Installing IBM Systems Director software updates on the IBM Smart Analytics System 5600 V1 and V2

Content

Prerequisites and co-requisites

1. Download the IBM Smart Analytics System 5600 V2 User Guide Supplement, version -01, which has the stop and start procedures that are applicable to both the IBM Smart Analytics System 5600 V1 and 5600 V2:

Note: An IBM ID is required.

https://www14.software.ibm.com/webapp/iwm/web/preLogin.do?source=idwbcu&lang=en_US

2. Verify that you must install the updates by checking for the following versions of the IBM Systems Director and the Common Agent (CAS) software that require the update:

• IBM Systems Director manager: Version 6.3.2.1
• Common Agent (CAS): Version 6.3.2


a. Verify that the IBM Systems Director manager software version is 6.3.2.1 by running the following command on the management node as root:

smcli lsver

b. Verify that the Common Agent (CAS) software version is 6.3.2 by running the following command on the management node as root:

dsh -a cat /opt/ibm/director/agent/version.key |grep "version="

Installation procedure

Important: Plan to install the IBM Systems Director updates during a scheduled maintenance window because it requires an outage of the core warehouse.

If you have the IBM Systems Director 6.3.2.1 and the Common Agent (CAS) 6.3.2 software installed on your system, install the update for the IBM Systems Director and Common Agent software on all of the IBM Smart Analytics System 5600 nodes.

Procedure

Run all of the steps of this procedure as the root user.

1. Remove the node discovery entries and Integrated Management Module (IMM) discovery entries for the standby management host and for all core warehouse nodes from the IBM Systems Director inventory.

a. Verify that the IBM Systems Director is in the Active state by running the following command on the management node:

/opt/ibm/director/bin/smstatus

b. Remove the node entries for the standby management host and the core warehouse nodes from the IBM Systems Director inventory.

i.) Generate a list of the node entries for the standby management node and the core warehouse nodes. Run the following command on the management node:

/opt/ibm/director/bin/smcli lssys -t OperatingSystem |grep -v -w "<mgmt_host_name>" |grep -v ethsw01

The following example output is a result of running the previous command:

host0101
host0102
host0103
host0106

ii.) Remove each node entry that you identified in the previous step. For each node entry, run the following command on the management node:

/opt/ibm/director/bin/smcli rmsys <node_entry>

If you see an error message similar to the following message, it indicates that you are trying to remove the node entry for the management node. Do not remove the node entry for the management node.

DNZCLI0705E : (Run-time error) The system host0101(OID: 0xc5f) cannot be removed. It represents the local system of director server.

iii.) Verify that the node entries for the standby management node and the core warehouse nodes were removed from the inventory by running the following command on the management node:

/opt/ibm/director/bin/smcli lssys

c. Remove the IMM entries for the standby management node and the core warehouse nodes from the IBM Systems Director inventory.

i.) Identify the IMM entry for the management node. Run the following command on the management node:

/opt/ibm/director/bin/smcli lssys -t Server -l | grep -E "DisplayName|InstalledOSDisplayName" | grep -w -B1 <mgmt_host_name>

The following example output is a result of running the previous command:

DisplayName: IBM 7915AC1 KQ0R8AT
InstalledOSDisplayName: host01

ii.) Generate a list of the IMM entries for the standby management node and the core warehouse nodes. Run the following command on the management node, where IBM 7915AC1 KQ0R8AT represents the IMM entry for the management node that you identified in the previous step:

/opt/ibm/director/bin/smcli lssys -t Server |grep -v "IBM 7915AC1 KQ0R8AT"

The following example output is a result of running the previous command:

IBM 7915AC1 KQ0R8AX
host0101imm
host0102imm
host0103imm
host0106imm

iii.) Remove each IMM entry that you identified in the previous step. For each IMM entry, run the following command on the management node:

/opt/ibm/director/bin/smcli rmsys <IMM_entry>

If you see an error message similar to the following message, it indicates that you are trying to remove the IMM entry for the management node. Do not remove the IMM entry for the management node.

DNZCLI0705E : (Run-time error) The system IBM 7915AC1 KQ0R8AT(OID: 0xc91) cannot be removed. It represents the local system of director server.

iv.) Verify that the IMM entries for the standby management node and the core warehouse nodes were removed from the inventory by running the following command on the management node:

/opt/ibm/director/bin/smcli lssys

2. Download the SysDir6_3_x_0_IT01062_IT01063_IT01199 update to any directory on the management node from IBM Fix Central and then copy it to all of the other nodes:

http://www-933.ibm.com/support/fixcentral/swg/downloadFixes?parent=ibm~Director&product=ibm/Director/SystemsDirector&release=All&platform=All&function=fixId&fixids=SysDir6_3_x_0_IT01062_IT01063_IT01199&includeRequisites=1&includeSupersedes=0&downloadMethod=ddp

3. Decompress the SysDir6_3_x_0_IT01062_IT01063_IT01199_IT01200.zip file by running the following command on all of the nodes:

unzip SysDir6_3_x_0_IT01062_IT01063_IT01199_IT01200.zip

4. Install the update. Update the management node by completing steps 4 and 5.

a. Run the following commands:

cd SysDir6_3_x_0_IT01062_IT01063_IT01199_IT01200/xLinux/SLES11_x86/

rpm -Uvh --force ibmcim-ssl-1.0.1-sles11.i386.rpm

The following example output is a result of running the previous command:

Preparing...
########################################### [100%]
1:ibmcim-ssl
########################################### [100%]

mv: cannot stat '/etc/opt/ibm/icc/truststore//*': No such file or directory

b. Set the OpenSSL environment variables. Run the following commands:

echo "export OPENSSL_CONF=/etc/opt/ibm/icc/openssl.cnf" >> /etc/profile.local

export OPENSSL_CONF=/etc/opt/ibm/icc/openssl.cnf

KEYSTORE_PATH=/etc/opt/ibm/icc/keystore

ICC_PATH=/opt/ibm/icc

export LD_LIBRARY_PATH=/opt/ibm/icc/lib:/opt/ibm/platform/lib

echo "export LD_LIBRARY_PATH=/opt/ibm/icc/lib:/opt/ibm/platform/lib " >> /etc/profile.local

HOSTNAME=`hostname`

Note: To run the previous `hostname` command, use the back tick (`) and not the single quote (') character.

c. Verify that the OpenSSL version is 1.0.1g. Run the following command:

/opt/ibm/icc/bin/openssl version

The following example output is a result of running the previous command:

OpenSSL 1.0.1g 7 Apr 2014

5. Generate a new SSL certificate and key.

a. Run the following command:

Note: Enter the command on a single line. It might display on multiple lines in this document.

echo -e "US\nNORTH CAROLINA\nRTP\nIBM\nSTG\n$HOSTNAME\n.\n.\n" | $ICC_PATH/bin/openssl req -x509 -nodes -sha256 -days 3650 -newkey 2048 -keyout $KEYSTORE_PATH/server.key -out $KEYSTORE_PATH/server.cert

The following example output is a result of running the previous command:

Generating a 2048 bit RSA private key
.....................................+++
....................................+++
writing new private key to '/etc/opt/ibm/icc/keystore/server.key'
-----
You are about to be asked to enter information that will be incorporated into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) []:State or Province Name (full name) []:Locality Name (eg, city) []:Organization Name (eg, company) []:Organizational Unit Name (eg, section) []:Common Name (eg, your websites domain name) []:Email Address []:

b. Restart the CIMOM server so that it uses the new key and certificate by running the following command:

service cimserverd restart

c. Verify that the SSL certificate was updated by running the following command:

/opt/ibm/icc/bin/openssl x509 -in $KEYSTORE_PATH/server.cert -noout -text

The SSL certificate is updated if the date and time returned as the Not Before values match the date and time that the new certificate was generated in step 5.a.

d. Verify that the SSL key is updated. Run the following command:

openssl s_client -connect localhost:15989 -showcerts

The key is updated if the previous command returns Server public key is 2048 bit.

6. The management node is now updated. Repeat steps 4 and 5 on all of the other nodes.

7. Reset the CAS configuration and rediscover the node. Run steps 7.a to 7.f on all of the nodes.

a. Reset the CAS configuration on the node by running the following commands:

Note: Enter each command on a single line. It might display on multiple lines in this document.

rm -rf /opt/ibm/director/agent/data/collectioncache.txt

rm -rf /opt/ibm/director/agent/data/providercache.txt

rm -rf /opt/ibm/director/agent/conf/.settings/instancecache/*

rm -rf /opt/ibm/director/agent/runtime/agent/subagents/eclipse/plugins/com.ibm.usmi.agent.coreagent.usmiimpl*/data/coreagent.dat

/opt/ibm/director/agent/runtime/agent/toolkit/bin/configure.sh -unmanaged -force

/opt/ibm/platform/bin/genuid

LANG=C;/opt/tivoli/guid/tivguid -Write -New

b. Run the configure.sh script with the following command on the node, where <mgmt_IP> is the management node IP address and <root_pwd> is the password for the root user:

/opt/ibm/director/agent/runtime/agent/toolkit/bin/configure.sh -amhost <mgmt_IP> -passwd <root_pwd> -force

c. Discover the node by running the following example command on the management node:

/opt/ibm/director/bin/smcli discover -i <node_IP>

The following command shows an example of discovering the administration node with IP address 172.16.10.2 (host02):

/opt/ibm/director/bin/smcli discover -i 172.16.10.2 

d. Check if the node is locked by running the following command on the management node:

smcli lssys -w AccessState=Locked

The following example output is a result of running the previous command and indicates that the node is locked:

host02

If the node is locked, run the following command on the management node to unlock it:

smcli lssys -w AccessState=Locked -t OperatingSystem | smcli accesssys -u root -p <root_pwd> -f -

The following example output is a result of running the previous command:

DNZCLI0727I : Waiting for request access to complete on... host02
Result Value: DNZCLI0734I : Request access was successful on : host02

Before continuing to the next step, verify that the node was successfully unlocked by running the following command on the management node:

smcli lssys -w AccessState=Locked

e. Discover the IMM for the node by running the following command on the management node:

/opt/ibm/director/bin/smcli discover -i 172.16.10.2 

f. Check if the IMM for the node is locked by running the following command on the management node:

smcli lssys -w AccessState=Locked

The following example output is a result of running the previous command and indicates which IMM is locked:

IBM 7945AC1 KQYBVKH

If the IMM for the node is locked, run the following command on the management node to unlock it:

Note: The '0' specified in the command is the number zero.

smcli lssys -w AccessState=Locked -t Server | smcli accesssys -u USERID -p PASSW0RD -f -

The following example output is a result of running the previous command:

DNZCLI0727I : Waiting for request access to complete on... IBM 7945AC1 KQYBVKH
Result Value: DNZCLI0734I : Request access was successful on : IBM 7945AC1 KQYBVKH

Before continuing to the next step, verify that the IMM for the node was unlocked by running the following command:

smcli lssys -w AccessState=Locked

8. Verify that the IBM Systems Director software can collect inventory from the nodes by running the following commands on the management node:

/opt/ibm/director/bin/smcli collectinv -p "All Inventory" -t Server

/opt/ibm/director/bin/smcli collectinv -p "All Inventory" -t OperatingSystem

The following example output is a result of running one of the previous two commands:

Inventory collection percentage      0%
Inventory collection percentage      58%
Inventory collection percentage      86%
Inventory collection percentage      96%
Inventory collection completed:      100%

9. Stop the software components in the system. The stop procedure is the same for both the IBM Smart Analytics System 5600 V1 and 5600 V2: Run steps 1 to 4 in the procedure "Stopping the IBM Smart Analytics System" of the IBM Smart Analytics System 5600 V2 User Guide Supplement, version -01.

10. Reboot all of the nodes in the system.

a. Reboot all of the core warehouse nodes first. Log in to each of the core warehouse nodes as root and run the following command:

shutdown -r now

b. Reboot the management node by running the following command on the management node as root:

shutdown -r now

11. Start the software components in the system. The start procedure is the same for both the IBM Smart Analytics System 5600 V1 and 5600 V2: Run steps 2 to 6 in the procedure "Starting the IBM Smart Analytics System" of the IBM Smart Analytics System 5600 V2 User Guide Supplement, version -01.

12. Verify that the IBM Systems Director software can collect inventory from all of the nodes by running the following commands on the management node:

/opt/ibm/director/bin/smcli collectinv -p "All Inventory" -t Server

/opt/ibm/director/bin/smcli collectinv -p "All Inventory" -t OperatingSystem

The following example output is a result of running either of the previous commands:

Inventory collection percentage 0%
Inventory collection percentage 25%
Inventory collection percentage 35%
Inventory collection percentage 37%
Inventory collection percentage 40%
Inventory collection percentage 60%
Inventory collection percentage 81%
Inventory collection percentage 94%
Inventory collection percentage 95%
Inventory collection percentage 97%
Inventory collection percentage 99%
Inventory collection completed:
100%