VCA upgrade with 7.40A agents

[Steve Giordano]

I'm testing upgrading our server agents to 7.40A by only installing the following:

HP Insight Agents for win2k/2k3 - 7.40
HP System Mgmt Homepage for Win - 2.1.2.127
Version Control Agent for Win - 2.1.2.740

This prevents me from having to reboot (and allows me to do it during the day not need a change request). But after installation of these three components I'm getting a timeout error loading data when connecting to the Sys Mgmt homepage and VCA page. Looking in the Sys Mgmt homepage log I see the following activity:

INFORMATION LOG (severity=0) Fri Dec 23 10:16:01 2005
Unable to load certificate file during SSL Server Initialization


INFORMATION LOG (severity=0) Fri Dec 23 10:16:05 2005
A new self signed certificate was generated.


INFORMATION LOG (severity=0) Fri Dec 23 10:16:05 2005
Certificate was successfully secured via the file system protection.


INFORMATION LOG (severity=0) Fri Dec 23 10:16:05 2005
A new private key was generated.


INFORMATION LOG (severity=0) Fri Dec 23 10:16:05 2005
Private key was successfully secured via the file system protection.

In this environment the Trust relationship is set to Trust All. The three components installed were configured before installation and deployed using the Remote Deployment Utility. Are there other components that have to be upgraded as well to allow these to function properly?

[Ananthak23]

Looks like VCA is timing out. Please make sure that VCA can connect to VCRM with appropriate credentials and can retrieve the PSP information. You might want to upgrade VCRM to the latest version if the installed version is 2.0.7.10 or less.

-Anantha

[Steve Giordano]

Current version of VCRM is 2.1.3.740. I have other servers that were built from scratch and the full PSP installed that are working with the VCA and VCRM fine. Can I just upgrade the VCA, Sys Mgmt homepage and SIM Agents on each server as opposed to running the full PSP install and rebooting? We'll have to do that eventually but I'm trying to get VCA functionality so I can use HP SIM to push out the PSP to all our servers. The servers that don't have the VCA configured will be upgraded (including the Sys Mgmt homepage and agents) so SIM can be used for the rest.

[Ananthak23]

You should be able to upgrade SMH, VCA and Agents. I guess the timeout problem might be because of the VCA connection to the VCRM.

[Steve Giordano]

I know it SHOULD work but I was trying to find out if there were any other dependencies to the service that might be causing the timeouts. This is the only error message I'm receiving as well. Notice in my original post I'm seeing the error message :

Unable to load certificate file during SSL Server Initialization

This is coming from the Sys Mgmt Homepage. I'm thinking this is all related. When upgrading from an older version of the agents how can you push out an "updated" certificate?

[Ananthak23]

As far as I know there is no dependencies for the SMH service. The log says that it has created a new ceritificate as it was not able to load the old cert and that shouldn't cause any timeouts.
Try stopping VCA and (or) Agent service and check if it eliminates the timeout problem.

[Steve Giordano]

I uninstalled the SMHomepage, VCA and SIM agents. Installed the SMHomepage - works great. Then installed the SIM agents - SMHomepage works great. Then installed the VCA and the timeouts started. I even tried doing a full uninstall of the PSP and full re-install and it still does it. Also downloaded newest version of SMHomepage than what comes with PSP 7.40A -- no luck.

[Ananthak23]

Please make sure that VCA *can* connect to VCRM system with correct credentials (Look for firewall inbetween).
Try pinging VCRM system from a VCA system also try configuring VCA by providing the correct credentials i.e the account that you are providing should have Administrator or Operator level access defined in SMH on the VCRM system.

If it doesn't work, check out for the VCA log. What does it say?

I assume SNMP community strings are already defined as you are performing an upgrade.

[Steve Giordano]

Yes I CAN ping the VCRM. No FW -- they're on the same subnet. The account I'm using has Admin rights on the server. It's the same account being used on all other servers that are working. The VCA a log information I put in my original post:

INFORMATION LOG (severity=0) Fri Dec 23 10:16:01 2005
Unable to load certificate file during SSL Server Initialization


INFORMATION LOG (severity=0) Fri Dec 23 10:16:05 2005
A new self signed certificate was generated.


INFORMATION LOG (severity=0) Fri Dec 23 10:16:05 2005
Certificate was successfully secured via the file system protection.


INFORMATION LOG (severity=0) Fri Dec 23 10:16:05 2005
A new private key was generated.


INFORMATION LOG (severity=0) Fri Dec 23 10:16:05 2005
Private key was successfully secured via the file system protection.

Yes -- SNMP community string is correct -- all other HP SIM functionality is working off of the same string name.

[Steve Giordano]

Is there a support number I can call? I need to get a resolution to this problem and I'm running out of ideas why it's working on some servers but not others.

[Steve Giordano]

New information regarding this issues:
While loading the Sys Homepage for this particular server (acutally any server I have the VCA timeout on) I get the following errors:

Line: 1898
Char: 1
Error: 'iscsiInstanceAttributesEntry' is undefined
Code: 0
URL: https://:2381/proxy/smhui/chptree.htm

Line: 1942
Char: 9
Error: 'cpqHeResilientMemCondition' is undefined
Code: 0
URL: https://:2381/proxy/smhui/chptree.htm

Then I get a timeout message from the SYS home page. It loads but not all the way. Hope this helps. This only happens on the same servers I'm having the VCA timeout issue on.

[Elinus Liga]

Usually I will install or upgrade "HP ProLiant Advanced System Management Controller driver" and "HP ProLiant System Management Controller driver" when upgrade SMH as well. (found in PSP > Driver - System Management)
Also check the installation log file whether you need to reboot the server after installing them.

[Steve Giordano]

Is there a support number that I can call? I just did a full install of the PSP 7.40A on a server (upgraded from 7.10) and I'm now seeing the "Unable to load certificate file during SSL Server Initialization" error message. We can't roll out 7.40 until these issues are resolved. Thanks.

[rcseattle · Accepted solution]

I don't see a mention of SNMP security settings in this thread.

Having SNMP security set to "Accept SNMP packets from these hosts" and not having localhost in there will cause the SMH to time out.

That's default on Server 2003 and you need both localhost and the name of the CMS.

[Steve Giordano]

Cool!! That did it. Looks like we had some servers (even 2003) that the "localhost" was removed from the SNMP service settings. I added it to all my test systems (2000/2003) and everything is working great now. Thanks so much.

[Steve Giordano]

The server "localhost" was missing from our SNMP service settings. This is required by the SM Homepage and VCA.