3.7.12

How to Create Host Profiles in VMware ESXi 5.0


Click Home, then at the bottom select Host Profiles [here you can create new profiles, manage existing profiles, edit the answer files, and edit the attached cluster].





Next you will see the Getting Started screen. You can create a profile from here, by selecting the hyperlink “Create a Host Profile” or you can create from the button on the top of the task bar.




No matter which method you chose to begin creating a Host Profile, the ‘Create Host Profile’ wizard opens and you are prompted to either create a profile from an existing host or import an existing profile. [If you create from an existing host, make sure the entire network, storage, etc. configurations are satisfactory before choosing a host. This should be planned in advanced]


Click Next.
Select the host from which the profile should be created from.


Click Next.
Give your profile a name, and add something in the Description field [insert dates, and configuration information]. This is not required, but having some description helps when deciding to apply a profile to a host if Profile Manager is accessed by multiple people.


Click Next.
The Wizard shows you a summary of the new profile, click finish if everything looks acceptable, otherwise click back and edit the areas that need to change.


Once you click finish, notice the Active Task bar.


When the task completes, you should see your new profile in the list of available profiles on the left [this example we created TEST01]



Now, depending on the profile you would like to use, you will need to assign a datacenter and host to the profile for compliance. To assign a datacenter, right click the new profile and select Attach Host/Cluster.


First attach the Cluster by selecting the cluster, then clicking the Attach button. Next add the individual hosts underneath the cluster, clicking attach after each one. You can add multiple clusters and multiple hosts. When you are finished, click OK.
You will see the task in the active task bar at the bottom. When it is complete, your new profile is available, and the hosts and datacenter [cluster] have been attached to the new profile.




In order for a host to check compliance against a profile, it must first have a completed answer file.
Think of the answer file as containing the “dynamic” information within the environment [IP addresses, mac addresses, server name, etc.] All of these things are the dynamic information that should change from one host to another [with the exception of a duplicated DR site]. You can view the status of a hosts answer file by going to Home > Host Profiles > select the profile > click the Hosts and Clusters tab > then view the answer file status column.

To edit, the answer file on any given hosts, simply right click on the host, and select either Check, Update, Import or Export. Any changes you make to the answer file will not take effect unless you click Update.



If you make a mistake or are unsure about the changes you have made, simply click Cancel! You will not see all of the same options in the Answer File as you do the Profile. Remember Answer = Dynamic.
Once you have been through the process of inserting and applying all of the ‘user prompted’ information, Update the answer file. In the status should change to complete. You can check compliance against the profile to see if the changes you made are still in compliance or not. If not, put the host in maintenance mode, and apply the profile.

Host Profiles:

By right clicking on the Host Profile, you have a couple of options, they include:
Edit Profile: by editing the profile, you make changes to the “blueprint” of the golden host configuration without actually changing any configurations on any of the hosts, until you’ve applied that newly changed Host Profile to your hosts.



Enable/Disable Profile Configuration: This allows you to apply specific configurations to the hosts in which you are checking compliance. Simply uncheck the box and click ok.



Clone, Delete, Export. [These should be self-explanatory].

Attach Host/Cluster: this is where you can attach a cluster or hosts or both to the profile in which you are wanting compliance against.




Change Reference Host: the reference host is the host in which the profile was originally created from. For example, I have 3 hosts in my environment, Host1, Host2, Host3. I originally created Profile A from Host1, but my networking guy made drastic changes to the virtual networking on Host2, and those changes need to be applied to all of the hosts. By changing the reference host from Host1 to Host2, I can capture the changes and Update the profile to reflect.

Update Profile From Reference Host: Continuing from the example above, in order for the Profile to reflect the changes the Networking guy made, I will need to not only Change my reference host, but also Update my profile from the Reference Host. Updating the profile, changes the Static information contained in the profile.

After you have changed the reference host, and updated the profile from the reference host, be sure to check compliance against the other hosts in the cluster. If any are not compliant, put the host in maintenance mode and apply the profile.



Some TROUBLE-shooting Encounters & Measures:
General Error…
After some digging around and a lot of headache… check to make sure that IF your hosts log files are stored somewhere OTHER than local to the host, that the logging is working!! Sometimes this can be remediated by rebooting the host. Be sure to take the steps of turning off HA, and DRS if enabled on the cluster, then migrate the virtual machines off and reboot the hardware. This should kick start all of the services and fix any connection issues to the hosts logs.























9.5.12

VMware PCI Compliance Checker


The way it works:

The ESX 4.1 checker installs on on a windows desktop. You then tell it which hosts to run the check against. There is a web-based GUI that you are able to and view the results. It's very simple.

It provides details “rule by rule” indications of pass or fail. When issues are found, you are given an explanation and advice on remediation.

This can be used during an audit to demonstrate IT compliance.

This does not install agents on the hosts or the virtual machines. The reports are logged on the machine that you’ve installed the compliance checker on.

Some things to do prior to installing the Checker:
1. Download the Java exe
2. Make sure you remember where you install it.
3. Know the ESX hosts IP, root username and password.
4. Run the tool.

Make sure you have this first!










Pay attention to the Checker Version you download. I downloaded the PCI checker for ESXi 4.1 VMware Hosts. When I tried to run it against a V5.0 host, it failed....




This is a great little tool to use. Be sure to check out VMware's vSphere Security Hardening Report Check Script.

16.3.12

enabling windows 2008 application-consistent quiescing on esxi

*Updated 04.09.12
The reason behind this post…

The customer was using TSM for VE (tivolli storage manager for virtual environments) v5.x to backup their current VMware environment (ESXi 4.1).

The guest OS was Windows Server 2008 R2 and the backups would consistently fail to complete, throwing time-out errors during snapshot creation, but would sometimes complete if forced individually. The initial work-around was to set the diskUUID=false, and then let the backups run. Sometimes they would complete, other times they would time out.

The other problem with having the diskUUID set to false, was that they were only getting file level backups, when they needed application level.

After a month with IBM technical support (great group of people btw), the issue was definitely not found with TSMVE, and it was going to have to be addressed within the VMware environment.
So digging through various KB articles, and reading many blogs by other IT professionals, these were the changes that resolved many issues, after the configurations changes, the environment was now effectively:
  • giving application-consistent backups
  • snapshots no longer timing out when initiated by Tivolli (est. 8 seconds to complete)
  • successful restores
All of this by disabling VMware's VSS writers, and enabling the Guest VSS, the application was able to be quiesced.






























1.1.12

1.1 Install and Configure vCenter Server - vCenter Server Editions

Identify available vCenter Server editions
  • vcenter server for essentials
  • vcenter server foundation
  • vcenter server standard
  • vcenter orchestrator: streamlines and automates IT processes
  • vcenter server linked mode: enables a common inventory view across multiple instances of vcenter.
Management Clients for Datacenter management & Virtual Machine access:
  • vSphere client: an interface that enables users to connect remotely to vCenter server or ESXi from any Windows PC.
  • vSphere Web client: a web interface that enables users to connect remotely to vCenter server from a variety of web browsers and OS's.
  • vSphere Command Line Interface (CLI)
***Personal Notes from failed & successful installs of vCenter Server & various components:
- when installing a new vCenter server, make sure that the computer/virtual machine that you are installing it on has already joined the domain that it will live in. Symptoms of not doing this include:
hardware management tab not appearing, and will not enable in plug-in manager
storage view tab does not appear & the plug -in will not enable.
HA fails... and will not see datastores for it's heartbeat.
Web Client detects the old generic computer name for vCenter after you've installed the client & will fail to open.
- If you are going to install the web client, and the vCenter server you are installing it on also has software for IBM Storage Manager, disable the IBM Web Manager service in Services, because this also uses the same port as the vmware web client... Symptoms include:
web client failing to open after a successful install (you may be able to access it through the https://localhost.9443..., but will not be able to access it through the registered vCenter address you create.