Is there guide to the hp Management Agents for VMware ESX Server 3.x?

[Dana Swanson]

I downloaded the HP Management Agents for VMware ESX Server 3.x 7.7.0.

In the file hpmgmt-7.7.0-vmware3x.tgz there's readme.txt and cmanic-7.7.0-5.vmware.linux.txt.

I haven't been able to find a user guide for this version of the insight agents like they have for Windows based servers.

When I look at the HP Insight Management Agents Installation Guide they cover Microsoft, NetWare and SCO, Unixware 7 but nothing on the ESX 3.x agents.

Thanks,

Dana

[Rob Buxton]

The README.txt file contains the install instructions. So if you've expanded the tgz you're half way there.

It's worth configuring up a hpmgmt.conf file and using the silent install.

What other info are you after? Once installed they're pretty much the same as windows agents, same trust requirements etc.

[Dana Swanson]

Hello,

I have been able to install the agents for ESX 3.x and can browse and login via root to the hp Management web site on the ESX server. I can see then hardware status fine.

I haven't been able to get the HP SIM server to communicate with the ESX 3.1 server. I add the device and then the auto discover jobs run. I then manually start the other discovery jobs to inventory the ESX server.

I don't think the hp sim server can talk to the ESX 3.1 server the way I have it configured. The only thing different I did with the initial install of HP SIM 5.1 was to omit Open SSH because of the vulnerabilities I have seen reported on Open SSH. I was guessing I could use another protocol for ESX 3.1 servers (snmp, etc)

I just tried to install Open SSH from the HP SIM 5.1 source and open ssh hung up. I'm rebooting and will stop the server agents first and then try to install open ssh from the hp sim 5.1 source again.

I also configured the ESX 3.1 server via the insight web page to trust by certificate and imported it from the hp sim server which worked good.

I configured the groups as well. Although last time I configured these groups on a Windows machine I used for example hpsimservername\AdminAccount. On the ESX config I added the group name without the servername in the beginning since I don't know the Linux box running ESX will recognize servername\groupname.

Thanks!

Dana

[Dana Swanson]

I was able to install OpenSSH that was packaged with the HPSIM5.1 source files.

I took a look at the Daily System Identification task details on the esx server that I can't detect from the console.

I'll attach the log to this message.

Since none of the protocols were communicating I tried replacing the admin account I was using with the root account this system uses.

I also made sure to force the protocol settings to use our standard or the root account.

For WBEM I turned on Use Certificate Instead. For snmp I entered our standard. For SSH I used the root account.

I did set trust by certificate on the ESX server and downloaded the certificate from the hp sim server. This satisfied the Windows clients when I did this.

Does the ESX server need additional certificate configuration?

Thanks!

[Rob Buxton · Accepted solution]

I don't use SSH in any communication with the ESX Server.
We do use VMM though.

For general HPSIM, you should just be able to use SNMP and the Agents.
You may want to check your SNMP settings.
Look at /etc/snmp/snmpd.conf, it contain something similar to the following;

# Thu Dec 28 16:24:31 NZDT 2006
dlmod cmaX /usr/lib/libcmaX.so
rwcommunity MYRWCommunity 127.0.0.1
rocommunity MYROCommunity 127.0.0.1
rwcommunity MYRWCommunity HPSIMServer.myco.nz
rocommunity MYROCommunity HPSIMServer.myco.nz
trapcommunity MYROCommunity
trapsink HPSIMServer.myco.nz MYROCommunity
syscontact root@localhost (edit snmpd.conf)
syslocation room1 (edit snmpd.conf)

You should also be able to import the HPSIM Server Certificate into the agent just like you would for a Windows Agent. If you think it's not right, delete it and re-import it.

[Dana Swanson]

Thanks,

I think I may have two entries in snmp not configured. I haven't looked but I must be missing rwcommunity and rocommunity. The two entries that ask for community strings for the server.

I don't know how much you have used the ESX 3.x insight agents but I found some utilities in /opt/Compaq/utils I'll attach some notes on what I found. Can't find these documented but they are not hard to use.

I'm glad OpenSSH is not required. I looked up OpenSSH Services 4.3p2 and found many vulnerabilities documented with OpenSSH 4.3p2. I was hoping not to use it.

Thanks Rob!

[Dana Swanson]

Hi Rob,

It was the snmp settings I referred to that was the issue. The console can now see data from the ESX 3.1 Machine, Thanks!

Is the following normal for ESX 3.1 Hosts?

On my Windows 2000 / 2003 servers I can click Health Status to go directly to the devices home page. I can then check the live health status.

On the ESX 3.1 host server running the insight agents for ESX 3.x I don't have a Health Status link. I can see data but don't have an area to connect to the device home page. Health Status on this server does not provide a link.

Could this be from the way I configured the group names on the ESX 3.1 server via it's device home page? I entered in the local group names that have been setup on the HPSIM Server. I didn't enter the HPSIM Server name in the group name reference. For example I did not enter something like HPSIM001\AdminGroup. I just entered the group name AdminGroup.

If I open Tools & Links I see
System Web Application Pages:
Default WebServer
Default WebServer

Both of these Default WebServer links open the web page from the ESX server called VMware ESX Server 3 Welcome:
Getting Started...

Is there any way to go directly to the ESX servers device home page?

Thanks Rob!

[Rob Buxton]

Clicking on the HW tab should take you directly to the Agent Home page.
You might want to rerun the identification task for the server.
You should be able to browse directly to the SMH like any other server - try https://myvmhost:2381
You'll need to login using local vmhost credentials.
Finally if you use Trust by certificate then from the SMH just import the certificate from the HPSIM Server.
You can also check if the SMH web is contactable in the properties for the server itself from HPSIM, click on the server name. Under the protocols discovered you'll see at least snmp, there should be others.

[Dana Swanson]

Thanks Rob,

I think this is were I'm getting the configuration wrong on ESX 3.0.1. I used the Linux root account to setup the hp ESX agents and I think this must be why I'm having an issue.

I was under the assumption active directory accounts would not be able to login and authenticate on the Linux OS of ESX. This is where I could be going wrong.

I have been using a active directory service account to setup everything and did not use this account to setup the ESX agents.

I did see there was a man page on the ESX server after the install "man hpasm". It did have some good information but not a complete guide.

I'll have to read about active directory and ESX and try a few things. Maybe I can add the service account as an admin where you would add users to be able to use "VMware Virtual Infrastructure Client 2.0"

If you have any advice it would be great.

Thanks!

Dana

[Dana Swanson]

I read up some more and it seems you need to use root to install the HP Agents for ESX 3.x.

The local groups I have setup on the HPSIM management server are not beeing seen by the management agents on the ESX server.

If I login to the ESX Device Home Page and look at the System Management Homepage Log there are errors like:

WARNING LOG (severity=1) Wed Apr 18 08:15:00 2007
User group [servername\Admin-Group-Name] could not be verified to exist by the operating system

It seems the ESX box can't authenticate the groups on the HP SIM server.

Thanks

Dana

[Dana Swanson]

I un-installed and re-installed the ESX management agents and used the plain group name without the server. Same issue still. I'll see if HP can help out.

Will post what the issue is if we can figure this out.

Thanks,

Dana

[Rob Buxton]

I install the ESX Agents from the root account.
Once installed I log onto the web page using the root account and credentials.

Once there I ensure trust by certificate is enabled and then manually import the certificate from the HPSIM Server.

From then on access using the root account isn't required.
You should check that there is an entry for the HP Agents in the firewall using esxcfg-firewall --query there should be an entries for hpim (port 2381 tcp in) and sim-cert (port 280 tcp out

[Dana Swanson]

Thanks Rob,

Thanks for the advice on the firewall settings, I hope thats the issue.

I noticed the issue with the group errors stopped once the certificate was downloaded so the groups may not have anything to do with the issue.

I did talk to hp support and the console people don't know the unix side and the unix side doesnt know what the console is supposed to do. Frustrating.

The HP Systems Insight Manager Console does not see the SMH:2.0 protocol supported on the esx server. From the consoles point of view the ESX server is not running or running the correct version of the System Management Homepage.

An FYI:
hp support did have me check the /etc/snmp/snmpd.conf
file for a correct rwcommunity setting and a correct trapsink. Some customers after install had these two lines blank.

Thanks,

Will let you know about the firewall.

See ya!

[Dana Swanson]

Hi Rob,

I checked the firewall settings and they were the same as you had listed.

Someone else in our company I just spoke to had the same issue and it just started working for some reason. Seems like it may be a bug in the code someplace? (Shrug)

Thanks,

Dana

[Dana Swanson]

One of 3 changes seemed to fix the issue.

Over the weekend this ESX 3.0.1 server was patched to the lastest rev's and security fixes from VMWare. The Emulex HBA agent was installed. Some test guest VM's were added to this machine after it was rebooted.

Something fixed the issue since now it can be connected to from the SIM console.

Thanks,

Dana

[Dana Swanson]

Fixed