Zsoldier's Tech Blog

Replace SSL Cert Emulex OCM for VMware with a signed one.

2012-05-18T17:10:00.000-04:00

SSL Certs are something of an enigma that have always eluded my proper understanding. So I took it upon myself to figure this one out.
Summary:
Replace default OCM cert w/ one that is CA signed. Click below to continue.
PreReqs:

Windows Server (VM Preferred) <-- OCM uses windows
Emulex OCM for VMware

Once installed, it’s important that you do NOT register the plugin to vCenter using the link provided.
Registration should occur using a link that looks something like this:

https://yourServers.FQDN.com:8443
This way the plugin registers w/ the 'SSL’ certificate published name.

Details:

OCM installs w/ JRE and the required keytool.exe. Open a command prompt to this directory.

It’s located under the installation directory: (normally here) C:\Program Files\Emulex\OCM for VMware\JRE\

First you need to delete the default cert:

keytool -delete -alias vcpluginselfsigned -keystore “C:\Program Files\Emulex\OCM for VMware\ApacheTomcat\conf\emulex.vcplugin.jks”
Password for the keystore is “emulex” w/o quotes, all lowercase.

You can also check the server.xml file for the java keystore pass.

Next you need to generate a key pair

keytool -genkey -alias whateverYouWantToNameIt -keyalg RSA -keystore “C:\Program Files\Emulex\OCM for VMware\ApacheTomcat\conf\emulex.vcplugin.jks” -keysize 2048
When it asks you for first name and last name, that is where you provide the server’s FQDN. ex. yourServers.FQDN.com:8443

Now we need to generate the CSR (Certificate Signing Request)

keytool -certreq -alias whateverYouWantToNameIt -keystore “C:\Program Files\Emulex\OCM for VMware\ApacheTomcat\conf\emulex.vcplugin.jks” -file C:\whereeveryouwant\something.csr

Now you can send the CSR to your CA to get a signed cert.
While waiting for your CA to return back a cert, you may need to import yourdomain’s cert as an authorized CA. To do so:

keytool -import -trustcaserts -alias yourdomain -file C:\yourdomainsRootCert.cer -keystore -keystore “C:\Program Files\Emulex\OCM for VMware\ApacheTomcat\conf\emulex.vcplugin.jks”

Once your domain’s root CA is authorized, you should be able to import your signed cert

keytool -importcert -file D:\yoursignedcert.cer -keystore “C:\Program Files\Emulex\OCM for VMware\ApacheTomcat\conf\emulex.vcplugin.jks” -alias whateverYouWantToNameIt

If you receive the error: “keytool error: java.lang.Exception: Failed to establish chain from reply” then it’s probably because your RootCA is not authorized. Refer to step 6 to fix the problem.

vCenter Operations 5.x vApp LDAP Configuration

2012-04-27T14:49:00.001-04:00

Summary:
I happened to see someone searching for this and coming across my previous post on it’s wonkiness, so I figured I’d make a post showing how I went about configuring it w/ an Active Directory domain. This only applies to the vcops-custom page. The standard vCops-vsphere page uses vCenter’s authentication via role permissions.
Details:

Log into your vcops-custom page as an admin. (example http://yourvCOPsUIvmIP/vcops-custom)
Select Admin –> Security

Select the Import from LDAP button

Select the add button

Now see the screenshot below to see how to fill out the configuration screen:

Below details how the auto-sync works:

You’re pretty much done @ this point.

Auto Sync occurs once every hour, so once you configure it, it’ll take approx. an hour before users are granted access. The other caveat is that nested groups are not supported. Users must be direct members of the security group you setup w/ Auto Sync.
Feel free to ask questions in the comments. I’m always keeping an eye on those.

Symantec and vExpert event

2012-04-27T14:19:00.001-04:00

Many moons ago back in April, I and several other vExperts were invited to Symantec HQ for an executive briefing. What I thought was just going to be a sales pitch, turned into a deep discussion around virtualization philosophy and technical discussion around Symantec’s many products. Hit the link to read more if you are interested in my experience.

To say the least, I was pleasantly surprised to find that Symantec was genuinely interested to hear our thoughts not only around their own products, but about purely virtualization topics. I can say from the demos, especially netbackup, I was thoroughly impressed w/ the level of thought and precision behind their technologies.

3 things came up that I found most intriguing and encouraging:

Netbackup’s evolution
Storage Vendor-agnostic dynamic multipathing
Symantec AV <—Agent vs. Agentless turning to Agent ‘and’ Agentless

I was still unimpressed w/ Application HA’s presentation, especially as an experienced sys admin. However, I did get an inkling of a feeling that there is much more to Application HA than what most presentations demonstrated. I plan on keeping in touch w/ their rep around this tech. I’ll post their twitter handle when I find the business card somewhere in my mountain of junk.

Anyway, other than the presentations and tech demos, it was a huge pleasure to meet some very excellent members of the vExpert community.

Here are their twitter handles and my brief non-helpful overly sarcastic attempt @ humorous descriptions:

vExperts:

@mpoore	Brits just sound smart to me and hilarious when they curse.
@vSential	Has lots to say, always…
@virt_pimp	Unique twitter pic
@hashmibilal	Does actually look like his 8-bit pic or would that be 16-bit?
@coolsport00	Way too in shape. I’m jealous.

Less sarcasm, more descript based on Twitter profiles:

Symantec:

@JordanPusey	Symantec Alliance Marketing, VMware Alliance
@kmitchel	Symantec NetBackup Product Marketing Manager interested in conversations around virtualization and backup
@SymRenRPM	Senior Regional NetBackup Product Manager for Symantec
@abdulRasheed127	Specializing in storage, data protection and virtualization. Carlson Executive MBA student at U of M. Gopher fan! Technical marketer at Symantec
@symantec	Official Symantec Twitter Account

Uninstall HA agent manually

2012-04-27T13:25:00.001-04:00

This is something you’ll likely have to do on a rare occasion. In case you do though, here is the info need to do so.

Disable HA on cluster.
SSH into ESX/ESXi box

Run the following:

# Stops management services

/sbin/services.sh stop

# Runs uninstaller script

/opt/vmware/uninstallers/VMware-aam-ha-uninstall.sh

# Sometimes has problems removing the below directory, so we help it.

rm -rf /opt/vmware/aam

# Restarts management services

/sbin/services.sh start

RSA and VMware View iPad App

2012-04-19T11:51:00.000-04:00

One of the nifty things about the current VMware View iPad App is it's ability to import a RSA token. Unfortunately, the documentation on how to do this is a bit scarce. These steps may work for Android too, but I don't have an Android tablet to test with.

PreReqs:

RSA Server 7.1 SP4 <-- This is what I tested against.
View 4.5+ w/ RSA enabled.
VMware View iPad application

Simply go to your RSA self-service page and request a new token. If it's enabled you should have an option like this:

You'll want to select "I need a specific software token" then select "RSA SecurID Token for iPhone and iPAD/iPOD"

Once you or your RSA admin approve your request, you should get a link and activation code that looks something like this:

Joe, your new or additional software token request has been approved with the following comments from your administrator:
RSAAdmin: approved
Please ensure that the RSA SecurID application is installed on your device before attempting to import your software token.
Download the SecurID Application: com.rsa.securid://ctkip?url=https://yourRSAServer:7004/ctkip/services/CtkipService

How To Import Your Software Token ( true ) Please follow the instructions provided by your administrator to import a token using the following information:
Link: https://yourRSAServer:7004/ctkip/services/CtkipService
Activation Code: 0000000000000

To import the software token into your iPad View app, you can copy the simply change the link that is prefixed w/ com.rsa.securid to viewclient-securid. So the link would look something like this instead:

viewclient-securid://ctkip?url=https://yourRSAServer:7004/ctkip/services/CtkipService

When you type/copy/paste this link into safari, it should open up the view ipad client and ask for you activation code.

Once done, you will be able to simply type your PIN for RSA credentials.

vExpert Gift!

2012-04-02T14:11:00.001-04:00

Pretty sweet gift from @VMWare.

vCOps Enterprise 5 vApp LDAP bug? (One or more users already exist and haven’t been imported)

2012-03-26T11:03:00.001-04:00

Summary:

I had been having issues w/ our deployment of the vCenter Operations vApp. The Web GUI interface has two pages, https://vCopsServerName/vcops-vsphere and https://vCopsServerName/vcops-custom. It seems vcops-vsphere simply uses vCenter privileges to determine whether you can login and what you can view. vcops-custom however does not and has a separate set of permissions it uses to determine a user’s access authority. They both however utilize the same useraccount table in the postgres database.

Workaround:

This KB contains the steps needed to workaround the LDAP import problem:

http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2013440

Step 2 was incorrect as of this post date, it should read as follows:

# su postgres
# psql -d alivevm

I’ve let VMWare and @VMWareKB know of the typo. So it should get corrected.

Details:

I found that when I login into vcops-vsphere, it uses my permissions on VC and creates a user object in the useraccount table on the analytics VM database labeled VC User if it doesn’t match one already found in the table. Although it creates an entry in the useraccount table it does not associate to an ‘account group’ in vcops-custom to allow access. These accounts even though listed, do not show up under ‘Not Grouped’ Account group in the user management section of the vcops-custom page.

This will likely become a larger issue as most users would log into the vcops-vsphere page first, create a crap entry in the useraccount table then LDAP import based on groups would have problems creating an authorized LDAP entry. This can be somewhat mitigated if users log into the vcops-vsphere using their sAMAccountName instead of the UserPrinicipalName(UPN). Then no conflicts should arise in the useraccount table.

Should they login w/ their UPN into vcops-vsphere prior to the import job or that user’s inclusion into an LDAP group, then this issue will likely arise assuming that’s how you configured your LDAP import. The only recourse that I’m aware of is following the steps detailed in the KB.

Failed to deploy ovf package: Operation Timed Out

2012-03-05T18:32:00.001-05:00

Summary:
I’ve found this can occur when you attempt to deploy to vmfs w/ formatted blocks not equal to 1MB. This only applies to vmfs 3.33 and earlier. vmfs 5 or vSphere 5 formatted datastores should not see this issue as they are all formatted in 1MB block sizes.
Workaround:
Deploy OVF to a 1MB block sized datastore.
Side Note:
I’m wondering if deployment fails because the vmdk’s were originally created on 1MB datastore’s?

CD-Rom connected to another client (VMWare vSphere ESX)

2012-02-01T14:07:00.001-05:00

Summary:

VM will not vMotion because CD-rom is detected as mounted by another user. Option to disconnect or remove CD-rom is unavailable/grayed out under settings of VM.

Resolution:

Open the VM’s Console, select the CD-rom drive icon and select disconnect.

As obvious as this seems, I found myself chasing a rabbit trying out methods to fix this issue. This method worked in vSphere 4.1 Update 1. Later revisions should too, not sure about earlier versions.

PowerCLI: UserVars.CIMoemProviderEnabled, changing to a value of 1 (or 0)

2012-01-24T18:32:00.001-05:00

Summary:
This value appears after installing the Dell OMSA vib for ESXi 4.1. Tried changing this value to 1 using PowerCLI proved a bit more difficult than I originally thought, even cheating w/ Onyx.
Example:
Using this:

$changedValue = New-Object VMware.Vim.OptionValue[] (1)
$changedValue[0] = New-Object VMware.Vim.OptionValue
$changedValue[0].key = "UserVars.CIMoemProviderEnabled"
$changedValue[0].value = 1
$_this = Get-View -Id 'OptionManager-EsxHostAdvSettings-00000'
$_this.UpdateOptions($changedValue)

I’d get this ‘useful’ error:
Exception calling "UpdateOptions" with "1" argument(s): "A specified parameter was not correct.
"
At line:1 char:21
+ $_this.UpdateOptions <<<< ($changedValue)
+ CategoryInfo : NotSpecified: (:) [], MethodInvocationException
+ FullyQualifiedErrorId : DotNetMethodException

Solution:
Apparently the ‘value’ property needs to be declared as an int64 type. By default, Powershell assumes the value to be a ‘string’ type. Below is what will work:

$changedValue = New-Object VMware.Vim.OptionValue[] (1)

$changedValue[0] = New-Object VMware.Vim.OptionValue

$changedValue[0].key = "UserVars.CIMoemProviderEnabled"

[int64]$changedValue[0].value = 1

$_this = Get-View -Id 'OptionManager-EsxHostAdvSettings-00000'

$_this.UpdateOptions($changedValue)

To determine what type of value the 'option' is looking for, you can query it to find out, like so:
($_this.setting | where {$_.key -eq "UserVars.CIMoemProviderEnabled"}).value.gettype().name

Above will return the 'type' of 'value' this particular setting is looking for.

Side Note:
How would you determine host and that obscure ‘OptionManager-ESXHostAdvSettings-0000’ object to work with and what host that references? Here is how you can get to that object in the simplest fashion:

$MyESXHost = Get-VMHost MyESXHost

$MyESXHost.ExtensionData.ConfigManager.AdvancedOption

# Using examples from above, it can also be wrote out like this:

$changedValue = New-Object VMware.Vim.OptionValue[] (1)

$changedValue[0] = New-Object VMWare.Vim.OptionValue

$changedValue[0].key = "UserVars.CIMoemProviderEnabled"

[int64]$changedValue[0].value = 1

$_this = Get-View -ID $MyESXHost.ExtensionData.ConfigManager.AdvancedOption

$_this.UpdateOptions($changedValue)

ESXTOP in Mac Terminal looks funky…

2011-12-27T15:18:00.001-05:00

Summary:

Seems that terminal in Mac is configured in a fashion where esxtop does not display properly. Thankfully, it’s pretty easy to fix.

Example:

This demonstrates what you would see when accessing esxtop in a default configured terminal session:

Solution:

Simply change your terminal emulator session from xterm-256color to ansi, by accessing terminal’s preferences, settings, Advanced, under ‘declare terminal as:’

Open up a new terminal session, run esxtop, and you should end up w/ what looks like this:

VMWare View Powershell useful cmdlet notes.

2011-12-21T18:23:00.001-05:00

Summary:
I’m just staring to put this together mainly for my own benefit, but if someone else finds this useful, then great. I’ll be continually adding to this post. If you’d like to contribute or if I got something wrong please feel free to leave a comment.
Notes:

Disable Provisioning in all linked clone pools:

$pools = get-pool
$pools | Update-AutomaticLinkedClonePool -isProvisioningEnabled:$false

Gets list of all View related cmdlets:

get-command | where {$_.modulename -match 'vmware.view'}

#Below is so you can include it into the

#add-pssnapin.ps1 under your View installation directory

function get-viewcommand {get-command | where {$_.modulename -match 'vmware.view'}}

Gets list of pools, max number of VM's, and datastores associated:

#Helps in making sure your pools are distributed across evenly among datastores.

Get-Pool | Select Pool_ID, MaximumCount, DatastorePaths

SQLPSX, redirected my documents, and 64-bit Windows

2011-11-29T10:58:00.001-05:00

Summary:
These 3 things don’t really want to work together. Three issues I’ve noticed w/ SQLPSX, but ways around them to get these awesome cmdlets to work.
Based on SQLPSX 2.3.2.1
Workaround:

Run the MSI installation. It defaults to your my documents directory. Instead redirect the installation directory to your powershell module installation directory.

Usually for 64-bit: C:\Windows\System32\WindowsPowershell\v1.0\Modules\
32-bit: C:\Windows\SysWow64\WindowsPowershell\v1.0\Modules\

These feel backwards to me, but seems to be true.

Once installed, you’ll need to copy the module folders into your my documents redirected location. You can get them from either the 64-bit or 32-bit paths above. The folders you need to copy are as follows:

SQLMaint
SQLServer
Agent
Repl
SSIS
Showmbrs
SQLParser
adolib

Once you do so, you should be able to run ‘import-module sqlpsx’ successfully. To find out what new cmdlets are available to you, simply run the following:

get-command | where {$_.module -match "SQLMaint|SQLServer|Agent|Repl|SSIS|ShowMbrs|SQLParser|adolib"}
You can also make this a function and include it in your PS profile like so:
Function Get-SQLcommands {get-command |where {$_.module -match "SQLMaint|SQLServer|Agent|Repl|SSIS|ShowMbrs|SQLParser|adolib"}}

If I’ve misrepresented anything or you have still have issues, feel free to leave me comments stating so. I check each and every one.

VMWare View 4.x/5.x (missing) entries

2011-11-08T10:30:00.001-05:00

Summary:
Stale entries in VMWare View show desktops in any of following status:

Provisioning Error (Missing)
Deleting (Missing)

Resolution:
If remove from the view admin console does not clear out the above entries within 30 min. – 1 hour, the steps in this KB from VMWare can assist in clearing out the those stale entries.
http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1008658

Cisco ASA, ESX/vSphere, and Duplicate IP’s

2011-10-31T17:19:00.001-04:00

Summary:

Windows (2003/2008/R2) and/or Linux VM’s added to a VLAN and continuously report duplicate IP’s and Windows assign themselves APIPA (Private Address).

Symptoms:

(Windows) 169.254.x.x Address shows up as (Preferred) when running ipconfig /all in command prompt
Resetting Adapter pops up Duplicate IP Error.
Changing VM Network to a dummy network and vm nic reset, causes issue to go away.
Changing VM Network back to problem network clears issue until vm is reset or nic is reset.

Resolution:

Assuming the Cisco ASA is the cause, you can follow the below steps to rectify the issue:

Login to the Security Appliance ASDM
Select Device Setup
Expand Routing
Select Proxy ARP
Disable Proxy arp on the related interface (usually associated w/ your VLAN)

Other command line method:

sysopt noproxyarp <interface name>

If Windows is the issue for some reason, you can do this:

Start –> Run… –> Regedit
Find this key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
Insert a new DWORD value
Name the DWORD value “ArpRetryCount”
Change the value for the new entry to 0 if not already set that way.
Disable and Re-enable your network adapter to see if problem goes away.

Save PowerCLI Login Credentials to XML Securely (Mostly)

2011-09-30T11:27:00.001-04:00

Summary:
PowerCLI has a cmdlet that allows you to save your logins to vCenter and ESX(i) hosts to a XML file so you can use those as reference in your PowerCLI scripts when calling the Connect-VIServer cmdlet.
How to use it:

#This stores your credentials into an xml file.  You can open the xml file, but the password is hashed.
New-VICredentialStoreItem -Host ESXorvCenterHostname -User root -Password "Super$ecretPassword" -File C:\Whateveryouwanttonameit.xml
 
#To use the data stored in the XML file, we will call the Get-VICredentialStoreItem and place the data into a variable for use.
$Creds = Get-VICredentialStoreItem -Host ESXorvCenterHostName -File C:\Whateveryouwanttonameit.xml

#Now you can use the $Cred variable for the username and password switches in the connect-viserver cmdlet
Connect-VIServer ESXorvCenterHostName -User $Creds.User -Password $Creds.Password

Caveats:

XML files can only be referenced from the computer they were created on.

Powershell Remoting or Running PowerCLI on the computer the xml files were generated.

Nothing is truly secure, so make sure those generated xml files are placed into a secure location. You don’t want users who don’t know what they are doing to access them.

I think this is a useful function especially if you have several vCenter servers not in linked mode.

Disable Delayed Acknowledgement Setting in iSCSI Software Adapter using PowerCLI

2011-09-22T10:58:00.001-04:00

Summary:

Somebody posed this question in the vmware communities forum. I figured out how to do it cheating w/ Onyx. Not sure why this is needed (since I don’t use iSCSI much), but figure it’s best I post this for reference if I or anyone needs to do this particular task.

Script:

#This section will get host information needed$HostView = Get-VMHost NameofESXServer | Get-View$HostStorageSystemID = $HostView.configmanager.StorageSystem$HostiSCSISoftwareAdapterHBAID = ($HostView.config.storagedevice.HostBusAdapter | where {$_.Model -match "iSCSI Software"}).device #This section sets the option you want.$options = New-Object VMWare.Vim.HostInternetScsiHbaParamValue[] (1) $options[0] = New-Object VMware.Vim.HostInternetScsiHbaParamValue$options[0].key = "DelayedAck"$options[0].value = $false #This section applies the options above to the host you got the information from.$HostStorageSystem = Get-View -ID $HostStorageSystemID$HostStorageSystem.UpdateInternetScsiAdvancedOptions($HostiSCSISoftwareAdapterHBAID, $null, $options)

You can have this script run against multiple ESX servers, but you will need to use the Foreach-Object cmdlet.

Hardware.SystemInfo.OtherIdentifyingInfo Blank in PowerCLI

2011-08-17T11:12:00.002-04:00

Summary:
Using my PowerCLI script to get Dell warranty information, I noticed that some of my ESX hosts were not returning service/asset tag information. The information was showing up in vCenter's hardware status tab, but not w/ my PowerCLI script.
Workaround:

First, check to see if your ESX host has this information populated:

Connect-viServer ESXHostName
$VMHost = Get-VMHost | Get-View
$VMHost.Hardware.SystemInfo.OtherIdentifyingInfo

If the above code returns objects, then the next step is to disconnect the host from vCenter, then reconnect it. You can use the following PowerCLI code to find all hosts w/ empty properties to do this for you. As always, test before you try it in a production environment.

$ESXHosts = @()
 
$VMHosts = Get-VMHost | Get-View
Foreach ($VMHost in $VMHosts)
{
$NewObj             = "" | Select Name, ServiceTag, AssetTag
$NewObj.Name        = $VMHost.Name
#Replace is used to clean up data that might be there for easier filtering
$NewObj.ServiceTag    = ($VMHost.hardware.systeminfo.OtherIdentifyingInfo | where {$_.IdentifierType.Key -eq "servicetag"}).identifierValue -replace(" ","")
$NewObj.AssetTag    = ($VMHost.hardware.systeminfo.OtherIdentifyingInfo | where {$_.IdentifierType.Key -eq "assettag"}).identifierValue -replace(" ","")
$ESXHosts += $NewObj
}
 
$VMHostsFiltered = $ESXHosts | Where-Object {($_.ServiceTag -eq "" -or $_.AssetTag -eq "") -and ($_.ServiceTag -ne "unknown") -and ($_.AssetTag -ne "unknown")}
 
Foreach ($EvilESXBox in $VMHostsFiltered)
{
Set-VMHost -VMHost $EvilESXBox.Name -State Disconnected
Set-VMHost -VMHost $EvilESXBox.Name -State Connected
}

Now running the code in my Dell Warranty Script should have all information populated as long as the ESX host has the information.

FYI:

If the assettag and servicetag fields are blank or unknown, it's likely that your server needs to be flashed by a Dell Technician to insert the service tag info. It supposed to be pre-populated by the factory, but if you've had the motherboard replaced, then it needs to be flashed.

Get ESX Host Warranty Info for Dell Servers

2011-08-16T19:53:00.001-04:00

Summary:
Needed to get my ESX host warranty info since we haven’t completely deployed our Dell vCenter Plugin. Here is the code, w/ the Dell Warranty grab code from Marcus Oh. It’ll get you some additional info too. You can always edit and remove what you don’t need.
Code:

$ESXServers = Get-VMHost
$ESXServerView = $ESXServers | Get-View
$ESXInfo = @()
 
$oWeb = New-Object System.Net.WebClient
 
Foreach ($ESX in $ESXServers){
$TargetESXServerView = $ESXServerView | where {$_.MoRef -eq $ESX.Id}
$NewObj         = "" | Select Cluster, Name, Model, Version, BIOs, ServiceTag, AssetTag, ShipDate, ExpiryDate
$NewObj.Cluster = $ESX.Parent.Name
$NewObj.Name    = $ESX.Name
$NewObj.Model    = $ESX.Model
$NewObj.Version    = $ESX.Version
$NewObj.BIOs    = (($TargetESXServerView.Runtime.HealthSystemRuntime.SystemHealthInfo.NumericSensorInfo | where {$_.Name -like "*BIOS*"  -and $_.SensorType -eq "Software Components"}).Name) -replace(".* BIOS ","") -replace(" .*","")
$NewObj.ServiceTag     = ($TargetESXServerView.hardware.systeminfo.OtherIdentifyingInfo | where {$_.IdentifierType.Key -eq "servicetag"}).identifierValue -replace(" ","")
$NewObj.AssetTag    = ($TargetESXServerView.hardware.systeminfo.OtherIdentifyingInfo | where {$_.IdentifierType.Key -eq "assettag"}).identifierValue -replace(" ","")
## Gets ServiceTag Info from Dell
#$oWeb = New-Object System.Net.WebClient
$ServiceTag = $null
If ($NewObj.ServiceTag -eq $null -or $NewObj.ServiceTag -eq "unknown" -or $NewObj.ServiceTag -eq "") {$ServiceTag = $NewObj.AssetTag} Else {$ServiceTag = $NewObj.ServiceTag}
$sUrl = "http://support.dell.com/support/topics/global.aspx/support/my_systems_info/details?c=us&l=en&s=gen&~ck=anavml&servicetag=$($ServiceTag)"
$sData = $oWeb.DownloadString($sUrl)
#get just the dates from the dell site.
$oRegEx = [regex]'\d{1,2}/\d{1,2}/\d{4}'
$cMatches = $oRegEx.Matches($sData)
#convert to a date object
$test = @()
foreach ($a in $cMatches){$Test += ([datetime]$a.Value)}
#Sort by the year
$datedata = $test | Sort-Object year
#Grab the earliest date for Shipdate
$ShipDate = ($Datedata[0]).toshortdatestring()
#Find the last object in the array
$cDates = ($Datedata.count) - 1
#Grab the latest date from the array for the warranty end date
$EndDate = ($Datedata[$cDates]).toshortdatestring()
## End Dell Site Code
$NewObj.ShipDate    = $ShipDate
$NewObj.ExpiryDate     = $EndDate
 
$ESXInfo += $NewObj
$ShipDate = $null
$EndDate = $null
}
$ESXInfo

If info is missing check this post.

ESX/ESXi Recommended BIOs Settings

2011-08-10T10:55:00.001-04:00

Summary:

Came across a PSOD on one my lab manager hosts. The error read:

LINT1 motherboard interrupt. This is a hardware problem; please contact your hardware vendor

Resolution:

According to Dell, this occurs because the C1E setting is enabled in the BIOs. This post helped me from EnterpriseAdmins.org.

Finally, it’s mentioned in Page 15 of the vSphere 4.0 Best Practices Guide for recommended hardware BIOs settings. Guess I need to work w/ Dell to do this for me before sending me an ESX Server.

NFS Datastore appears inactive in vCenter

2011-08-09T09:56:00.001-04:00

Summary:

This was more of an annoyance for me, but essentially I had two NFS datastores that were mapped incorrectly to some ESX hosts. Those datastores were unmounted and remounted w/ correct pathing using PowerCLI. However, one host ‘seemed’ to hold onto the incorrectly mapped one. This was only reflected in vCenter, not the host itself.

Experience:

vCenter 4.1
ESX 4.0 U2

Symptoms:

When attempting to unmount the following error appears:

The object has been deleted or has not been completely created

Connecting directly to the ESX host does not show these ‘inactive’ nfs datastores.
esxcfg-nas –l within TSM/SC on the ESX host does not show these ‘inactive’ datastores.

Resolution:

Disconnect ESX host from vCenter
Connect ESX host to vCenter.

This seems to help vCenter resolve the display issue. For help on similar NFS issues, this search seemed helpful.

EMC Virtual Storage Integrator (VSI 4.1)

2011-08-01T18:34:00.002-04:00

Summary:
Upgrading to VSI 4.1 is fairly painless if you followed my last post on 3.0.1. You still have to do a couple things for it to work though.

PreReq:

VSI Installed on server system.
Reference last post for install instructions. Overall same process.
Downloaded VSI Storage Viewer Plug-in 4.1
Record IP's, username's, and passwords of your array connections.

Details:

Upgrade the version on your server and upgrade the version on your system.
Follow step 1 on my last post on the server. (This is so your local system can connect to the server's solutions enabler service.)
Once done, vCenter should show the new EMC VSI icon under 'Solutions and Applications'

Other Optional Components:

There are additional plug-ins that can be installed to allow self-service operations among other things:

VSI Unified Storage Management

NaviSphere CLI required for block provisioning
UniSphere CLI required for VNXe provisioning

VSI Storage Pool Management
VSI Symmetrix SRA Utilities

This works in conjunction w/ VMWare SRM.

VSI Path Management

ESXi 4.1 Kickstart Script for EDA Virtual Appliance

2011-07-27T10:45:00.001-04:00

Summary:
This one has been on the back burner for a little while, but I finally got it put together thanks to resources like virtualghetto. lamw is crazy smartz!
Script:
Everything seems to work fine, the only one I’m not sure of is the enabling the CIMoemProviderEnabled Advanced setting as to whether that works or not. Let me know if you happen to brave my custom kickstart script made for Dell servers, but can be adjusted for pretty much any setup I think.

# Bind vmnic4 to vSwitch0.  EDA adds vmnic0 automatically
# Active/Passive
esxcfg-vswitch -L vmnic4 vSwitch0
esxcfg-vswitch -X 1 vSwitch0
  
# Add vSwitch1, VMkernel, and bind vmnic1/3
# Active/Passive
# The following configures vSwitch1 as the vmKernel vmotion switch
esxcfg-vswitch -a vSwitch1
esxcfg-vswitch -A VMkernel vSwitch1
esxcfg-vswitch -L vmnic1 vSwitch1
esxcfg-vswitch -L vmnic3 vSwitch1
esxcfg-vswitch -X 1 vSwitch1
  
# Add vSwitch2 and bind vmnic2/5
# Active/Passive
# Created VM Switch
esxcfg-vswitch -a vSwitch2
esxcfg-vswitch -L vmnic2 vSwitch2
esxcfg-vswitch -L vmnic5 vSwitch2
esxcfg-vswitch -X 1 vSwitch2
  
# NTP Configuration
/bin/echo "restrict 127.0.0.1" &gt; /etc/ntp.conf
/bin/echo "restrict default kod nomodify notrap" &gt;&gt; /etc/ntp.conf
/bin/echo "server timeserver1.local" &gt;&gt; /etc/ntp.conf
/bin/echo "server timeserver2.local" &gt;&gt; /etc/ntp.conf
/etc/init.d/ntpd restart
  
# Configures vmk0 as Mgmt Interface
HOSTSVC_FILE=/etc/vmware/hostd/hostsvc.xml
  
/bin/cat &gt; ${HOSTSVC_FILE} &lt;&lt; __CREATE_HOST_SVC__
&lt;ConfigRoot&gt;
  &lt;mangementVnics&gt;
    &lt;nic id="0000"&gt;vmk0&lt;/nic&gt;
  &lt;/mangementVnics&gt;
  &lt;mode&gt;normal&lt;/mode&gt;
  &lt;service&gt;
    &lt;tsm-ssh&gt;off&lt;/tsm-ssh&gt;
  &lt;/service&gt;
&lt;/ConfigRoot&gt;
__CREATE_HOST_SVC__
  
# Configure vmk1 as vMotion Interface
esxcfg-vmknic -a VMkernel -i ###HOSTIP### -n 255.255.255.0
/bin/vim-cmd hostsvc/net/refresh
/bin/vim-cmd hostsvc/vmotion/vnic_set vmk1
  
# DNS Secondary (replace x.x.x.x w/ IP of another DNS server) 
/bin/echo "nameserver x.x.x.x" &gt;&gt; /etc/resolv.conf
  
# Configure Local Datastore Name to standard
/bin/vim-cmd hostsvc/datastore/rename datastore1 "$(hostname -s)_local"
  
# Configure Syslog to forward to remote syslog server like Splunk
/bin/vim-cmd hostsvc/advopt/update Syslog.Remote.Hostname string x.x.x.x
  
# Configure port to forward Syslogs.
/bin/vim-cmd hostsvc/advopt/update Syslog.Remote.Port int 514
  
# Only needed if local syslog going to be used.
#/bin/vim-cmd hostsvc/advopt/update Syslog.Local.DatastorePath string "[$(hostname -s)_local] /logfiles/hostName.log"
  
# Maps standard NFS Shares (I use these as shared stores for iso and vmtemplates)
esxcfg-nas -a -o linuxserver1 -s /share/STUFF nfs_share
esxcfg-nas -a -o nasdevice1 -s esx_vmtemplates nfs_share_vmtemplates
  
#### Start of Join AD code ####
#Joins to Active Directory (ESX 4.1) Update 1 Code Hashed Out
/bin/cat &gt; /tmp/joinActiveDirectory.py &lt;&lt; __JOIN_AD__
import sys,re,os,urllib,urllib2,base64
 
# mob url
url = "https://localhost/mob/?moid=ha-ad-auth&amp;method=joinDomain"
 
# mob login credentials -- use password = "" for build scripting
username = "root"
password = ""
 
# which domain to join, and associated OU
# e.g.
#       "local.com"
#       "local.com/VMware Server OU"
domainname = "local.com/someOU/"
 
# active directory credentials using encoded base64 password
ad_username = "someserviceaccount@local.com"
### To get an encoded password, use python.  It's not really secure, but better than plain text.
encodedpassword = ""
ad_password = base64.b64decode(encodedpassword)
  
# Unhash for ESXi 4.1 Update 1
### Create global variables
# global passman,authhandler,opener,req,page,page_content,nonce,headers,cookie,params,e_params
 
# Code to build opener with HTTP Basic Authentication
passman = urllib2.HTTPPasswordMgrWithDefaultRealm()
passman.add_password(None,url,username,password)
authhandler = urllib2.HTTPBasicAuthHandler(passman)
opener = urllib2.build_opener(authhandler)
urllib2.install_opener(opener)
  
# Unhash below for 4.1 Update 1
### Code to capture required page data and cookie required for post back to meet CSRF requirements  ###
#req = urllib2.Request(url)
#page = urllib2.urlopen(req)
#page_content= page.read()
  
# Unhash below for 4.1 Update 1
### regex to get the vmware-session-nonce value from the hidden form entry
# reg = re.compile('name="vmware-session-nonce" type="hidden" value="?([^\s^"]+)"')
#nonce = reg.search(page_content).group(1)
  
# Unhash below for 4.1 Update 1
### Code to join the domain ESXi 4.1U1
#params = {'vmware-session-nonce':nonce,'domainName':domainname,'userName':ad_username,'password':ad_password}
#e_params = urllib.urlencode(params)
#req = urllib2.Request(url, e_params, headers={"Cookie":cookie})
#page = urllib2.urlopen(req).read()
 
#Hash if using 4.1 U1
### Code to join domain ESX 4.1
params = {'domainName':domainname,'userName':ad_username,'password':ad_password}
e_params = urllib.urlencode(params)
req = urllib2.Request(url,e_params)
page = urllib2.urlopen(req).read()
 
__JOIN_AD__
 
#execute python script to Join AD
/bin/python /tmp/joinActiveDirectory.py
  
#### End AD Join Code ####
# Changes UserVars.CIMoemProviderEnabled to 1.  Required for OMSA VIB to work properly.
esxcfg-advcfg -s 1 /UserVars/CIMoemProviderEnabled 
%firstboot --unsupported --interpreter=busybox --level=9999
# Do Patching in this section
  
#Gets Emulex and OMSA VIB from IIS Server w/ virtual directory pointed to NAS hosted directory
#Applies Emulex then OMSA VIB &lt;-- Must be in this order.
# Maintenance Mode attempted twice before attempting patch because it sometimes fails.
/bin/vim-cmd hostsvc/maintenance_mode_enter
sleep 5
/bin/vim-cmd hostsvc/maintenance_mode_enter
  
# Entries entered twice due to metadata.zip possibly not extracting properly the first time.
/sbin/esxupdate --bundle=http://IISSERVER.local.com/VIBS/Emulex_CIM/elx-esx-4.1.0-emulex-cim-provider-3.2.30.1-offline_bundle-364582.zip update
  
/sbin/esxupdate --bundle=http://IISSERVER.local.com/VIBS/Emulex_CIM/elx-esx-4.1.0-emulex-cim-provider-3.2.30.1-offline_bundle-364582.zip update
  
/sbin/esxupdate --bundle=http://IISSERVER.local.com/VIBS/Dell_OMSA/OM-SrvAdmin-Dell-Web-6.5.0-2247.VIB-ESX41i_A01.zip update
  
/sbin/esxupdate --bundle=http://IISSERVER.local.com/VIBS/Dell_OMSA/OM-SrvAdmin-Dell-Web-6.5.0-2247.VIB-ESX41i_A01.zip update
  
  
/bin/vim-cmd hostsvc/maintenance_mode_exit
  
/sbin/reboot -d 120

PSA: ESX 4.x Emulex LPe12000-E, Firmware 2.00A3 not compatible with vMax

2011-07-15T16:45:00.000-04:00

Summary:
Found this out the hard way, but for anyone who might be banging your head against the wall. Check if your ESX host has Emulex LPe12000-E and running firmware 2.00A3. If so upgrade to 2.00A4.

Symptoms:

ESX host not mapping/detecting LUN regardless of rescan attempts.
VM's suddenly going offline because of disk access problems.

Emulex VIB and Dell OMSA VIB w/ Dell Management Plugin for vCenter

2011-07-15T16:02:00.000-04:00

Summary:
Found this out when installing the Emulex VIB on an ESXi 4.1 host w/ the Dell OMSA VIB installed. Apparently something w/ the Emulex VIB causes issues w/ the Dell OMSA install causing it to stop talking to the Dell Management Plugin for vCenter.

Solution:

Install the Emulex VIB THEN the Dell OMSA VIB

Uninstall Dell OMSA VIB, reboot, then attempt install based on order above.

FYI:

To uninstall a VIB from ESXi 4.1, you can use vCLI or TSM (Tech Support Mode).

esxupdate query <-- This will return the installed VIB's and their bulletin ID which is need for removal.

esxupdate --b Bulletin_ID_of_VIB remove <-- This will remove the VIB