Aaron Delp’s BladeVault

Judging by the number of posts recently, it is no surprise that I haven’t seen a lot of good documentation surrounding VMWare Update Manager.  One thing I haven’t seen is a best practices on how to configure Update Manager.  Here is a list of the options and some thoughts on setting for each one.

1. To access the configuration settings, Click the Update Manager Button
2. Click the Configuration Tab in Update Manager
3. Guest Settings -> By default this will take a snapshot of guests but not delete them.  This can degrade performance.  Consider not taking snapshots or have them autodelete after a certain number of hours (Max appears to be 100 hours)
4. ESX Host Settings -> By default the response of ESX hosts that can not enter maintenance mode is to retry every 30 minutes but the number of times is set for zero.  That doesn’t make sense to me.  Consider setting the value to 1 or 2 and setting the time as appropriate for your environment.  In addition to retry as an action, you can also Fail Task, Power Off and Retry, or Suspend and Retry
5. Update Downloads -> Click Update Downloads in the upper right corner

• • Under Select Update Types, check the boxes for the OS’s you will update.  By default, Windows, Linux and ESX are all checked.  If you are only going to update ESX servers, uncheck Windows and Linux.  Click Next.
  • Under Schedule Task, enter the parameters for the scheduled download task and click Next
  • Under E-mail Notification, optionally enter the e-mail addresses to be notified when new updates are downloaded and click Next
  • Click Finish

You can also modify the Internet Settings if you have a proxy server and/or modify the ports Update Manager uses.  I will assume this is self explanatory.

By default, VMWare Update Manager is configured to download updates for Windows, Linux, and ESX.  If you only plan to update ESX servers with Update Manager, this can waste a lot of disk space.  To configure Update Manager to only download ESX updates, do the following:

1. From the VI Client, Click the Scheduled Tasks Button at the top
2. Right click the Update Manager Update Download task
3. Click Properties
4. Under Select Update Types, uncheck Windows and Linux.  Click Next
5. Optionally you can modify the additional task parameters as needed (time to download, e-mail notification, etc)
6. Click Finish

By default, VMWare Update Manager only checks for updates once a week.  To initiate a download immediately, perform the following:

1. From the VI Client, Click the Scheduled Tasks Button at the top
2. Right click the Update Manager Update Download task
3. Click Run

In my humble opinion, the VMWare Update Manager Documentation isn’t the greatest.  So, I have developed this cheat sheet to help me set it up.  I will also be posting more information on configuration of Update Manager shortly.

1. From the Virtual Center Client, click the Update Manager Button
2. From the Getting Started Tab, click Create A New Baseline
3. Enter a name and description for the baseline (i.e ESX Hosts)
4. Click ESX Server Updates for the Baseline Target and click Next
5. Click Next to leave the Baseline Type to Dynamic
6. Click Next to leave the Criteria at the defaults
7. Click Finish
8. From the Virtual Center Client, click the Inventory Button
9. Select a host to configure in the left hand pane
10. Once a host has been selected, click the Update Manager tab all the way on the right in the right hand window (next to maps)
11. Click Attach Baseline
12. Select the Baseline created above and click Ok
13. Right Click the host in the left hand pane and select Scan for Updates
14. Click Yes to confirm the scan
15. After the scan is complete, click the Update Manager tab for the host (not the button at the top!) to determine if the server is compliant
16. If the server is not compliant, right click the host in the left hand pane and select Remediate
17. From the Baselines page, check the baseline you would like to apply and click Next
18. Check all patches you would like to apply and click Next
19. Choose the Remediation Time and the Failure Options and click Next
20. Click Finish

I did something interesting recently.  I bought a "dumb phone" to replace my Windows Smart Phone.  Why would I do such a thing you ask?  Two reasons, the Verizon XV6800 isn’t a very good phone and I wasn’t getting my money out of the data plan to justify the data charges.  I like the features of the XV6800 and Windows Mobile is OK but in the end I’m very happy with my decision.

By the way, I have been "cheating" so far.  I still have the XV6800 and I am using it much like a PDA.  I connect to Exchange using ActiveSync, still upload notes in Evernote, etc using the wireless.  I am considering selling the XV6800 and purchasing an Ipod touch or something similar but for now this is working out for me.

I have performed the process to license Virtual Center numerous times for customers but sometimes I forget the order.  Here ya go…

1. Copy the license key files into c:\program files\vmware\vmware license server\licenses
2. Restart the VMWare License Server service
3. From the Virtual Center Client, Administration Menu -> VirtualCenter Management Server Configuration
4. From the License Server entry, choose the appropriate license server destination (this server by default)
5. From the License Server entry, choose the appropriate type of VC Server (VC Server or VC Foundation Server)
6. Click OK

I found an interesting bug in the latest version (1.42o) of the IBM Blade AMM (Advanced Management Module) that I wanted to share with everyone.  If you are using the new Intelligent Copper Pass Thru Modules you are not able to update the firmware on the ICPM.  If you try to update it using the AMM interface, you will get an error and the ICPM will not flash.

This may not be a deal killer for other switches but it was for the ICPM because we needed the latest version for the modules to work correctly (version 1.0.1.2 if I remember right).  So, catch 22….

IBM Support found the problem and it was indeed a bug in the 1.42o AMM.  If you back level to 1.42i, the problem goes away.  The problem is 1.42i is pulled from the web.  So, if you see this, open a ticket with IBM support and they will fix you up.

I assume the next version of the management module code will fix the bug and/or IBM will start shipping the ICPM’s with the 1.0.1.2 code on the ICPM so this article probably has a limited life span.

I periodically set up ESX servers for customers.  Over time I have developed a document that helps me when I am performing configurations on-site.  This is by no means an inclusive list of commands, this is more a brain dump for me so I have access to this in case my laptop isn’t handy.  If anybody has any additions, I would love to hear them!!

• Edit an ESX server to allow root SSH and SFTP access
  • vi /etc/ssh/sshd_config
  • Change PermitRootLogin no to yes
  • Restart ssh service using the command: service sshd restart

• Edit an ESX Server for NTP access (Internet in this case, could be a customer NTP server)
  • vi /etc/ntp.conf
  • Change OUR TIMESERVERS section, enter the server names – For the Internet use the following:
    • server 0.us.pool.ntp.org
    • server 1.us.pool.ntp.org
    • server 2.us.pool.ntp.org
  • Pipe the NTP Servers into step-tickers so NTP will update at NTP start using the following the commands:
    • Echo 0.us.pool.ntp.org >> /etc/ntp/step-tickers
    • Echo 1.us.pool.ntp.org >> /etc/ntp/step-tickers
    • Echo 2.us.pool.ntp.org >> /etc/ntp/step-tickers
  • Set NTP to start: chkconfig ntpd on
  • Set ESX Firewall to allow NTP Traffic: esxcfg-firewall –e ntpClient
  • Run an manual update: ntpdate 0.us.pool.ntp.org

• Patch the ESX Server with the latest patches (Update Manager is MUCH easier!)
• NOTE: The patches must be installed in “groups” based on their date starting with the oldest to the newest (i.e. apply the Septmber 9th patches, then the September 21st patches, etc)

• • SFTP the Patches into a directory on the server
  • Change into the folder and run the following as root
  • For ESX 3.0.X: tar –xvzf (name of patch).tgz
  • For ESX 3.5.X: unzip *.zip
  • change into the directory it creates
  • esxupdate –(2 dashes)noreboot update
  • change back to the root patch folder, rinse, repeat
  • When complete enter the following command to check the patch status: esxupdate query

• Commands to change the server ip, name, dns, gatewat, etc.
  • To check the config of the server from the command line: esxcfg-info
  • To check the vSwitch settings from the command line: esxcfg-nics -l
  • To change the hostname of the server or the default gateway
    • vi /etc/sysconfig/network
    • vi /etc/hosts with the new name
  • To change the DNS entries of the ESX server: vi /etc/resolv.conf
  • To change the IP Address and the Subnet Mask of the ESX Server:
    • esxcfg-vswif –i (IP Address) –n (Subnet Mask) (vswitch-name -> vswif0 for the Service Console by default)
  • To change the VLAN tag of the service console port:
    • esxcfg-vswitch vSwitch0 –p “Service Console” –v (VLAN NUMBER)
  • NOTE: If you modify the above settings, make sure you also modify the network section of the /root/anaconda-ks.cfg file as well.
  • To see what services the ESX firewall will allow: esxcfg-firewall –s
  • To change the root password from the command line: passwd
  • If you have changed the ip address or name and HA is acting up:
    • /opt/vmware/aam/bin/ft_gethostbyname
    • rename and/or delete FT_HOSTS file under /etc/opt/vmware/aam/

Just a quick heads up that I’m on-board for the "Social Network Revolution".  Over the last few weeks I’ve created accounts on Facebook, Twitter, Delicious, and Friend Feed.  I’ll be integrating a lot of this information into the blog "in the near future".  For now, here are the links to everything.

A quick note on Friend Feed in case you aren’t familiar with it.  Friend Feed is really nice because it aggregates all of your social networks into one feed.  My friend feed has the blog, twitter, and delicious all in one place.  NICE!

Delicious - http://delicious.com/aarondelp - If you subscribe to the feed, you already see these links (Hint! Hint!)

Twitter - http://twitter.com/aarondelp

Friend Feed - http://friendfeed.com/aarondelp

FaceBook - Friend me up if you know me in real life.  I’m saving that space to stay in touch with old friends.

IBM recently released another Ethernet card that is worth mentioning.  This card is different from previous Ethernet cards because it is the CFFh form factor instead of CFFv.  If you are confused about the whole CFFv vs CFFh let me know, I am considering a post about this in the near future.

For now, suffice to say you can have a CFFv card and a CFFh card on the blade for a total of 2 expansion cards.  You always had a lot of choices for CFFv but only one for CFFh (if you’re not going high speed!).  The existing card was a dual port FC and dual port Ethernet combo card all in one.  What if you didn’t need the FC ports?  Up until now you were out of luck.

This is a nice addition for customers that need more Ethernet ports on a blade but didn’t want the FC ports.

Link to IBM Product Announcement for the card

I just found this and I wanted to share.  This could have been on the site for a long time, I just now discovered this document and found it very useful.  IBM now publishes a BladeCenter Interop guide listing just about everything you would ever need to know about the BladeCenter, Blades, and options.  Check it out!

Link to IBM BladeCenter Interop Guide

HP recently announced that the NC364T adapter may need to be replaced.  Please note this is NOT the NC364 quad nic that fits on the Blades.  This is the PCI-E adapter for the rack mount servers.  Details of the replacement can be found at the link below as well as a link to verify if your adapters need to be replaced.

Link to the NC364T Advisory

Link to check NC364T cards