Powershell on Neale's Corner

Setting vSphere Round Robin multipath policy with PowerCLI

Mon, 02 Aug 2021 00:00:00 +0000

Last week I was adding new datastores to a cluster for a provider whose best practices recommended a Round Robin multipath policy, changing paths with every iop. There is a VMware knowledge base article on how to do this - https://kb.vmware.com/s/article/2069356 - which details the CLI commands that need to be run on every host in the cluster for every datastore that needs to be configured. Attached to the KB article is a list of the PowerCLI commands that will also implement the same configuration.

When pressed for a choice, either - enabling SSH on each host, logging in, running the commands, logging out, disabling SSH - or - running PowerCLI commands remotely against the vCenter Server - the easiest option seems obvious.

So, I’ve written a script that will do this for multiple datastores against all hosts in a cluster. The latest version is available at https://github.com/nelons/psscripts/blob/master/vsphere/Set-ESXRoundRobinForDatastore.ps1, or the version at the time of writing this article is displayed below.

# Configuration variables.
# The FQDN (or IP) of your vCenter Server.
$vCenterServer = "vcenter.dnsname";
$ClusterName = "cluster";

# An array of datastore names that you want to convert.
$datastores = @("Datastore Name");

# When should the path be switched ?
$iops_switch = 1;

Connect-VIServer $vCenterServer | out-null;
$hosts = Get-VMHost -Location $ClusterName | Where-object {($_.ConnectionState -like "Connected")} | Sort-Object Name

# This will get the datastores from the array at the top of the file. 
$ds_id = $datastores | ForEach-Object { Get-Datastore -Name $_ } | ForEach-Object { return $_.ExtensionData.Info.Vmfs.Extent.DiskName; }

# Uncomment this line if you want to ignore the datastore name array
# and instead filter on the start of the datastore name.
# Remember to update the part of the line that starts with "start of datastore name" !
# Remember to comment out the datastore array line above !
#$ds_id = $datastores | ForEach-Object { Get-Datastore | { $_.Name.StartsWith("Start of datastore name"); } } | ForEach-Object { return $_.ExtensionData.Info.Vmfs.Extent.DiskName; }

$hosts | ForEach-Object { 
    $esx = $_;
    Write-Output "$($esx.Name): Checking LUNs.";

    $ds_id | ForEach-Object {
        $lun = $esx | Get-SCSILun -LunType Disk -CanonicalName $_;
        if ($null -ne $lun) {
            # Make sure it is RoundRobin
            if ($($lun.MultipathPolicy) -notlike â€œRoundRobinâ€) {
                Write-Output "$($esx.Name), $($_): Setting multipath policy to RoundRobin.";
                $lun | Set-ScsiLun -MultipathPolicy RoundRobin | out-null;
            }

            if ($($lun.CommandsToSwitchPath) -ne $iops_switch) {
                # Set the IOPS switch.
                Write-Output "$($esx.Name), $($_): Settings commands to switch path parameter to 1.";
                $lun | Set-ScsiLun -CommandsToSwitchPath $iops_switch | out-null;
            }
        }
    }
}

Disconnect-VIServer -Force -Confirm:$False;

Get VMHost Swap datastore using PowerCLI

Mon, 23 Mar 2020 00:00:00 +0000

This is a quick one-liner to get the configured swap datastore on a host/hosts:

`1`	`Get-VMHost \| Sort Name \| select Name, VMSwapfileDatastore`

If we want to make the name look a little nicer we could do:

`1`	`Get-VMHost \| Sort Name \| select Name, @{L='Swap Datastore';E={ ($_.VMSwapfileDatastore).Name } }`

This would get the results for all the esxi hosts for the target that you are connected to, however if you wanted to reduce the scope to a cluster or a datacenter you could change the start to:

`1`	`Get-VMHost -Location <Datacenter / Cluster Name> \| ...`

Or you could pipe in the location or array of hosts:

`1`	`Get-Cluster <cluster name> \| Get-VMHost \| ...`

or:

`1`	`$array_of_host_objects \| ...`

WSUS, Powershell and Computers

Mon, 16 Mar 2020 00:00:00 +0000

My role currently involves dealing with Windows in addition to the standard VMware/hardware infrastructure. If we ever thought that patching ESXi was fun, dealing with WSUS is whole other ball game. I will no doubt get around to writing a full post about it in the near future, as dealing with it has been quite time consuming and there are a few gotchas ;)

However the point of this post is looking at WSUS and automation, in this case using Powershell. There are two obvious approaches to using WSUS:

Approve everything to every computer group (depending on your patching schedule).
Approve only the required patches to each computer group.

The latter approach appeals to me, purely because we can ensure that a patch is approved/applied to a less important environment (think Dev -> UAT - > Production) and easily identify those patches that *haven’t* been required previously (Do you really want to apply a patch for the first time to Production ?)

So the crux of any script is going to be getting the computers in the WSUS Computer group so we can discover what patches need to be approved. There are two methods that I know of, though there could be more :)

Before I start, I’m using WSUS on Windows Server 2016/2019, and Powershell needs to be run as an Administrator in order to run the scripts (if your UAC is so inclined). I’m also being lazy and including screenshots from my workplace as opposed to sorting out a lab environment, so there won’t be any proper screenshots and all computer information will be omitted.

Get-WSUSComputer

This command is included in the UpdateServices module, and is straight forward to use:

Get-WSUSComputer
-All
-NameIncludes
-ComputerTargetGroups <name>,<name>,<name>
-IncludeSubgroups
-IncludeDownstreamComputerTargets

The full documentation for this command is at https://docs.microsoft.com/en-gb/powershell/module/updateservices/Get-WsusComputer?view=win10-ps.

The last switch is important if you have a downstream WSUS server, as by default WSUS will only return computer information that it is responsible for. Using the switch will include all downstream computers in this group.

The data returned is also quite strange - this is the header for the table displayed by the command:

However, these are display names, there is no field called “Computer” or “Name”, so if you wanted to sort it by this you’d get nothing back !. Running the command below will show us what we need:

`1`	`Get-WSUSComputer -All \| Select -First 1 \| Get-Member`

So we can now discover the mapping is:

Computer is FullDomainName
IP Address is IPAddress
Operating System is OSDescription
Last Status Report is LastReportedStatusTime

Object Methods

Instead of using a provided command, which no doubt wraps the method calls, we can call the methods directly. The code below will do the same as a one-liner above !

$wsus = get-wsusserver
$wg = $wsus.GetComputerTargetGroups() | ? { $_.Name -eq "Infrastructure" }
$cscope = New-Object Microsoft.UpdateServices.Administration.ComputerTargetScope
$cscope.IncludeDownstreamComputerTargets = $true;
$cscope.ComputerTargetGroups.Add($wg);
$wsus.GetComputerTargets($cscope);

Which is better ? That’s up to you and your style/comfort.

Which should you use ? That’s up to you too :)

The first scripts using WSUS that I found used methods to get the information, so this is how I’ve written most of my scripts. I have not found any advantage using one way instead of the other, but that doesn’t mean there isn’t. I hate to be non-committal, but like most tech, choose the one that works for you :)

Cisco UCS Central - getting free slots from connected domains

Mon, 22 Apr 2019 00:00:00 +0000

Quick powershell snippet time ! When you have a UCS Central instance with a number of domains, knowing what free slots you have available is quite useful - especially when you’ve got a smart hands service and won’t be racking new servers but instead having to communicate instructions.

In my time I’ve seen UCS Central used to manage geographically separate domains and a large number of domains across a small number of sites. When you get a new blade it needs to be put into a free slot, the question is where ?

The script below uses domain groups to separate out domains, but the code is formatted so it can be removed if they aren’t used.

Get-UCSCentralOrgDomainGroup -Filter { Level -ceq 1 } | % {
	$group = $_;
	Get-UCSCentralComputeSystem | ? { $_.OperGroupDn.StartsWith($group.Dn); } | % {
		$compute = $_;
		Get-UCSCentralChassis -ComputeSystem $_ | sort Id | select @{L='Group';E={$group.name}}, @{L='Domain';E={$compute.Name}}, @{L='Chassis';E={ $_.Id}}, @{L='Blade Count';E={(Get-UCSCentralBlade -Chassis $_).Count}}
	}
}

Apologies I don’t currently have any domains available to run this against to show you some sample output so I appreciate you’ll be trying this out blind. I hope that it meets your expectations !

I’ve uploaded this to my github in a script file so it can be run as you need it :)

Reporting on vSphere Replication transfer sizes

Mon, 15 Apr 2019 00:00:00 +0000

vSphere Replication is really a wonderful product - I’ve been using it for a few years now across a few employers and I’ve never had a really serious problem with it - it just seems to work.

Sure, there are a few feature requests we could make of it, for example setting a schedule of when to replicate and ignoring RPO violations outside of that, and bandwidth limiting on the traffic coming out of the appliance, but they really aren’t necessary for what it is designed for.

Something I like exists in the Flash/Flex UI, where we can find out the size of the last data replication was (“Last sync size” in the image below). However this only exists in this one place and I haven’t found that this can be reported on anywhere else. It’s good to know the rate of change for your servers for judging bandwidth (yes we should have monitoring on the lines, but this won’t break transfers down into individual servers)

Finding what to report upon

As I was asked to provide change rates for some servers I started in the usual place (your search engine of choice) but couldn’t find a way of extracting this information. I then looked in the Events section of a VM being replicated and found that something was being logged - hurrah !

Yes I’m still using the Flash GUI. Come at me :p

Looking at a completed event I found:

We have a number of bytes transferred - we might be able to work with this. Time to switch to PowerCLI And these are the last two events to be logged with the VM:

If we have a look at the Arguments field we find (I’ve assigned $e to the first event in the above image because laziness !):

This information should give us enough to generate a report:

Filter on “EventTypeId” and matching to “hbr.primary.DeltaCompletedEvent”.
Using the Arguments.Value field to report on the size of the transfer.

Let’s give this a try:

Get-VM $name | get-vievent -MaxSamples ([int]::MaxValue) | ? { $_.EventTypeId -eq "hbr.primary.DeltaCompletedEvent" } | Select CreatedTime, @{L="MB Transferred";E={  [math]::Round($_.Arguments.Value/1MB, 2)}}

This will display the following - perfect !

Determining accurate numbers

Let’s remind ourselves of the UI report for the last transfer size - 40.64 MB:

So we can see that the numbers don’t quite add up - the GUI reports 40.64 MB and the event reports 40.78 MB.

Time to venture onto the Internet and see if we can find out how to get from 42761392 bytes to 40.64 MB (as I’m going to assume that the VMware engineers are clever than I and I’ve made a mistake somewhere). Using Google’s inbuilt calculator we find that 42761392 bytes are 42.76 MB.

If we use gbmb.org we get a bit more distinction - it is 42.76 MB if we take 1 MB to mean 1000000 (decimal, megabytes), and it is 40.78 MB if 1 MB is equal to 1048576 bytes (binary, mebibytes):

So I honestly have no idea how or why the UI reports the size as being 40.64 - from the above it should be either 40.78 or 42.76 depending on the value of 1 MB in bytes. So this leaves us with the following options:

The Arguments.Value is incorrect.
We are using Arguments.Value incorrectly.
The UI is incorrect.

For this report, we are going to accept the inaccuracy and use 1048576 as the value of 1 MB, as this will get us closer to the UI number.

Bringing it all together

Our script to generate the report is now:

Param([Parameter(Mandatory=$true)] $VMName,
      [DateTime] $Start,
      [DateTime] $Finish,
      [string] $OutputFile);

$vm = Get-VM $VMName;
if ($null -ne $vm) {
    $EventStart = $null;
    if ($null -eq $Start) {
        $EventStart = $(Get-Date).AddDays(-7);
    } else {
        Write-Host $Start.ToString();
        $EventStart = $Start;
    }

    $EventEnd = $null;
    if ($null -eq $Finish) {
        $EventEnd = Get-Date;
    } else {
        Write-Host $Finish.ToString();
        $EventEnd = $EventEnd;
    }

    $events = get-vievent -MaxSamples ([int]::MaxValue) -Start $EventStart -Finish $EventEnd | ? { $_.EventTypeId -eq "hbr.primary.DeltaCompletedEvent" } | Select CreatedTime, @{L="MB Transferred";E={ [math]::Round($_.Arguments.Value/1MB, 2)}}
    if ($null -ne $events) {
        if ($null -ne $OutputFile -And $OutputFile.Length -gt 0) {
            $events | Export-Csv -NoTypeInformation -Path $OutputFile;
        } else {
            $events;
        }
    } else {
        Write-Host "Could not find any replication events for the vm $VMName" -Foreground Red;
    }

} else {
    Write-Host "Could not find a VM with the name $VMName" -Foreground Red;
}

From here, we can output a CSV file, import that into Excel and make some fun graphs !

As far as my limited search engine searches have returned, there is no way to find out which VMs are protected by vSphere Replication with PowerCLI. Given that there is a vRO plugin, I think that if this needs to be used if you need further information.

I’ve uploaded the script to github :)

As usual, please let me know if I’ve got something wrong or you found it useful !

Modifying cross forest members of Active Directory groups

Mon, 11 Mar 2019 00:00:00 +0000

Adding users to groups within the same domain using Powershell is quite simple - there is a cmdlet Add-ADGroupMember (and removing them is just as easy !), but how we accomplish when one domain contains groups and has a one way trust with a domain in another forest that contains the users ?

This is a rhetorical question ;) Assuming we are running from the domain containing the groups, the other domain needs to be mapped to a PSDrive. Once done we can search for the user and use the Add-ADGroupMember cmdlet to add them.

Removing users is nearly as straight forward, though I only had success using Remove-ADPrincipalGroupMembership to remove the remote user.

We will need to know:

The name of the remote domain.
A credential for the remote domain.
The name of the group.
The samaccountname of the users to add or remove.

I’ve written a script below, which is able to add and remove users to a group in single call. There is no need to specify the domain controller for the remote user domain as this can be discovered (I’m assuming your DNS is configured correctly and healthy !). However this has not been tested:

In a two-way trust.
Running in the user domain/forest.

param([Parameter(Mandatory=$true)][string] $GroupName = $(Read-Host -Prompt "Please enter a group name"),
      [string[]] $Add = $(Read-Host -Prompt "(optional) Please enter the names of any users to add to the group"),
      [string[]] $Remove = $(Read-Host -Prompt "(optional) Please enter the names of any users to remove from the group"),
      [Parameter(Mandatory=$true)][string] $RemoteDomainName = $(Read-Host -Prompt "Please enter the remote domain name"),
      [Parameter(Mandatory=$true)][PSCredential] $RemoteCredential = $(Get-Credential),
      [string] $RemoteDC,
      [switch] $Confirm)

# Ensure that this is loaded. Fail if not.
if ($null -eq $(Get-Module ActiveDirectory)) {
	Write-Host "Attempting to load ActiveDirectory module.";
	try {
		Import-Module ActiveDirectory;
		Write-Host "Loaded ActiveDirectory module." -ForegroundColor Green;
	} catch {
		Write-Host "Could not load ActiveDirectory module" -Foreground Red;
		exit;
	}
}

# Try and connect to the remote domain.
$domain = Get-ADDomain $RemoteDomainName -Credential $RemoteCredential -ErrorAction SilentlyContinue;
if ($null -eq $domain) {
    Write-Host "There was an error retrieving domain information for $RemoteDomainName" -ForegroundColor Red;
    exit;
}

# Get the group in the local domain.
$group = Get-ADGroup $GroupName -ErrorAction SilentlyContinue -Properties *
if ($null -eq $group) {
    exit;
}

if ($group.GroupScope -ne "DomainLocal") {
    Write-Host "The group $($group.Name) has scope $($group.GroupScope)";
    Write-Host "The group is not configured to contain remote users." -ForegroundColor Red;
    exit;
}

# Get the remote domain details.
$RemoteNetBIOS = $domain.NetBIOSName;
$RemoteDN = "//RootDSE/$($domain.DistinguishedName)";

if ($null -eq $RemoteDC -Or $RemoteDC.Length -eq 0) {
    $dc = Get-ADDomainController -Discover -DomainName $RemoteNetBIOS
    $RemoteDC = $dc.HostName;
}

# Try and map the remote domain to a PS drive.
try {
    New-PSDrive -Name $RemoteNetBIOS -Credential $RemoteCredential -Root $RemoteDN -PSProvider ActiveDirectory -Server $RemoteDC | out-null

} catch {
    Write-Host "There was an error connecting to the $RemoteDomainName domain." -ForegroundColor Red;
    exit;
}

foreach ($username in $Add) {
    if ($null -eq $username -Or $username.Length -eq 0) {
        continue;
    }

    # Get the user and add to the group.
    $user = Get-ADUser -Filter {SamAccountName -eq $username} -Server $RemoteNetBIOS -Credential $RemoteCredential;
    if ($null -ne $user) {           
        $group | Add-ADGroupMember -Members $user;
        Write-Host "$username was added to the group '$GroupName' successfully." -ForegroundColor Green;

    } else {
        Write-Host "Could not find a user with the username '$username'" -ForegroundColor Red;

    }
}

foreach ($username in $Remove) {
    if ($null -eq $username -Or $username.Length -eq 0) {
        continue;
    }

    $user = Get-ADUser -Filter {SamAccountName -eq $username} -Server $RemoteNetBIOS -Credential $RemoteCredential;
    if ($null -ne $user) {
        Remove-ADPrincipalGroupMembership -Server $RemoteNetBIOS -Credential $RemoteCredential $user -MemberOf $group -Confirm:$Confirm;
        Write-Host "$username was successfully removed from the group '$GroupName'" -ForegroundColor Green;

    } else {
        Write-Host "Could not find a user with the username '$username'" -ForegroundColor Red;

    }
}

# Unmap the remote domain
if ($null -ne $(Get-PSDrive -Name $RemoteNetBIOS -ErrorAction SilentlyContinue)) {
    Remove-PSDrive $RemoteNetBIOS;
}

The script doesn’t take into account if the user is already a member of the group - the way to do this is to retrieve the groups “member” property and use the SID to check against the user.

As usual, let me know if this is useful or you have any other corrections/comments. I’ve put this into a simple script located here as the script “Set-ADGroupTrustedForestMembership.ps1”.

Detaching Devices from a Cluster

Mon, 14 Aug 2017 00:00:00 +0000

When working with block storage we occasionally need to remove a storage device from the hosts it is connected to. When using the Web Client we can detach devices on a per-host basis, but there is nothing to detach from all its attached hosts.

What we do have is a helpful KB article on how to remove/detach a datastore -Â https://kb.vmware.com/kb/2004605Â and a PowerCLI file that contains some functions. However the functions revolve around managing actions on datastores as opposed to devices that are connected and could be used for RDMs.

Most LUNs are masked to all the hosts in a cluster so that, whether the device is an RDM or has a VMFS datastore on it, VMs can run on any host in the cluster. To deal with this use case, I use a script that will detach a device from every host in a cluster. If the device does not exist on Â a host then an error is displayed and the script moves on to the next device/host.

Before we can detach a device we need to ensure the following:

It is not used for a datastore.
It is not in use as a RDM.
The perennially reserved flag is not set for the device on the host.

The last point comes from the KB article above - if the flag is set (and it should be for any RDMs) then it could prevent the device from being unmounted successfully. So although clearing the flag is not required, clearing it ensures the best chance of success.

So, our script will start off with the following - we will accept a cluster to unmount/detach the device(s) from, an array of device identifiers, and a switch that will allow us to do checks without actually detaching anything.

param(
	[Parameter(Mandatory=$true,ValueFromPipeline)][VMware.VimAutomation.ViCore.Impl.V1.Inventory.ClusterImpl] $Cluster,
	[Parameter(Mandatory=$true)][String[]] $LUNIdentifiers,
	[switch]$CheckUsage = $false
)

For the sake of time, we will make the assumption that all devices are masked to all hosts in the cluster - so when checking what the device is used for we will only check on the first host in the cluster. The following code will get the VMs in the cluster (for checking RDM usage in the next step) and the host that we will use for checking.

$vms = $Cluster | Get-VM;
$cluster_host = $Cluster | Get-VMHost | sort Name | select -First 1

$LUNs_To_Detach = @();
$LUNIdentifiers | % {
	$lunid = $_;
$lun = get-scsilun -VMHost $cluster_host | ? { $_.CanonicalName -eq $lunid }

Finally we will use the Get-ESXCLI cmdlet to check if the perennially reserved flag is set.

`1`	`$myesxcli = get-esxcli -VMHost ESXhost`

When all our checks are complete, we can loop through the hosts in the cluster and attempt to detach the LUN.

	$Cluster | get-vmhost | sort Name | % {
		write-host "Detaching LUNs from $($_.Name)" -Foreground Yellow
		$esx = $_;
		
		$storSys = Get-View $_.Extensiondata.ConfigManager.StorageSystem
		
		foreach ($lunid in $LUNs_To_Detach){				
			$lun = Get-ScsiLun -VmHost $esx | ? { $_.CanonicalName -eq $lunid }
			if ($lun -ne $null) {
				# Ensure the LUN is attached 
				if ($lun.ExtensionData.OperationalState -eq "ok") {
					write-host "Detaching LUN $lun" # from $($esx.Name)"
					$storSys.DetachScsiLun($lun.ExtensionData.Uuid)
					write-host "Detach Complete" -Foreground Green
					
				} elseif ($lun.ExtensionData.OperationalState -eq "off") {
					Write-Host "LUN is already unmounted on this host." -Foreground Green;
					
				} else {
					Write-Host "OperationalState is $($lun.ExtensionData.OperationalState)";
					
				}
				
			} else {
				Write-Host "Could not find LUN $lun on host $esx.Name";
			}
		}
}

The entire script is available from my github here. As always, feel free to fork and make pull requests if you find a mistake.

Finding a UCS Service Profile from the MAC Address

Tue, 08 Aug 2017 00:00:00 +0000

Quick snippet on how to find the name of a service profile given the MAC address.

I found this useful as when troubleshooting ESXi locks, the MAC address of the locking host is shown and sadly not the name. Once I had the name I was able to continue debugging my problem :)

`1`	`Get-UCSCentralServiceProfile \| % { $h = $_.Name; $res = $_ \| Get-UcsCentralVnic \| ? { $_.Addr -eq "<MAC address here>" }; if ($res -ne $null) { Write-Host $h; } }`

This will work with UCS domains not joined to Central (and having global service profiles) - change the code by removing the word “Central” from the cmdlets.

Automating Brocade FC Configuration (Part 2)

Fri, 20 Jan 2017 00:00:00 +0000

From the first article we looked at how to use the SSH Sessions Powershell module to log into a Linux server that will, via a script, log into a Brocade FC switch and get the zoning configuration.

As per the disclaimer in the first part, these articles have been assembled from my notes and memory and may not be 100% correct. I worked with FOS 6.x and so 7.x/later releases might not need this approach - I no longer have access to any Brocade FC switches to test :)

Getting the switch config via a function

As we’re going to need to get the config from two switches, we’ll write a powershell function that will get the config from one switch, so we have one call for each. The function is as follows:

Function Get-BrocadeSwitchZoneConfig {
	[CmdletBinding()]
	Param (
		[Parameter(Mandatory=$true)][string] $Target,
		[Parameter(Mandatory=$true)][string] $Username,
		[Parameter(Mandatory=$true)][string] $Password,
		[switch] $VersionSix
	)
	Process {
		# Import the SSH-Sessions Module.
		Import-Module $PSScriptRoot\..\modules\SSH-Sessions\SSH-Sessions.psd1
		
		# Connect to the target.
		New-SshSession -ComputerName $Target -Username $Username -Password $Password | out-null
		
		# Invoke the command to get the config.
		$config = "";

		if ($VersionSix -eq $False) {
			$config = Invoke-SshCommand -ComputerName $Target -Command "zoneshow" -Quiet
			
		} else {
			$config = Invoke-SshCommand -ComputerName $Target -Command "bash --login -c 'zoneshow'" -Quiet;
		
		}
	
		# Disconnect from the target.
		Remove-SShSession -ComputerName $Target | out-null;
		
		# return the config.
		return $config;
	}
}

So, let’s get the config:

1
2

$config1 = Get-BrocadeSwitchZoneConfig -Target "switch1.fqdn" -Username "automation" -Password "password";
$config2 = Get-BrocadeSwitchZoneConfig -Target "switch2.fqdn" -Username "automation" -Password "password"

Sanity Checking the Zone Configuration

Before changing the configuration we need to make sure anything we create does not already exist. Namely, we’ll be checking:

WWPNs of the server HBAs.
The name of the server zone.

Function Check-FCConfig {
	[CmdletBinding()]
	Param (
        Parameter(Mandatory=$true)][string] $Config,
		[Parameter(Mandatory=$true)][string] $Hostname,
		[Parameter(Mandatory=$true)][string] $HBA
	)
	Process {
		# need to trim the "-" from the hostname as it is an illegal char on the brocades.
		$brocade_hostname = $Hostname.Replace("-", "");
		
		if ($HBA -ne $Null) {			
			# Check to see if the hostname is present
			if ($Config.ToLower().Contains($brocade_hostname.ToLower())) {
				Write-Host "Hostname exists in the current config.";
				return $False;
			}
			
			# Check to see if HBA address is present.
			if ($Config.ToLower().Contains($HBA.ToLower())) {
				Write-Host "HBA exists in the current config.";
				return $False;
			}

                        return $True;
		}

                return $False;
        }
}

So, we’ll then need to call this for each of the switch configs we got earlier. Our new script looks as follows:

$config1_ok = $false;
$config2_ok = $false;

$config1 = Get-BrocadeSwitchZoneConfig -Target "switch1.fqdn" -Username "automation" -Password "password";
if ($config1.Length -gt 0) {
  $config1_ok = Check-FCConfig -Config $config1 -Hostname "server01" -HBA "20:00:00:25:B5:40:02:0F";
}

$config2 = Get-BrocadeSwitchZoneConfig -Target "switch2.fqdn" -Username "automation" -Password "password"
if ($config2.Length -gt 0) {
  $config2_ok = Check-FCConfig -Config $config2 -Hostname "server01" -HBA "20:00:00:25:B5:40:02:1F";
}

if ($config1_ok -eq $true -And $config2_ok -eq $true) {
 // Here is where we create the config.

}

Hopefully the above is quite straight forward - we get the config for the both switches and check that it is ok for the servername and for the HBA address. We store the result in a local variable, and when both checks are complete we will only be making changes to the FC switches if both configs reported good.

The final proxy script

Our final Linux proxy script will change the configuration on a singleÂ switches, and we will call it twice, once for each server. This would allow us to provide different variables for each switch, in case they have not been configured identically. The variables that we will pass, and their position for the script are below:

Hostname of the filer.
Username for the filer.
Password for the filer.
Server hostname
WWPN for the HBA
Name of the active configuration

Our full script will be:

cat « _END_ | sshpass -p ${1} ssh ${3} -tt -o StrictHostKeyChecking=no -l ${2} alicreate ${4}_hba0, ${5} zonecreate ${4}, “${4}_hba0;san_hba0;san_hba1” cfgadd ${6}, ${4} echo y|cfgenable ${6} exit _END_

This is how we would call it:

$brocade_hostname = $Hostname.Replace("-", "");
$brocade_config_name = "config";
$fc_switch1 = "switch1.fqdn";
$fc_switch2 = "switch2.fqdn";
		
# Connect to the brocade scripting host.
New-SshSession -ComputerName $brocade_script_host -Username $brocade_script_host_username -Password $brocade_script_host_password | out-null;
		
# Run the Script.
$results = Invoke-SshCommand -ComputerName $brocade_script_host -Command "./create-fc-zone $fc_switch1 $brocade_username $brocade_password $brocade_hostname $HBA0 $brocade_config_name" -Quiet;

# Run the Script.
$results = Invoke-SshCommand -ComputerName $brocade_script_host -Command "./create-fc-zone $fc_switch2 $brocade_username $brocade_password $brocade_hostname $HBA1 $brocade_config_name" -Quiet;
		
# Disconnect from the host
Remove-SshSession -ComputerName $brocade_script_host | out-null;

Powershell Configuration Script

When we put the above together we will aim to have some powershell that will:

Get the config of each FC switch
Check the config to ensure there will be no clashes or problems.
Call the proxy script to update the config.

This would look like:

Function Create-FC-Zone {
	[CmdletBinding()]
	Param (
		[Parameter(Mandatory=$true)][string] $Hostname,
		[Parameter(Mandatory=$true)][string] $HBA0,
		[Parameter(Mandatory=$true)][string] $HBA1
	)
	Process {
		$brocade_hostname = $Hostname.Replace("-", "");
		$brocade_config_name1 = "config";
		$brocade_config_name2 = "config";
		
		# FC Switch Details.
		$fc_switch1 = "switch1.fqdn";
		$fc_switch2 = "switch2.fqdn";
		$fc_username = "automation";
		$fc_password = "password";
		
		# Proxy Details
		$proxy_host = "proxy.fqdn";
		$proxy_username = "automation";
		$proxy_password = "password";
		
		$config1_ok = $false;
		$config2_ok = $false;

		$config1 = Get-BrocadeSwitchZoneConfig -Target $fc_switch1 -Username $fc_username -Password $fc_password;
		if ($config1.Length -gt 0) {
			$config1_ok = Check-FCConfig -Config $brocade_config_name1 -Hostname $brocade_hostname -HBA $HBA0;
		}

		$config2 = Get-BrocadeSwitchZoneConfig -Target $fc_switch2 -Username $fc_username -Password $fc_password;
		if ($config2.Length -gt 0) {
			$config2_ok = Check-FCConfig -Config $brocade_config_name2 -Hostname $brocade_hostname -HBA $HBA1;
		}

		if ($config1_ok -eq $true -And $config2_ok -eq $true) {			
			# Connect to the brocade scripting host.
			New-SshSession -ComputerName $proxy_host -Username $proxy_username -Password $proxy_password | out-null;
					
			# Run the Script.
			$results = Invoke-SshCommand -ComputerName $proxy_host -Command "./create-fc-zone $fc_switch1 $fc_username $fc_password $brocade_hostname $HBA0 $brocade_config_name" -Quiet;

			# Run the Script.
			$results = Invoke-SshCommand -ComputerName $proxy_host -Command "./create-fc-zone $fc_switch2 $fc_username $fc_password $brocade_hostname $HBA1 $brocade_config_name" -Quiet;
					
			# Disconnect from the host
			Remove-SshSession -ComputerName $proxy_host | out-null;
		}	
    }
}

This uses the function “Get-BrocadeSwitchZoneConfig” at the beginning of this article, and most of the variables are configured in the script. For the sake of security you’ll want to remove these from being hardcoded and pass them in as parameters. I’ve left them as hardcoded to show what is required and where it is used.

This is available in a single file on my psscripts github repo.

Please let me know if anything is wrong or if this helped you !

Automating Brocade FC Configuration with Powershell (Part 1)

Wed, 04 Jan 2017 00:00:00 +0000

I’ve been looking at automating physical server creation, and there are tools from Cisco and NetApp that allow Powershell to do the heavy lifting for UCS and Storage. The missing part of theÂ process is the FC switches (Brocade in this case, though when I researched this I could not find a toolkit for Cisco MDS) - so we will cheat and use powershell to issue SSH commands to the switches. This post will look at automating Brocade FC Configuration on v6.00 and later switches.

There are two disclaimersÂ - this is what has worked for me, it may not work for you. I also don’t have access to the script files any more, so this has been assembled from notes and memory - I last looked at this about a year ago. If there is anything wrong you’ll need to troubleshoot.

My Linux skills are not so advanced that I think this is the best way of doing things. If you know of something better please leave a reply in the comments !

Throughout researching this I usedÂ The SAN Guy’s list of useful Brocade CLI commands as a crib sheet for using the CLI.

The diagram below shows a very basic overview of the infrastructure, with devices from top to bottom being the SAN, FC switches and the server - though if using Cisco UCS the server will be encapsulated within the appropriate domain.

Configuration used in this article

WeÂ will have a single physical server with 2 HBAs:

HBA0 WWPN: 20:00:00:25:B5:40:02:0F HBA1 WWPN: 20:00:00:25:B5:40:02:1F

The SAN has four WWPN’s (two for each FC switchÂ in the overview diagram above) and they are identified on the FC switches as “san_hba0” and “san_hba1” (connected to one switch) and “san_hba2” and “san_hba3” (connected to the other switch). These aliases have already been created on the FC switches.

The FC switch configuration is called “active_config”.

Creating the Script

We will need to create a zone for the server on each FC switch and include the appropriate server HBA initiator WWPN and the storage WWPN’s in each. I have seen some configs where a server zone will contain all WWPN’s - even for initiators that will never connect to the switch - but in this case the zone will only contain the minimum number of addresses.

We are going to have these steps:

Create an alias. alicreate
Create a zone. zonecreate
Add the zone to the current configuration. cfgadd
Save/Enable the current configuration. cfgenable

Using an SSH client we can run through the steps to do this. This would translate to the following for the first switch:

alicreate server01_hba0,Â 20:00:00:25:B5:40:02:0F
zonecreate server01, “server01_hba0, san_hba0, san_hba1”
cfgadd server01
cfgenable active_config

This for the second FC switch:

alicreate server01_hb1,Â 20:00:00:25:B5:40:02:1F
zonecreate server01, “server01_hba1, san_hba2, san_hba3”
cfgadd server01
cfgenable active_config

If you are doing this on your infrastructure please make sure that you run through your commands manually - automation should only be used for proven processes.

Getting it to work (or not)

The module “SSH-Sessions” allows us to run remote commands from Powershell and can be found atÂ http://www.powershelladmin.comÂ - install this.

Sadly, things are not always meant to be simple and if we run our SSH commands directly from powershell it will not work. You might already know this (which is why you’re here) but there is no way we can save the zoning configuration from Powershell because the “cfgenable” command presents an interactive prompt to confirm that the changes should be saved.

Thanks to this forum threadÂ we have a way to run these commands from a linux OS SSH session. So we’re going to use Powershell to SSH to a Linux OS and then run a script that will SSH to a FC switch and create and save the zone.

Using SSH-Session

If you don’t want to put the module into one of the modules paths in order to test it, you don’t have to. From the directory the files are stored in, run:

`1`	`Import-Module "\SSH-Sessions.psd1"`

You may receive the error message:

Could not load file or assembly “Renci.SshNet.dll” or one of its dependencies. Operation is not supported. (Exception from HRESULT: 0x80131515)

This postÂ solves this issue - we need to right-click the .dll file and open Properties and then click the “Unblock” button - though it is a good idea to do this for all the files. Once done,Â open a new powershell window and start again.

Once the module has been imported, it’s time to test it out. Let’s try a “zoneshow” command. We’ll do:

1
2

New-SshSession -ComputerName  -Username user -Password pass
Invoke-SshCommand -ComputerName  -Command "zoneshow"

If you’re running FOS 6.x you’ll probably run intoÂ the problem below,Â but happily there is a simple solution.

FOS 6.xx Command Problems

This only applies if the target FC switch is running FOS 6.xx. When attempting to run these commands from FOS 6.xx we get this error:

had an error: sh:
\[command\]
: command not found

The answer is available on this page, and the command needs to be phrased as:

`1`	`Invoke-SshCommand -ComputerName -Command "bash --login -c 'zoneshow'"`

Dealing with the cfgsave problem

To show what happens when we try and save the config when running the SSH command directly from Powershell (amend for FOS 6 with “-c” as necessary), run the command:

`1`	`Invoke-SshCommand -ComputerName -Command "cfgsave"`

This will hang the powershell window and you’ll have to force close the window.

To solve this problem we need a Linux proxy which we can connect via SSH to run scripts. Whether you’ll need to spin up a new VM or whether there is a current system you can use depends on your environment, but it is important that networking wise, our powershell host can connect to the proxy and the proxy can connect to both FC switches.

Setting up the Proxy

I used CentOS, installed SSHPass and configured a separate user for automation. Make sure that the SSH service is running, and enabled to start with the OS.

To install sshpass (the reference for epel-release is here):

1
2

yum install epel-release
yum install sshpass

As an FYI, to create a user that we will use to ssh:

1
2

useradd automation
passwd automation

We won’t need any special permissions for this user account, as we will create and run scripts as this user.

Scripting

Now we need to open up a SSH session to our Linux OS and log in as the automation user we just created.

We’re going to pass information to the script, and these are represented as ${x} in the script file, where x is the numerical position of the information. Our first simple script is going to log on to the filer and do a ‘zoneshow’.

Our parameters will be:

Hostname / Address of Filer
Username
Password

I’ve called the script “first-script” and the contents are below:

1
2
3

sshpass -p ${3} ssh ${1} -tt -o StrictHostKeyChecking=no -l ${2}
zoneshow
exit

Mark the script that it is executable:

`1`	`chmod 750 first-script`

Now let’s run it.

`1`	`./first-script username password`

You will see that we can log into the filer, but then nothing else happens. We need to change the script so we execute the commands properly, and the post by alknet on the Brocade Community forumsÂ explains how we should do it. Change to your script to match below:

cat << _END_ | sshpass -p ${1} ssh ${3} -tt -o StrictHostKeyChecking=no -l ${2}
zoneshow
exit
_END_

That’s it for this article, in part two we’ll do a basic sanity check that the WWPN’s and zones don’t already exist before changing the configuration.

PowerTool - Getting UCS Blades with SD Cards

Sun, 23 Oct 2016 00:00:00 +0000

This is a quick snippet that allows you to retrieve UCS Blades that have SD cards - this might be useful in determining if your blades are ready to have an OS installed on them. These scripts assume you’ve already connected to your UCS Central or UCS Domain.

This will get the blades if you’re using UCS Central:

Get-UCSCentralBlade | ? { $blade = $_; $cards = Get-UcsCentralStorageFlexFlashCard | ? { $_.Dn.StartsWith($blade.Dn); }; return ($cards.Count -gt 0); } | select @{L='Domain';E={ (Get-UcsCentralComputeSystem -Dn $_.Dn.Substring(0, 16)).Name }}, ServerId, ChassisId, SlotId, Name, @{l="Cards";e={$cards.Count}}, OperState, Association,Discovery, Model, TotalMemory, LsDn | Sort Domain, ServerId

If you’re not using UCS Central, we modify the commandlets by removing the “Central” from them, and remove resolving the domain (because you’ll know what domain you’re running it against). The following (currently untested) should work:

Get-UCSBlade | ? { $blade = $_; $cards = Get-UcsStorageFlexFlashCard | ? { $_.Dn.StartsWith($blade.Dn); }; return ($cards.Count -gt 0); } | select ServerId, ChassisId, SlotId, Name, @{l="Cards";e={$cards.Count}}, OperState, Association,Discovery, Model, TotalMemory, LsDn | Sort ChassisId, ServerId

Setting VM SDRS automation levels

Thu, 11 Jun 2015 00:00:00 +0000

I learnt recently that when you Storage vMotion a VM within a datastore cluster and you check the box to select which datastore you explicitly want the VM to be migrated to, it sets the SDRS automation level for the VM to disabled.

Finding out which VMs have an automation level of disabled can be achieved with the following line:

`1`	`Get-DatastoreCluster \| % { $_.ExtensionData.PodStorageDrsEntry.StorageDrsConfig.VmConfig } \| ? { $_.Enabled -eq $False } \| % { Get-View $_.VM \| select Name }`

Since I like to have VMs set to the cluster default we need a bit of PowerCLI to change the VMs back. The following code will look at all the datastore clusters on the vCenter, and all the VMs with a disabled automation level therein.

Credit goes to LucD whose posts in the VMware Communities forum formed the base of this script. The threads are here and here.

This script is designed to be used with PowerCLI 6, as per the “Import-Module” statements at the top. For previous versions of PowerCLI the lines should be replaced with adding the appropriate snapin.

param([Parameter(Mandatory=$true)][String] $VIServer)

Import-Module VMware.VimAutomation.Core;
Import-Module VMware.VimAutomation.Storage;

Connect-VIServer $VIServer

$storMgr = Get-View StorageResourceManager;

Get-DatastoreCluster |
	% { $vms = $_.ExtensionData.PodStorageDrsEntry.StorageDrsConfig.VmConfig;
		$spec = New-Object VMware.Vim.StorageDrsConfigSpec;
		$vms | ? { $_.Enabled -eq $False } | % {
			$entry = New-Object VMware.Vim.StorageDrsVmConfigSpec;
			$entry.Operation = "edit";
			$entry.Info = $_;
			$entry.Info.Enabled = $true;
			$spec.vmConfigSpec += $entry;
		}
		
		$storMgr.ConfigureStorageDrsForPod($_.ExtensionData.MoRef, $spec, $true);
	}
	
Disconnect-VIServer -Confirm:$False

If needed, this script can easily be expanded to check for Tags or Custom Attributes assigned to the VM, and only to change the automation level given the presence or absence of a tag or the value of a custom attribute.

VMware vCheck NTP and Syslog Plugin Amendments

Tue, 09 Jun 2015 00:00:00 +0000

I’m a big fan of the vCheck script by the very talented Alan Renouf and community, but a couple of the plugins don’t work as well as I’d like with our environment, where we have multiple NTP and Syslog servers and these settings can differ depending on the cluster within a single vCenter. So I’ve made a few changes to the vCheck NTP and Syslog plugins.

NTP Plugin

The file is called “31 NTP Name and Service.ps1” and kept in the “30 Host” folder.

I’m going to cut out the bottom part of the plugin script as there would only be cosmetic changes made there.

# Start of Settings
# The NTP server which should be set on your hosts
$ntpserver = "ntp-server1.cluster1 ntp-server2.cluster1", "ntp-server1.cluster2"
# End of Settings

$Result = @($VMH | Where {$_.Connectionstate -ne "Disconnected"} | Select Name, @{N="NTPServer";E={"$($_ | Get-VMHostNtpServer)"}}, @{N="ServiceRunning";E={(Get-VmHostService -VMHost $_ | Where-Object {$_.key -eq "ntpd"}).Running}} | Where {$_.ServiceRunning -eq $false -o $ntpserver -notcontains $_.NTPServer})
$Result

There are two changes here:

The line “$($_ | Get-VMHostNtpServer)” has been enclosed in quotation marks to expand the array into a string.
The check at the end has been changed so we are now checking if the NTP server values are in the provided array.

I’m fairly sure the list of NTP servers are ordered (but have been known to be wrong before), so I’m leaving the list of servers in the order that PowerCLI decides to return them. So when specifying a list of NTP servers, do it in the order they should be used/configured.

Syslog Servers

The syslog plugin file is called “51 Syslog Name.ps1” and it is also in the “30 Host” folder.

I don’t believe that the syslog hosts are ordered (they certainly shouldn’t be), so in the code below we’re looking at the list of syslog hosts sorted alphabetically.

The code is now:

# Start of Settings 
# The Syslog server which should be set on your hosts
# Multiple syslog entries per host must be space separated and in alphabetical order.
# Multiple possible entries per vCenter should be comma separated so an array is created.
$SyslogServer = "udp://syslog-server1 udp://yet-another-syslog-server"
# End of Settings

@($VMH | Where-Object {$_.ExtensionData.Summary.Config.Product.Name -eq 'VMware ESXi'} | Select-Object Name,@{Name='SyslogServer';Expression = {"$(($_ | Get-VMHostSysLogServer).Host | sort Host)"}} | Where-Object {$SyslogServer -notcontains $_.SyslogServer})

There’s a few changes:

The ‘SyslogSettings’ section, supporting ESXi 4.x has been removed.
The line “$(($_ | Get-VMHostSysLogServer).Host | sort Host)” sorts the names and expands the array into a string.
The comparison check at the end now checks for presence in the array.

Summary

This is very much a lazy fix to a problem I had, and there will be a better solution. For instance, it’s not going to check that hosts in a certain cluster have particular settings - just that all hosts have a valid setting permissable for the vCenter. But it’ll do the job, and for everything else there should be host profiles - and there is vCheck plugin that can be used unaltered to check on those ;)

Viewing VM CPU Masks via PowerCLI

Fri, 05 Jun 2015 00:00:00 +0000

This post was updated on 9th May 2017 to fix an error condition in the script.

Support for Windows Server 2012 was announced starting with ESXi 5.0 Update 2, but there was a little known flaw in this support - in that without a CPU mask, a VM could blue screen at any time. The support article KB2060019 was released which explained everything and the issue was fixed for Update 3.

It might be useful to try and track down which 2012 VM’s (it can be adjusted for Windows 8) had their CPU masked during this time, in order to remove. The following PowerCLI reports on all Windows 2012 (and R2) VM’s and displays any CPU masking they might have. You’ll then have to manually check the results and look for a 0 in the 5th most significant bit on the edx register, but I’m sure this could be automated further.

get-vm | ? { $_.ExtensionData.Config.GuestFullName -like "*2012*" -And $_.ExtensionData.Config.cpuFeatureMask -ne $null } | select Name, @{N="CPU";E={$_.ExtensionData.Config.cpuFeatureMask}} | select -Property Name -ExpandProperty CPU | Sort Name | fl

PowerCLI: Datastore Block Sizes

Wed, 01 Apr 2015 00:00:00 +0000

Before VMFS5 the block size of the datastore determined the maximum size of a hard disk that could be added to a virtual machine. In our new glorious future it now makes no difference, but VMFS datastores that have been upgraded to version 5 will retain their old block size.

The following PowerCLI will show all the datastores connected to the vCenter and their block size.

`1`	`Get-Datastore \| select Name, CapacityGB, @{Label="BlockSize";Expression={$_.ExtensionData.Info.vmfs.BlockSizeMb}}`

If we wish to show all datastores that have a block size larger than 1MB then we could do the following:

`1`	`Get-Datastore \| ? { $_.ExtensionData.Info.vmfs.BlockSizeMb -gt 1 } \| select Name, CapacityGB, @{Label="BlockSize";Expression={$_.ExtensionData.Info.vmfs.BlockSizeMb}}`

Creating a Cisco UCS Profile using PowerTool

Thu, 26 Mar 2015 00:00:00 +0000

Creating a Cisco UCS Profile using PowerTool

This post is going to walk through creating a powershell function to create a Service Profile on a Cisco UCS domain. Later posts in this series will look at how to assign it to a server, configure shared storage on a NetApp filer, and configure the zoning on Fiber Channel switches - essentially all the work we’d need to do to automate the creation of a physical server.

There are a few ways to create Service Profiles on a Cisco UCS domain, but if you’re looking for consistency, best practice and the possibility to automate then you’ll need to use templates - not just a Service Profile template, but templates within the Service Profile template - for vNICs, vHBAs and for any other policies. I have assumed that templates have been set up and are being used.

We are going to be using Cisco UCS PowerTool for this, so ensure you’ve got this installed on your system. You can get it from , but you’ll need a Cisco.com login.

The File

Open up your favourite IDE or text editor (personally I use Notepad++) and create a new file. Save it with a filename and a location of your choice. My file is going to be called “automate.ps1” and I keep everything in a “scripts” folder in the root of a hard drive. Powershell has a verb system, so the cmdlets are prepended (for example) with “New”, “Get” and “Set”. I’m going to use the verb “Automate” to make our functions stand out from anything else that might exist on your system, but you might wish to use your company name or something else.

Below is a sample function definition for “Automate-NewUCSProfile”.

Function Automate-NewUcsProfile {
	Param()
	Process {
		# Our code will go here
	}
}

The first line declares the function and the curly brackets open its contents. The “Param()” line will be expanded so we can pass parameters into the function, and the main body of code will reside in the curly brackets are the “Process {” section. We then close off every open curly bracket “{” with the opposite curly bracket “}”.

If you’d like to learn more about Powershell functions, your search engine of choice will direct you.

Connections

When we connect to a UCS domain we can be given a handle to it. PowerTool will support connections to multiple UCS domains, though I believe the default is one and it needs to be reconfigured through the Set-UcsPowerToolConfiguration cmdlet (see it and the Connect-UCS cmdlet help for more information). If we are connecting to one UCS domain then we won’t need to use the handle when using other cmdlets, however I believe it is good practice to do so, so I will.

To connect we use:

`1`	`Connect-UCS -Name ucspe01 -Credential (Get-Credential)`

When running the above connect cmdlet (and after entering correct credentials for the target UCS domain) we are given something similar to below (which is a platform emulator output running on VMware Workstation 9):

Proxy                       :
Cookie                      : 1427096220/c399b102-8234-4bad-a94d-4202ed62593a
Domains                     : org-root
LastUpdateTime              : 23/03/2015 07:36:59
Name                        : 192.168.117.135
NoSsl                       : False
NumPendingConfigs           : 0
NumWatchers                 : 0
Port                        : 443
Priv                        : {aaa, admin, ext-lan-config, ext-lan-policy...}
RefreshPeriod               : 600
SessionId                   :
TransactionInProgress       : False
PromptOnCompleteTransaction : False
Ucs                         : UCSPE-192-168-117-135
Uri                         : https://192.168.117.135
UserName                    : config
VirtualIpv4Address          : 192.168.117.135
Version                     : 2.2(2c)
WatchThreadStatus           : None

So, if we want to connect without this information being printed to the screen then we’ll need to accept the handle being returned from the cmdlet, as below:

`1`	`$ucs = Connect-UCS -Name ucspe01 -Credential (Get-Credential)`

Credential can be prompted for by using the “(Get-Credential)” input above, or it can be provided ahead of time, by putting the output of “Get-Credential” into a variable.

1
2

$cred = Get-Credential
$ucs = Connect-Ucs -Name ucspe1 -Credential $cred

To disconnect, we use the cmdlet

`1`	`Disconnect-UCS -Ucs $ucs`

So building our function it will start to look as below. We are passing in the name of the UCS domain and the credentials to connect to it.

Function Automate-NewUcsProfile {
	Param(
		[Parameter(Mandatory=$true)][String] $ucs_domain,
		[Parameter(Mandatory=$true)][System.Management.Automation.PSCredential] $credential = (Get-Credential)
	)
	Process {
		# Our code will go here
		$ucs = Connect-Ucs -Name $ucs_domain -Credential $credential
		if ($ucs -ne $null) {
		
		
		
			Disconnect-Ucs -Ucs $ucs;
		}
	}
}

One thing to note here is that if a Credential is not provided, then the person running the script is prompted to provide one.

Creating a Service Profile from a template

One line of code is required to create a Service Profile based upon a template, and it takes the following parameters:

- ServiceProfile is the name of the template upon which to base the new profile - NewName is the name of the new profile.

It returns a object to represent the service profiles that it creates. An example:

`1`	`$service_profile = Add-UcsServiceProfileFromTemplate -ServiceProfile "template-name" -NewName "new-profile" -Ucs $ucs;`

Note this this leaves the new profile bound to the template. We can change this later.

We should do some sanity checking though - I’m sure you are aware of the two types of templates - “initial” and “updating” (if not, Cisco have a useful page on Service Profiles). These are represented in PowerShell by being a Service Profile object, but with a type of either “initial-template” or “updating-template”. A Service Profile object that is actually a Service Profile has a type of “instance”. So let’s make sure that a profile with this name exists:

`1`	`$template = Get-UCSServiceProfile -Name "template-name" -Ucs $ucs \| ? { $_.type -ne "instance" }`

This code is retrieving all service profiles of the name “template-name”. It then runs a check on them to see if they have type set to “instance”, and if so, the object is returned.

If $template is equal to $null (i.e. $template -eq $null) then no template could be found. Putting our code together, outside of our function, it would look like:

$ucs = Connect-UCS -Name ucspe01 -Credential (Get-Credential)
if ($ucs) {

	$template = Get-UCSServiceProfile -Name "template-name" -Ucs $ucs | ? { $_.type -ne "instance" };
	if ($template -ne $null) {
		$service_profile = Add-UcsServiceProfileFromTemplate -ServiceProfile $template -NewName "new-profile" -Ucs $ucs;
	}

	Disconnect-UCS -UCS $ucs;
}

Optional: Unbinding from the Service Profile template

If you wish to unbind from the template, the line is simple:

`1`	`Set-UcsServiceProfile -ServiceProfile $service_profile -SrcTemplName '' -Force \| out-null;`

Though we could pipe the $service_profile variable to it, as per:

`1`	`$service_profile \| Set-UcsServiceProfile -SrcTemplName '' -Force \| out-null`

The “| out-null” just ensures that nothing is printed on the screen as it is being run.

Assembling our Function

From the above we need to know some things:

- The name of the UCS domain to connect to. - The credentials to connect with. - The name of the Service Profile we want to create. - The name of the Template we are going to bind to.

So when we put the code from above into the function, and configure our parameters, this is what it should look like:

Function Automate-NewUCSProfileFromTemplate {
	Param(
		[Parameter(Mandatory=$true)][String] $Domain,
		[Parameter(Mandatory=$true)][System.Management.Automation.PSCredential] $Credential,
		[Parameter(Mandatory=$true)][String] $new_profile_name,
		[Parameter(Mandatory=$true)][String] $template_name
	)
	Process {
		$ucs = Connect-Ucs -Name $Domain -Credential $Credential
		if ($ucs -ne $null) {			
		
			$template = Get-UCSServiceProfile -Name $template_name -Ucs $ucs | ? { $_.type -ne "instance" };
			if ($template -ne $null) {
				Add-UcsServiceProfileFromTemplate -ServiceProfile $template -NewName $new_profile_name -Ucs $ucs;
			}
		}

		Disconnect-UCS $ucs;	
	}
}

Organisations and checkingÂ Profile existence

We’ve got one last check that we should make - that the service profile doesn’t already exist. This is slightly more complicated due to Organisations - service profile names are unique within each organisation. This is represented in service profile objects by distinguished names which are formed of two parts, the location and the service profile name. Running the code:

`1`	`Get-UcsServiceProfile \| ft Name, Rn, Dn`

will show us the format:

PS C:\> get-ucsserviceprofile | ft Name, Rn, Dn

Name                                    Rn                                      Dn
---- -- --
test                                    ls-test                                 org-root/ls-test
test                                    ls-test                                 org-root/org-Finance/ls-test

As we can see, we have two service profiles with the name “test”, one in the “root” organisation, and one in the “Finance” organisation. Let’s get the details about the organisations:

PS C:\> Get-UcsOrg | ft Name, Dn

Name                                                        Dn
---- --
root                                                        org-root
Acme                                                        org-root/org-Acme
Finance                                                     org-root/org-Finance

So when we create our profile we must make a choice about where we create it - by default it will be in the root organisation. Our code will have to take a string that allows callers to provide an organisation (but have a default of “root”). We will then search for the service profile within that organisation:

`1`	`$existing_profile = Get-UcsServiceProfile -Name $sp_name -Org $org`

It looks simple, but there is a catch - it will still match against any service profiles in sub-organisations. We need to add the “-LimitScope” parameter in order to only match within our desired target organisation. If $existing_profile is equal to $null, then we can continue.

So our function will now look like:

Function Automate-NewUCSProfileFromTemplate {
	Param(
		[Parameter(Mandatory=$true)][String] $Domain,
		[Parameter(Mandatory=$true)][System.Management.Automation.PSCredential] $Credential,
		[Parameter(Mandatory=$true)][String] $NewName,
		[String] $Organisation = "root",
		[Parameter(Mandatory=$true)][String] $Template
	)
	Process {
		$ucs = Connect-Ucs -Name $Domain -Credential $Credential
		if ($ucs -ne $null) {			
			$org = Get-UcsOrg $Organisation;
			if ($org) {
				# Check to see if profile already exists.
				$existing_sp = Get-UcsServiceProfile -Name $NewName -Org $org -LimitScope;
				if ($existing_sp -eq $null) {
		
					# Check to see if template exists.
					$sp_template = Get-UCSServiceProfile -Name $Template -Ucs $ucs | ? { $_.type -ne "instance" };
					if ($sp_template -ne $null) {
						$sp = Add-UcsServiceProfileFromTemplate -ServiceProfile $Template -NewName $NewName -Ucs $ucs;
					}
				}
			}
		}

		Disconnect-UCS $ucs;	
	}
}

Note: Organisation names are not unique throughout the Domain and it is the Dn that will determine uniqueness. This is something that we’ll deal with next.

One Final Step

To make everything simple, we should do all our checks to see if any stage of this will fail at the start of code. For the sake of separation we’ll create a new function for this:

Function Automate-CheckUcsServiceProfileConflict {
	Param(
		[Parameter(Mandatory=$true)][Cisco.Ucs.UcsHandle] $Ucs,
		[Parameter(Mandatory=$true)][String] $NewName,
		[String] $Organisation = "root",
		[Parameter(Mandatory=$true)][String] $Template
	)
	Process {
		$result = $True;
	
		# Check the Organisation exists.
		$org = Get-UcsOrg $Organisation;
		if ($org -eq $null) {
			Write-Host "The Organisation does not exist.";
			$result = $False;
		
		} elseif ($org.Count -gt 1) {
			# We found more than one Organisation
			Write-Host "There is more than one Organisation with the name '$Organisation'. Please use the Org Dn to create Service Profiles.";
			$result = $False;
		
		} else {		
			# Check that a profile with the existing name doesn't already exist.
			$existing_sp = Get-UcsServiceProfile -Name $NewName -Org $org -LimitScope;
			if ($existing_sp -ne $null) {
				Write-Host "A Service Profile with the name '$NewName' already exists in the organisation '$Organisation'.";
				$result = $False;
				
			}			
		}
		
		# Check that the template exists.
		$sp_template = Get-UCSServiceProfile -Name $Template -Ucs $ucs | ? { $_.type -ne "instance" };
		if ($sp_template -eq $null) {
			Write-Host "The template $Template does not exist.";
			$result = $False;
		}
		
		return $result;
	}
}

There are a few differences to our original function - we are passing in the connection handle to the UCS Domain, so we don’t have to deal with any Connect-Ucs/Disconnect-Ucs and credentials. We are then going to run some checks and return whether we can go ahead with creating the service profile.

Let’s go through the code:

- We first get all the Organisations that have the name we supply. - If there are no Organisations then we output this to the user and ensure we will return failure. - We see if there is more than one Organisation with the name. - If there is one Organisation then we check to see if there is a service profile with the same name in it.

- We check to see if the service profile template exists. - We return the result.

This is where we are handling that we could have multiple Organisations could have the same name. If more than one is found, then we will fail and tell the person running our function to supply the Dn if they wish to continue.

When we alter our original function to use this one to do checks, and put everything together, it looks as per the below:

Function Automate-CheckUcsServiceProfileConflict {
	Param(
		[Parameter(Mandatory=$true)][Cisco.Ucs.UcsHandle] $Ucs,
		[Parameter(Mandatory=$true)][String] $NewName,
		[String] $Organisation = "root",
		[Parameter(Mandatory=$true)][String] $Template
	)
	Process {
		$result = $True;
	
		# Check the Organisation exists.
		$org = Get-UcsOrg $Organisation;
		if ($org -eq $null) {
			Write-Host "The Organisation does not exist.";
			$result = $False;
		
		} elseif ($org.Count -gt 1) {
			# We found more than one Organisation
			Write-Host "There is more than one Organisation with the name '$Organisation'. Please use the Org Dn to create Service Profiles.";
			$result = $False;
		
		} else {		
			# Check that a profile with the existing name doesn't already exist.
			$existing_sp = Get-UcsServiceProfile -Name $NewName -Org $org -LimitScope;
			if ($existing_sp -ne $null) {
				Write-Host "A Service Profile with the name '$NewName' already exists in the organisation '$Organisation'.";
				$result = $False;
				
			}			
		}
		
		# Check that the template exists.
		$sp_template = Get-UCSServiceProfile -Name $Template -Ucs $ucs | ? { $_.type -ne "instance" };
		if ($sp_template -eq $null) {
			Write-Host "The template $Template does not exist.";
			$result = $False;
		}
		
		return $result;
	}
}

Function Automate-NewUCSProfileFromTemplate {
	Param(
		[Parameter(Mandatory=$true)][String] $Domain,
		[Parameter(Mandatory=$true)][System.Management.Automation.PSCredential] $Credential = (Get-Credential),
		[Parameter(Mandatory=$true)][String] $NewName,
		[String] $Organisation = "root",
		[Parameter(Mandatory=$true)][String] $Template
	)
	Process {
		$ucs = Connect-Ucs -Name $Domain -Credential $Credential
		if ($ucs -ne $null) {			

			$checks_passed = Automate-CheckUcsServiceProfileConflict -Ucs $ucs -NewName $NewName -Organisation $Organisation -Template $Template;
			if ($checks_passed -eq $True) {
				$sp = Add-UcsServiceProfileFromTemplate -ServiceProfile $Template -NewName $NewName -Ucs $ucs;
				if ($sp) {
					Write-Host "Service Profile Created";
				
					# If you want to unbind from the template then put the code here.
					Set-UcsServiceProfile -ServiceProfile $sp -SrcTemplName '' -Force | out-null;
				}
			}			
		}

		Disconnect-UCS -Ucs $ucs;	
	}
}

And that’s it :). We now have some code that will create a UCS Service Profile from a template in a given organisation and will pass the obvious sanity checks.

We can now create (or at least attempt to) a service profile by doing the following:

1
2

C:\Scripts\>. .\automate.ps1
C:\Scripts\>Automate-NewUCSProfileFromTemplate -Domain ucspe01 -NewName server01 -Template init-windows

Next time, we’re going to get the HBA WWPNs and associate the service profile with a server.

Powershell: Getting a list of VM adapter types

Mon, 23 Mar 2015 00:00:00 +0000

The following code will list the VMs which have network adapters that are not VMXNET3. This is useful for knowing what you likely have to change ;)

It will output the Name of the VM, the Type of adapter and the Network (i.e. Virtual Machine Portgroup) that it is connected to.

The code will examine all the VMs on the vCenter, but you can pass parameters to the Get-VM cmdlet to reduce the scope (i.e. Get-VM -Location “Discovered Virtual Machines”).

`1`	`Get-VM \| Get-NetworkAdapter \| ? { $_.Type -ne "vmxnet3" } \| Select @{Name="Name";Expression={$_.Parent.Name}}, Type, NetworkName \| ft`

Getting a NetApp volume size with Powershell

Tue, 17 Mar 2015 00:00:00 +0000

I ran into a problem recently where I needed to get the size of a volume from a NetApp filer so I could create a new volume (of the same size) and initialise a snapmirror relationship to it. The problem was that sometimes the snapmirror relationship would fail to start, reporting that the destination volume was too small. The fault was in how I was calculating the size of the source volume. I’m going to look at what I did wrong, and the right way to do it.

Using the Data ONTAP Powershell module, the below code shows the result of getting the properties that start with an “S” for the volume “random_volume”.

PS C:\> Get-NaVol "random_volume" | fl S*

Sis                                    :
SizeAvailable                          : 148084289536
SizeTotal                              : 154618822656
SizeUsed                               : 6534447104
SnapAutodelete                         : DataONTAP.Types.Volume.SnapAutodelete
SnaplockType                           :
SnaplockVolumeComplianceClock          :
SnapshotBlocksReserved                 : 37748736
SnapshotPercentReserved                : 20
SpaceReserve                           : volume
SpaceReserveEnabled                    : True
State                                  : online
SnaplockVolumeComplianceClockSpecified : False
SpaceReserveEnabledSpecified           : True

I was using the “SizeTotal” property in the output above to calculate the size of volume. When the number above is divided by 1GB it will translate to 144 GB, but this is incorrect, as System Manager reports the volume as 180 GB. So why is this number incorrect ?

The answer is also in the above output, as the “SnapshotBlocksReserved” and “SnapshotPercentReserved” values are not 0. As expected, this means a portion of the volume has been reserved for snapshots - in the above case, 20%. The catch is that “SnapshotBlocksReserved” is not in bytes, but in kilobytes. So to get the total size of the volume in bytes we must do the following:

1
2

$volume = Get-NaVol "random_volume";
$size = $volume.TotalSize + ($volume.SnapshotBlocksReserved * 1024)

If we then use the powershell magic of:

`1`	`$size / 1GB`

We get the correct result of 180 GB.

I wouldn’t recommend using the SnapshotPercentReserved property to calculate the correct total size - it is a better practice to use the exact number of blocks reserved for snapshots.

Importing UCS VLANs

Thu, 13 Jun 2013 00:00:00 +0000

I’ve had to deal with two UCS systems recently, ensuring that the configuration matches on them both, most of which I was happy to go through by hand. But the long list of VLANs was another story. I could see that they can be exported, but I couldn’t find an import ability. So, a quick search later, I found this webpage: http://www.mennodeliege.nl/cisco-ucs-powershell-toolkit-vlan butÂ is very nearly what I’m after, but we need to make a little modification.

Â This is because the VLANs are exported in the following format:

So we must adjust the powershell to take account of the format of the Name field (where the name always comes after the first “-”). This is what it looks like:

$vlancsv = import-csv "filename"
foreach ($row in $vlancsv) { 
    add-ucsvlan -id $row.ID -Name ($row.Name.SubString($row.Name.IndexOf("-") + 1)) -Sharing none -LanCloud (Get-UcsLanCloud) 
}

This does print out the details of each VLAN once it has been added. Adding a “| out-null” at the end of the line in the foreach loop should fix that if you want it to be nice and tidy.

Listing Virtual Machines and Portgroups

Mon, 20 May 2013 00:00:00 +0000

vSphere 5.0 - If you need a list of Virtual Machines and the portgroups they are attached to:

`1`	`Get-VM -Location "somewhere" \| ft Name, @{Expression={$_.NetworkAdapters.NetworkName};Label="Network Name"}`

If you need to export this to a CSV:

`1`	`Get-VM -Location "somewhere" \| select-object Name, @{Expression={$_.NetworkAdapters.NetworkName};Label="Network Name"} \| export-csv "vm-networks.csv"`

Getting a vSphere VM's Network Adapters

Tue, 26 Mar 2013 00:00:00 +0000

Getting all the network adapters for a VM is an easy task:

`1`	`get-networkadapter -vm [vm name]`

When you remove a network adapter, vSphere will remove it’s entry in the .vmx file. In the .vmx file, the adapter configuration options are prepended by an “ethernetX” string, where X is a number between 0 and 9. Removing the adapter, removes all the appropriate “ethernetX” entries from the file. Adding an adapter to a VM will use the first available number, so if in a 5 NIC VM “ethernet2” is not present, this is where the adapter will be placed. This has the effect of calling the NIC “Network Adapter 3”.

Why does this matter ? Because we want to get our adapters in a reliable order, regardless of the number of NICs present.

`1`	`get-networkadapter -vm [vm name] \| sort Name`

The above line will work for all VM’s with less than 10 NICs. When we have 10 NICs we need to do a little bit of regex on the sort code:

`1`	`get-networkadapter -vm [vm name] \| sort { if ($_.Name -match '(\d+)') { [int] $matches[1] } }`

This strips out the number from the name of the adapter, converts it to an int and sorts based upon that.

This was all done with PowerCLI 5.0.0.3501.

Sidenote: I really need to find a decent plugin for code highlighting :-/

Swapfile Datastores

Wed, 16 Jan 2013 00:00:00 +0000

If you have more than one swap file datastore for your hosts, then you might want to see which hosts are connected to what datastores.

`1`	`get-vmhost -location "<cluster/datacenter name>" \| sort-object Name \| ft Name, VMSwapfileDatastore`

Quick PowerCLI #1

Mon, 17 Dec 2012 00:00:00 +0000

I may or may not make this a series ;) PowerShell with VMware is very useful. Ignoring the Connect-VIServer and Disconnect-VIServer commands, here are some tips.

Getting the Swap File Datastore for all hosts in a cluster

If you store VM swap files away from the VM folder (faster disk I would hope) and have more than one datastore for doing this then you’ll want to separate the datastores used for each host.

`1`	`get-vmhost -location "(cluster name)" \| sort Name \| ft Name, VMSwapfileDatastore`

Getting the Tools Version for a VM

I prefer the first way because it’s slightly less to type ;). With get-vm (the second query) you can target containers that you can’t with get-vmguest. So it’s all a matter of choice !

1
2

get-vmguest "(name/match query)" | ft VM, @{Name="ToolsVersion";Expression={$_.ExtensionData.ToolsVersion}}
get-vm "(name/match query)" | ft Name, @{Name="ToolsVersion";Expression={$_.ExtensionData.Config.Tools.ToolsVersion}}