RHCSA 7 Exam Notes #1: Understand and use essential tools

Word version available here:
https://drive.google.com/file/d/0B9WPh0iDN4KwejAxaVJZS0hTWVk/edit?usp=sharing

Access a shell prompt and issue commands with correct syntax.

Basic Linux Commands:

ls -lh    (human readable format)
ls -a (show hidden files)           

First Character File Type explanation: d=directory,l=symbolic link,p=uni-directional named pipe file,s=bi-directional socket file

pwd                             (Show present working directory)

cd /usr/bin                 (go to directory /usr/bin off root)
cd /                              (go to root directory of filesystem)
cd ~                             (go to users home folder)
cd -                              (switch back to last dir)
cd..                              (move up 1 folder lvl)

who                             (who is logged in)

w                                 (a variation of above)
id                                 (id and context of current user)
groups                         (what groups does current user belong to)
uname -a                     (system info)
hostname                    (fqdn of server)

last                              (user logins, logout and system boot)

last reboot                   (same as above but only shows system boots)
lastb                            (failed logins)

clear                            (clears terminal window)

whereis cat                 (provides path to binary and man pages)

history 17                    (show last 17 commands)

!ch                               (reexecute last command starting with ch)
!82                               (reexecute command number 82 from previous history command)

Use input-output redirection (>, >>, |, 2>, etc.)

Ll > ll.out                     (generates text file we can sort in the next command)
Sort ll.out > sort.out    (creates sorted version sort.out, use >> to append to existing file)

Normally errors and output are piped to terminal window. You can manipulate this as follows:
 

Standard Input=0, Standard Output =1, Standard Error=2
mailx student < /tmp/myball              (mail the user student the contents of file myball)
find / -name cat -print 2> /dev/null  (/dev/null is a black hole)
ls /etc /tmp 1> outputfile 2>&1          (pipes directory listing of two directories to output file with any associated errors)

Use grep and regular expressions to analyze text

grep -i student /etc/passwd /etc/group         (searches for pattern student in passwd & group files and display filename. -i ignores case)
grep -i olives ~/Desktop/*      (searches all files in users home/Desktop folder for text olives)
grep -i ^student /etc/passwd  (searches file passwd for lines beginning with student)
rep nologin$ /etc/passwd     (searches file passwd for lines ending with nologin)
ll /etc | egrep ‘drwx|xin’        (searches ll directory listing output for permission matches)

diff -i -c myball1 myball2       (compares both files and uses 3 sections in output to show differences, can be used on directories also, -i ignores case, -c makes output readable)

While we’re at it what about finding files themselves:

find / -iname ‘myball*’           (case insensitive search starting in / for file starting with myball, will find /root/myball1 & /root/myball2)
find /etc -size +1G                   (find files in /etc over 1Gigabyte in size)
find /usr -user student            (find files owned by user Student)
find /tmp -mtime +90             (find files modified more than 90 days ago; also -90,90,-atime)
find /var -perm 777                (find files with permissions set to 777)

Access remote systems using ssh and VNC

I wish they were all this easy! SSH is a doddle, VNC is almost so if you ignore the painful official documentation instructions!

ssh root@server1.example.com         (connect to remote server1 as user root)

yum -y install tigervnc-server             (“yum -y install vnc” to get the client)

Next, use GUI Menu: Applications,Sundry,Firewall to configure a permanent exclusion for vnc-server
vncserver                                            (Starts VNC Server and prompts for password)

VNC uses ports 5900 for service and 5901+ for each connection. To test, open The Windows Client and put in the IP Address followed by port number “192.168.192.129:5901” for example and enter the password used earlier.

Click Applications / Internet / TigerVNC Viewer to test with the Linux Client

Log in and switch users in multiuser targets

su -                  (switch to root and execute root’s initialization files including PATH variables)
su - lisa            (switch to user Lisa, not space between - and lisa’s username)

To permit users to use sudo run command “visudo” and copy root line as follows:
 

root                 ALL=(ALL)        ALL
student            ALL=(ALL)        NOPASSWD:  ALL
test with sudo firewall-config as an example, you won’t be prompted for user passwd with the option used above for student

Archive, compress, unpack, and uncompress files using tar, star, gzip, and bzip2

tar cvf /tmp/test.tar /var /etc/ntp.conf         (c - creates tarball, v - verbose, f - specify name, creates test.tar in /tmp with contents of /var and the file ntp.conf)

Note: Error “Removing leading ‘/’ from member names" when adding individual files can be worked  around by running the command from the directory where the files you want to archive are.
 

tar rvf /tmp/test.tar /etc/yum.conf                (r - appends to existing uncompressed tarball)
tar tvf /tmp/test.tar                                        (t - shows contents of test.tar tarball, add z or j if compressed)
tar xvf /tmp/test.tar –C /tmp                         (x – extracts contents of test.tar, use -C extract to specified directory)
tar cvfz /tmp/test.tar.gz /etc/yum.conf         (Create tarball and compress with gzip)
tar xvfz /tmp/test.tar.gz                                 (Extract gzipped tarball)
tar cvfj /tmp/test.tar.bz2 /etc/ntp.conf          (Create tarball and compress with bzip2)
tar xvfj /tmp/test.tar.bz2                               (Extract bzipped tarball)
bzip2 is slower but compresses better than gzip. Note: you can’t append to compressed archives.

star is not installed by default but is SELinux aware, sudo yum –y install star-1*
star –h                                                 (to show help or use “man star”)
Command works the same as per TAR but accepts extended options
star cvf /tmp/myball.tar /home         (tvf and xvf options as per tar) gzip /root/myball1 /root/myball2      (gzips both files & appends .gz extension)
gunzip /root/myball1.gz                     (unzips file)
bzip2 /root/myball1 /root/myball2    (create 2 new bzipped2 files with .bz2 extension)
bunzip2 /root/myball1.bz2                 (unzips file)

Create and edit text files

touch myball2   or   vi myball2           (creates new file myball2)
vi has 3 modes, command mode (default) for copy, paste, replace and search etc; input mode for inserting text into file, last line mode for commands starting in :

input mode:
i or I                 (inset test at current position or beginning of current line)
escape to exit input mode

command mode:

dd                    (deletes the current line)
D                      (deletes from cursor position to end of current line)
u                      (undoes last command or U undoes all changes done on current line)
?apples            (searches for work apples, n continues search for next instance)
yy & p              (yy copies current cursor line into buffer, p pastes it below the current line)

last line mode:

:%s:/oldword/newword/gi      (replaces all occurrences of oldword with newword, case insensitive)
:r myball4        (reads file myball4 and inserts it below the current line)
:wq!                 (write all changes and quit)
:wq! myball3   (saves file as myball3)

Create, delete, copy, and move files and directories

mkdir –p /usr/mike/wibbly/wobbly    (creates all directories in one go)
cp –i myball1 myball2            (copies file but -i states to confirm any overwrite)
cp -r folder1 folder2               (copies folder1 & all subdirectories to folder2)
mv -i  myball1 test                  (moves myball1 into subfolder test)
mv myball1 myball2               (renames file)
mv newdir test                        (moves newdir folder into test folder)
mv newdir2 newdir3               (renames folder)
rm deleteme                           (deletes file deleteme)
rm -r test                                 (deletes non empty directory)

Create hard and soft links

Inodes – the glue which points to an individual file or joins two files at the hip
Soft Link – equivalent to windows shortcut
ln –s bigball linktobigball        (creates a pointer file linktobigball which links to file bigball)
ll -i                                           (shows link between files in earlier step, 1^st column show inode number which should be different)
Hard Link – associates two files to same inode number
ln bigball myotherbigball       (file have identical permissions, owndership, time stamp and contents. Change one, it changes the other)
ll -i                                           (shows both files now have same inode number in 1^st column)

List, set, and change standard ugo/rwx permissions

What’s ugo you may ask? User, Group & Owner permissions. They are assigned combinations of rwx, otherwise called Read, Write and Execute permissions.

-rw-rw-r--. 1 michael michael 39 Jul  4 12:30 myball34

[File type]-[Owner perms]-[Owners Group Member perms]-[Public perms]  # links  File Owner  Owners Group  File Size  Modified Timestamp  Filename

chmod [u/g/o/a(all)] [+/-/=] [r/w/x] myball34

chmod u+w myball34             (gives write permissions to owner)
chmod a=rwx myball34          (gives all permissions to all 3 categories)
decimal method: 0=None, 4=Read, 5=Execute, 6=Read&Write, 7=Read&Write&Execute
chmod 744 myball34              (gives all permissions to Owner and Read to other two)
chmod 770 myball34              (gives all permissions to Owner and Owner Group, None to Public)
chmod o+t /tmp                      (sets sticky bit for public on /tmp to protect against deletion)

umask command displays 0002 and umask –S shows default permissions in rwx format

To calculate take 666 for files -002 gives 664, so that’s R&W for Owner and Owner Group and Read for Public. Use 777 for folders -002 which gives R&W&X for Owner and Owner Group and R&X for Public. To set new defaults such as 640 File & 750 Directory use umask 027 (666-X=640, 777-X=750). Not permanent.

To change the owner of a file use ll –n to show UID and GID and the following command:

chown student2 mybigball
chgrp student2 mybigball
chown student2:student2 mybigball               (does both in one go!)
chown –R student2:student2 /usr/student2   (does folder /usr/student2 and all subfolders in one go)

Locate, read, and use system documentation including man, info, and files in /usr/share/doc

man star                                  (Brings up manual for Star command)
man -k system-config             (Find command using all man pages that match system-config)
man –f host.conf                     (Finds info on file/command)
star –h
cat –help
passwd -?
info star
/usr/share/doc contains folders for all installed packages with various files in each one

                                   

Technology Career Path Musings

Well, I thought I’d have a quiet year and take a break from exams. Got my VCAP5-DCA and VCAP5-DCD last year but with major moves on OpenStack I thought I’d find out more about what it all means. In doing so I figured some Linux skills would come in handy. I’ve dabbled a bit to get under the covers in ESXi and some virtual appliances but never taken any formal training. It appeared very complex but with Microsoft pushing Azure / Cloud and starting to pull away from technologists who’ve supported them for over a decade (e.g. Technet cancellation, Master Program cancellation) and generally getting all rowdy (What's up with their VDI licensing and get SA for passive DR copies of Servers/SQL?), I thought Linux would be a good complementary skill to have. If Openstack takes off, KVM might become even more important and RedHat I felt was a good distribution to certify on to open other doors. Microsoft are a great company and they’ve a very loyal following but with everything being sucked into the cloud my 3 x MCSE’s don’t feel like a good investment of my time anymore to renew.

So, RedHat just released Red Hat Enterprise Linux 7 just in the middle of my studies (!) and the exam has been upgraded also. It’s a 2.5 Hour exam, hands on and I’m book to sit it in a few weeks. The RHEL 7 exam objectives are mostly the same with a few additions so I thought as I’ve to redo my notes anyway for this version I’d try and blog some or all of the commands I felt I needed to know to meet each sections requirements. So for the next while it’s RHEL7 all the way and my attempts to find the easiest and quickest way to meet exam objectives and pass my first Linux exam.

The exam blueprint is available here:

https://www.redhat.com/training/courses/ex200/examobjective

There are a number of objective headings as follows:

·         Understand and use essential tools

·         Operate running systems

·         Configure local storage

·         Create and configure file systems

·         Deploy, configure, and maintain systems

·         Manage users and groups

·         Manage security

I’ve listed the full objectives below and highlighted those that have been added for the RHEL7 Exam over the RHEL6 exam:

Understand and use essential tools

 

• Access a shell prompt and issue commands with correct syntax.
• Use input-output redirection (>,>> , |, 2>, etc.).
• Use grep and regular expressions to analyze text.
• Access remote systems using ssh and VNC.
• Log in and switch users in multiuser targets.
• Archive, compress, unpack, and uncompress files using tar, star, gzip, and bzip2.
• Create and edit text files.
• Create, delete, copy, and move files and directories.
• Create hard and soft links.
• List, set, and change standard ugo/rwx permissions.
• Locate, read, and use system documentation including man, info, and files in /usr/share/doc.

 
Operate running systems

• Boot, reboot, and shut down a system normally.
• Boot systems into different targets manually.
• Interrupt the boot process in order to gain access to a system.
• Identify CPU/memory intensive processes, adjust process priority with renice, and kill processes.
• Locate and interpret system log files and journals.
• Access a virtual machine's console.
• Start and stop virtual machines.
• Start, stop, and check the status of network services.
• Securely transfer files between systems.

 

Configure local storage

• List, create, delete partitions on MBR and GPT disks.
• Create and remove physical volumes, assign physical volumes to volume groups, and create and delete logical Volumes.
• Create and configure LUKS-encrypted partitions and logical volumes to prompt for password and mount a decrypted file system at boot.
• Configure systems to mount file systems at boot by Universally Unique ID (UUID) or label.
• Add new partitions and logical volumes, and swap to a system non-destructively.

 

Create and configure file systems

 

• Create, mount, unmount, and use vfat, ext4 and xfs file systems.
• Mount, unmount, and use LUKS-encrypted file systems.
• Mount and unmount CIFS and NFS network file systems.
• Configure systems to mount LUKS-encrypted, and network file systems automatically.
• Extend existing unencrypted logical volumes.
• Create and configure set-GID directories for collaboration.
• Create and manage Access Control Lists (ACLs).
• Diagnose and correct file permission problems.

  

Deploy, configure, and maintain systems

 

• Configure networking and hostname resolution statically or dynamically.
• Schedule tasks using at and cron.
• Start and stop services and configure services to start automatically at boot.
• Configure systems to boot into a specific target automatically.
• Install Red Hat Enterprise Linux automatically using Kickstart.
• Configure a physical machine to host virtual guests.
• Install Red Hat Enterprise Linux systems as virtual guests.
• Configure systems to launch virtual machines at boot.
• Configure network services to start automatically at boot.
• Configure a system to use time services.
• Install and update software packages from Red Hat Network, a remote repository, or from the local file system.
• Update the kernel package appropriately to ensure a bootable system.
• Modify the system bootloader.

     

 Manage users and groups

 

• Create, delete, and modify local user accounts.
• Change passwords and adjust password aging for local user accounts.
• Create, delete, and modify local groups and group memberships.
• Configure a system to use an existing LDAP directory service for user and group information.
• Configure a system to use an existing authentication service for user and group information.

  

Manage security

 

• Configure firewall settings using system-config-firewall or iptables.
• Configure key-based authentication for SSH.
• Set enforcing and permissive modes for SELinux.
• List and identify SELinux file and process context.
• Restore default file contexts.
• Use boolean settings to modify system SELinux settings.
• Diagnose and address routine SELinux policy violations

 So what follows are responses to each section and an attempt to create a self study guide. MY advice, do the course! I'm not going to but if I fail I might beg my manager to be sent on one! Sometimes being shown something is worth a thousand blog posts! If you're thinking of heading down this path I wish you the best of luck. If you're just a Microsoft Admin currently how many job posting ask for Linux skills, it could help you out one day. Of course, not using those skills will mean they degrade but I've already found them useful. The Quorum Witness used with 3PAR Peer Persistence is a RedHat Appliance. Going to ESXi command line I feel more comfortable and confident putting in different expressions and searching for what I want rather than opening whole files up. I'm still a novice sitting beside anyone who has a lot more exposure but at least I can now recognise the commands even if I would need to look up how to use them. Scott Lowe has started down the OpenStack path in a big way for the last 18 months and recently blogged how he now looks around him and realises he gets scripting and terms that others are looking blankly at, and how his knowledge has expanded but he only just realised how much progress he's made.

IT is changing, where do you want to be in 5 years? A colleague feels overwhelmed at the changes they are encountering, where do you even start studying and it always a catch up. Graduates coming in behind you are paid less and have a better chance of getting in with skills you can only dream of but after nearly 20 years in IT I've got the experience they don't. Technology changes but the underlying hardware really doesn't. It still needs someone to rack and stack and configure. It's really the higher level of automation that's changing focus and with the recent scares around Microsoft Lync/Office 365 downtime, Codespaces being taken down and hacked to death (company no longer exists), NSA spying, I would imagine a lot of IT execs will be nervous about public cloud for some time. I think Private/Hybrid will be worth learning about so grab a distribution and learn one, the concepts are key and you can always cross train in another a bit more easily if required. Take an Openstack primer. Mirantis even do training. I'm not a coder so I feel OpenStack has a way to go before I think customers or even me can use it effectively. The latest HP Openstack Cloud System 8 is a good beginning. The next 18 months things are only going to get better!

 

 

HP CloudSystem 8.0

Well,

I thought I'd give HP CloudSystem 8.0 a spin. I downloaded all Zip Files
https://h20392.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=Z7550-63212
(Needs a HP Web / Passport Account)

Next I got hold of the install documentation:
http://www.hp.com/go/cloudsystem/docs

Extract all the Zip Files. I'm using VMware so I'll end up with the following:

Folder:
HP_CloudSystem_Enterprise_ESX_8.0_Mar_2014_Z7550-01323
File:
CS-Enterprise-8.0.0.20.ova

Folder:
HP_CloudSystem_Foundation_ESX_8.02_May_2014_Z7550-01430
File:
CS-Base-8.0.2.0.ova
CS-NN-8.0.2.0.ova
CS-SDN-8.0.2.0.ova

HP_CloudSystem_Tools_8.0_Mar_2014_Z7550-01325
extract csstart-windows.zip to a subfolder

Now you're ready to start deploying!

Connect to vCenter with the C# client (there are bugs with some of the web client versions and importing OVFs). Import the four ova's above to a new VM Folder to group them. Ensure they are named as follows as the script we run later won't work otherwise. Check the "0" and "." placement in particular.

CS-Base-8.0.0.20
CS-Enterprise-8.0.0.20
CS-NN-8.0.0.20
CS-SDN-8.0.0.20

Before you mark them as templates (This step may not be needed), determine what memory you have available on your test system and reduce the hardware accordingly. It will automatically reduce the vCPU requirement for the Base OVA from 8 to 4 but it also looks for 32Gb Ram! I've reduced mine to 8Gb and it seemed to survive. Mark all 4 as templates.

Next open a administrative command prompt on the system where the castart-windows.zip was extracted to. Browse to this folder and execute the following command:

csstart gui --start-browser --insecure

This will start locally hosted web page you use to commence the initial setup.

Create the following Port Groups in your ESXi environment:

cloud-mgmt
dc-mgmt
Cloud-Trunk
External

Run through the setup wizard step by step. I tried using the standalone Host name instead of a cluster but it kept rejecting it with an error. I used 10.0.0.0/24 as the network. I selected 50GB for my glint store as I don't have much free. After encountering an error I created a basic Cluster with no DRS/HA and put my Host into it and after adjusting the memory of the base VM it could clone and power up the next set of VMs. I used the name ca1.lab.local as my base server.
Tip: ensure your PC can resolve the DNS name, I had to edit my HOSTS file to fix this. You should end up with the following VMs which form the Foundation level solution:

  









The Logon page looks like this:

Update: I'm still missing something. Getting the following error and it deletes the additional VMs:

Hmmm...checked networking and they are getting a DHCP lease off my Domain Controller instead of the Base VM. Turned off DHCP on my DC and rebooted the 4 sub VMs just generated and the wizard finished fine! I just need to find a 3PAR now...!

You can get more activity information in this location (I couldn't find it earlier!):

You can now see the errors encountered earlier:

Next extract the OO Central file to your workstation:
HP_CloudSystem_OO_Studio_8.0_Mar_2014_Z7550-01319.zip

Run the OO-installer.exe as administrator, Click Next on all the Defaults EXCEPT don't select any of the content packs at this time.


Extract the OO-studio-upgrade.zip to a subfolder and cut and paste the Upgrade subfolder into C:\Program Files\Hewlett-Packard\HP Operations Orchestration

Open a command prompt as administrator and change into the directory C:\Program Files\Hewlett-Packard\HP Operations Orchestration\Upgrade\10.02\bin
Ensure OO Studio is closed and run the command "apply-upgrade.bat" from this folder

Then register your vCenter under Integrated Tools section:

To Launch the OO Studio make sure you execute the shortcut below as Administrator & Import the content packs from the extracted folder you unzipped to earlier:

The next step is to deploy the Enterprise components. Switch to the Enterprise section in the portal:

Then step through the wizard giving assigning the name and ip to the appliance. Ensure DNS works for it first! The final VM is spun up. This one is big - it gave itself 4 vCPU & 16Gb of RAM when the template shows half that! Hungry thing!

vCenter 5.5 U1 vs Server 2012 Upgrade to R2 MU1

Thought I'd snapshot my Lab's vCenter running 5.5 U1 and upgrade the O/S from 2012 to 2012 R2 MU1 which was just released. Don't try this on Production folks!

I took a snapshot and kicked off the upgrade. After the final reboot, all the services started up except the vSphere Web Client. I tried the C# Client but that wouldn't connect either. I turned off the Firewall to see if that helped as the main vCenter service had started and I still got a connection failure. Then I noticed that the IP Address had changed, it was using DHCP. I changed back to the original static address, enabled the Firewall again and rebooted. Now the C# Client worked but the web client service was still not responding.

I did a repair install (remove/install) of the Web Client to see if that would help. This got the Web Client Service into a running state finally and after a few minutes I could connect via the Web Client Interface.

I had the same trouble as this with 5.5.0b and was hoping 5.5 U1 would get around it but obviously not. For Production Servers you have the choice of trying the steps above with good backups in place (!) or build a fresh vCenter on 2012 R2 MU1 and migrate the Database, SSL keys etc.

Note: By MU1 I mean the maintenance update released by Microsoft for Server 2012 R2 in April 2014. There is a set of 6 patches for existing 2012 R2 systems or you can give it the integrated ISO which is the method I used above to upgrade from 2012.

vSphere 5.5 observations

Well, as I mentioned in another post, I've finished a vSphere 5.5 deployment. Just thought I'd jot down a few observations. Disclaimer: these are based on my own opinion and do not represent the views of any Company I've worked for past, present or future.

I found the new web interface a little daunting at first, I tried to do everything possible with the it rather than drop back to the C# client.So in no particular order:

The refresh rate is a little slow which is annoying, when you power off a VM it doesn't instantly update and I find myself forcing a refresh several times a day.

Drag and drop works nicely but you have to wait until it's finished as it removes the object temporarily and then puts it back which can screw up your next selection!

Great working with the new SSO, no Database required, didn't give any trouble at all.

Tried using the VCSA but it gave a LOT of trouble so after two rebuilds I called time and reverted to the Windows version. It's just not ready for the big time outside of Labs / Test / Development, again, my opinion only. The web client was more unstable with the VCSA than with the windows one.

The Notes field doesn't show custom attribute data so it's either input what the VM does or have Veeam input the latest backup job information. Tags don't cut it for dynamic data like that. You can use Custom Attributes but the web client won't display them. You can get a community written plugin that does however.

Use the latest vCenter build you can get provided your plugins work with it. There's many, many bugfixes in the newer versions, especially over the last year and multiple vCenter releases. Bit concerning but at least they are trying to address it. One outstanding issue is you can't deploy OVFs with the web client, you have to drop back to the C# Client.

Tip: Deploy vCenter and SQL VMs with Hardware version 9 and keep a standard switch handy with no physical uplinks to allow you to restore vCenter back onto the network where you are using Distributed switches exclusively. Remember the C# Client can't edit VMs with a hardware version of 10, hope your PowerCLI skills are good in that case when vCenter is down and you've to restore from backup!

The console plugin doesn't launch great in Firefox, it stalls the browser completely for about 10 seconds. When doing testing using multiple VMs, drop back to the C# Client, console is a little better there. Or try a different browser?!

All the third party plugins are pretty Cool, I've used HP Insight Control v 7.3 (it Rocks! Especially for Storage visibility), Veeam is good also - last 7 days of backup history on tap.

Sometimes you right click on a VM and the options you expect to be available aren't. Try the Action menu at the top instead. Annoying especially when it's due to a refresh lag.

Filtering Advanced ESXi Host settings is very handy, looking for words like "Scratch", "BPDU" or "PDL" makes it very easy to configure or check settings.

Not using Tags to date but found Datastore Clusters interesting. When they overlap with Storage features however they are less useful.

Still not getting LLDP exposed through HP Virtual Connect but one day.....

Don't forget to backup your DVS configuration! Handy feature but could be placed better or allow automation?

Veeam & 3PAR Integration

I've recently finished a VMware 5.5 Deployment that included HP Blades, 3PAR 7400 and Veeam Backup & Replication 7.0. I was curious how this would work from a SAN backup point of view and I got good experience configuring the integration. One thing I found lacking was a good guide from either Veeam or HP to tie these together. I knew in Theory what needed to happen but it's not listed anywhere I could find so here's some pointers and how I got it to work.

I'm using Datastore based backups, i.e. 1 Veeam Backup job per Datastore so I'm not taking multiple 3PAR snapshots of each Datastore as it sifts through the grouping of VMs. The solution has two 3PAR 7400's, a virtual Veeam Enterprise Manager, two physical Veeam Proxy Servers all running 7.0 with Patch 3. The Veeam Proxy Servers have 10Gb Nics and 8Gb Fibre. The backup storage is iSCSI, the Fibre is used to connect to the 3PAR Storage where the VMs reside and a Tape Library for good measure. So far, so fun, let's see where configuration is needed:

• SAN Switch Zoning - I examined one of the existing Blade Server Zones and used that as a template. There are two SAN fabrics, each needed two Zones set up for each Proxy Server. Proxy Server HBA #1 is zoned with one SAN Controller and then separately to the second SAN's Controller. Then HBA #2 then zoned to the same way to the other controller on each SAN. 
• 3PAR - The Proxy Server can now log in to the SAN Fabric and you should see the WWIDs appear in 3PAR. Define a Host using both sets of WWIDs. You need to do this on each 3PAR.
• Double check the Proxy O/S is not set to automount. Veeam disables this by default but recheck.
• Now you can configure a test backup job, you need Veeam B&R Enterprise Plus to do this remember, check your license. Enable SAN Based Backups on the test job.

During the Backup window you'll see temporary snapshot volumes being presented to the Proxy Server in Disk Manager, these disappear after a time. At no stage do you need to export the live Production LUNs used for VMware to the proxy server. 3PAR snapshots the LUN and presents this so it's a safe configuration and fast.

Restores have to be carried out over the network. I've seen backups processing 100's of MB/s but restores typically are in the region of 50 MB/s even with 10Gb network speeds. So a 200GB VM could take 2 hours to restore but that's typical of most backup / restore comparisons (it takes twice as long to restore than to backup).

I had one issue where some Datastores would use SAN snapshots and others wouldn't. When I spent some time looking at it I found it was working for SAN #1 but not SAN #2. Turned out I had defined the Host on SAN #1 but forgotten to do it also on SAN #2. Easy fix!

Get your SAN administrator to do the Zoning & 3PAR piece if you're not comfortable as it can be tricky. The Server zoning was already done by an expert so I just copied their naming convention and config to extend it to the Proxy Servers which made it handy!

Tape Integration is next, so far so good, basic but it works nicely. I tested instant restore also which worked like a charm and used Storage vMotion to relocate the VM afterwards.

I really like Veeam, they deliver great software and it's very usable from an Engineer's point of view. Probably one of the last product out there I can say that about! 

Securing vCenter to SQL communication - event id 36870

Hi,

Well, I'm rebuilding my Lab currently using Server 2012. This gives me a chance to use SQL 2012 and vCenter 5.5 (Note to self: 2012 R2 is fine EXCEPT for vCenter! It gets stuck at "Installing Directory Services" and is not supported anyway). One thing I'd read about was configuring SQL communication encryption (as opposed to Database encryption) and I wanted to use that. I held off installing vCenter until I could get the certificate installed and SQL services running but ran into a roadblock every time I applied the Certificate and started the SQL Server Service:

I thought it was my Certificate but I'd generated it with Openssl and the AD certificate services just like the other VMware Certs I'd deployed previously. I came back at the issue a week later and found this post which solved my problem:
http://sqlblog.com/blogs/greg_low/archive/2013/05/30/sql-server-service-won-t-start-after-changing-service-account-service-specific-error-2146885628.aspx
Now I'm no SQL guru but a permission problem wasn't what I expected. What I did remember was I tried using Managed Service Accounts to test how these work and that was the account the SQL server service was using and subsequently didn't have sufficient permissions.
Here is SQL configuration manager showing the accounts I'm running the services under:

And here is the Certificate I had previously selected:

So once I had changed the permissions on the folder C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys I could start the SQL server service just fine. I did get an error applying permissions for the msvc_Labsql55 account at the folder level, I had 2 files in the folder, one would not let me edit permissions but the other accepted the update fine. I think one of the files corresponds to my SSL cert but the other is a system key and shouldn't be meddled with! Test in a Lab yourself to make sure!

So now I can create an ODBC connection for the vCenter 5.5 Database and tick the box to encrypt the connection:

 

And it tests successfully:

Job Done! Now I just have to get building!