Download pdf - CEC 2017 20/Jun/2017 - Schedschd.ws/hosted_files/commoneuropecongress2017/86/Inside the HMC... · CEC 2017 20/Jun/2017 1 ... SSH Access to the HMC and command line options ... Open

CEC 2017

20/Jun/2017

1

Larry “DrFranken” Bolhuis [email protected] Technology Consulting, LLC 616.855.1667Grand Rapids, MI www.frankeni.com

2

Introduction

HMC Version 8 Enhanced +

HMC Version 7 and Version 8 Classic layout

Understanding HMC to FSP Connections

Configuring IP on the HMC

Initial Configuration items

HMC Users and Security

Updating the HMC

SSH Access to the HMC and command line options

Disk status and Cleanup on the HMC

Configuring 5250 and other consoles through the HMC

Final Thoughts

Care and Feeding of your HMC CEC 2017

ASMI – Advanced Systems Management Interface CEC – Complex Electronics Cabinet (aka System unit) COD – Capacity on Demand CUOD – Customer Upgrade on Demand DHCP – Dynamic Host Configuration Protocol FSM – Flex Systems Manager FSP – Flexible Service Processor HMC – Hardware Management Console vHMC – Virtual Hardware Management Console (KVM, VMWare) HSL – High Speed Loop/Link Modem – Modulator Demodulator. An antique device that interfaces

a serial port to a phone line to carry date at abysmally low speeds. SDMC – A short lived console that tried (and failed) to replace the HMC VIOS – Virtual Input Output Server VPM – Virtual Partition Manager WEBSM – Web Systems Manager FUBAR – What you don’t want to do.

3Care and Feeding of your HMC CEC

2017

HMC Stands for Hardware Management Console◦ As the name implies it is used to manage POWER systems hardware

including: Which partitions get which resources Which partitions are up or down Updating code in the FSP◦ It can also be the console for ALL partitions (Sweet!)

The HMC together with the FSP replace the primary partition required on pre-POWER5 models


2017

On all (*) partitioned machines On all machines with CUOD capability On many ‘Large’ or Enterprise systems Required to change state of partitions Required to change resources on a partition Not required for ‘static’ operation (e.g. you can turn

it off and your Server will keep running)

(*) Up to 3 Partitions with 100% virtualized hardware can be configured with VPM on machines without an HMC

Also POWERKVM is supported on POWER8 hardware for virtualizing Linux machines.


2017

Note the three colored bars.

These dynamically update and are links to appropriate tools.


2017


2017

8

Introduction







Updating the HMC




Final Thoughts


Use https://your.hmc.name.here for GUI access.◦ Extremely important that the name matches the name used

when configuring the network on the HMC

◦ If it does not match, some pages cannot be displayed due to certificate conflicts

HMC Version 8 is required for POWER8 servers

HMC Version 8 offers new view option of Enhanced plus. 8.8.6 is last to offer the Classic view

With SP1 this is the new default and you must select ‘Classic’ each time you log in.


2017

IE and Firefox supported, Firefox seems generally better.◦ Chrome is unsupported. Getting more difficult for Chrome to accept the cert also.

**MUST** allow pop-ups before you can even log in.◦ This thing pops better than Orville Redenbacher!

V7.790 best (and LAST) for Power5 All other uses get to V8.840 or newer.◦ V8.860 required for latest POWER8 firmware

Firewall rules ◦ Open port 443, and 12443 for the management interface◦ Open port 2300 for 5250 consoles◦ Open port 8443 for the ASM proxy/redirector◦ Open port 22 for SSH access


2017

Allows selection of which view you want to work with.

Default is “What I did last time” ◦ ‘Default’ gone with 8.8.6 SP1

Classic is the same as Version 7

The first time you select “Enhanced+” you get a ‘Getting Started’ page.


2017

Enhanced + does NOT Pseudo-maximize instantly!

Note column layout vs. row layout in Classic◦ This is the default, row view is available (button upper right)


2017

Check the box for the system desired (top left)

The “Action” Button lights up◦ Click on it to get the menu below.


2017

Memory shown. Tabs for other resources.


2017

Right is Gallery View

Below is Table view◦ Allows sorting

by column.


2017


2017

It is noticeably slower with all the graphics it uses.◦ This may be mitigated by faster processors in your HMC and a local LAN

connection to it.

Much terminology has changed. e.g. Add Adapter vs Dynamic Partitioning.

Sorting in graphical views is alphabetical but all upper chars first then lower case later.◦ E.g. ABCDEF …. abcdef…

Many fewer popups. ◦ Personally I don’t like this change. ◦ Some remain as they use the classic pop up, you just navigate to them

differently. e.g. Network Settings, User Management, Reference Code History

Some items you have to search for because you know they are there!◦ e.g. Manage profiles is a couple levels deep beneath Partition Actions.

No more ‘disconnect’ only ‘Log Off’


2017

Because it’s Java the ‘links’ aren’t real so cannot be copied and opened in other windows or tabs. ◦ The Browser Back Button is used a lot!

I do not yet use it. (Yet?)

The next version (8.8.7? 8.9?) will no longer support the Classic view!!

Even with SP1 those using i hosting i cannot do everything with the enhanced+ view.

IBM has promised that before they removed ‘Classic’ they will add everything needed to support i hosting i.


2017

19

Introduction







Updating the HMC




Final Thoughts



2017

21

You will spend 95% of your time managing partitions and profiles.

Navigation Panel Components


22

Dynamicallyupdatedstatus!

Status Overview

Exceptions

Attention LED

Serviceable Events


23

Introduction







Updating the HMC




Final Thoughts


There are normally two Ethernet ports used on the HMC◦ Eth0 or the first port is connected to the first HMC port on the POWER

System’s FSP.

This port is labeled HMC 1

For single POWER Systems single HMC, shops a direct cable should be connected between the FSP and the HMC.

The ports on the FSP are auto-cross so a crossover cable is not required.

For multiple HMCs or Multiple Servers a switch is required.

For multiple HMCs AND Multiple Servers especially with Dual FSPs at least Two switches are required

The network connecting the HMCs and FSPs must be completely private! NOTHING else gets connected to that network.

◦ Eth1 or the second port is connected to your company network.


2017


2017


2017

To successfully install an HMC requires a Network Address range for the private HMC-FSP network.

Available ones are: a 192.168, two 172.16/17 and many 10. ranges.

You may only pick from the list, you may not create your own.◦ (*) You can manually assign all the IP addresses in the network.

Sadly the 192.168 address range is the entire upper ½ of the class B range! Avoiding this one is a good idea.

This is a CRITICAL network and it is best practice to completely isolate it from all other traffic.

Also use of a $5 switch from office max is not recommended!


2017

28

Introduction







Updating the HMC




Final Thoughts


Before the system can be used it’s network settings must be configured.


2017

30

Select LAN Adapters Tab

Remember eth0 is normally the private network HMC to FSP◦ This network gets a private range for HMC to FSP communications.

(Shown on next slide)

eth1 is the company network◦ This network gets an address in

your company network space.

Click ‘Details’ to set up the network. (Two slides down)


Shown is the Connection to the FSP

Note Partition Communication is checked◦ This interface communicates with

the FSP

You must select from one of the ranges provided

From the list selected an address will be chosen for the HMC.

IF this is the 2nd HMC you will not enable DHCP and the system will select DHCP for the HMC address

V7R3.5 added an IPv6 tab.


2017

This is the Open Interface to the company network.

Note Partition Communication is unchecked◦ This interface does not

communicate to the FSP

I recommend a Fixed IP address for this interface


2017

On the Firewall tab open the ports you need access to run the firewall.

Here we see the remote web access ports

Likely want 5250, and probably Secure Shell too.


2017

34

Introduction







Updating the HMC




Final Thoughts


35

•Nav menu: Service management then: Manage Customer Information

•If this isn’t completed then IBM has no idea who to call when the HMC calls home!

•REMEMBER to update this when Adminschange!

•Suggest a help desk email and phone number here as well.


36

•Nav menu: Service management then: Manage Outbound Connectivity•HMC Must have outbound access to UDP Port 500 to initiate this connection to the IBM VPN•Recommend Internet AND VPN connectivity are enabled.


•Do test this as mail servers can be finicky!

37

•Nav menu: Service management then: Manage Serviceable Event Notification

•Email server and port are required. Also be sure to select the ‘Enable’ button!

•Add users.


38

•Nav menu: HMC Management: Remote Command Execution

•Nav menu: HMC Management: Enable Remote Virtual Terminal

•Nav menu: HMC Management: Remote Operation


From the advanced menu select Import Server Certificate.

This will remove the ‘pinkeye’ from internet exploder.


2017

40

Introduction







Updating the HMC




Final Thoughts


41

Options are provided to work with users and to work with task and resource roles

Task and roles define what the user is allowed to do

V7 feature allows you to see who’s on-line and what they are doing!


42

Nav Menu: HMC Management -> Manage Users and tasks.

Here we see who’s doing what and how long they have been idle.

Users can be kicked off and tasks can be taken over or terminated.


Under User Profiles this GUI allows maintenance of users

43

Treat this like Service tools. Each user needs a profile. Don’t give too much

authority.


Back in V7.350 this new properties panel was been added.

Note “Allow Remote Access”

Set other values to your (or auditors) taste.

44

Don’t forget to select this (default is NOT!) or you can’t open the web interface.


The Resource roll defines which resources that can be managed.

These can be as granular as a single item These can be based on an existing role.


2017

Task Roles define the tasks which can be done.

Restrict a user to a small list of functions such as access to the console but not to memory and CPU.


2017

Now our new roles show up and we can select them

47

Resources are the test COMMON3 partition Roles are just the console. No Expire for pwd.


48

Introduction







Updating the HMC




Final Thoughts


As with IBM i the code on the HMC needs to be updated or at the very least verified.

Version 7 brought lots more information to this page◦ BIOS level and type/Model/Serial number◦ And the FSP version is now right up front!

49

HMC Service installed


50

•http://www-933.ibm.com/support/fixcentral/Care and Feeding of your HMC CEC 2017

51

The gray area below is requisite to the white area above.

If you do not havethis release start atthe red arrow.

Next get the servicepack (blue arrow)

Finally any fixes forthat service pack(green arrow.)

Note that there mayMany at the greenarrow.

Current view selecting what to get


52

My favorite option is FTP. You may change your selected option with the

“Change my Download options” link.

You get the information below to feed into an FTP script or client

Alternative at the bottom is to use your browser to do the download.

Download your fixes


53

•This is chopped as it is a very long page!

•You can see POWER 8, 7, 6, and 5 firmware shown here.

•Notice anything odd about the Power5 column?

•The link is to the right.http://bit.ly/1j3ZhIl


Each version seems to bring a new rule on which version can upgrade to another version.

Instructions can be found on Fix Central for each supported From/To release combination. ◦ In many cases a specific fix level of the From level is required.

Always assure HMC BIOS is current before starting.◦ In some cases upgrade will fail without current BIOS!

◦ Note that as of V7.731 shows BIOS level on the update screen as shown a few panels back.

ALWAYS Backup the HMC before starting! ALWAYS!

With any Recovery data is lost unless proper backups are performed!

READ the docs. (As an example after the MH01102 required fix for V7.733 you must reboot, TWICE.)


2017

55

HMC Data Backup can be a large backup!

In addition to when the system is being upgraded this should also done when any service is applied to the system.

Three location options◦ My favorite is Remote Site

with FTP

◦ Note Flash memory works just fine now and DVDs are no longer large enough.


This backup saves everything that has been applied since the system was last loaded from the recovery Disks.

Three backup locations available here: Local DVD, Remote file system (NFS) or Remote FTP site

My preference is the Remote System and I use IBM i.◦ Note that IBM i FTP server needs a few settings:

CHGFTPA NAMEFMT(*PATH) LISTFMT(*UNIX) INACTTIMO(1200) CURDIR(*HOMEDIR) Tells FTP Server to act like Unix (In other words like a normal FTP

server!) ENDTCPSVR *FTP STRTCPSVR *FTP

Restarts for the changes. CRTUSRPRF USRPRF(HMC) PASSWORD(password) INLPGM(*NONE)

INLMNU(*SIGNOFF) LMTCPB(*YES) TEXT('HMC Backup User') HOMEDIR(*USRPRF)

MKDIR DIR('/home/HMC') Creates a user and it’s home directory to save the backup images

in.


2017

57

Enter the IP address or name of your server, and the user id and password.

The description is for your reference later if you should need to restore!


Updates, Like PTFs, for the most part fix things.◦ They are applied from the GUI we’ve just seen.◦ Can by from DVD, USB Sticks, FTP sites.◦ Can use ZIP files, or .ISO files Can also burn them to media if you like that sort of thing.

Upgrades replace the O/S with a new version◦ Can be started by booting media or by copying media into

the server and restarting from that. (Network upgrade) Network upgrades can be done remotely!◦ Like with IBM i, updates are required after any Upgrade.

The following backup is required ONLY for Upgrades.


2017

59

Upgrade Data backs up to the hard drive to a special partition that doesn’t get smoked

DO NOT do this unless you are upgrading! At the next HMC IPL this data is restored!◦ if that happens to be months later you’ll get a surprise!

This one is quick.


60

Click the Update HMC Button.

Thissummons the wizard to the right.

Review and click “Next”


Choose the Remote Server for FTP (Shown) or media if you have a DVD.

61

Enter the

server IP

or name,

user ID

pwd, and

directory

if needed.

HMC

password


After a moment the list of what’s found on the server is provided.

Select the appropriate package and click “Next”

Much

improved

from

previous

versions as

typos are

eliminated!


2017

Confirmation above is last point to stop.

Click “Next” and progress below begins.

Success! This message and the “OK” button appears.

(Click “OK”)


2017

Once it’s done a Reboot is always required.

You can wait if “now” is a bad time.

Click Yes when you are ready to reboot.


2017

Confirm that the service pack is now installed.

Here we see Service Pack 1

Repeating the backup now is a good idea.


2017

66

Introduction







Updating the HMC




Final Thoughts


With 5733SC1 installed on IBM i you an SSH to the HMC and enter commands.

From a workstation you can use Putty to do the same.

The command line can be used to move resources without having to GUI to the HMC.


2017

lssyscfg -r sys◦ Shows all systems connected to this HMC.

lssyscfg -r lpar -m [sys & S/N from above cmd]◦ Shows all partitions on the selected system.

lssyscfg -m [sys & S/N] -r lpar -F name,lpar_id,state◦ Shows only the name, lpar ID, and state of partition

lsled -r sa -t virtuallpar -m [sys & S/N]◦ Shows status of status LEDs for the partitions.

lshwres -m [sys & S/N] -r io --rsubtype slot -F description,unit_phys_loc,bus_id,phys_loc,lpar_id◦ Shows each i/o card in the system, it’s bus, location and which lpar owns the card.

chsysstate -o on -k normal -m “Enterprise" -n Tomcat -f Tomcat -r lpar-i b◦ Starts lpar Tomcat using profile Tomcat on server Enterprise in normal mode from the

b side.

chsysstate -o on -k manual -m Kennedy -n Prowler -f “EA-6B SAN" -r lpar -i d --ip 172.29.3.16 --netmask 255.255.255.0 --gateway 172.29.3.2 --serverip 172.29.3.2 --serverdir /ibmi/v7r3/licpgm --duplex auto --mtu1500◦ Starts a partition in Manual mode from D via TFTP for install. Simple eh?


2017

lshwres -m [sys & S/N] -r io --rsubtype slot -F description,drc_index,lpar_id

◦ Shows each i/o card in the system, it’s ID and and which lpar owns the card. Such as:

Other Mass Storage Controller,21010003,none

chhwres -m [sys & S/N] -r io -o a --id 1 -l 21010003

◦ Moves card with id 21010003 to partition 1

◦ Repeating the first command after this one shows:

Other Mass Storage Controller,21010003,1 <- Partition 1


2017

As you can see from some of the samples on the previous pages the commands are capable of many things. ◦ (The truth is they are capable of EVERYTHING!)

Moving resources with the HMC command line may not handle the operating system side of movement.◦ For example moving memory from one IBM i partition to

another goes smoothly as the O/S handles everything.

◦ Moving a DVD drive requires that the device be varied off on the source partition and varied on on the target.


2017

71

Introduction







Updating the HMC




Final Thoughts


When at an HMC command line you can see disk status with the command ◦ monhmc –r disk◦ The output (below) refreshes each 4 seconds.◦ CTRL-C to exit.

Every 4.0s: MONHmc disk Mon Sep 3 20:31:19 2012

Fileystem 1K-blocks Used Available Use% Mounted/dev/sda2 16121184 7368528 7933744 49% /tmpfs 2047864 196 2047668 1% /devtmpfs 2047864 0 2047864 0% /dev/shm/dev/sda3 6040320 438300 5295180 8% /var/dev/sda7 8056524 150956 7496316 2% /dump/dev/sda8 442460668 203036 419781896 1% /extra


2017

We don’t have direct file system access.

IBM Provides a utility for cleaning up logs and such that works by cleaning up logs and temporary files.

chhmcfs –o f {–d x –h y –s z }◦ x= number of days of old files to keep.

◦ y= number of hours of old files to keep

◦ z= MB of space to free up in each file system.


2017

74

Introduction







Updating the HMC




Final Thoughts


75

Systems Configuration -> Edit -> Select the Console Tab.

Select the HMC Radio Button.

Enter the HMC Name or IP address

◦ Optionally click Advanced (below) which bypasses system and partitionselection when connecting.

Care and Feeding of your HMC CEC 2017Secure it!

76

2300

Frankenhmc


Access is to the HMC Public IP, NOT any i5 partition Personal Communications 5.7 or newer is required◦ iSeries Navigator V5R3 includes PC 5.7

Select ‘Default User ID Prompt as Needed’ You must enter the user profile Q#HMC◦ This tells the 5250 program that it is connecting to an HMC and not

to prompt for a password.

Select Unsecured Port number must be 2300 Once connected you will be prompted for your Language

and then the i5 you wish to connect to You must have an HMC user profile with the 5250 role

(As we created previously)


2017

You can also obtain consoles for other O/Ss from the HMC as well.

Either open a restricted shell or SSH to the HMC (with PUTTY or other SSH tool)

Sign on the the HMC

Enter “vtmenu” and select the partition you wish to access the console for. ◦ Note that you will see “i5/OS partitions omitted” on the

screen. They cannot be accessed this way.


2017

79

Introduction







Updating the HMC




Updating the FSP


This thing is the ‘Facilities Manager’ of your system

It controls who gets what resources◦ Buses, Cards, Processor, Memory etc.

It powers up and down all the bits.◦ Expansion Units, Card slots, etc.

It powers up when power is applied to the system unit. (That is, the power cords are plugged in.)

It owns the front panel and is partially controlled by it.

It provides a web based management interface

It is managed by an HMC


2017

FSP Code updates can be installed from the HMC or from a Service Partition

If you use a Service Partition:◦ The service partition is designated through the HMC◦ ASMI must be used to enable Firmware (FSP) updates from

the Operating System◦ All other partitions must be shut down and then the

‘Service Partition’ is powered off. On the way down it updates the FSP code. *LANDMINE

If this happens when you do not expect it, you risk losing your HMC. Firmware could be newer than the HMC can handle and communications would be lost.


2017

82

Unassigned is recommended

Only one partition may be a Service Partition

Must also enable software updates by O/S


83

Do you get the idea that Rochester thinksupdating the Firmware is best done from an HMC? If not, read this again!



2017

You may lose consoles for a time during the update. If the update is disruptive the hardware may power

down for up to 20 minutes on POWER5 systems.◦ Leave it alone and get coffee or MtDew!

Limit use of things that require the FSP during the updates.

POWER6 systems go much faster.◦ Approximately 25% of the time required for POWER5

systems.

POWER7 systems are a bit faster yet.


2017

86

Introduction







Updating the HMC




Final Thoughts


System plans are created with the System Planning Tool. Plans can be imported and exported◦ Imported plans can be deployed to the i5


2017


2017

CoD is Capacity on Demand◦ This is temporary activation of resource such as CPU

CUoD is Customer Upgrade on Demand◦ This is permanent activation of resource such as CPU and Memory◦ Codes are entered through the HMC◦ Once activated the new resources can be allocated to partitions

Codes are retrieved from IBM here:◦ http://www-912.ibm.com/pod/pod


2017

Newer HMC code requires more memory More systems managed requires more memory More partitions on the system require more memory More users on the HMC require more memory. Have you heard the clue-phone yet?

1GB was the absolute minimum and is no longer supported.

Get to 4 or 8 GB at a minimum. Also newer HMCs have much faster and mult-core

processors. This is GOOD for performance!! Virtual HMCs update MUCH more quickly as they reboot

in 5% of the time!


2017

Treat the HMC as another server in your datacenter that needs care and feeding.

With this information you should be able to successfully maintain and update an HMC

Understanding its capabilities can help you better utilize the HMC

Knowing security on the HMC will allow you to protect your system from accidental issues.

Recent browser changes accelerate the need to keep the HMC current!

As with IBM i **STAY CURRENT**


2017

IBM i Knowledge Center

http://www-01.ibm.com/support/knowledgecenter/ssw_ibm_i/welcomeFix Central

https://www14.software.ibm.com/webapp/set2/sas/f/hmc/home.html

System Planning Tool http://www-304.ibm.com/jct01004c/systems/support/tools/systemplanningtool/


2017

Thank You!

How to contact me:Larry Bolhuis

[email protected]

93


Don’t Forget to Fill Out Your Session Surveys!

1. Log on to Sched and go to your schedule

2. Click on the this session

3. Click on the feedback survey link above the session abstract

4. To fill out additional surveys go back to your schedule and click on the next session