of measure is something other than a percentage, such as Megabytes or days, the ring plot scale starts at 0 (zero) and ends with the maximum value reported by all the monitored managed systems Launching the Performance Dashboard tool 1. Select the following menu item from the Insight Control user interface: Tools Integrated Consoles Performance Dashboard Monitoring Metrics in real time 177