Aix Practices

Aix Interview Questions

2012-02-21T19:43:00.001-08:00

Q 1. What is Virtualization?

Q2 What is micropartitioning?

Q3 What is Shared pool processor? How it works?

Q4 What is vCpu? How you define the vCpu values( min , desired & max)? What is the importance of vCpu?

Q5 What is the importance of desired vCPU and max vCpu?

Q6 Scenario based questions; What could be the maximum value can be defined to vCPu for a lpar if managed systems has total 6 physical CPU?

Q7 Scenario 2:- If physical CPU defined as min 1, desired 2 & max 4 where as vCpu defined as min 1, desired 3 and max4, then how any logical cpu you will see on a lpar concerning power5,6 and power7?

Q8:- following above scenario who system will dispatch or use the CPU cycles.?

Q9:- What is capped and uncapped processor? What is the entitled Capacity incase of capped and uncapped CPU with example?

Q10:- Scenario :- In case of uncapped processor how load will be distributed on each lpar? During peak time or during demand of extra Cpu by the lpar how the hypervisor will distribute the CPU from free pool or shared pool? How it defines the priority of allocating extra CPU to heavily loaded Lpar? Again if Lpar is weight is 98 and other lpar weight is 105 then how cpu will be distributed by hypervisor and in what ratio?

Q11 Is there any formula to calculate the vCpu distribution by hypervisor?

Q12What is ASM? How it works?

Q13 What is shared memory processor? How it works?

Q13 What is ASE (Active Shared memory Expansion)? How it works.

Q14 What is turbo core? How it works? What is the benefit of turbo core? Do all power7 have this feature? How to enable or disable turbo core?

Q15 What is the difference between Power4, Power5 Power6 and Power7?

Q16 What is the difference between Aix 5.1, 5.2 , 5.3 and Aix 6.1?

Come on do some home work yourself; that's why I have not posted the answers... Wait for more question I will post only when I get some response on above question, drop your answers...

Creating a Self signed Certificate for IBM HTTP Server

2011-11-16T20:38:00.001-08:00

The process to generate the self Signed certificate for IBM HTTP Server 6.1.

Considering you are enabling one Web site for SSL, and the hostname is the same as the one already defined in the Global Scope for non-SSL (port 80), you can enable SSL as follows.

1. Check you http website is working with either using IP address or using url or both on Port 80 as shown below:-

say http://x.x.x.x or http://abc123.com

Check Http processes are running.

2. Just for sake check if https for same Ip address or url is working at port 443 or not.

This is what we have to achieve to get working same URL access using the HTTPS via self signed certificate

3. Check Https and 443 port are defined in /etc/services.

# cat /etc/services |grep -i 443 |grep -i https
https 443/tcp # http protocol over TLS/SSL
https 443/udp # http protocol over TLS/SSL

4. Check GSK v7 for Http 6.1 is installed or not

# lslpp -l |grep -i gsk

# cd /usr/opt/ibm

ksh: /usr/opt/ibm: not found.

5. Install GSK v7 for Http6.1

IBM HTTP Server V6.1 releases
*Supports Global Security Kit Version 7 only!
V6.1.0.0 ...............................................7.0.3.20 (or higher)

# lslpp -l |grep -i gsk

gskjs.rte 7.0.3.18 COMMITTED AIX Certificate and SSL Java

gskjt.rte 7.0.3.18 COMMITTED AIX Certificate and SSL Java

gsksa.rte 7.0.3.18 COMMITTED AIX Certificate and SSL Base

gskta.rte 7.0.3.18 COMMITTED AIX Certificate and SSL Base

# cd /usr/opt/ibm
# ls -ltr
total 0
drwxr-xr-x    8 root     system          256 Nov 15 11:11 gsksa
drwxr-xr-x    7 root     system          256 Nov 15 11:12 gskjt
drwxr-xr-x    7 root     system          256 Nov 15 11:12 gskjs
drwxr-xr-x    8 root     system          256 Nov 15 11:14 gskta
#

Please apply the latest fix packs do for proper functioning.

# lslpp -l |grep -i gsk
gskjs.rte                 7.0.3.18 COMMITTED AIX Certificate and SSL Java
gskjt.rte                 7.0.3.18 COMMITTED AIX Certificate and SSL Java
gsksa.rte                 7.0.3.18 COMMITTED AIX Certificate and SSL Base
gskta.rte                 7.0.3.20 COMMITTED AIX Certificate and SSL Base
#

6. Now stop and start Http services.

      # pwd
     /usr/IBM/HTTPServer/bin
     #./stopapa

# ./startapa

7. Check GUI interface working on AIX server , using xclock & xmanager. Install key for ssl as shown below:-

# cd /usr/IBM/HTTPServer/bin

# ./ikeyman

( ket database --> CMS, File name --> key.kdb, Loctaion --> /usr/IBM/HTTPServer/bin )

Select the checkbox Stash the password to a file? This encrypts the password and saves the file as a .sth file in the same directory as the key database file.

Say password is :- xyzabc123

Click OK

   Key Files have been created as shown
           # pwd
              /usr/IBM/HTTPServer/bin
           #
           # ls -ltr key*
              -rw-r--r--    1 root     system          129 Nov 15 11:36 key.sth
              -rw-r--r--    1 root     system           80 Nov 15 12:36 key.rdb
              -rw-r--r--    1 root     system       115080 Nov 15 12:36 key.kdb
              -rw-r--r--    1 root     system           80 Nov 15 12:36 key.crl
           #

8. Now we need to create the self signed certificate for which we dont need to have authentication from CA or Verisign.

Click on self signed certificate to generate the certificate:-

Key Label= (The name you want to give the certificate to identify it in IKEYMAN)

Say key label :- www.hostname.com or ur url

Note: Using the SiteName (for example, www.robo.com) as the label is a good practice.

Not able to generate 2048 bit key

Rename or move the gskikm.jar file from its default location

# pwd

/usr/IBM/HTTPServer/bin

As done below:-

# pwd

/usr/IBM/HTTPServer/java/jre/lib/ext

# mkdir gskfiles

# mv gskikm.jar /usr/IBM/HTTPServer/java/jre/lib/ext/gskfiles/gskikm.jar_backup_orignal

Now re-run ikeyman from GUI. If still you didn't get the 2048 bit key option look for latest patches for Java and GSK. Since I was just testing on a box so I didn't take pain to fix this. For more refer to IBM Link

http://www-01.ibm.com/support/docview.wss?uid=swg21307574

Number of day I have taken 10 years i.e 3650 days and Click OK

We don't need to receive and extract the certificate as it self signed or unless it is required.

9. Enable SSL directives within the IBM HTTP Server's configuration file (httpd.conf):-

For releases of IBM HTTP Server v2.0, v6.0 and v6.1: We need to load the below module in httpd.conf file

LoadModule ibm_ssl_module modules/mod_ibm_ssl.so

# cd /usr/IBM/HTTPServer/conf
# ls -ltr httpd.conf
-rw-r--r-- 1 root system 32974 Nov 17 10:11 httpd.conf
# more httpd.conf|grep mod_ibm_ssl.so
LoadModule ibm_ssl_module modules/mod_ibm_ssl.so
#

Now do the below entries in httpd.conf file below Listen Port 40

ServerName www.XYABC.com ---> If you are using the URL and defined DNS name for the web,

else no need to define you are accessing via IP

Listen 443

SSLEnable

SSLClientAuth None

</VirtualHost>

SSLDisable

KeyFile "/usr/IBM/HTTPServer/bin/key.kdb"

SSLV2Timeout 100

SSLV3Timeout 1000

10. Now open the browser and open the links both using https and http. DONE :)

Done!

11. For more info and configuration refer to IBM link

https://www-304.ibm.com/support/docview.wss?uid=swg21179559#step3

*****Note you must a DNS or local pc host file defined if you are using the Name server

Taking Backup of Datavg on running Aix System / FAST backup of datavg

2011-11-06T23:14:00.000-08:00

How to clone data VG & restore to other system without downtime/fast clone. ( Well tested)

How to take backup of running system if application availability is high priority and offline backup takes near 5-8 hrs to get completed.

========================================================================
Map the hdisky or lun to both the system

On system1:-

lspv

cfgmgr ** to get new hdiskY/lun

Now Extendvg

extendvg vgname hdisky/lun

******if you are unable to extendvg due to Max pp limitation then change the Vg properties.

chvg -t 2|3|4 (etc) vgname

extendvg vgname hdiskY

mirrorvg vgname hdiskY

lsvg -l vgname * check all fs are syncd and consistent, else wait to get it consistent.

Freeze the Filesystems to keep the consistency and to clear the chace so that all data will be written on disk.

chfs -a freeze=120 filesystem_names ( all filesystem of that VG and application )

This will freeze the filesystem no I/O will be happen. Users will get the application hanging issue for 2 mins but these 2 mins will be enough for you to split the consistent VG.

Now split the VG

splitvg -y new_vgname -c 2 -i old_vgname ( -i is used so that hdiskY cant join the vg again and lv/fs remain consistent, else if you need the hdisk to rejoin the vg then dont use -i , -c 2 is to separate the second copy of lv i.e hdiskY)

Activate or thawn the filesystems:- Now activate the filesystems to be accessed by the application and Users.

chfs -a freeze= 0 filesystem_names ( fielsystems whch were made frozen above)

Now you have only taken or say frozen the application for 2 -3 mins and you can take the backup of the consistent datavg as shown below:-

varyoffvg new_vgname

exportvg new_vgname

rmdev -Rdl hdiskY
=======================
ON System 2 or TSM

Then map same hdiskY/lun to different system if you have not done earlier

lpsv

cfgmgr

lspv

importvg -y vgname( name you like to put) hdiskY

cp -p /etc/filesystems /etc/filesystems_copy

edit /etc/filesystems remove unwanted prefix like /fs/fs etc
mount all

check VG doesn’t have any stale Lv.

Check files and application.

Remove mapping of hdisky/lun from system1.

Mount the filesystems

Take the backup on TSM for consistent datavg with the down time of 2-3 mins only on actual host and user will now keep on accessing the server or run the application as cloned server if your mksysb is also cloned on the target server.

That its.

Done!
=========================================================================

Extra using script to change lv or fs prefix if you want or else u can do it in /etc/filesystems file as I tested that also as stated above:-

the filesystems still have the "/fs/fs" prefix. So, a quick and dirty script cleans that up:

for fs in `lsvg -l datavg | grep fs | awk '{ print $7 }' | cut -d'/' -f 4-`
do
chfs -m /$fs /fs/fs/$fs ****chfs -m newmount oldmount******
done

And, the LVs still have the "fs" prefix, I could leave them, but my OCD won't let me:

for fs in `lsvg -l datavg | grep fs | awk '{ print $1 }' | cut -d's' -f 2-`
do
chlv -n $fs fs$fs
done

Then I used "mount -a" to mount all the filesystems.

How to configure NPIV (N_Port ID Virtualization)

2011-10-24T08:17:00.000-07:00

Step By Step NPIV configuration

For maximum redundancy for the paths create the instance on dual VIOS. We will consider an scenario having Power6/7 Server, with 2 PCI Dual/Single port 8 GB Fibre Card with VIOS level – 2,2 FP24 installed and VIOS is in shutdown state.

First we need to create Virtual fibre channel adapter on each VIOS which we will later on map to physical fibre adapter after logging into VIOS similarly as we do for Ethernet

Please Note: - Create the all lpar clients as per requirements and then configure the Virtual fiber adapter on VIOS. Since we are mapping one single physical fiber adapter to different hosts, hence we need to create that many virtual fiber channel adapter. Dynamically virtual fiber channel adapter can be created but don’t forget to add in profile else you lost the config on power-off.

1. 1. Create Virtual fibre channel adapter on both VIOS server.

HMC--> Managed System-->Manage Profile-->Virtual Adapter

Let say I have define the virtual fiber adapter for AIX client Netwqa with adapter ids 33 & client adapter id 33

Similarly on Vios2 for multipath redundancy:-

If you have any more LPARs which you want to configure for NPIV, repeat the above mentioned steps with those LPAR details.

2. Mapping defined virtual fiber channel adapter to Physical HBA ports

Now activate VIOS Lpar. Logon to VIOS server and check the status of physical Fibre channel port. Or if Vios are already running then run cfgmgr or config manager to get the defined virtual FC adapter on Vios servers.

$ lsnports

Name physloc fabric tports aports swwpns awwpns

fcs0 U5802.001.008A824-P1-C9-T1 0 64 64 2048 2048

fcs1 U5802.001.008A824-P1-C9-T2 0 64 64 2048 2048

fcs2 U5877.001. 0083832-P1-C9-T1 0 64 64 2048 2048

fcs3 U5877.001.0083832-P1-C9-T2 0 64 64 2048 2048

If the value for the ‘fabric’ parameter shows as ‘0’ that means that HBA port is not connected to a SAN switch supporting the NPIV feature. Please connect fibre cable between Physical fibre channel adapter and San switches. If the value for the ‘fabric’ parameter shows as ‘1’ that means that HBA port is connected to a SAN switch supporting the NPIV feature

Above commands displays

Name:- Display Name and

physloc :- location of physical adapter.

aports:- Display number of available physical ports (aports)

awwpns:- Display total numbers of WWPNs that physical port support.

After connecting fibre channel cable, execute lsnport again you should get fabric=1

$ lsnports

Name physloc fabric tports aports swwpns awwpns

fcs0 U5802.001.008A824-P1-C9-T1 1 64 64 2048 2048

fcs1 U5802.001.008A824-P1-C9-T2 1 64 64 2048 2048

fcs2 U5877.001. 0083832-P1-C9-T1 1 64 64 2048 2048

fcs3 U5877.001.0083832-P1-C9-T2 1 64 64 2048 2048

Run the ‘lsdev –vpd | grep vfchost’ command to know which device represents the Virtual FC adapter on any specific slot. Or run`lsmap -npiv –all`to list number of FC adapter and their mapping to physical adapter

Here we are interested in vfchost2 as I am showing the example for connecting vfchost2.

Check Status and Flags:-

Status:LOGGED_IN, Flags: a<LOGGED_IN,STRIP_MERGE>

-> The vfchost adapter is mapped to a physical adapter, and the associated client is up and running.

Status: NOT_LOGGED_IN, Flags:1<NOT_MAPPED,NOT_CONNECTED>

-> The vfchost adapter is not mapped to a physical adapter

Status: NOT_LOGGED_IN, Flags:4<NOT_LOGGED>

-> The vfchost adapter is mapped to a physical adapter, but the associated client is not running. If you suspect a problem, check for VFC_HOST errors.

ClntName:- will only be displayed when your mapped vio client is booted and running state.

ClntOS : Name will only be displayed when your mapped vio client is booted and running state

Now we need to map the device ‘vfchost2’ to the physical HBA port ‘fcs1’ using the ‘vfcmap -vadapter vfchost2 -fcp fcs1’command. Once it is mapped, check the status of the mapping using the command ‘lsmap -vadapter vfchost2 -npiv’. Please note that the status of the port is showing as ‘NOT_LOGGED_IN’, this is because the client configuration is not yet complete and hence it cannot login to the fabric.

$ vfcmap -vadapter vfchost2 -fcp fcs1

List the adapter using below ` lsmap –vadapter vfchost2 –npiv`.

Since Aix client is not configured and mapped that’s why status is not Logged_IN, it will not display the ClntName and ClntOS along with VFC client name and DRC

Repeat the above mentioned steps in the second VIOS LPAR also. If you have more client LPARs, repeat the steps for all those LPARs in both the VIOS LPARs.

3. .Aix Client Configuration

Create Virtual FC client adapter on Aix lpar by navigating HMC and below tabs:-

HMC à VIO Client (NETWQA) à manage ProfileàVirtual Adapterà Action à Create as

Create the second Virtual FC Client Adapter with the slot number details as shown in below figure. Make sure the slot numbers match with the slot numbers we have entered in the second VIOS LPAR while creating the Virtual FC Server Adapter.

Now activate the AIX LPAR and install AIX in it, note that the minimum version required to support the NPIV feature is AIX 5.3 TL9 or AIX 6.1 TL2. Once the AIX installation is complete, depending on the SAN Storage box, you need to install the necessary subsystem driver and configure it. If Aix is already running then issue `cfgmgr` command.

Install SDDPCM driver for multipathing depending upon the storage you have.

You can now check the status of the Virtual FC Server Adapter ports in both the VIOS to check whether the ports are successfully logged in to the SAN fabric.

VIOS2

4. Allocating San Storage:-

You can now assign the storage to the Aix lpar. Do proper zoning between san storage and wwpn of Aix client FC virtual adapter. Use below command to check the WWPN of virtual Fibre channel adapter on AIX client.

#lscfg -vpl fcs*

Or below commands as shown below:-

You can also get the wwpn number from AIX client profile through HMC as shown below:-

NOTE: When viewing the properties of the Virtual FC Client Adapter from the HMC, it will show two WWNs for each Virtual FC Client Adapter as shown above. The second WWN shown here is not used until there is a live migration activated on this LPAR through Live Partition Mobility. When a live migration happens for this LPAR, the new migrated hardware will be accessing SAN storage using the second WWN of the Virtual FC Client Adapter, so you have to make sure the second WWN is also configured in Zoning and Access Control.

Use lspath or pcmpath query adapter , ‘datapath query adapter’, ‘datapath query device’, ‘lsvpcfg’ , pcmpath query essmap etc commands to check the mutlipathing and hdisk configured properly.

It will show the output as shown below. You can see that there are 4 separate paths for the disk ‘hdisk2’ which is through two separate virtual FC adapters as I have connected my DS storage to fiber switch through 4 cables for each fiber card.

**Zoning on SAN Switch is out of scope for this document; if you want to know how to do zoning you can drop a comment or mail me.

Limitations:-

§ NPIV is only supported on 8Gb FC adapters on p6 hosts. The FC switch needs to support NPIV, but does not need to be 8 Gb (the 8 Gb adapter can negotiate down to 2 and 4 Gb).

§ Maximum number of 64 NPIV adapters per physical adapter (see lsnports)

§ 16 virtual fibre channel adapters per client

§ No support for IP over FC (FCNET)

§ Optical devices attached via virtual fibre channel are not supported at this time

Diagnostics no supported for virtual fibre channel adapters

Important NPIV Commands

$lsnports

Display information about physical ports on physical fibre ports

$lsmap –npiv –all

Display Virtual fibre channel adapter created in VIO Server and there status

$lsmap –npiv –vadapter vfchost0

Display attributes for virtual fibre channel adapter

$vfcmap –vadapter vfchost0 –fcp fcs0

Map virtual fibre adapter with physical fibre adapter

$ vfcmap –vadapter vfchost0 –fcp

Unmaps Virtual fibre channel adapter

$ portcfgnpivport ------ > On IBM brocade san switch

0 - Disable the NPIV capability on the port

1 - Enable the NPIV capability on the port

Usage :- $portcfgnpivport 10 1

Unable NPIV functionality on Port 10 of san switch

Also configure Fibre card to dyntrk = yes and fc_err_recov :fast_fail on Aix Lpar

What is NPIV (N_Port ID Virtualization)

2011-10-24T02:36:00.000-07:00

N_Port ID Virtualization or NPIV is a Fibre Channel facility allowing multiple N_Port IDs to share a single physical N_Port. This allows multiple Fibre Channel initiators to occupy a single physical port, easing hardware requirements in Storage Area Network design. An NPIV-capable fibre channel HBA can have multiple N_Port IDs, each with a unique identity and world wide port name.

In Simple words we virtualize Physical fibre card similarly like we do for network card in VIOS. A Single Fibre channel port can be share across multiple Vio client with unique WWN numbers means you can connect each Vio Client to independent physical storage on a SAN.

On System p the Virtual I/O Server (VIOS) allows sharing of physical resources between LPARs including virtual SCSI, virtual Fibre Channel (NPIV) and virtual networking. NPIV allows System p logical partitions (LPARs) to have dedicated N_Port IDs, giving the OS a unique identity to the SAN, just as if it had a dedicated physical HBA(s).
For availing maximum redundancy for the SAN paths of the LPARs, the paths has to go through two different HBAs and those HBAs should be assigned to two different VIO Servers.

Pre-requisites/Basic Requirements

• IBM POWER6 or above processor based hardware
• Firmware level: EM340_039
• 8Gb PCIe Dual-port FC Adapter (Feature Code #5735)
• SAN switch supporting the NPIV feature
• Virtual I/O Server version 2.1.0.10-FP-20.1 or later
• AIX 5.3 Technology Level 09 or above (required filesets devices.vdevice.vfc-client and devices.vdevice.IBM.vfc-client)
• AIX 6.1 Technology Level 02 or above (required filesets devices.vdevice.vfc-client and devices.vdevice.IBM.vfc-client)
• SDD 1.7.2.0 + PTF 1.7.2.2
• SDDPCM 2.2.0.0 + PTF v2.2.0.6 or 2.4.0.0 + PTF v2.4.0.1
• For HMC managed systems HMC release 7.3.4.0 with MH01152 or later is required

NPIV Model:

To enable NPIV on the managed system, you must create a Virtual I/O Server logical partition (version 2.1 or later) that provides virtual resources to client logical partitions. You assign the physical fibre channel adapters (that support NPIV) to the Virtual I/O Server logical partition. Then, you connect virtual fibre channel adapters on the client logical partitions to virtual fibre channel adapters on the Virtual I/O Server logical partition. A virtual fibre channel adapter is a virtual adapter that provides client logical partitions with a fibre channel connection to a storage area network through the Virtual I/O Server logical partition. The Virtual I/O Server logical partition provides the connection between the virtual fibre channel adapters on the Virtual I/O Server logical partition and the physical fibre channel adapters on the managed system.

There is always a one-to-one relationship between virtual fibre channel adapters on the client logical partitions and the virtual fibre channel adapters on the Virtual I/O Server logical partition. That is, each virtual fibre channel adapter on a client logical partition must connect to only one virtual fibre channel adapter on the Virtual I/O Server logical partition, and each virtual fibre channel on the Virtual I/O Server logical partition must connect to only one virtual fibre channel adapter on a client logical partition.
On systems that are managed by the Hardware Management Console (HMC), you can dynamically add and remove virtual fibre channel adapters to and from the Virtual I/O Server logical partition and each client logical partition. You can also view information about the virtual and physical fibre channel adapters and the worldwide port names (WWPNs) by using Virtual I/O Server commands.
To enable N_Port ID Virtualization (NPIV) on the managed system, you create the required virtual fibre channel adapters and connections as follows:
---You use the HMC to create virtual fibre channel adapters on the Virtual I/O Server logical partition and associate them with virtual fibre channel adapters on the client logical partitions.
---You use the HMC to create virtual fibre channel adapters on each client logical partition and associate them with virtual fibre channel adapters on the Virtual I/O Server logical partition. When you create a virtual fibre channel adapter on a client logical partition, the HMC generates a pair of unique WWPNs for the client virtual fibre channel adapter.
---You connect the virtual fibre channel adapters on the Virtual I/O Server to the physical ports of the physical fibre channel adapter by running the vfcmap command on the Virtual I/O Server.

The HMC generates WWPNs based on the range of names available for use with the prefix in the vital product data on the managed system. This six digit prefix comes with the purchase of the managed system and includes 32,000 pairs of WWPNs. When you remove a virtual fibre channel adapter from a client logical partition, the hypervisor deletes the WWPNs that are assigned to the virtual fibre channel adapter on the client logical partition. The HMC does not reuse the deleted WWPNs when generating WWPNs for virtual fibre channel adapters in the future. If you run out of WWPNs, you must obtain an activation code that includes another prefix with another 32,000 pairs of WWPNs. To avoid configuring the physical fibre channel adapter to be a single point of failure for the connection between the client logical partition and its physical storage on the SAN, do not connect two virtual fibre channel adapters from the same client logical partition to the same physical fibre channel adapter. Instead, connect virtual fibre channel adapters from multiple client logical partitions to one physical fibre channel adapter.

Check the Next Article: How to configure NPIV .

When root password was last updated in Aix server

2011-10-16T21:56:00.000-07:00

This is cumbersome to know when root password was lasted updated in Aix system especially at times of audit. Calculating the days/time as per the info in /etc/security/password which is really a madness. Here is the solution of how to check when root password was last updated.

1) Check lastupdate in /etc/security/passwd or pwdadm -q root
root:
lastupdate = 1316984479

2) Then run this command
perl -le 'print scalar localtime 1316984479'

Mon Sep 26 02:31:19 2011

That's it!

How to disable TCB on running Aix Server

2011-10-16T21:30:00.000-07:00

It has been thinking of many Aix admins that Trusted Computing Base if enabled cant be disabled on the running system; you need to reinstall the OS to deactivate it. What a Joke!!! Everything is becoming dynamic and we are still standing on same level. Let's step forward:-

MYTH of TCB can't be disbaled if once enabled. How to disable TCB on fly

If TCB is enabled in AIX can be disabled without rebooting or rather say reinstalling the OS. Here is the process: -

Don't need any application downtime.

*Playing with ODM is dangerous, so keep your hands safe ;)))

1) Take Odm backup

/usr/lib/objrepos, /usr/share/lib/objrepos and /etc/objrepos recursively

2) Check the TCB in odm

# odmget -q attribute=TCB_STATE PdAt

PdAt:
uniquetype = ""
attribute = "TCB_STATE"
deflt = "tcb_enabled"
values = ""
width = ""
type = ""
generic = ""
rep = ""
nls_index = 0
#

3) Disable TCB

odmget -q attribute=TCB_STATE PdAt | sed 's/tcb_enabled/tcb_disabled/' | odmchange -o PdAt -q attribute=TCB_STATE

4) Now TCB is disbaled

# odmget -q attribute=TCB_STATE PdAt

PdAt:
uniquetype = ""
attribute = "TCB_STATE"
deflt = "tcb_disabled"
values = ""
width = ""
type = ""
generic = ""
rep = ""
nls_index = 0
#

5) If you want to enable TCB again

odmget -q attribute=TCB_STATE PdAt | sed 's/tcb_disabled/tcb_enabled/' | odmchange -o PdAt -q attribute=TCB_STATE