PDA OS Upgrade FAQs & Upgrade Process for PureData System for Analytics

Answer

What is PDA OS Security Patching?

The PDA OS Security release provides the Red Hat Enterprise Linux (RHEL) monthly
repository releases previously delivered by the IBM Netezza Host Management
release, subject to new release minimums described below.
Critical patches are initially delivered through Host Management.
There is a lag of up to one month before critical patches are delivered by PDA
OS Security.
This release is a 2-disc set. Disc 1 includes RHEL 5 content. Disc 2 includes
RHEL6 content.

What are the minimum pre-requisites for PDA OS Security Patching?

RHEL5:

- HPF 5.6.0.1 (except C1000 requires v5.3.6)
- FDT 4.3.1 (except C1000 requires v2.6.1 & N100 requires v4.1.2)
- NPS 7.2.0.x for N100/N1001
7.1.0.2-P1 or 7.2.1.x for C1000
- RHEL 5.11 (Host Management 5.4.4.0, disc 2)
- Host Management 5.4.4.0 (disc 2)

RHEL6:

- HPF 5.6.0.1
- FDT 4.3.1
- NPS 7.0.4.1 for N200x
7.2.0.4 for N3001
- RHEL 6.5 or above ( RHEL 6.6 for N3001-001 models,
Host Management 5.4.4.0, disk 7)
- Host Management 5.4.4.0 (disc 3)

Is a pre-upgrade check required?

Yes, we require a pre-upgrade check to be performed on the system 3-7 days prior to the scheduled upgrade date. The pre-upgrade checks are non-intrusive and can be run while the system is online. It is important that the pre-upgrade check is performed a maximum of 7 days prior to the upgrade to minimize the possibility of issues arising between pre-check and upgrade.

Do upgrades require root access?

Yes, PDA OS upgrades and pre-upgrade checks require root access to the system. Please have root passwords ready for scheduled pre-upgrade checks and upgrades.

How often should I upgrade?

You should upgrade your system OS once a year. OS can also be updated to the latest at this time or customer can choose not to update as well if satisfied with current version.

How long do upgrades take?

System downtime of 2 hrs is required for the upgrade.

Introduction

This upgrade will only work on systems running RHEL 6.5 or above.
Once the RHEL update is applied, it CANNOT be downgraded to the previous version.
For all models, HPF 5.6 is a minimum release prerequisite before applying the PDA OS Security
upgrade.

For N3001-001 models, RHEL 6.6 (Host Management 5.4.4.0, disk 7) AND HPF 5.6 are release
prerequisites that must be met before applying the PDA OS Security upgrade.
Enhanced Cryptography enablement is not supported on releases below NPS 7.1.0.9, 7.2.0.8, or 7.2.1.2 running Red Hat 6.6. The feature should not be enabled prior to PDA OS Security upgrade.

if running an NPS release below these versions See the PDA OS Security release notes for all other release minimums.

Prior to the Upgrade

1. As root, mount the ISO you are using for the upgrade, and run the system check as follows:

[root@nzhost1 ~]# mount -o loop nz-pda-os-securityv2.0.16.06_
Disk2_RHEL6_Update_2016-06.iso /mnt

[root@nzhost1 ~]# cd /mnt/PDA-OS-Security-RH6-2016-06

[root@nzhost1 ~]# sh yum_system_check.sh

NOTE: The yum_system_check.sh script must be run from active host only. It will check for
HPF, NPS, FDT, RHEL minimums and prevent the upgrade from proceeding if those
minimums are not met.

2. As root, check the uptime on each server:

[root@nzhost1 ~]# uptime

2a. If the system uptime is less than 30 days then reboot hosts before proceeding to the Perform the Upgrade section.

2b. If the uptime is more than 45 days, perform the reboot procedure described in this
document: http://www-01.ibm.com/support/docview.wss?uid=swg21968522

2c. Confirm the systems come up fully and clustering is restored after the reboot, then
continue to step 3.

3. Change to user nz
[root@nzhost1 ~]# su – nz

4. Check to see if Call Home is enabled:

[nz@nzhost1 ~]$ nzcallhome -status
If enabled, disable it:

[nz@nzhost1 ~]$ nzcallhome –off
Note: Ensure that nzcallhome returns status as disabled. If there are errors in the call-
Home.txt configuration file, errors are listed in the output, and callHome is disabled.

5. Check the state of the Netezza system:

[nz@nzhost1 ~]$ nzstate

6. If the system state is online, stop the system using the command:

[nz@nzhost1 ~]$ nzstop

7. Wait for the system to stop, using the command:

[nz@nzhos1t ~]$ nzstate
System state is 'Stopped'.

8. Exit from the nz session to return to user root:

[nz@nzhost1 ~]$ exit

9. Logged into the active host as root, type the following commands to stop the heartbeat
processes:

[root@nzhost1 ~]# ssh ha2 ‘/sbin/service heartbeat stop’
[root@nzhost1 ~]# /sbin/service heartbeat stop

10. Run below commands as a root user to disable heartbeat from startup:

[root@nzhost1 ~]# ssh ha2 ‘/sbin/chkconfig heartbeat off’
[root@nzhost1 ~]# /sbin/chkconfig heartbeat off

11. Type the following commands to stop the DRBD processes:

[root@nzhost1 ~]# ssh ha2 ‘/sbin/service drbd stop’
[root@nzhost1 ~]# /sbin/service drbd stop

12. Run below commands as a root user to disable drbd from startup:

[root@nzhost1 ~]# ssh ha2 ‘/sbin/chkconfig drbd off’
[root@nzhost1 ~]# /sbin/chkconfig drbd off

Performing the Upgrade

1. As root, mount the ISO you are using for the upgrade as follows (If not already mounted):

[root@nzhost1 ~]# mount -o loop nz-pda-os-securityv2.0.16.06_Disk2_RHEL6_Update_2016-06.iso /mnt
[root@nzhost1 ~]# cd /mnt/PDA-OS-Security-RH6-2016-06

2. As root, create a yum repository file called rhel6_month.repo in the following directory to
load the rpms:

[root@nzhost1 ~]# vi /etc/yum.repos.d/rhel6_month.repo

3. Update the file /etc/yum.repos.d/rhel6_month.repo with below contents:

[IBM]
name=rhel6_month
baseurl=file:/mnt/
enabled=1
gpgcheck=0

4. Confirm the repository file matches the above structure:

[root@nzhost1 ~]# more /etc/yum.repos.d/rhel6_month.repo

5. Run yum repolist to confirm the correct files are loaded:

[root@nzhost1 ~]# yum repolist

6. Run yum update script to update the kernel and non-kernel packages

[root@nzhost1 ~]# sh yum_update.sh

Sample Output:-
Transaction Summary
=========================================================
Upgrade 183 Package(s)
Total download size: 25 M
Is this ok [y/N]:
Press “y” to continue the upgrade
Note2: If machine is being re-upgraded, in /etc/grub.conf we need to
set : "default=0" otherwise uname –r will not show the upgraded version.

7. Repeat the above steps to upgrade the 2nd Host.

After the Upgrade

1. After the upgrade is complete, run the reboot command to restart both the host
individually. On the first host, run:

[root@nzhost1 ~]# /sbin/shutdown -r now

Make sure the first server comes up and is reachable before rebooting the second server
with the above command.

2. Type below commands to start drbd and heartbeat services on both ha1 and ha2 hosts:

[root@nzhost1 ~]# service drbd start
[root@nzhost1 ~]# ssh ha2 'service drbd start'
[root@nzhost1 ~]# service heartbeat start
[root@nzhost1 ~]# ssh ha2 'service heartbeat start'

3. Check the status of Cluster:

[root@nzhost1 ~]# crm_mon -i5

Result: When the cluster manager comes up and is ready, status appears as
follows.
Make sure that nzinit has started before you proceed. (This could
take a few minutes.)

Node: nps61074 (e890696b-ab7b-42c0-9e91-4c1cdacbe3f9): online
Node: nps61068 (72043b2e-9217-4666-be6f-79923aef2958): online
Resource Group: nps
drbd_exphome_device(heartbeat:drbddisk): Started nps61074
drbd_nz_device(heartbeat:drbddisk): Started nps61074
exphome_filesystem(heartbeat::ocf:Filesystem): Started nps61074
nz_filesystem (heartbeat::ocf:Filesystem): Started nps61074
fabric_ip (heartbeat::ocf:IPaddr): Started nps61074
wall_ip (heartbeat::ocf:IPaddr): Started nps61074
nzinit (lsb:nzinit): Started nps61074
fencing_route_to_ha1(stonith:apcmaster): Started nps61074
fencing_route_to_ha2(stonith:apcmaster): Started nps61068

From host 1 (ha1), press Ctrl+C to break out of crm_mon.

4. Older kernel and kernel-devel packages can be removed from the system by running
remove_old_kernel.sh script located in /opt/pda/os_security/rh_tools folder
As a root user, below is the command:

[root@nzhost1 ~]# cd /opt/pda/os_security/rh_tools/
[root@nzhost1 ~]# sh remove_old_kernel.sh

5. Check if you have an upgraded OS on your system:

[root@nzhost1 ~]# cat /etc/redhat-release
[root@nzhost1 ~]# uname –r