System Center Cross Platform and Interop : Unix

Cross Platform Audit Collection Services released

BarryShilmover — Thu, 17 Dec 2009 18:13:00 GMT

We are happy to announce the release of the Cross Platform Audit Collection Services for Operations Manager 2007 R2. This feature extends the existing Audit Collection Services and Cross Platform features in R2 to include UNIX and Linux Event auditing.

Cross Platform Audit Collection Services allows you to collect events from UNIX/Linux servers and have Operations Manager 2007 R2 ACS collect them in the same way the Windows events are collected. Reports can then be viewed to show the collected events (the reports are included with the Cross Platform Audit Collection Services installer) .

Three downloadable components are required for Cross Platform Audit Collection Services:

For Cross Platform ACS to function, the existing R2 Cross Platform Management Packs were updated. They are not required for normal Cross Platform operation, only for Cross Platform ACS. These Management Packs can be downloaded from within the Operations Manager 2007 R2 Console or directly from the link above.

Note: With these updated MPs, Language Packs have been introduced (versus full MPs containing all languages as was the case with the Release of R2). If you are using a localized version of Operations Manager, you will need to download and install the English Updated Management Pack and any Language Pack that you require.

The logic as to which events are to be collected for each of the UNIX/Linux Servers is included in the Cross Platform Audit Collection Services Management Packs. There is a UNIX ACS Management Pack that is required by all the platforms, as well as individual Management Packs for each supported Platform (for example, SUSE Linux Enterprise Server 11). These Management Packs can be downloaded from within the Operations Manager 2007 R2 Console or from the link above.

Note: The Cross Platform Audit Collection Services Management Packs are currently only available in English.

Finally, the Cross Platform Audit Collection Services Installer needs to be downloaded and installed. Cross Platform ACS should be installed only on Operations Manager Management Servers that actively monitor the UNIX/Linux Servers. Also, an ACS Collector needs to be configured and the ACS Forwarder on the Management Server needs to be enabled. The RMS should not act as an ACS Collector/Forwarder. For more information on best practices and how to install Cross Platform ACS, check out the Deployment Guide. The Cross Platform Audit Collections Services Installer can be downloaded from the link above.

Note: As with the Cross Platform ACS Management Packs, the Installer is currently only available in English.

For more information on installing and configuring the Cross Platform Audit Collections Services feature and installing the included report, refer to the Deployment Guide (available on the download page with the Installer).

The documentation can be access directly via the following links:

ACS Release Notes and Deployment Guide: http://technet.microsoft.com/en-us/library/ee873221.aspx
ACS Managment Pack Guide http://technet.microsoft.com/en-us/library/ee873234.aspx

Privileged and Non-Privileged “Run As” accounts in cross platform monitoring

Robert Hearn — Thu, 17 Dec 2009 00:00:00 GMT

One of the initial configuration requirements (and one of the top things new users forget to do) for cross platform monitoring is setting up the user accounts to use for privileged and non-privileged actions. But what exactly are privileged and non-privileged actions? Why would you need one or the other?

When performing remote operations on clients such as monitoring, diagnostics or remediation, the agent performs these actions running as a specific user account (the “Run As” account specified by the administrator). The recommended security practices call for specifying a low-privilege account for most actions and using a higher-privilege account only where necessary. This segregates security privileges according to the types of actions performed and can help prevent inadvertently assigning tasks outside of the user’s security scope.

You assign Run As accounts to multiple computers through Run As Profiles, and assign the profile to the group of computers. When you install Operations Manager R2 Cross Platform extensions, it creates for you two profiles under Administration > Run As Configuration > Profiles. These profiles are named Unix Action Account and Unix Privileged Account. These profiles are pre-assigned to the various monitors and tasks within the UNIX and Linux management packs, so that once the actual accounts are specified, they need to be set up only once and all of the UNIX/Linux MPs will now work.

They key is that the user accounts need to be defined in the Run As Profile for the profile to work. There’s no obvious indication in the console that these accounts aren’t defined in the profile, but your MP’s will not work until the accounts are added. (See: How to Create a Run As Account in Operations Manager 2007)

Ok, so you understand the basics of Run As accounts and profiles – but which tasks require which profile? Generally, monitoring actions do not require privilege, but many remediation actions do. This is because they are stopping / restarting processes or daemons and we don’t want that happening accidentally. Also, deploying agents does not require privilege, but installing and uninstalling requires a privileged account.

Here are some links to specifics about the actions requiring privilege across the supported operating systems (latest OS version shown, but other versions similar and in the same documentation):

Cross Platform PowerShell Scripts Released

BarryShilmover — Fri, 11 Dec 2009 19:15:00 GMT

We are happy to release several cross platform-specific PowerShell scripts to help automate the discovery of UNIX/Linux servers, installation and upgrade of the cross platform agents for Operations Manager 2007 R2, signing of the certificates, and changing the Management Server managing the UNIX/Linux server.

Four PowerShell scripts are currently available:

ChangeUnixIsManagedBy.ps1
DiscoverUnixAgent.ps1
InstallUnixAgent.ps1
UpgradeUnixAgent.ps1

Each of these scripts is covered in this article, and help for each of these scripts is available by running the script without any parameters.

These four scripts leverage several helper scripts, which do not perform any actions on their own (and return no output if run on their own):

ChangeUnixIsManagedByImpl.ps1
DiscoverUnixAgentImpl.ps1
InstallUnixAgentImpl.ps1
scx.ps1
UpgradeUnixAgentImpl.ps1

The .zip file attached contains the files noted above.

Note: All of these scripts require PowerShell to be installed and are run from a Windows computer (not from a UNIX/Linux client computer).

ChangeUnixIsManagedBy.ps1

The ChangeUnixIsManagedBy script is used to change the current management server monitoring a UNIX/Linux server (or group of UNIX/Linux servers) to a new server as specified in the command line parameters.

The script accepts a list of Unix/Linux hosts on the input pipe. These hosts are represented either as strings with fully qualified domain names (FQDN) or as objects with a "ComputerName" string property with the FQDN.

The output of the script is a list of objects with a "ComputerName" string property with the FQDN of the Unix/Linux host and a "Status" property with the status of the operation for the current host.

The following parameters can be used with the ChangeUnixIsManagedBy script:

Parameter	Definition
RootManagementServer	Name of OpsMgr root management server to use or empty string to use current computer (default)
ManagementServer	Management Server to assign (required)
Target	Additional computer to change management server for (done before any hosts are piped into script)

Usage:

ChangeUnixIsManagedBy.ps1-RootManagmentServer:<RMS FQDN> -ManagementServer:<MS FQDN>
-Target:<Target Computer FQDN>

Examples:

You have a Linux computer named SLES10-1.contoso.com and you want to change its Management Server to ContosoMS2.contoso.com, so you would use the following command:

ChangeUnixIsManagedBy.ps1 -ManagementServer:ContosoMS2.contoso.com
-Target:SLES10-1.contoso.com

Note: The script can also be executed without the parameter names, but only if all the parameters are provided. For example:

ChangeUnixIsManagedBy.ps1 ContosoRMS.contoso.com ContosoMS2.contoso.com
SLES10-1.contoso.com

InstallUnixAgent.ps1

The InstallUnixAgent script is used to deploy and install the Operations Manager Cross Platform Agent on the UNIX/Linux server(s). Running this script will first deploy the agent to the specified UNIX/Linux server and then install it.

The script accepts a list of UNIX/Linux hosts on the input pipe. The hosts are represented either as strings with fully qualified domain names (FQDN) or as objects with a "ComputerName" string property with the FQDN.

The output of the script is a list of objects with a "ComputerName" string property added/changed to contain the FQDN of the Unix/Linux host and a "Status" property added/changed to contain the status of the operation for the current host. All status strings except 'OK' are an error message.

The following parameters can be used with the InstallUnixAgent script:

Parameter	Definition
Port	Port to connect to at remote host (default is 22)
RootManagementServer	Name of OpsMgr root management server to use, or empty string to use current computer (default)
Username	User name to use for connecting to remote host (required)
Password	Password for specified username (required)
PackageName	Name of package to install (required, name of package file)
PackagePath	Full path (on the Operations Manager server) to package being installed (required, name of folder with package file)
Distro	Distribution or OS name (required, one of AIX, HPUX, Solaris, RHEL or SLES)
Version	OS version of the remote host (required, one of 11iv2, 11iv3, 4, 5, 5.3, 6.1, 8, 9, 10, 11)
Architecture	OS architecture of the remote host (required, one of Powerpc, IA64, PARISC, SPARC, x86 or x64)
Target	Additional remote computer targeted for install (done before any hosts piped into script)

Usage:

InstallUnixAgent.ps1-Port:<SSH Port Number> -RootManagmentServer:<RMS FQDN>
-Username:<username> -Password:<password> -PackageName:<Agent Package Name>
-PackagePath:<Full Path to Package> -Distro:<Distribution> -Version:<OS Version>
-Architecture:<Architecture> -Target:<Target Computer FQDN>

Example:

To deploy and install the x86 version of the SUSE Linux Enterprise Server 10 (SLES) Agent to the computer named SLES10-1.contoso.com, the following would be used:

InstallUnixAgent.ps1 -Username:root -Password:password -PackageName:scx-1.0.4-248.sles.10.x86.rpm -PackagePath:”C:\Program Files\System Center Operations Manager 2007\AgentManagement\UnixAgents” -Distro:SLES –Version:10 -Architecture:x86
-Target:SLES10-1.contoso.com

Note: The script can also be executed without the parameter names, but all the parameters must be provided.

UpgradeUnixAgent.ps1

The UpgradeUnixAgent script is used to upgrade an existing Operations Manager Cross Platform Agent on a UNIX/Linux server. This is done by first deploying the updated agent to the remote UNIX/Linux server and then installing it (upgrading).

Usage:

UpgradeUnixAgent.ps1-Port:<SSH Port Number> -RootManagmentServer:<RMS FQDN>
-Username:<username> -Password:<password> -PackageName:<Agent Package Name>
-PackagePath:<Full Path to Package> -Distro:<Distribution> -Version:<OS Version>
-Architecture:<Architecture> -Target:<Target Computer FQDN>

Example:

To upgrade an existing SLES agent to a new version (e.g., version 1.0.4-252), you would use the following command:

UpgradeUnixAgent.ps1 -Username:root -Password:password -PackageName: scx-1.0.4-252.sles.10.x86.rpm -PackagePath:”C:\Program Files\System Center Operations Manager 2007\AgentManagement\UnixAgents” –Distro:SLES –Version:10 –Architecture:x86
–Target: SLES10-1.contoso.com

DiscoverUnixAgent.ps1

The DiscoverUnixAgent script is used to sign the certificate used for communication and discovering an instance of the UNIX/Linux Server into Operations Manager.

The following parameters can be used with the DiscoverUnixAgent script:

Parameter

Definition

Port

Port to connect to at remote host (default is 22)

Server

Name of OpsMgr server to use or empty string to use current computer (default)

RootManagementServer

Name of OpsMgr root management server to use or empty string to use current computer (default)

Username

User name to use to connect to remote host (required)

Password

Password to use to connect to remote host (required)

Distro

Distribution or OS name (required). (see below for valid combinations of operating systems, versions and architectures)

Version

OS version of the remote host (required). (see below for valid combinations of operating systems, versions and architectures)

Architecture 

OS architecture of the remote host (required) (see below for valid combinations of operating systems, versions and architectures)

Target

Additional remote computer to discover (done before any hosts piped into script)

Valid combinations of operating systems, versions and architectures:

OS	Valid versions	Valid Architectures
AIX	5.3 \| 6.1	Powerpc
HPUX	11iv2 \| 11iv3	PARISC
Solaris	8 \| 9 \| 10	SPARC
	10	x86 (ver > 120012-14)
RHEL	4 \| 5	x86 \| x64
SLES	9	x86 \| x64
SLES	10 \| 11	x86 \| x64

Usage:

DiscoverUnixAgent.ps1-Port:<SSH Port Number> -Server:<OpsMgr Server>
-RootManagmentServer:<RMS FQDN> -Username:<username> -Password:<password>
-Distro:<Distribution> -Version:<OS Version> -Target:<Target Computer FQDN>

Example:

To sign the certificate and discover the x86 version of the SUSE Linux Enterprise Server 10 (SLES) Agent to the SLES 10 server named SLES10-1.contoso.com, the following would be used:

InstallUnixAgent.ps1 -Username:root -Password:password -Distro:SLES -Version:10
-Target: SLES10-1.contoso.com

As before, the script can also be executed without the parameter names, however, in these instances all the parameters must be provided.

Chaining the PowerShell Scripts

The Cross Platform PowerShell scripts are designed so that they can be chained together. For example, you may want to deploy, install, sign, and discover a single UNIX/Linux server (or a group of UNIX/Linux servers) by using a single command. This is done the same way other PowerShell scripts are chained together - by piping the output of one command into the input of the next.

However, in these instances, we want to make sure that the output from one command is only piped into the next if the action being performed was successful. For example, if the initial agent installation fails, we don’t want to attempt to discover the server into Operations Manager. This can be done in a couple of ways.

Examples:

This command passes the output from the first script into the second script, but only if the first one was successful:

Type File_of_hosts | InstallUnixAgent.ps1 | Where { $_.Status -eq "OK"} | DiscoverUnixAgent.ps1

This command passes the output from the first script into the second script, but only if the first one was successful. Otherwise, it will write out an error status:

Type File_of_hosts | InstallUnixAgent.ps1 | foreach { if ($_.Status -eq "OK")
{ Write-Output $_ } else { Write-Error $_.Status } } | DiscoverUnixAgent.ps1

This example adds another piped command to return a list of the UNIX/Linux Servers against which the scripts were run and the outcome of each:

Type File_of_hosts | InstallUnixAgent.ps1 | foreach { if ($_.Status -eq "OK")
{ Write-Output $_ } else { Write-Error $_.Status } } | DiscoverUnixAgent.ps1 | Foreach { Write-Host $_.ComputerName $_.Status }

OpsMgr 2007 Cross Platform Extensions Beta Refresh

lsteinberg — Mon, 11 Aug 2008 23:07:00 GMT

We are happy to announce that the Cross Platform Extensions Beta 1 refresh is now available on the Microsoft connect site - http://connect.microsoft.com. We appreciate the feedback on the product received to date and hope you will continue this. Please let us know if you have any questions.

This Beta refresh adds three new features to the product that customers have been asking for:

· Support for OpsMgr Server running on 64-bit systems

· Gateway role support

· AIX 5.3 support

Flying pigs in Las Vegas

BarryShilmover — Fri, 09 May 2008 19:50:00 GMT

I originally came from the partner team, where I recall telling folks that we would do a cross platform solution "when pigs flew" and here I am today. How far we have come!

To celebrate the release of CPE at MMS and my statement above, we decided to have some flying pigs produced for MMS. Needless to say, they were the hit of the show.

Below are a couple of links to articles that specifically mention the pigs . :-)

MMS 2008 and Interop: Fear, Loathing, and Flying Pigs in Las Vegas

Of Flying Pigs

Cross Platform Extensions Overview session at MMS

BarryShilmover — Thu, 01 May 2008 17:13:00 GMT

For those of you at MMS in Las Vegas, hope you are all having fun!

We wanted to remind you that we have a session today that is going to cover the Cross Platform Extensions beta. In the session, we will cover the architecture, features, release plans and lots of demos. Oh, and you might just see a flying pig or two :-)

Its session number SO20 and is going to take place in Veronese 2401B at 10:15 AM.

If you cannot make the session, we are working on posting the Powerpoint presentation on this blog following the session.

See you there!

Announcing System Center Operations Manager 2007 Cross Platform Extensions and Connectors

lsteinberg — Tue, 29 Apr 2008 20:24:00 GMT

Hello and welcome to the System Center Cross Platform and Interop blog site. Today Microsoft announced a few new beta products – two of which came from our team. The System Center Operations Manager 2007 Cross Platform Extensions, which enable customers to manage Unix/Linux systems from Operations Manager 2007, was delivered as a beta today. If you were attending Bob Muglia’s Keynote this morning then you walked away with a CD containing the beta bits.

The second beta announcement from our team was the availability of the System Center Operations Manager 2007 Connectors for HP OpenView (Unix/Windows) and IBM Tivoli Enterprise Console (TEC). CD’s will be available later this week at MMS.

Both betas are available on http://connect.microsoft.com – sign in or sign up, then click 'connection directory' and look for "System Center TAP/Beta". If you’re attending MMS, then stop by and see us at the Operations Manager 2007 Pod. You can also attend the two breakout sessions:

- SO20 - System Center Operations Manager 2007 Cross Platform Extensions

- SO09 - Connectors for System Center: The Microsoft Interop Strategy

Also, there’s a hands on lab for the Cross Platform Extensions at MMS – details will follow later. Tonight there will be a birds of a feather session - BO03 Integrating with Microsoft Systems in a Mixed Environment (Windows, Linux, OSX etc).

If you happen to be at ‘Interop Las Vegas’ down the street at Mandalay Bay, then stop by and see us at the Microsoft booth.

We look forward to keeping this site updated with information, tips, and tricks about these new products from our group. Please check us out often.

The Cross Plat and Interop team