Neale's Corner

Remove network adapters attached to specific portgroups from VMs using PowerCLI

Mon, 16 Aug 2021 00:00:00 +0000

Isn’t that a mouthful for a title ? I can feel my SEO plugin complaining at me as I write this ;) This is a short and simple script that will examine the VMs in your infrastructure and remove the network adapters from them that are attached to specific portgroups. It came in handy as we were decommissioning a network and wanted to remove the adapter from our multi-honed VMs.

As noted in the script, this has been made possible by LucD’s code in his answer on the VMware communities site (link below). I’ve only wrapped it up to only apply to certain VMs.

This script takes two parameters:

VMName - this is used as an argument to Get-VM, so it can be used to get more than one VM.
NetworkName - this will match any portgroups that start with the same string.

param([string] $VMName,
      [Parameter(Mandatory=$true)][string] $NetworkName)

<#
    param: vm name. if blank, get them all.
    param: network name. to match the name of the network to remove.

    Uses code from LucD from the following location:
    https://communities.vmware.com/t5/VMware-PowerCLI-Discussions/Remove-network-adapter-from-running-vm/td-p/1269138
#>

# Ensure connected.
if ($global:DefaultVIServers.Count -eq 0) {
    Write-Output "There are no connected VI Servers. Connect to one using Connect-VIServer and then run this script again.";
    exit;
}

# Get the VMs
$vms = @();
if ($null -ne $VMName -And $VMName.Length -gt 0) {
    $vms = Get-VM $VMName;
} else {
    $vms = Get-VM | Sort-Object Name;
}

# Loop through the VMs and disconnect any found adapters.
$vms | ForEach-Object { 
    $vm = $_;
    $adapters = $vm | Get-NetworkAdapter | Where-Object { $_.NetworkName.StartsWith($NetworkName); }
    if ($null -ne $adapters) { 
        $adapters | ForEach-Object {
            $adapter_name = $_.Name;
            $nic = $vm.ExtensionData.Config.Hardware.Device | Where-Object {$_.DeviceInfo.Label -eq $adapter_name };
            if ($null -ne $nic) {
                $spec = New-Object VMware.Vim.VirtualMachineConfigSpec;
                $dev = New-Object VMware.Vim.VirtualDeviceConfigSpec;
                $dev.operation = "remove";
                $dev.Device = $nic;
                $spec.DeviceChange += $dev;

                Write-Output "$($vm.Name) - disconnecting $adapter_name";
                $vm.ExtensionData.ReconfigVM($spec);
            }
        }
    }
}

The script is also available in my library - hosted at https://github.com/nelons/psscripts.

Also, yes, the SEO plugin told me the title was too long. Oh well !

Setting vSphere Round Robin multipath policy with PowerCLI

Mon, 02 Aug 2021 00:00:00 +0000

Last week I was adding new datastores to a cluster for a provider whose best practices recommended a Round Robin multipath policy, changing paths with every iop. There is a VMware knowledge base article on how to do this - https://kb.vmware.com/s/article/2069356 - which details the CLI commands that need to be run on every host in the cluster for every datastore that needs to be configured. Attached to the KB article is a list of the PowerCLI commands that will also implement the same configuration.

When pressed for a choice, either - enabling SSH on each host, logging in, running the commands, logging out, disabling SSH - or - running PowerCLI commands remotely against the vCenter Server - the easiest option seems obvious.

So, I’ve written a script that will do this for multiple datastores against all hosts in a cluster. The latest version is available at https://github.com/nelons/psscripts/blob/master/vsphere/Set-ESXRoundRobinForDatastore.ps1, or the version at the time of writing this article is displayed below.

# Configuration variables.
# The FQDN (or IP) of your vCenter Server.
$vCenterServer = "vcenter.dnsname";
$ClusterName = "cluster";

# An array of datastore names that you want to convert.
$datastores = @("Datastore Name");

# When should the path be switched ?
$iops_switch = 1;

Connect-VIServer $vCenterServer | out-null;
$hosts = Get-VMHost -Location $ClusterName | Where-object {($_.ConnectionState -like "Connected")} | Sort-Object Name

# This will get the datastores from the array at the top of the file. 
$ds_id = $datastores | ForEach-Object { Get-Datastore -Name $_ } | ForEach-Object { return $_.ExtensionData.Info.Vmfs.Extent.DiskName; }

# Uncomment this line if you want to ignore the datastore name array
# and instead filter on the start of the datastore name.
# Remember to update the part of the line that starts with "start of datastore name" !
# Remember to comment out the datastore array line above !
#$ds_id = $datastores | ForEach-Object { Get-Datastore | { $_.Name.StartsWith("Start of datastore name"); } } | ForEach-Object { return $_.ExtensionData.Info.Vmfs.Extent.DiskName; }

$hosts | ForEach-Object { 
    $esx = $_;
    Write-Output "$($esx.Name): Checking LUNs.";

    $ds_id | ForEach-Object {
        $lun = $esx | Get-SCSILun -LunType Disk -CanonicalName $_;
        if ($null -ne $lun) {
            # Make sure it is RoundRobin
            if ($($lun.MultipathPolicy) -notlike â€œRoundRobinâ€) {
                Write-Output "$($esx.Name), $($_): Setting multipath policy to RoundRobin.";
                $lun | Set-ScsiLun -MultipathPolicy RoundRobin | out-null;
            }

            if ($($lun.CommandsToSwitchPath) -ne $iops_switch) {
                # Set the IOPS switch.
                Write-Output "$($esx.Name), $($_): Settings commands to switch path parameter to 1.";
                $lun | Set-ScsiLun -CommandsToSwitchPath $iops_switch | out-null;
            }
        }
    }
}

Disconnect-VIServer -Force -Confirm:$False;

Expand/Collapse Animation with UWP

Tue, 27 Jul 2021 00:00:00 +0000

In my latest app I wanted to have an UI element that could expand and collapse on demand - it was taking up a lot of screen real estate and I wanted to give the user a choice of whether to minimise part of it. Hooking a button up to change the visibility of the block is straight forward enough, but I’d like to have a nice animation to go with it - perhaps with the UI element below sliding upwards to expand into the new space. This is what I wanted to achieve:

First I found a stackoverflow answer that did most of what I wanted - but the bottom block didn’t slide upwards. This is because the CompositeTransform.ScaleY property scales the control but does not change the boundaries - I found this out in this post on MSDN. The key information is here:

Scaling transforms affect how the UIElement is rendered but don’t change other properties such as Height: the Height will remain whatever it is, but the overall image’s display size is stretched or shrunk (in this case shrunk) by the ScaleY factor.

So, if we want to change the height of the shrinking block, we need to change the height, and this is where I found out about Dependent and Independent animations.

A dependent animation is one that will cause the Xaml to re-layout. Expensive; therefore requiring an “opt-in”.

https://stackoverflow.com/questions/10479903/how-to-animate-height-of-control-in-windows-8-xaml

So, putting this together in a Storyboard, I had the following XAML code:

        <Storyboard x:Name="TestShrink">
            <!-- this works but only if From is also set.  -->
            <DoubleAnimation
                EnableDependentAnimation="True"
                Storyboard.TargetName="info"
                Storyboard.TargetProperty="Height"
                From="100"
                To="0"
                Duration="0:0:1" />
        </Storyboard>

I ran this and nothing happened. Then I added a “From” property and it shrank just fine. This is in contrast to the notes in the Microsoft documentation:

**To only:**Â The animation progresses from the animated property’s base value or a previous animation’s output value to the value specified by theÂ ToÂ property.

https://docs.microsoft.com/en-us/uwp/api/Windows.UI.Xaml.Media.Animation.DoubleAnimation?view=winrt-20348

Clearly, the animation was not using the animated property’s base value as the starting value.

So, there was only one thing for it - to write this thing in code and retrieve/assign the height of the control programmatically. This, in C++/CX is what I ended up with as proof of concept code, and it should be reasonably easy to convert into C# or C++/WinRT if needed:

	// Configuration parameters.
	double animation_length_seconds = 5.0;
	FrameworkElement^ chevron = fiToggleShowConfig;
	FrameworkElement^ target = info;
	static double _openHeight = 0.0;

	// Create the storyboard.
	auto storyboard = ref new Windows::UI::Xaml::Media::Animation::Storyboard();

	double start_height = 0.0, end_height = 0.0;
	double start_opacity = 0.0, end_opacity = 0.0;
	double start_rotation = 0.0, end_rotation = 0.0;
	if (target->Visibility == Windows::UI::Xaml::Visibility::Visible) {
		_openHeight = target->ActualHeight;
		start_height = target->ActualHeight;
		end_height = 0.0;

		start_opacity = 1.0;
		end_opacity = 0.0;

		start_rotation = 0.0;
		end_rotation = 180.0;

		// Make the target collapsed at the end of the storyboard.
		{
			auto visible = ref new ObjectAnimationUsingKeyFrames();
			auto kf_start = ref new DiscreteObjectKeyFrame();
			KeyTime kt_start;
			TimeSpan ts_start;
			ts_start.Duration = 0;
			kt_start.TimeSpan = ts_start;
			kf_start->KeyTime = kt_start;
			kf_start->Value = Windows::UI::Xaml::Visibility::Visible;
			visible->KeyFrames->Append(kf_start);

			auto kf_end = ref new DiscreteObjectKeyFrame();
			KeyTime kt_end;
			TimeSpan ts_end;
			ts_end.Duration = (animation_length_seconds * 1000) * 1000;
			kt_end.TimeSpan = ts_end;
			kf_end->KeyTime = kt_end;
			kf_end->Value = Windows::UI::Xaml::Visibility::Collapsed;
			visible->KeyFrames->Append(kf_end);

			storyboard->SetTarget(visible, target);
			storyboard->SetTargetProperty(visible, "(UIElement.Visibility)");
			storyboard->Children->Append(visible);
		}

	} else {
		start_height = 0.0;
		end_height = _openHeight;

		start_opacity = 0.0;
		end_opacity = 1.0;

		start_rotation = 180.0;
		end_rotation = 0.0;

		// Make the target visible straight away.
		target->Visibility = Windows::UI::Xaml::Visibility::Visible;
	}

	// Shrinking the info size.
	{
		auto shrink = ref new DoubleAnimation();
		shrink->From = start_height;
		shrink->To = end_height;

		TimeSpan ts = TimeSpan();
		ts.Duration = (long long) ((animation_length_seconds * 1000) * 1000);
		shrink->Duration = ts;
		shrink->EnableDependentAnimation = true;

		storyboard->SetTargetProperty(shrink, "Height");
		storyboard->SetTarget(shrink, target);
		storyboard->Children->Append(shrink);
	}

	// Reducing the Opactity of the info.
	{
		auto hide = ref new DoubleAnimationUsingKeyFrames();
		auto start = ref new EasingDoubleKeyFrame();
		KeyTime kt;
		TimeSpan start_ts;
		start_ts.Duration = 0;
		kt.TimeSpan = start_ts;
		start->KeyTime = kt;
		start->Value = start_opacity;
		hide->KeyFrames->Append(start);

		auto end = ref new EasingDoubleKeyFrame();
		TimeSpan end_ts;
		end_ts.Duration = (animation_length_seconds * 1000) * 1000;
		KeyTime end_kt;
		end_kt.TimeSpan = end_ts;
		end->KeyTime = end_kt;
		end->Value = end_opacity;
		hide->KeyFrames->Append(end);
		
		storyboard->SetTarget(hide, target);
		storyboard->SetTargetProperty(hide, "(UIElement.Opacity)");
		storyboard->Children->Append(hide);
	}

	// Rotating the Chevron
	if (chevron != nullptr)
	{
		auto rotate = ref new DoubleAnimationUsingKeyFrames();

		auto kf_start = ref new EasingDoubleKeyFrame();
		KeyTime kt_start;
		TimeSpan ts_start;
		ts_start.Duration = 0;
		kt_start.TimeSpan = ts_start;
		kf_start->KeyTime = kt_start;
		kf_start->Value = start_rotation;
		rotate->KeyFrames->Append(kf_start);

		auto kf_end = ref new EasingDoubleKeyFrame();
		KeyTime kt_end;
		TimeSpan ts_end;
		ts_end.Duration = (animation_length_seconds * 1000) * 750;
		kt_end.TimeSpan = ts_end;
		kf_end->KeyTime = kt_end;
		kf_end->Value = end_rotation;
		rotate->KeyFrames->Append(kf_end);

		storyboard->SetTarget(rotate, chevron);
		storyboard->SetTargetProperty(rotate, "(UIElement.RenderTransform).(RotateTransform.Angle)");
		storyboard->Children->Append(rotate);
	}

	storyboard->Begin();

This can be easily compressed into a function for your needs, apologies that the naming scheme for variables isn’t consistent - this is very much proof of concept code written with kids running around !

This is the XAML that I have on the page:

    <Grid>
        <Grid.RowDefinitions>
            <RowDefinition Height="Auto" />
            <RowDefinition Height="Auto" />
            <RowDefinition Height="Auto" />
            <RowDefinition Height="Auto" />
            <RowDefinition Height="Auto" />
        </Grid.RowDefinitions>

        <TextBlock
            Grid.ColumnSpan="2"
            Margin="10"
            FontSize="18"
            FontWeight="Bold">
            Text Header
        </TextBlock>

        <Grid x:Name="infogrid" Grid.Row="1">
            <Grid.ColumnDefinitions>
                <ColumnDefinition Width="40" />
                <ColumnDefinition Width="500" />
            </Grid.ColumnDefinitions>

            <FontIcon
                x:Name="fiToggleShowConfig"
                Margin="10,10"
                HorizontalAlignment="Left"
                VerticalAlignment="Top"
                FontFamily="Segoe MDL2 Assets"
                Glyph="&#xE70D;"
                RenderTransformOrigin="0.5,0.5"
                Tapped="fiToggleShowConfig_Tapped">
                <FontIcon.RenderTransform>
                    <RotateTransform />
                </FontIcon.RenderTransform>
            </FontIcon>

            <TextBlock
                x:Name="info"
                Grid.Column="1"
                Margin="10"
                TextWrapping="Wrap">
                Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.
                <TextBlock.RenderTransform>
                    <CompositeTransform />
                </TextBlock.RenderTransform>
            </TextBlock>

        </Grid>

        <TextBlock
            Grid.Row="2"
            Grid.ColumnSpan="2"
            Margin="10"
            FontSize="18"
            FontWeight="Bold">
            Another Title
        </TextBlock>

        <TextBlock
            Grid.Row="3"
            Grid.ColumnSpan="2"
            Margin="10"
            TextWrapping="Wrap">
            Sed ut perspiciatis unde omnis iste natus error sit voluptatem accusantium doloremque laudantium, totam rem aperiam, eaque ipsa quae ab illo inventore veritatis et quasi architecto beatae vitae dicta sunt explicabo. Nemo enim ipsam voluptatem quia voluptas sit aspernatur aut odit aut fugit, sed quia consequuntur magni dolores eos qui ratione voluptatem sequi nesciunt. Neque porro quisquam est, qui dolorem ipsum quia dolor sit amet, consectetur, adipisci velit, sed quia non numquam eius modi tempora incidunt ut labore et dolore magnam aliquam quaerat voluptatem. Ut enim ad minima veniam, quis nostrum exercitationem ullam corporis suscipit laboriosam, nisi ut aliquid ex ea commodi consequatur? Quis autem vel eum iure reprehenderit qui in ea voluptate velit esse quam nihil molestiae consequatur, vel illum qui dolorem eum fugiat quo voluptas nulla pariatur?
        </TextBlock>
</Grid>

The code is run when the fiToggleShowConfig control is tapped, and as the animation is dependent and running on the UI thread, nothing more can happen with the UI until it is complete - therefore you don’t have to handle a new animation being started before the current one is complete.

It does mean that everything else you need to run on the UI thread will be delayed until it is complete though.

Get VMHost Swap datastore using PowerCLI

Mon, 23 Mar 2020 00:00:00 +0000

This is a quick one-liner to get the configured swap datastore on a host/hosts:

`1`	`Get-VMHost \| Sort Name \| select Name, VMSwapfileDatastore`

If we want to make the name look a little nicer we could do:

`1`	`Get-VMHost \| Sort Name \| select Name, @{L='Swap Datastore';E={ ($_.VMSwapfileDatastore).Name } }`

This would get the results for all the esxi hosts for the target that you are connected to, however if you wanted to reduce the scope to a cluster or a datacenter you could change the start to:

`1`	`Get-VMHost -Location <Datacenter / Cluster Name> \| ...`

Or you could pipe in the location or array of hosts:

`1`	`Get-Cluster <cluster name> \| Get-VMHost \| ...`

or:

`1`	`$array_of_host_objects \| ...`

WSUS, Powershell and Computers

Mon, 16 Mar 2020 00:00:00 +0000

My role currently involves dealing with Windows in addition to the standard VMware/hardware infrastructure. If we ever thought that patching ESXi was fun, dealing with WSUS is whole other ball game. I will no doubt get around to writing a full post about it in the near future, as dealing with it has been quite time consuming and there are a few gotchas ;)

However the point of this post is looking at WSUS and automation, in this case using Powershell. There are two obvious approaches to using WSUS:

Approve everything to every computer group (depending on your patching schedule).
Approve only the required patches to each computer group.

The latter approach appeals to me, purely because we can ensure that a patch is approved/applied to a less important environment (think Dev -> UAT - > Production) and easily identify those patches that *haven’t* been required previously (Do you really want to apply a patch for the first time to Production ?)

So the crux of any script is going to be getting the computers in the WSUS Computer group so we can discover what patches need to be approved. There are two methods that I know of, though there could be more :)

Before I start, I’m using WSUS on Windows Server 2016/2019, and Powershell needs to be run as an Administrator in order to run the scripts (if your UAC is so inclined). I’m also being lazy and including screenshots from my workplace as opposed to sorting out a lab environment, so there won’t be any proper screenshots and all computer information will be omitted.

Get-WSUSComputer

This command is included in the UpdateServices module, and is straight forward to use:

Get-WSUSComputer
-All
-NameIncludes
-ComputerTargetGroups <name>,<name>,<name>
-IncludeSubgroups
-IncludeDownstreamComputerTargets

The full documentation for this command is at https://docs.microsoft.com/en-gb/powershell/module/updateservices/Get-WsusComputer?view=win10-ps.

The last switch is important if you have a downstream WSUS server, as by default WSUS will only return computer information that it is responsible for. Using the switch will include all downstream computers in this group.

The data returned is also quite strange - this is the header for the table displayed by the command:

However, these are display names, there is no field called “Computer” or “Name”, so if you wanted to sort it by this you’d get nothing back !. Running the command below will show us what we need:

`1`	`Get-WSUSComputer -All \| Select -First 1 \| Get-Member`

So we can now discover the mapping is:

Computer is FullDomainName
IP Address is IPAddress
Operating System is OSDescription
Last Status Report is LastReportedStatusTime

Object Methods

Instead of using a provided command, which no doubt wraps the method calls, we can call the methods directly. The code below will do the same as a one-liner above !

$wsus = get-wsusserver
$wg = $wsus.GetComputerTargetGroups() | ? { $_.Name -eq "Infrastructure" }
$cscope = New-Object Microsoft.UpdateServices.Administration.ComputerTargetScope
$cscope.IncludeDownstreamComputerTargets = $true;
$cscope.ComputerTargetGroups.Add($wg);
$wsus.GetComputerTargets($cscope);

Which is better ? That’s up to you and your style/comfort.

Which should you use ? That’s up to you too :)

The first scripts using WSUS that I found used methods to get the information, so this is how I’ve written most of my scripts. I have not found any advantage using one way instead of the other, but that doesn’t mean there isn’t. I hate to be non-committal, but like most tech, choose the one that works for you :)

Enabling SSH on ESXi with vRO

Mon, 19 Aug 2019 00:00:00 +0000

I think it is a good rule of thumb that the security maturity of the organisation can be measured by whether SSH is left enabled (with warnings muted) or disabled on ESXi Hosts. As there is a warning on the host if the service is enabled, and the hardening guides recommend that it is disabled, there is little doubt that this disabled state is VMware’s preference and a security best practice.

So how do we enable SSH on ESXi ? I am assuming that the only accessible interface is the Web Client, as access to the console is likely restricted too - perhaps the hosts are in lockdown mode ? We have a few options..

Web Client

This is a little bit convoluted. We need to follow the steps:

Select the host on which to enable/disable SSH.
Go to the Configure tab.
Select the Security Profile menu option.
*Optional: Minimise one or both Firewall sections (Incoming Connections and Outgoing Connections).
*Optional: Scroll down to the Services section.
Press the Edit button in the Services section.
Select the SSH entry in the list.
Press Start or Stop.

The * noted items are for vCenter 6.5 or earlier. In vCenter 6.7 the Services panel is moved to the top of the Security Profile section.

The menu to manipulate the service looks as below:

In summary, this is quite a bit of work to enable the service on only one host. Next we’ll look at how to do the same on the HTML5 Client.

HTML5 Client

The steps required to enable/disable SSH on a host using the HTML5 client are as follows:

Select the host on which to enable/disable SSH.
Go to the Configure tab.
Select the Services menu option.
Select the SSH entry in the list.
Press the Start button

There are fewer steps in the list compared to the Flex client, however this is still onerous when having to work with multiple hosts. The section for changing service state in this client looks as follows:

vRealize Orchestrator

Ah, so we’ve got to the real reason of why I’m writing this post ! With past experience I’ve needed to use SSH to:

troubleshoot on a single host
perform maintenance/change on every host in the cluster.
disable SSH on host as someone else left it enabled and the timeout value hasn’t been set properly.

This identifies that we need workflows to enable and disable the service for a host, and for every host in a cluster.

However, thinking about this, if a host typically has SSH disabled then the shell/ssh enabled warning will not be suppressed - so you will know whether SSH is enabled or not. So, we will also have a workflow that toggles the service between enabled/disabled on a host - purely as a way of presenting fewer options to the end user so the vRealize Orchestrator submenu is kept as trim as necessary :)

Our approach to the cluster can re-use some of this - in a best case scenario the service is in the opposite of the desired state for every host in the cluster - i.e. if we want to enable, then the state of every host’s service is disabled. However we must also account for the possibility that the service is enabled on some hosts and disabled on others. Conversely, if the SSH service has been left enabled on a few hosts in a big cluster and we want to disable them, it could be easier to do in a single cluster workflow rather than running a workflow per host. A toggle workflow will not work here - we want to explicitly set the state of the service for all hosts in the cluster - whether enabled or disabled - otherwise we could end up reversing the state. From the point of the user - they know what end state they want, let’s get them there !

This leaves us with one last architecture decision between:

A workflow for enable and a workflow for disable.
A single workflow with a boolean parameter that defines enable/disable.

Honestly, I don’t think there is much between the two, both are good and reasonable choices. I decided to go with the top option for the reasons:

The workflow can be invoked remotely with less parameters.
Flex WebClient integration will allow the workflow to be immediately run with less clicks.

Building the workflow

The following code block will enumerate the services available on the host, and if the SSH service is not running, start it.

var services = host.configManager.serviceSystem.serviceInfo.service;

for each (var svc in services)
{
	if (svc.key == "TSM-SSH")
	{
		var current_state = (svc.running == true) ? true : false;	
		
		if (current_state == false)
		{
			host.configManager.serviceSystem.startService("TSM-SSH");
		}	
		
		break;
	}
}

Conversely, to stop the service, most the above is identical, except for the innermost conditional block:

		if (current_state == true)
		{
			host.configManager.serviceSystem.stopService("TSM-SSH");
		}

Our toggle code can be written as:

		if (current_state == false)
		{
			host.configManager.serviceSystem.startService("TSM-SSH");
		}
		else if (current_state == true)
		{
			host.configManager.serviceSystem.stopService("TSM-SSH");
		}		
		
		break;

The workflows for the cluster follow a typical pattern:

Get all the hosts in the cluster
Call the appropriate workflow for each host

The workflow schema looks as follows:

As can be seen, we use a built-in action to get all the hosts in a cluster, and the builtin workflow loop object to run a workflow for every host in the array.

In the workflows I also check the connection state of the host - there is no point trying to change the service state on a host that is disconnected !

Download

If your browser renames the file, you are free to change the file extension to “.package” (the import may still work if you do not). The file is an exported vRO package (from version 7.5) and is ready for import onto your server.

Click this link to download the package.

Cisco UCS Central - getting free slots from connected domains

Mon, 22 Apr 2019 00:00:00 +0000

Quick powershell snippet time ! When you have a UCS Central instance with a number of domains, knowing what free slots you have available is quite useful - especially when you’ve got a smart hands service and won’t be racking new servers but instead having to communicate instructions.

In my time I’ve seen UCS Central used to manage geographically separate domains and a large number of domains across a small number of sites. When you get a new blade it needs to be put into a free slot, the question is where ?

The script below uses domain groups to separate out domains, but the code is formatted so it can be removed if they aren’t used.

Get-UCSCentralOrgDomainGroup -Filter { Level -ceq 1 } | % {
	$group = $_;
	Get-UCSCentralComputeSystem | ? { $_.OperGroupDn.StartsWith($group.Dn); } | % {
		$compute = $_;
		Get-UCSCentralChassis -ComputeSystem $_ | sort Id | select @{L='Group';E={$group.name}}, @{L='Domain';E={$compute.Name}}, @{L='Chassis';E={ $_.Id}}, @{L='Blade Count';E={(Get-UCSCentralBlade -Chassis $_).Count}}
	}
}

Apologies I don’t currently have any domains available to run this against to show you some sample output so I appreciate you’ll be trying this out blind. I hope that it meets your expectations !

I’ve uploaded this to my github in a script file so it can be run as you need it :)

Reporting on vSphere Replication transfer sizes

Mon, 15 Apr 2019 00:00:00 +0000

vSphere Replication is really a wonderful product - I’ve been using it for a few years now across a few employers and I’ve never had a really serious problem with it - it just seems to work.

Sure, there are a few feature requests we could make of it, for example setting a schedule of when to replicate and ignoring RPO violations outside of that, and bandwidth limiting on the traffic coming out of the appliance, but they really aren’t necessary for what it is designed for.

Something I like exists in the Flash/Flex UI, where we can find out the size of the last data replication was (“Last sync size” in the image below). However this only exists in this one place and I haven’t found that this can be reported on anywhere else. It’s good to know the rate of change for your servers for judging bandwidth (yes we should have monitoring on the lines, but this won’t break transfers down into individual servers)

Finding what to report upon

As I was asked to provide change rates for some servers I started in the usual place (your search engine of choice) but couldn’t find a way of extracting this information. I then looked in the Events section of a VM being replicated and found that something was being logged - hurrah !

Yes I’m still using the Flash GUI. Come at me :p

Looking at a completed event I found:

We have a number of bytes transferred - we might be able to work with this. Time to switch to PowerCLI And these are the last two events to be logged with the VM:

If we have a look at the Arguments field we find (I’ve assigned $e to the first event in the above image because laziness !):

This information should give us enough to generate a report:

Filter on “EventTypeId” and matching to “hbr.primary.DeltaCompletedEvent”.
Using the Arguments.Value field to report on the size of the transfer.

Let’s give this a try:

Get-VM $name | get-vievent -MaxSamples ([int]::MaxValue) | ? { $_.EventTypeId -eq "hbr.primary.DeltaCompletedEvent" } | Select CreatedTime, @{L="MB Transferred";E={  [math]::Round($_.Arguments.Value/1MB, 2)}}

This will display the following - perfect !

Determining accurate numbers

Let’s remind ourselves of the UI report for the last transfer size - 40.64 MB:

So we can see that the numbers don’t quite add up - the GUI reports 40.64 MB and the event reports 40.78 MB.

Time to venture onto the Internet and see if we can find out how to get from 42761392 bytes to 40.64 MB (as I’m going to assume that the VMware engineers are clever than I and I’ve made a mistake somewhere). Using Google’s inbuilt calculator we find that 42761392 bytes are 42.76 MB.

If we use gbmb.org we get a bit more distinction - it is 42.76 MB if we take 1 MB to mean 1000000 (decimal, megabytes), and it is 40.78 MB if 1 MB is equal to 1048576 bytes (binary, mebibytes):

So I honestly have no idea how or why the UI reports the size as being 40.64 - from the above it should be either 40.78 or 42.76 depending on the value of 1 MB in bytes. So this leaves us with the following options:

The Arguments.Value is incorrect.
We are using Arguments.Value incorrectly.
The UI is incorrect.

For this report, we are going to accept the inaccuracy and use 1048576 as the value of 1 MB, as this will get us closer to the UI number.

Bringing it all together

Our script to generate the report is now:

Param([Parameter(Mandatory=$true)] $VMName,
      [DateTime] $Start,
      [DateTime] $Finish,
      [string] $OutputFile);

$vm = Get-VM $VMName;
if ($null -ne $vm) {
    $EventStart = $null;
    if ($null -eq $Start) {
        $EventStart = $(Get-Date).AddDays(-7);
    } else {
        Write-Host $Start.ToString();
        $EventStart = $Start;
    }

    $EventEnd = $null;
    if ($null -eq $Finish) {
        $EventEnd = Get-Date;
    } else {
        Write-Host $Finish.ToString();
        $EventEnd = $EventEnd;
    }

    $events = get-vievent -MaxSamples ([int]::MaxValue) -Start $EventStart -Finish $EventEnd | ? { $_.EventTypeId -eq "hbr.primary.DeltaCompletedEvent" } | Select CreatedTime, @{L="MB Transferred";E={ [math]::Round($_.Arguments.Value/1MB, 2)}}
    if ($null -ne $events) {
        if ($null -ne $OutputFile -And $OutputFile.Length -gt 0) {
            $events | Export-Csv -NoTypeInformation -Path $OutputFile;
        } else {
            $events;
        }
    } else {
        Write-Host "Could not find any replication events for the vm $VMName" -Foreground Red;
    }

} else {
    Write-Host "Could not find a VM with the name $VMName" -Foreground Red;
}

From here, we can output a CSV file, import that into Excel and make some fun graphs !

As far as my limited search engine searches have returned, there is no way to find out which VMs are protected by vSphere Replication with PowerCLI. Given that there is a vRO plugin, I think that if this needs to be used if you need further information.

I’ve uploaded the script to github :)

As usual, please let me know if I’ve got something wrong or you found it useful !

Managing a DRS group with vRealize Orchestrator

Mon, 25 Mar 2019 00:00:00 +0000

The use case for this challenge was a small (8-10 ESXi hosts) cluster, that only a subset of servers were ‘assigned’ with Windows datacenter licenses - so in order to maintain compliance all the Windows VMs would need to run on those hosts. The natural choice for ensuring this happens is a “must run” DRS rule between a group of VMs and a group of hosts and the automation step for this is ensuring that the VM group is accurate by only containing VMs that are still in the cluster and contains all Windows VMs in the cluster. Thus, the plan is use vRealize Orchestrator to manage the DRS group.

This technique (and workflow) will be left open enough for it to be used with any type of Operating System, after all I believe Red Hat also license on a per-hypervisor basis.

Core

The schema of the workflow is pictured below.

The flow is one of the simplest we can make ! The steps are:

Retrieve the configuration variables from the ConfigurationElement.
Get the VMs from the cluster (exit the workflow if it has none).
Get the DRS Group from the name (exit if it does not exist).
Loop through the VMs and add/remove them to the DRS group as necessary.
Send an email report if changes are made.

It has a single input of a ConfigurationElement, with the following variables. The description should make it apparent what each variable is used for.

The magic of the workflow is the updating of the DRS rule, which the below script covers:

Where next

As it stands now, we can schedule the workflow to run at the end of the day and allow DRS to place the VMs correctly.

However, to really ensure that the VM is running on the correct host we would invoke this workflow on every creation and addition to the cluster. This is possible when using LogInsight - configured as a destination for the ESXi hosts’ syslogs - to call Orchestrator via a Webhook when the appropriate events are received.

Now that we can dynamically change a DRS rule, this is starting to open up possibilities. Stay tuned :)

Summary

You can download the workflow package using the button below. Please let me know if you found this useful !

Download package file

Updating a HP iLO using Rest API and vRealize Orchestrator

Mon, 18 Mar 2019 00:00:00 +0000

A security vulnerability against Hewlett Packard iLOs was announced last year (link - https://www.rapid7.com/db/modules/auxiliary/admin/hp/hp_ilo_create_admin_account), along with the required firmware to patch. No doubt there are some amazing tools by HP that will allow firmware to be patched across an estate, but as I don’t have access to them I need to find another way to get firmware out to 20+ servers.

There is an API (documentation at https://hewlettpackard.github.io/ilo-rest-api-docs/ilo4/) which is quite straight forward to use, so we’ll have a look at using Postman to update an iLO and then use vRealize Orchestrator to implement a workflow.

Using Postman

Throughout this I will be using the headers below, though the second one is only required when updating the firmware.

To start, we’ll ask the iLO for a Manager interface, which will provide links to the services it offers. Authentication is handled by the headers on a per-request basis. We won’t need to manage session or tokens :)

The initial request is a GET to https://<FQDN/IP>/redfish/v1/managers/ as below:

The data returned contains an array with the name “Members” that will point to the URL for the manager for the iLO. We’re going to use that to get the details for the manager - there is a lot of data here so I’m not going to post it all. There are two points of interest for us - firstly the current firmware version:

Secondly the links to services - we are interested in the UpdateService.

We will use the location provided to access the service - which will allow the current firmware status to be retrieved and an update to be triggered.

The documentation has some reference on what to do - https://hewlettpackard.github.io/ilo-rest-api-docs/ilo4/#links-updateuri-extref-and-links-updateuri-extref - which is pictured below.

However, other documentation at http://h22208.www2.hpe.com/eginfolib/servers/docs/HPRestfultool/iLo4/data_model_reference.html#HpiLOFirmwareUpdate details the following:

This explains we’ll need to include an “Action” parameter in our request. To update the iLO we will need to host the firmware on a webserver that is accessible from the iLO address - this blog entry isn’t going to cover how to do this (I’m assuming that you’ve got a webserver to hand and you’re allowing the extension/content-type to be downloaded. Remember to test it manually before trying to automate, especially if your environment is subject to network controls)

Our POST request body will look as follows:

The iLO will restart when complete - there is no need to manually trigger this, though it is generally a good idea to ensure it has completed. To do this, we will call the GET request to the UpdateService/ URL and check the “State” value - it will change to the following values:

UPDATING
COMPLETED
(The request will fail when the iLO automatically restarts)
IDLE

So if we get a value of COMPLETED or IDLE then we can check the iLO version. However, given that a value of COMPLETED will follow with a period of silence it is more prudent to wait for the IDLE - which I believe we will also receive in the result of failure.

Using vRealize Orchestrator

Now to find a way to put the above into Orchestrator - the workflow to upgrade an iLO is:

The workflow has the following inputs:

The check version value will, if set to true, retrieve the version from the iLO and compare it to the values in the new_major and new_minor fields. If the firmware version on the iLO is newer then the firmware installation will not proceed. This check is dependent on human accuracy as there is no way of reliably retrieving the firmware version from the file, thus if the incorrect version is entered then installation will fail.

The heart of using vRO to drive this process is dynamically creating REST hosts in code, sending the requests and dealing with the response. Taking a look in the vRO workflow “Invoke a dynamic REST operation” we can see how VMware have done it:

The important things to note are:

We need to create a REST Host object, and then use it to create a transient host.
We need to specify the base url and authentication on the transient host object.

However if we invoke a REST call over HTTPS without importing the certificate it will fail, so we will need to handle this failure by importing the certificate and re-running the REST invocation.

This is handled by the Import Cert ?/Import a certificate/Log Cert Import elements. This is done by catching the exception that is thrown.

We now need to can connect to the manager address and find out the location of the UpdateService service - which we did earlier in Postman. Doing this in some javascript looks like the following:

The main part of this workflow is upgrading the firmware - we need to POST the update:

And then loop until we reach the IDLE state. When we exit the loop we can check if the version is different from before we started the process. This will give us our success/failure result to return to the user. The loop is as below:

Wrapping it Up !

Updating multiple iLOs

This is quite straight forward - there are two approaches.

The first one will duplicate the workflow and then adjust the input to take an array of addresses (This does however mean that the credentials to access the iLO must be the same). The schema will be changed to loop through the addresses.

The second approach is the one I favour - we create a new workflow which has duplicate inputs, with the exception of an addition for an array of addresses. The workflow loops through the addresses and calls our original workflow with the other inputs. This method means that we only have one workflow which contains the code that upgrades the iLO, so there is less to manage/maintain.

The workflow in this case will look like this:

with the following inputs:

Updating an ESXi Cluster using a custom attribute

To take this a step further, each ESXi host has a custom attribute with the address of its iLO (work Host so address is blanked):

A workflow is created that will get all the hosts in the cluster, and for each host retrieve the custom attribute. If a value exists, then the original workflow is called to upgrade the firmware. This workflow will only upgrade one physical server at a time, even though there is (or should not be) any impact on the running workloads. It’s just less risky, and isn’t that what our job is really about ? ;)

The challenge here will be ensuring that hosts have a completed (and valid) address for the iLO.

vSphere Client Integration

Still using the Flash Client because it allows you to call vRealize Orchestrator workflows ? Yep, me too. We can export the workflows we’ve created here to make them available on the context menu for hosts and clusters - thus making the upgrade even easier !

Further Automation / Improvements

Taking this further would be to wrap this in an interface (custom HTTP, ansible, etc) that allows end users to provide the firmware file and the host(s) or cluster(s) to upgrade.

This is beyond the scope of this post, but could be provisioned through your DevOps platform of choice. Let me know your thoughts on this one !

Summary

The workflow(s) and associated actions/etc are all available to download via the button below.

Download package file

I hope you’ve found this useful, please let me know your feedback and whether it helped. Thanks for reading :)

Modifying cross forest members of Active Directory groups

Mon, 11 Mar 2019 00:00:00 +0000

Adding users to groups within the same domain using Powershell is quite simple - there is a cmdlet Add-ADGroupMember (and removing them is just as easy !), but how we accomplish when one domain contains groups and has a one way trust with a domain in another forest that contains the users ?

This is a rhetorical question ;) Assuming we are running from the domain containing the groups, the other domain needs to be mapped to a PSDrive. Once done we can search for the user and use the Add-ADGroupMember cmdlet to add them.

Removing users is nearly as straight forward, though I only had success using Remove-ADPrincipalGroupMembership to remove the remote user.

We will need to know:

The name of the remote domain.
A credential for the remote domain.
The name of the group.
The samaccountname of the users to add or remove.

I’ve written a script below, which is able to add and remove users to a group in single call. There is no need to specify the domain controller for the remote user domain as this can be discovered (I’m assuming your DNS is configured correctly and healthy !). However this has not been tested:

In a two-way trust.
Running in the user domain/forest.

param([Parameter(Mandatory=$true)][string] $GroupName = $(Read-Host -Prompt "Please enter a group name"),
      [string[]] $Add = $(Read-Host -Prompt "(optional) Please enter the names of any users to add to the group"),
      [string[]] $Remove = $(Read-Host -Prompt "(optional) Please enter the names of any users to remove from the group"),
      [Parameter(Mandatory=$true)][string] $RemoteDomainName = $(Read-Host -Prompt "Please enter the remote domain name"),
      [Parameter(Mandatory=$true)][PSCredential] $RemoteCredential = $(Get-Credential),
      [string] $RemoteDC,
      [switch] $Confirm)

# Ensure that this is loaded. Fail if not.
if ($null -eq $(Get-Module ActiveDirectory)) {
	Write-Host "Attempting to load ActiveDirectory module.";
	try {
		Import-Module ActiveDirectory;
		Write-Host "Loaded ActiveDirectory module." -ForegroundColor Green;
	} catch {
		Write-Host "Could not load ActiveDirectory module" -Foreground Red;
		exit;
	}
}

# Try and connect to the remote domain.
$domain = Get-ADDomain $RemoteDomainName -Credential $RemoteCredential -ErrorAction SilentlyContinue;
if ($null -eq $domain) {
    Write-Host "There was an error retrieving domain information for $RemoteDomainName" -ForegroundColor Red;
    exit;
}

# Get the group in the local domain.
$group = Get-ADGroup $GroupName -ErrorAction SilentlyContinue -Properties *
if ($null -eq $group) {
    exit;
}

if ($group.GroupScope -ne "DomainLocal") {
    Write-Host "The group $($group.Name) has scope $($group.GroupScope)";
    Write-Host "The group is not configured to contain remote users." -ForegroundColor Red;
    exit;
}

# Get the remote domain details.
$RemoteNetBIOS = $domain.NetBIOSName;
$RemoteDN = "//RootDSE/$($domain.DistinguishedName)";

if ($null -eq $RemoteDC -Or $RemoteDC.Length -eq 0) {
    $dc = Get-ADDomainController -Discover -DomainName $RemoteNetBIOS
    $RemoteDC = $dc.HostName;
}

# Try and map the remote domain to a PS drive.
try {
    New-PSDrive -Name $RemoteNetBIOS -Credential $RemoteCredential -Root $RemoteDN -PSProvider ActiveDirectory -Server $RemoteDC | out-null

} catch {
    Write-Host "There was an error connecting to the $RemoteDomainName domain." -ForegroundColor Red;
    exit;
}

foreach ($username in $Add) {
    if ($null -eq $username -Or $username.Length -eq 0) {
        continue;
    }

    # Get the user and add to the group.
    $user = Get-ADUser -Filter {SamAccountName -eq $username} -Server $RemoteNetBIOS -Credential $RemoteCredential;
    if ($null -ne $user) {           
        $group | Add-ADGroupMember -Members $user;
        Write-Host "$username was added to the group '$GroupName' successfully." -ForegroundColor Green;

    } else {
        Write-Host "Could not find a user with the username '$username'" -ForegroundColor Red;

    }
}

foreach ($username in $Remove) {
    if ($null -eq $username -Or $username.Length -eq 0) {
        continue;
    }

    $user = Get-ADUser -Filter {SamAccountName -eq $username} -Server $RemoteNetBIOS -Credential $RemoteCredential;
    if ($null -ne $user) {
        Remove-ADPrincipalGroupMembership -Server $RemoteNetBIOS -Credential $RemoteCredential $user -MemberOf $group -Confirm:$Confirm;
        Write-Host "$username was successfully removed from the group '$GroupName'" -ForegroundColor Green;

    } else {
        Write-Host "Could not find a user with the username '$username'" -ForegroundColor Red;

    }
}

# Unmap the remote domain
if ($null -ne $(Get-PSDrive -Name $RemoteNetBIOS -ErrorAction SilentlyContinue)) {
    Remove-PSDrive $RemoteNetBIOS;
}

The script doesn’t take into account if the user is already a member of the group - the way to do this is to retrieve the groups “member” property and use the SID to check against the user.

As usual, let me know if this is useful or you have any other corrections/comments. I’ve put this into a simple script located here as the script “Set-ADGroupTrustedForestMembership.ps1”.

Managing Snapshots with vRO

Mon, 25 Feb 2019 00:00:00 +0000

One of the main issues that face departments on their virtualisation journey is how they are managing snapshots:

Who can take them
Who can delete them
How long do they stick around for
Name/Description formatting policy

I consider them ’low hanging fruit’ on the management tree - how an organisation approaches this is defined by policy and there shouldn’t be anything too contentious involved. There are also options to have the snapshots deleted automatically, with most management software providing the function. If you don’t have this, then a vSphere alarm can be created to warn on snapshots sizes.

There was no option to automatically remove snapshots that was in accordance with the policy that was agreed at a previous role, so it was time to automate something :). One of the items revolved around communication to the snapshot owner - it is very important to inform them that the snapshot will be automatically removed and when it has been. Another item was where some snapshots that might be automatically cleared up would need to be held for longer - perhaps as a part of a Root Cause Analysis investigation.

Requirements

From the above, the requirements are this:

Inform the user who took the snapshot that it will be deleted in X days, daily until deleted. (X should be configurable).
Inform the user that the snapshot has been deleted.
Report to a team/email address details on all snapshots present and estimate the space use.
Exclude Virtual Machines from having their snapshots automatically deleted.

These will mean that:

The workflow will always produce a report. Therefore our input values should include an email address.
A means of identifying a Virtual Machine as being excluded. We could supply a list, or a naming format to match, a tag or a custom attribute.
Given that we can retrieve the username of the person who created the snapshot (it is contained within the event), we still need a means of identifying the email address of the user.

My preference for the second item above is to use a tag as we can retrieve VMs easier from a management perspective.

The identity source for the vCenter is assumed to be Active Directory, thus we would have the further assumption that no local accounts are allowed (or only in exceptional circumstances) and will be taking snapshots. We can therefore use the Active Directory plugin to query for the user and retrieve the email address. However we should also handle the edge case that the user does not have an email address set, or it is not valid - therefore we will issue warning emails to an appropriate team that the end user was not/cannot be warned of the snapshot expiry.

In summary, our input values are:

# Days when start to warn end users of deletion.
# Days when the snapshot should be deleted.
Email address in case of errors.
Email address for the report.
Tag name for VMs to be excluded from snapshot management.
A ‘WhatIf’ to control whether action is taken.

Our vRO server will also need to have the Active Directory plugin active and configured.

We also need to deal with another assumption - there can be more than one snapshot on a VM, and multiple snapshots may need to be deleted on each day.

\[Hindsight\]

After creating the workflows I added another couple of inputs:

Minimum age of VM snapshot to appear on the report.
Subject of the report.

Workflows

I write vRO workflows in a decentralised manner - for example if I am to do something with a Virtual Machine I have a workflow for:

The Virtual Machine
The Cluster
(Sometimes) The Datacenter
vCenter Server

This can add up to a lot of workflows, but it allows for testing and iterating changes easily. I will often put a “WhatIf” input on the Virtual Machine workflow so that I can test the workflows that function at a higher level - this ties in with the identified inputs earlier. So in this case, the workflow design mirrors the above (but without a datacenter script).

Additionally, when communicating to people the details of a VM with a snapshot I include Custom Attributes and Tags. So the workflows below will contain some tagging actions that I really need to release ;)

Virtual Machine

This workflow will need to do the following:

Get the snapshot information for a VM.
Calculate snapshot size (if possible).
Get the tags for a VM.
Add information to the report.
Check the tag to see if the VM will have it’s snapshots automatically managed.

If the VM is to be automatically managed, it will need to do:

If the snapshot is older than the warning age, send a warning to the snapshot creator, or the errors address.
If the snapshot is older than the deletion age, send a notification to the snapshot creator, or the errors address.

I’ve separate the above into two lists as I think the logic flows naturally in this way - the first list will apply to every VM that we examine whereas the second will only apply to those VMs with snapshots that we will manage. Thus we can break the logic up into two workflows.

Disclaimer: I’m assuming some familiarity with Orchestrator here, and there are plenty of other awesome blogs introducing the tool, so I’m going to dive in to some completed workflows.

The schema for the first flow is below:

Some notable steps:

Excluded from snaps - This is where the tag is checked.
Automatic Management - This is where the WhatIf is handled.
Manage Snapshots - We call the workflow to manage them. This sits inside a loop that will examine all the snapshots on a VM.

Some scripts are included to help with generating the report :)

The schema for Managing Snapshots is here:

The notable steps for this workflow are:

getEmailAddressForUser - this will query Active Directory for the mail attribute for the user identified earlier.
Remove Snapshot - deletes the snapshot and sets a task object so the workflows/entire process operates synchronously.
Customise Email - these write the warning and notification emails to be sent to the end user.

Cluster Workflow

This workflow retrieves all the VMs in the cluster and runs the main VM workflow against it. Nothing special here :)

Clusters / vCenter Servers Workflow

This is fairly standard workflow that goes through all the clusters on a vCenter Server and runs the Cluster workflow. It follows a standard pattern of retrieving a set of items and iterating through them. The end of the schema is devoted to sending the report email.

Configuration Element

As I wrote this a while ago, I put all the configuration inside a Configuration Element so that configuration variables could be updated once a workflow was scheduled. Please excuse my naming format, it does the job but the names made sense at the time I promise !

These names match the inputs that the workflows take:

Emails

Here is an example of the report email running on a live environment:

An example of the email notification a user receives about their snapshot (some field values have been removed):

Download

The workflows, actions and configuration element is available to download here. The package includes the following workflows

Once the package is imported, run one of the workflows and let me know what you think ! You’ll be able to run the cluster and VM workflows without having to configure a Configuration Element.

Download package file

Improvements

The most obvious improvement to this workflow would be to made the notifications optional and controlled via an input. Maybe something for a rainy day ;)

Let me know if this was useful or interesting to you !

ScaleIO 2.5 Upgrade advice

Thu, 03 May 2018 00:00:00 +0000

I’m getting into ScaleIO (Software Only) so am still quite new to the ecosystem and management commands, but having just gone through an upgrade cycle to the 2.5 release (from a later version than 2.0.0.1) I thought I’d note down my experience from doing a ScaleIO 2.5 upgrade and some things that might be useful to anyone else who does this.

Please note that this is just me experience and I am not to be considered a guru in all things ScaleIO. I’m happy to be corrected and educated :)

MDM certificates

Ensure these are accepted before you begin otherwise you’ll have to accept them and restart. Not a big deal, but just one of those nice things for a smooth process :)

SLES uploads

After extracting the software upgrade there are two folders - SLES11_3 and SLES11_3.SVM. Installation Manager will show you which one you need to upload:

LIA Passwords

Mine were identical on every node and I saw no problems but I would expect there to be errors if not.

Upgrade the SDCs automatically

I don’t know whether this box should be ticked. The PDF said to tick it, and a VxRack guide said not. I would guess that this should install the vibs ready for the ESX restart, but I don’t know for sure. As it would need ESX root passwords and SSH enabled I would hope that we would get prompted.

ScaleIO GUI Tools

The GUI Tools for 2.0.0.3 appeared to work with 2.5. The guide doesn’t say when to upgrade them - I did after the install completed but before upgrading the SDCs (Hosts).

Enabling SSH on ESXi hosts

This is so much easier via the HTML5 interface !

Updating SDCs

Instead of using the ScaleIO plugin and enabling SSH / root access to upload the VIBS - why not upload the zip file to Update Manager, configure a baseline and remediate each host ? Way easier !

The power down sequence for a host with an SDS is:

Maintenance mode the SDS node
Power down the SDS node
Maintenance mode the ESXi host

Then we can remediate. Reverse the order to bring back online.

Switch the Primary/Master MDM

You will need to run the commands:

scli –login –username (you will then be prompted for a password) scli –switch_mdm_ownership –new_mdm_target_id

I got the ID from the scli –query_cluster command, where it must be one of the slave MDMs.

Rebalance/Rebuild

I love how fast this is :)

Overall, this was relatively painless upgrade with so much potential to automate - especially the ESXi section. But that’s for another post !

Detach old ESXi installation devices

Thu, 22 Mar 2018 00:00:00 +0000

When clearing up host storage, you might sometimes encounter an error when you come to detach a device. The cause of this can be an old ESXi installation and you’ll need to erase the ESXi partitions in order to detach old ESXi installation devices.

The typical use case for this is reclaiming SAN boot LUNs that are no longer required since we’ve moved to SD card / Local disk / AutoDeploy. Reclaiming unused storage is always a good idea ;)

The first step in the process is unmounting any datastores that exist on the device:

When Unmount is selected, we’ll need to confirm the hosts to unmount from:

The UI should update to show that it is now unmounted.

If this was a normal device we would then detach it - let’s do this now.

Aha, we get an error message:

This means that an ESXi install has been found on the device, even if it is old and inactive. In order to get past this, we will make sure this isn’t an active installation and then we will erase the partitions on the device.

A summary of the partitions is displayed and confirmation of erasure is required:

The device can be successfully detached now that the ESXi installation has been erased.

That’s it :) I’m sure there is a way to automate this, but I only had a few to do so I took the lazy way out this time !

vRealize Orchestrator: Finding a REST Host from a vCenter SDK connection

Tue, 13 Mar 2018 00:00:00 +0000

vRealize Orchestrator can communicate directly with the vCenter Server(s) that it is connected to, but uses the old SOAP API. However, with the advent of the REST API for vSphere, some things are easier (for example, tagging) and only possible to handle outside of the builtin abilities. In this post I will look at how to find a REST Host from a vCenter SDK connection in vRealize Orchestrator - this can be used to reduce the number of inputs on a workflow or make it easier to create multiple-vCenter workflows.

Each vSphere object has an “sdkConnection” property that refers to the vCenter Server. This is useful, but if you wish to use the REST API, we’ll need to provide a RestHost object type. We could provide that as an input to the workflow, but this is not dynamic and we shouldn’t force unnecessary parameters on users.

There must be an easier way, right ?

We should assume that every vCenter Server that is connected to vRealize Orchestrator is also configured as a Rest Host. This configuration only needs to be done once, though we will look at automating this at the end of the article.

Thus, we can enumerate the REST Hosts and find the one we’re after by comparing the URL of the vCenter API endpoint to the vCenter REST API endpoint. There is a catch in that the URLs are different so we will need to do a little string manipulation to make it work.

For example:

The vCenter Server is https://auto-vc.auto.internal:443/sdk
The REST Host is https://auto-vc.auto.internal/rest

I believe it is a fair assumption that the protocol will always be https for both, so we can ignore that - to match up we would need to ensure that the vCenter Server has been added with either the FQDN or hostname identically in both locations - if not then the lookup will fail. Personally I don’t see anything wrong with always using the FQDN :)

Adding a REST Host

I have no doubt that this has been done many times before on many other blogs, but for the sake of completeness I will document how I’ve added the REST host below.

This next step is me being lazy - I’m going to pass in the SSO administrator credentials. This is not best or even good practice - you should pass in user credentials or a role-limited vco-specific account.

I haven’t included screenshots of the (3a) and (4a) wizard pages - I have accepted the defaults. Change if you need to !

Comparing Values

Our code will need to strip the protocol and the port (if either of them exist) from an URL, returning the hostname. We’ll use this on both the vCenter URL and every REST Host URL to see if they match. Since this is a straight forward bit of a code, we’ll put it in an action.

The main configuration of the action is below:

As seen above, the action assumes an input named “vcenter” of type VC:SdkConnection and returns an output of type REST:RESTHost.

// Trim out protocol and match url up to the : or "/".
function gethostname(url) {
	var hostname = url.substring(url.indexOf("://") + 3);
	var port = hostname.indexOf(":");
	var slash = hostname.indexOf("/");
	
	var end = -1;
	if (port != -1 && slash != -1) {
		end = (port < slash) ? port : slash;
	
	} else if (port == -1 && slash != -1) {
		end = slash;
	
	} else if (port != -1 && slash == -1) {
		end = port;
		
	}
	
	hostname = hostname.substring(0, end);
	return hostname;
}

var vcenter_hostname = gethostname(vcenter.name);

var hosts = RESTHostManager.getHosts();
for each (var current_host in hosts)
{
	var rest_host = RESTHostManager.getHost(current_host);	
	var rest_hostname = gethostname(rest_host.url);
	if (vcenter_hostname == rest_hostname) {
		host = rest_host;
		break;
	}
}

The “gethostname” function is responsible for stripping the URL down to the hostname. We use the RESTHostManager object to loop through configuration hosts and return the host if there is a match.

Now when creating workflows that would require a REST Host object, we can retrieve the correct object from the sdkConnection property of the managed object, thereby removing the need to add another input to the workflow, and if you have a workflow against multiple vCenters this should really make life easier !

Next Steps

We will take this on to do some vSphere tagging using the REST API :)

Summary

I’ve created an action for this and saved it in my github - the unencrypted action file can be found here.

Let me know your thoughts in the comments :)

Multiple service vROPs dashboard

Tue, 30 Jan 2018 00:00:00 +0000

aving worked with vRealize Operations Manager (vROPS) for a little while now, one of my aims was to enable end-users, i.e. application support teams and VM owners, the ability to log in and see a dashboard of all the VMs that are related to their service. Setting up a dashboard for each service seemed relatively straight forward but I didn’t want to manage any more dashboards than necessary - if a change needed to be made then I only wanted to do it once. So, my quest became on how to get a multiple service vROPs dashboard, so that end-users would only be able to see the services that were appropriate to them.

As there is an article (and you’re reading it !) it is possible to do and combines permissions with a custom group type to deliver. When it is done, we’ll have a dashboard that will let us view the list of VMs in a service, and the infrastructure utilisation statistics for it.

Pre-requisites

Before you begin, you must identify how you are grouping service VMs together. For example, the VMs could:

all be in the same cluster or resource pool.
all be in the same VM folder.
have a tag with the service name.
all share a common part of your naming convention.

Sadly, custom attributes will not work here as I have not found a way for vROPS to load them as attributes.

Take some time and write out what services you have and how you identify everything related to them. It may be that some VMs are used by more than one service (possibly database servers ?) so how do you handle this ?

Custom Group Type

We need to add a group type that will be used as a container for all our custom groups. I recommend, as with everything in vROPs, that you prefix this. As this is part of my “auto.internal” infrastructure (where I test out automation in my home lab) I’m going to be prefixing with “Auto”. So, under Administration and Configuration there is an option for Group Types (pictured below). Select it and press the green plus button to add a new group type.

The box below will appear - type in the name of the container for the service groups. This container will appear in the Environment/Custom Groups structure. When done, press OK.

Custom Groups

When this is done, navigate to Environment, and leave Custom Groups selected. On the left hand side, under Groups and Applications, select Custom Groups in order to show the structure. You should see your new container listed (as below):

Now it is time to create some service groups. Using the Actions button at the top of the main part of the window, select to create a new group - give it an appropriate name (again with the prefix !) and select the group type as the container you’ve just created. If you are using dynamic criteria to set the group (i.e. tagging, cluster/resource pool/folder membership) then select to keep the group membership up to date.

Setting a policy is up to you - in my case I have a policy set for these VMs with a higher priority, so the policy setting here is disregarded.

The picture below shows how to set up a Custom group based upon a vSphere Tag:

The group in the image below is all the Virtual Machines that are running a flavour of Windows.

I created another group (identical to above but containing the word “Linux”) and the result is that I have three groups in the image below. These groups are purely for example, you can do this for SQL servers, Exchange servers, custom applications, management tools, domain controllers. I suspect it is easier if you are using the Service Discovery Management Pack, but I haven’t tried this out yet ;)

Access Control

This next step assumes that you have linked your instance of vROPs to Active Directory as an authentication source. I’m not going to cover how to do this here as there are more than a few guides (in addition to the official documentation) available online.

Once we have custom groups created and vROPs joined to AD, we either create or use an existing Active Directory security group to control access. In the image below, I’ve created a new group for each of the services that we just created:

Now that we have security groups for access we must import them. This is done on the Administration, Access and Access section. Navigate to the User Groups section and press the Import button.

From the picture below, I have searched for the new security groups and ticked the ones I wish to import. The “vctr_auto_admins” group has a grey tick as it has already been imported.

At this stage don’t assign any roles or permissions to the user groups as this will be done individually afterwards. Select a group and use the pencil icon above the list:

In this case, members of the group will be given ReadOnly permission to the group - though a customised (and more restrictive role could be used). After selecting the role we must tick the Assign this role to the group box in order to select what we will apply the role to. In the left hand column select Custom Groups and in the right hand column put a tick next to the service name that we wish to apply it to.

Ensure Propagation is enabled, so permissions are applied to the objects (Virtual Machines, Hosts, etc) that are included into the group.

The multiple service dashboard

We have our services and we have controlled who has access to them, it’s now time to build the dashboard that they will use.

Go to the Dashboards section and selection Actions and Create Dashboard (pictured below).

Give the dashboard a name, and as below I have added the prefix to ensure it won’t be overwritten by updates.

Under Widget List, drag an Object List onto the dashboard. This will automatically populate with everything, and you can see below some of the other objects that exist in my Home Lab :)

Edit the Object List settings using the pencil at the top of the widget. Make changes as below:

Set a Name to describe what the list of objects is.
Set Auto Select First Row to On.
Our Group Type is an Object Type that we can filter upon. Open up the list of Object Types, find it and select it.

The dashboard will now look as follows:

Add a second Object List to the right of the Services widget:

I have edited the settings of the Object List to change:

the Name, to something appropriate.
limit the Object Types to Virtual Machine
change the Mode to Children**.**

I prefer Auto Select First Row being set to On (in most cases) as it will automatically show some information to the end user, without having to imply that they need to click something else to load data.

On the left hand side select the next tab - Widget Interactions - change it so the Inventory list displays data based upon the Services selection. This is pictured below.

Press Apply Interactions to save changes and then Save to save the dashboard.

At this point you could create widgets that show the performance of the VM (taking the selection from the inventory list), or perhaps an overall view of the service, but I’ll leave that up to you :)

We will now tidy up the user experience a little by sharing our dashboard and moving it to the top of the dashboard list. Select All Dashboards and Manage Dashboards.

When the page has opened, select the gear button and press Reorder/Autoswitch Dashboards.

Re-order the dashboards (to put the service information at the top). To do this, use the “hamburger” picture on the right to grab and drag to the correct position. Sadly there is no “To top” bottom, so the more dashboards that exist, the more dashboards this dashboard needs to be dragged through :(. When done, press Save.

To share the dashboard, go back to the gear icon on the “Manage Dashboards” page and select Share Dashboards:

Most of the dashboards are shared by default, however I like to curate the experience of users to ensure they only see the dashboards they would be interested in. On the left is the list of groups that exist in the system with the number of dashboards that have been shared to them. A red mark (as above) in the same column as a number indicates that there have been changes. The selection in this left side determines what is displayed in the “Shared Dashboards” section - either a list of dashboards shared to a group, or all the dashboards in the system.

We will begin by removing all the shared dashboards- select Everyone and select all (or as many dashboards as possible) and use the Sharing button (the picture of a yellow person with a line through them) at the top to unshare all dashboards from everyone. Do this until the number is 0.

Now select Not Grouped and find the Service dashboard that you have created. Drag it onto the group names on the left, so the numbers change - this means the users in those groups will now see that dashboard. In the picture above the “vctr_auto_admins” group can see other dashboards about the infrastructure that have been shared.

Save the window.

Now it is time to test ! Log in as a user - below I have logged in as the Windows user:

This change means the user can only see the Windows service in the list, and the Virtual Machines that are members of this group (the Inventory on the right).

If a user has rights to more than one group, they see multiple options in the Services list. Below is a user that has rights to both the Linux and the Windows groups.

We now have a single Service dashboard that we manage for all services, and will allow people who manage more than one service to see information about those services separately.

The next things to do would be:

Planning your dashboards to show relevant service/server information.
Curating the role permissions to define a directed user experience (i.e. does the user need to see Alerts or Environment ?

vRealise Log Insight and Orchestrator

Fri, 15 Sep 2017 00:00:00 +0000

I’m a big fan of the vRealize suite as it really adds value to a vSphere deployment. In relation to this post, LogInsight is a great tool for providing log analysis and Orchestrator manages workflows to automate and orchestrate most/all of the infrastructure.

A series of postsÂ on vmware.com - “Self Healing Datacenter” - have examined how to connect Operations Manager to Orchestrator using a shim - the first part of the series is here.Â The shim is also capable of taking input from LogInsight, though this isn’t covered by the articles.

That webhooks are offered for LogInsight is great, but it is sad that there is no official tool to send events/data from one product in the vRealize suite to another. I’m interested in how and why things work (and also because it doesn’t appear to work quite right), so instead of using the shim presented in the series above I’m going to write my own in node.js so we can look at how this all works.

Environment

In this environment we’ll be using vRealize LogInsight 4.3 and Orchestrator 7.2, both which have a straight forward and simple deployment - both are single servers (no clusters !) and both are configured to a vSphere 6.5 deployment.

In vSphere we create a nested host to test against, and have put it in its own cluster. I’ve done this because some of the actions I want to take involve shutting the host down (not always gracefully) and I don’t have the spare physical hosts to do this (e.g. the auto-esxi VMs below are the hosts in the Nested cluster).

LogInsight has been set up with vSphere integration - all hosts (including the nested host) have been configured to send syslogs to the LogInsight address. A look at the “Hosts” page in the LogInsight Administration section shows that logs are being successfully received:

Integration

It isn’t actually possible for LogInsight to start Orchestrator workflows, the closest we can come is by using the “webhook” functionality when setting up an alert - this will make an HTTP request to an URL with some information when something happens (below is an example of our LogInsight query for a host going into maintenance mode).

It is because the vRealize Orchestrator API requires some additional parameters that we can’t start Workflows, and when we look at the schema on the swagger API reference page (https://

:8281/vco/api/docs/index.html - where

is the FQDN/IP of your Orchestrator server), we can see what is required:

WebHook Shims

The shim referenced in the “Self Healing Datacenter” series can be found as the “log insight webhook-shims” on githubÂ (this also works with vROPs). To test this I deployed a Photon OS instance and installed it via docker:

systemctl enable docker
systemctl start docker
docker pull vmware/webhook-shims
docker run -it -p 5001:5001 –name lishims vmware/webhook-shims bash

The public page for this docker container shows how to set it up -Â https://hub.docker.com/r/vmware/webhook-shims/ - and after this we need to configure the vRealize Orchestrator connection in the container. At the command line, enter the following:

vi loginsightwebhookdemo/vrealizeorchestrator.py:

When this file is saved we can start the server within the container:

./runserver.py

As per the INFO message above, if we browse to http://

:5001 (where

is the FQDN/IP of the server running the shim) we get a guidance screen on how to use the software - scroll down to view the advice on how to integrate with vRealize Orchestrator.

Now we can return to our LogInsight query and set up an alert based upon it. Select the Alert button on the UI and the following window will appear:

Select the Webhook notify option and put in the formatted address of the webhook server:

http://address : port / endpoint / vro / workflow-id

Aha, we don’t have a workflow set up so we don’t know what worfklow-id to type in here - let’s do this now. Open up the vRealize Orchestrator client and create a new workflow - we’re going to keep this one simple and just write something in the log, the schema for which is below:

When we look at the details of the workflow we see the ID to use the alert:

So now we have a workflow id we can create our LogInsight alert. Go back to the LogInsight alert configuration page, update the webhook and URL and save.

Workflow problems

Time to put a host (that is configured to send syslog to our LogInsight server) into Maintenance Mode - which I did I 0753 in the screenshot below:

We see the following workflow implementations:

Woah - we only put the host into maintenance mode once and the workflow was started 10 times - what could have happened ? The sequence of what happens is:

LogInsight matches the query and notifies shim server via webhook.
Shim server receives request and formats a vRealize Orchestrator API call. Sends to vRealize Orchestrator
vRealize Orchestrator starts the workflow.

If you were watching the console of the Photon OS container then you would have seen that for every workflow invocation a new request was sent by the webhook shim code. So this excludes vRealize Orchestrator from causing this, but is the shim code receiving a new notification for every workflow ?

I did toy with the idea of setting up port mirroring via a distributed switch and using Wireshark to check only one request was sent, but this seems unnecessarily complex. Â The is another way :)

Node.js

We can spin up a very simple node.js server that logs out every request that is made to it. Our server code looks as follows:

// include the http module
var http = require('http');

// create a webserver
http.createServer(function (req, res) {

    // respond to any incoming http request
    res.writeHead(200, {'Content-Type': 'text/plain'});
    res.end();
    console.log("Request Received.\n");

}).listen(5001, '127.0.0.1');

// log what that we started listening 
console.log('Server running at 127.0.0.1:5001');

When we put a host into maintenance mode now we can see that we only receive one email and that our notification monitor only receives one request from Log Insight. So the problem is somewhere in the shim server. But in the spirit of creating stuff and learning something new, let’s write our own shim server !

The main body of our server function is:

var responseCode = 500;

// Get Body	
var request_body_array = new Array();
req.on('data', function(chunk) {
	request_body_array.push(chunk);
});
	
req.on('end', function() {
	var request_body = "";
	if (request_body_array.length > 0) {
		request_body = request_body_array.join('');
	}

	responseCode = handle_request(req.url, request_body);
	res.writeHead(responseCode, {'Content-Type': 'text/plain'});
	res.end();
});

This is really straight forward and will receive the full request and call handle_request (which I’m not going to detail Â here), which will then invoke the call_vro function with appropriate parameters.

In our call_vro function we will need to set up the parameters for the Orchestrator call:

var creds_base64 = new Buffer(vro_username + ":" + vro_password).toString('base64');
var messages_value = new Buffer(request_body).toString('base64');

var request_body_json = JSON.parse(request_body);

var vro_execution_context = {
	parameters: [
		{
			name: 'messages',
			description: 'Base64 encoded JSON of LogInsight messages',
			scope: 'local',
			type: 'string',
			value: {
				string: {
					value: messages_value
				}
			}
		},
		{
			name: 'alertName',
			scope: 'local',
			type: 'string',
			value: {
				string: {
					value: request_body_json.AlertName
				}
			}
		},
		{
			name: 'hitCount',
			scope: 'local',
			type: 'number',
			value: {
				number: {
					value: request_body_json.HitCount
				}
			}
		}
	]
};

var workflow_request_body = JSON.stringify(vro_execution_context);

The code above sets up the basic authentication string and defines the parameter arrayÂ for the request. We are going to provide three parameters for the workflow:

messages - the messages passed by LogInsight. These will be Base64 encoded so Orchestrator will need to decode them.
alertName - the name of the alert that was configured in LogInsight.
hitCount - the number of times this alert was triggered.

As our alert should be triggered on every invocation we won’t worry about hitCount for now - but we should make a note to test this later.

After the parameters have been set up, they are convered to a JSON string for the request. We can see below in the request header set up that we are declaring our content is JSON.

var vro_auth_options = {
	host: vro_server,
	port: vro_port,
	path: '/vco/api/workflows/' + workflow_id + '/executions',
	method: 'POST',
	rejectUnauthorized: false,
	headers:  {
		'Accept': 'application/json',
		'Content-Type': 'application/json;v=5.1.1',
		'Content-Length': workflow_request_body.length,
		'Authorization': 'Basic ' + creds_base64
	}
};

var auth_data_array = new Array();
var callback = function(response) {
	response.on('data', function(chunk) {
		auth_data_array.push(chunk);
	});

	response.on('error', function(chunk) {
		console.log("ERROR = " + err.message);
	});

	response.on('end', function() {
		var auth_data = auth_data_array.join('');

		if (response.statusCode == 202) {
			if (auth_data.length > 0) {				
				var res = JSON.parse(auth_data);
			}

			console.log("Workflow " + workflow_id + " successfully started");

		} else {
			console.log("Workflow execution response: " + response.statusCode);
		}
	});
}

const req = https.request(vro_auth_options, callback);
req.write(workflow_request_body);
req.end();

This code sets up the connection, defines the functions for what happens when the request errors or is complete and then makes the connection (https.request at the bottom). If we receive an error code of 202 then all is good !

Mental note: current status codes for starting a workflow:

Trying it out

When we put a host into maintenance mode now we can see that we only get one Orchestrator workflow generated for each alert. But if we look at Log Insight, the alert is examined every 5 minutes:

So what happens if we put two hosts into maintenance mode before the alert is examined ?

This is the console of the server:

Looking at the request that has been passed we can see that there are messages for both hosts, but we only have one workflow started:

We need to look at how we pull out the information contained in the ‘messages’ input variable. First, we need to download and install a plugin that will allow us to decode base 64 strings. This can be obtained from Â https://github.com/vmware/o11n-plugin-crypto and installation is straight forward from the Control Center. After installation, the vCO service needs to be restarted (not the server) - the message stating the service needs to be restarted doesn’t disappear immediately, but it does go :)

Then we need to modify our workflow to accept these parameters:

I’ve also added an attribute to the workflow with the name “hosts” and type “Array/string” - but you can omit this and comment out the lines that reference this attribute. We can now add a scriptable task with the following:

// Decode the string and parse into a JSON objecct.
var decoded_str = CryptoEncoding.base64Decode(messages);
var li_obj = JSON.parse(decoded_str);

// Create the array to hold our hosts detail.
hosts = new Array();
for each (var item in li_obj.messages)
{
	// Get the Host name
	var hostname = "";
	
	for each (var field in item.fields)
	{
		if (field.name == "__li_source_path")
		{
			hostname = field.content;
			break;
		}
	}
	
	// Debugging: Write out the host name.
	System.log(hostname + " has entered maintenance mode.");
	
	// Add to the array.
	hosts.push(hostname);
}

This is what we see now in the Logs section for the workflow when we put two hosts into maintenance mode for the same alert interval - we can now handle more than one host, and identify which host has gone into maintenance mode.

Summary

So we can now decode the messages we receive from LogInsight and work with multiple messages - I’ve left the node.js console printing out the contents of the request (line 34) in order to help identify useful fields of information. This needs some tidying up to be useful (and a solution for storing username/passwords in the node.js file should be found) but hopefully is a good proof of concept of what is capable.

As usual, the code is available on github - https://github.com/nelons/loginsight_webhook_shim. Feel free to use/abuse in any way you like, let me know if I’ve made a mistake or if you found this useful.

Detaching Devices from a Cluster

Mon, 14 Aug 2017 00:00:00 +0000

When working with block storage we occasionally need to remove a storage device from the hosts it is connected to. When using the Web Client we can detach devices on a per-host basis, but there is nothing to detach from all its attached hosts.

What we do have is a helpful KB article on how to remove/detach a datastore -Â https://kb.vmware.com/kb/2004605Â and a PowerCLI file that contains some functions. However the functions revolve around managing actions on datastores as opposed to devices that are connected and could be used for RDMs.

Most LUNs are masked to all the hosts in a cluster so that, whether the device is an RDM or has a VMFS datastore on it, VMs can run on any host in the cluster. To deal with this use case, I use a script that will detach a device from every host in a cluster. If the device does not exist on Â a host then an error is displayed and the script moves on to the next device/host.

Before we can detach a device we need to ensure the following:

It is not used for a datastore.
It is not in use as a RDM.
The perennially reserved flag is not set for the device on the host.

The last point comes from the KB article above - if the flag is set (and it should be for any RDMs) then it could prevent the device from being unmounted successfully. So although clearing the flag is not required, clearing it ensures the best chance of success.

So, our script will start off with the following - we will accept a cluster to unmount/detach the device(s) from, an array of device identifiers, and a switch that will allow us to do checks without actually detaching anything.

param(
	[Parameter(Mandatory=$true,ValueFromPipeline)][VMware.VimAutomation.ViCore.Impl.V1.Inventory.ClusterImpl] $Cluster,
	[Parameter(Mandatory=$true)][String[]] $LUNIdentifiers,
	[switch]$CheckUsage = $false
)

For the sake of time, we will make the assumption that all devices are masked to all hosts in the cluster - so when checking what the device is used for we will only check on the first host in the cluster. The following code will get the VMs in the cluster (for checking RDM usage in the next step) and the host that we will use for checking.

$vms = $Cluster | Get-VM;
$cluster_host = $Cluster | Get-VMHost | sort Name | select -First 1

$LUNs_To_Detach = @();
$LUNIdentifiers | % {
	$lunid = $_;
$lun = get-scsilun -VMHost $cluster_host | ? { $_.CanonicalName -eq $lunid }

Finally we will use the Get-ESXCLI cmdlet to check if the perennially reserved flag is set.

`1`	`$myesxcli = get-esxcli -VMHost ESXhost`

When all our checks are complete, we can loop through the hosts in the cluster and attempt to detach the LUN.

	$Cluster | get-vmhost | sort Name | % {
		write-host "Detaching LUNs from $($_.Name)" -Foreground Yellow
		$esx = $_;
		
		$storSys = Get-View $_.Extensiondata.ConfigManager.StorageSystem
		
		foreach ($lunid in $LUNs_To_Detach){				
			$lun = Get-ScsiLun -VmHost $esx | ? { $_.CanonicalName -eq $lunid }
			if ($lun -ne $null) {
				# Ensure the LUN is attached 
				if ($lun.ExtensionData.OperationalState -eq "ok") {
					write-host "Detaching LUN $lun" # from $($esx.Name)"
					$storSys.DetachScsiLun($lun.ExtensionData.Uuid)
					write-host "Detach Complete" -Foreground Green
					
				} elseif ($lun.ExtensionData.OperationalState -eq "off") {
					Write-Host "LUN is already unmounted on this host." -Foreground Green;
					
				} else {
					Write-Host "OperationalState is $($lun.ExtensionData.OperationalState)";
					
				}
				
			} else {
				Write-Host "Could not find LUN $lun on host $esx.Name";
			}
		}
}

The entire script is available from my github here. As always, feel free to fork and make pull requests if you find a mistake.

Finding a UCS Service Profile from the MAC Address

Tue, 08 Aug 2017 00:00:00 +0000

Quick snippet on how to find the name of a service profile given the MAC address.

I found this useful as when troubleshooting ESXi locks, the MAC address of the locking host is shown and sadly not the name. Once I had the name I was able to continue debugging my problem :)

`1`	`Get-UCSCentralServiceProfile \| % { $h = $_.Name; $res = $_ \| Get-UcsCentralVnic \| ? { $_.Addr -eq "<MAC address here>" }; if ($res -ne $null) { Write-Host $h; } }`

This will work with UCS domains not joined to Central (and having global service profiles) - change the code by removing the word “Central” from the cmdlets.

vSphere REST API and C++ (Part 2)

Tue, 13 Jun 2017 00:00:00 +0000

This is the second part in an ongoing series looking at using the vSphere REST API and C++ with the cpp rest sdk (formerly known as “Casablanca”). In the first part we authenticated against SSO and got some information from the vCenter.

In this part we are going to refine our methods so that we can reuse our code. We will introduce some structs and functions that allow us to work with results.

Connecting

The first thing we are going to introduce is a struct that will manage our connection data. It is as follows:

struct vc_info {
  std::wstring server; // The address of the server
  std::wstring token; // The SSO token.

  http_client_config config; // The connection configuration
  credentials server_credentials; // Authentication credentials for the connection

  int last_status_code; // The last HTTP status code we received.
  std::string last_exception; // A text explanation of the last exception
};

All the members are annotated with how they will be used.

We will now assemble a ConnectAsync function which will return a task (and a pointer to a vc_info object). The code looks as follows:

task<shared_ptr<vc_info>> ConnectAsync(const wchar_t* server, const wchar_t* username, const wchar_t* password)
{
	std::shared_ptr<vc_info> pInfo = make_shared<vc_info>();
	pInfo->config.set_validate_certificates(false);
	pInfo->server_credentials = credentials(username, password);
	pInfo->config.set_credentials(pInfo->server_credentials);
	pInfo->server = server;

	http_client client(server, pInfo->config);
	http_request request(methods::POST);
	request.set_request_uri(U("/rest/com/vmware/cis/session"));

	return concurrency::create_task(client.request(request)).then([pInfo](http_response response) {
		// if status is OK then extract json.
		pInfo->last_status_code = response.status_code();
		return response.extract_json();

	}).then([pInfo](web::json::value v) {
		// get and set the token
		std::shared_ptr<vc_object> data = CheckJson(U(""), v);
		if (data) {
			std::shared_ptr<vc_property> value = get_object_property(data, L"value");
			if (value) {
				pInfo->token = value->s;
			}
		}

	}).then([pInfo](task<void> t) {
		// exception catching.
		try {
			t.get();

		}
		catch (const std::exception& e) {
			pInfo->last_exception = e.what();
			printf("Exception: %s\n", e.what());

		}

		return pInfo;
	});
}

As you can see,this function will wrap the call toÂ /rest/com/vmware/cis/session and provision our object to hold information about the “connection”.

It takes a server name, username and password and attempts to connect, returninf a vc_info object with completed information whether it is successful or not. The task chain is similar to what we wrote in part 1, with the exception that we now store the SSO token in the vc_info object. We will use a function “CheckJson” to format the result into an object hierarchy and we will be creating this in the next section.

This is how our ConnectAsync function can be used in a synchronous fashion.

`1`	`std::shared_ptr<vc_info> pInfo = ConnectAsync("my-vsphere.fqdn", L"administrator@vsphere.local", L"password").get();`

Handling JSON

As most calls will return information in a JSON format, we will use the following two structs to store and organise information.The CPP Rest SDK contains some JSON classes, so when we call

`1`	`return response.extract_json();`

on a response, we get a

`1`	`web::json::value`

object that we can use as we desire. We will transform this into our own objects -Â vc_property and vc_object, which are defined below.

struct vc_property {
	std::wstring name;
	int type;

	// unrestricted unions not working on MSVC mean s cannot be a member :(
	union {
		bool b;
		int i;
		double d;
	};

	std::wstring s;
};

struct vc_object {
	std::vector<std::shared_ptr<vc_property>> properties;

	std::shared_ptr<vc_object> parent;
	std::vector<std::shared_ptr<vc_object>> children;
};

As noted, as unrestricted unions were/are not supported on the version of Visual Studio I wrote this on, we exclude the variable “s” from the union. Possibly fixed or working in another complier thoughI haven’t checked.

We now need a function that we will call to extrapolate our JSON and structure it so we can use it. Because objects can contain other objects we may need to call this function recursively. The function takes the name of the key/value pair, the value and the parent object.

// Properties are automatically added to parent. Don't need to be returned.
// Objects are returned to be added to the children ..
std::shared_ptr<vc_object> CheckJson(utility::string_t name, web::json::value v, std::shared_ptr<vc_object> parent = nullptr)
{
	std::shared_ptr<vc_object> result = nullptr;

	if (v.is_array()) {
		for (unsigned int i = 0; i < v.size(); ++i) {
			std::shared_ptr<vc_object> obj = CheckJson(U(""), v[i], parent);
		}

	}
	else if (v.is_object()) {
		result = make_shared<vc_object>();

		web::json::object o = v.as_object();
		std::for_each(begin(o), end(o), [&result](std::pair<utility::string_t, web::json::value> item) {
			CheckJson(item.first, item.second, result);
		});

		if (parent != nullptr)
			parent->children.push_back(result);

	}
	else {
		std::shared_ptr<vc_property> prop = std::make_shared<vc_property>();
		prop->name = name;

		if (v.is_string()) {
			prop->s = v.as_string();

		}
		else if (v.is_integer()) {
			prop->i = v.as_integer();

		}
		else if (v.is_boolean()) {
			prop->b = v.as_bool();

		}
		else if (v.is_double()) {
			prop->d = v.as_double();

		}

		if (parent)
			parent->properties.push_back(prop);
	}

	return result;
}

Note: I believe the array code won’t work at this time - I haven’t worked with any arrays to test yet - we’ll take a look at this later. It will however, handle objects as children and fill in the properties as required.

As an example, when authenticating with ConnectAsync the following information is returned:

We deal with this data with the following code:

std::shared_ptr<vc_object> data = CheckJson(U(""), data);
if (data) {
	std::shared_ptr<vc_property> value = get_object_property(data, L"value");
	if (value) {
		pInfo->token = value->s;
	}
}

The code above should be fairly straight forward - the code will transform the result to a vc_object object called data, and we get the value of the key/value pair with the key of “value” and assign it to the pInfo->token member property.

We are still missing a “get_object_property” function to make the code work. As the code to walk object properties for a specific entry will be commonly used it has been pulled out into it’s own function. This is straight forward and below:

std::shared_ptr<vc_property> get_object_property(std::shared_ptr<vc_object>& obj, const wchar_t* name)
{
	std::shared_ptr<vc_property> result = nullptr;

	if (obj != nullptr && name != 0 && wcslen(name) > 0) {
		std::vector<std::shared_ptr<vc_property>>::iterator find_result = std::find_if(begin(obj->properties), end(obj->properties), [name](std::shared_ptr<vc_property> prop) {
			return (_wcsicmp(prop->name.c_str(), name) == 0);
		});

		if (find_result != end(obj->properties)) {
			result = *find_result;
		}
	}

	return result;
}

Tasks

To do things with the API I’ve written a generic function that can send requests - this is very basic at the moment. One of the ways we can improve this later is to allow for the passing of values in a POST request. The body of the function is below:

task<std::shared_ptr<vc_task>> SendRequestAsync(web::http::method method, std::shared_ptr<vc_info> pInfo, const wchar_t* uri)
{
	std::shared_ptr<vc_task> result = make_shared<vc_task>();
	result->pServer = pInfo;

	return concurrency::create_task([pInfo, uri, method]() {

		http_client client(pInfo->server, pInfo->config);
		http_request request(method);
		request.set_request_uri(uri);

		// We need to pass the token with the request.
		request.headers().add(U("vmware-api-session-id"), pInfo->token.c_str());

		return client.request(request);

	}).then([pInfo, result](http_response response) {
		pInfo->last_status_code = response.status_code();
		result->status_code = pInfo->last_status_code;
		return response.extract_json();

	}).then([result](web::json::value v) {
		// parse the result and store.
		result->data = CheckJson(U(""), v);

	}).then([result](task<void> t) -> std::shared_ptr<vc_task> {
		try {
			t.get();

		}
		catch (const std::exception& e) {
			printf("Get exception: %s.\n", e.what());
		}

		return result;
	});
}

The function takes:

The type of request - i.e. GET, POST, PUT, DELETE
The vc_info object for the server.
The URI to send the request to.

It will return a vc_task object that will contain the status code and the parsed JSON from the response body. The vc_task struct is defined as:

struct vc_task {
	std::weak_ptr<vc_info> pServer;
	int status_code;
	std::string exception;
	std::shared_ptr<vc_object> data;
};

Example

Now we’ve done all of this, we can put this together and try it out - we’ll get information about the hosts. This is the pertinent section of our code:

std::shared_ptr<vc_info> pInfo = ConnectAsync(vcenter_url.c_str(), admin_username.c_str(), admin_password.c_str()).get();
if (pInfo && pInfo->last_status_code == 200) {
	wprintf(L"Connected successfully to %s.\n", vcenter_url.c_str());

	// Get hosts.
	shared_ptr<vc_task> task_results = SendRequestAsync(methods::GET, pInfo, L"/rest/vcenter/host").get();
	if (task_results->status_code == 200) {
		// Do something with the hosts ...
		if (task_results->data) {
			printf("There are %d results.\n", task_results->data->children.size());

			for_each(begin(task_results->data->children), end(task_results->data->children), [](std::shared_ptr<vc_object> host) {
				std::shared_ptr<vc_property> host_name = get_object_property(host, L"name");
				if (host_name) {
					wprintf(L"Host discovered: %s\n", host_name->s.c_str());
				}
			});
		}
	}

} else {
	// Could not connect.
	if (pInfo) {
		printf("ConnectAsync request returned code %d.\n", pInfo->last_status_code);

	} else {
		printf("Unknown error - ConnectAsync did not return server information object.\n");

	}
}

When running this against my home lab (please ignore the different DNS domains :p) I get the following output:

The code is available at the github repo - github.com/nelons/vSphereRestApi - please try it out and give me any feedback you have :)

Next Time

Now we’ve tidied up our structure to allow reuse we’ll look at tags and getting relevant objects.

Using Orchestrator to automatically upgrade Tools

Wed, 08 Mar 2017 00:00:00 +0000

One of the main challenges in every (non-small) place I’ve worked is keeping VMware Tools updated, and with Change Management processes this becomes a little bit more complicated. There is a setting on each VM to upgrade Tools when the VM is booted and this is a good way to keep Tools updated on those VMs that aren’t mission critical and require manual intervention.

In this post we’ll look at creating an action and a workflow to configure this setting, and pushing it as a context setting in the Flex Web Client.

This leads to the issue of how this setting is enabled - firstly as part of the initial push (you don’t want to enable this manually for 100’s (or more) VMs) and with newly created VMs. Although this can be set on a VM template or “Gold Build” (or equivalent terminology), this can still lead to human error so we’ll also look creating a workflow to set this for a cluster and scheduling this using the Flex Web Client.

Upgrade Tools Action

To configure a VM to upgrade Tools we need to create a new configuration specification and set the tools configuration appropriately. Our actionÂ will return the Task for the configuration (note: this can be null) and will take two inputs - the VM to configure and whether we are automatically upgrading Tools. Here is a screenshot of the action configuration:

The script of the action is as follows:

task = null;

if (vm != null)
{
	var toolsconfig = new VcToolsConfigInfo();
	
	if (autoupgrade == true) {
		toolsconfig.toolsUpgradePolicy = "upgradeAtPowerCycle";
	} else {
		toolsconfig.toolsUpgradePolicy = "manual";
	}
	
	var vmconfig = new VcVirtualMachineConfigSpec();
	vmconfig.tools = toolsconfig;

	task = vm.reconfigVM_Task(vmconfig);
}

return task;

In the code snippet above, we ensure that the “vm” variable contains a valid VM. We create a new ToolsConfigInfo object which will contain the tools settings that we wish to apply and then create a new VirtualMachineConfigSpec object and assign the ToolsConfigInfo object to it. Thus when we call the reconfigVM_Task() function with the configuration object, the VM is only reconfigured with the settings we have provided.

Now we have an action, we can create a workflow that will invoke it and then wait for the task to complete. This is the schema diagram:

The workflow (and action) can be downloadedÂ from the file at the end of this post.

Cluster Workflow

Now we have an action to make the changes, we can put together a workflow that will look at all VMs in the cluster and configure them. The schema is as follows:

The workflow will get all VMs in the cluster and for each one:

Only upgrade Windows VMs (“Upgrade VM ?” decision)
Check if the configuration setting currently matches what we want it to. (“Decide setting” script).
Change the setting.

The meat of the process is in the “Decide setting” script item - we will look at what the setting should be, and if the current setting does not match then we will change it. This also means that if we wish the VM to update Tools manually and it is set to automatically update at power on, the setting will be changed to update manually.

Setting as a context action

To set this as a context action on the cluster within the Flex Web Client, we need to look at the Orchestrator pages in the Web Client. The server page will have a Manage screen and a Context Actions page:

Next we need to add a new one - select the workflow to add and the type of object to associate it with - in this case we’re adding the workflow to set the upgrade for Tools for a single virtual machine, so we select the Virtual Machine object:

Press OK and all is done. You’ll need to reload the Flex Web Client in order to see it - it appears at the bottom of the actions menu for the object - under the “vRealize Orchestrator context actions” title.

That’s it !Â This workflow a prime candidate for being scheduled to ensure all your VMs are kept up to date.

The workflows (and action) for this are available at my github repo - https://github.com/nelons/vco-content.

SCOM 2012 Hello World !

Mon, 27 Feb 2017 00:00:00 +0000

I’ve been investigating how to connect to SCOM 2012 through code in order to extract information, and I thought a good first task (therefore a SCOM 2012 Hello World if you will ;)) would be to retrieve the current alerts. I couldn’t find any examples on how to do this, soÂ after some searching came up with the following.

I have used some sample code from Stackoverflow to read in the password for the user and have attributed the code with the source URL below.

The full code is as follows:

using System;
using System.Collections.Generic;
using System.Security;
using System.Linq;
using System.Text;
using System.Threading.Tasks;

using Microsoft.EnterpriseManagement;
using Microsoft.EnterpriseManagement.Administration;
using Microsoft.EnterpriseManagement.Common;
using Microsoft.EnterpriseManagement.Configuration;
using Microsoft.EnterpriseManagement.Monitoring;

namespace SCOMHelloWorld
{
    class Program
    {
        static string scom_management_server = "scom.fqdn";
        static string scom_domain = "DOMAIN";
        static string scom_username = "Administrator";

        static void Main(string[] args)
        {
            Console.WriteLine("Enter the password for the '" + scom_username + "@" + scom_domain + "' user account:");
            string password = ReadPassword();

            ManagementGroupConnectionSettings settings = new ManagementGroupConnectionSettings(scom_management_server);
            settings.Domain = scom_domain;
            settings.UserName = scom_username;
            settings.Password = new SecureString();
            Array.ForEach(password.ToArray(), settings.Password.AppendChar);
            settings.Password.MakeReadOnly();

            try
            {
                ManagementGroup mg = new ManagementGroup(settings);
                IList alerts = mg.OperationalData.GetMonitoringAlerts(MonitoringAlertCriteria.Empty, default(DateTime));

                if (alerts.Count > 0)
                {
                    foreach (MonitoringAlert alert in alerts)
                    {
                        Console.WriteLine();
                        Console.WriteLine("Name: " + alert.Name);
                        Console.WriteLine("Resolution state: " + alert.ResolutionState.ToString());
                    }
                }
                else
                {
                    Console.WriteLine("No alerts found.");
                }
            }
            catch (Exception e)
            {
                Console.WriteLine("Exception " + e.GetType().FullName + " encountered: " + e.Message);
            }

            Console.WriteLine("Press any key to continue.");
            Console.ReadKey();
        }

        // From: http://stackoverflow.com/questions/29201697/hide-replace-when-typing-a-password-c
        static string ReadPassword()
        {
            string password = "";
            ConsoleKeyInfo info = Console.ReadKey(true);
            while (info.Key != ConsoleKey.Enter)
            {
                if (info.Key != ConsoleKey.Backspace)
                {
                    Console.Write("*");
                    password += info.KeyChar;
                }
                else if (info.Key == ConsoleKey.Backspace)
                {
                    if (!string.IsNullOrEmpty(password))
                    {
                        // remove one character from the list of password characters
                        password = password.Substring(0, password.Length - 1);
                        // get the location of the cursor
                        int pos = Console.CursorLeft;
                        // move the cursor to the left by one character
                        Console.SetCursorPosition(pos - 1, Console.CursorTop);
                        // replace it with space
                        Console.Write(" ");
                        // move the cursor to the left by one character again
                        Console.SetCursorPosition(pos - 1, Console.CursorTop);
                    }
                }
                info = Console.ReadKey(true);
            }
            // add a new line because user pressed enter at the end of their password
            Console.WriteLine();
            return password;
        }
    }
}

Note that ifÂ the user’s password has expired and needs to be changed, the SCOM Management Server will reject the connection with anÂ exception, so if you get an error remember to check the domain account manually.

The default resolution state values that are supplied with SCOM are below, though obviously custom ones can be defined in the Administration space.

This project will be uploaded to github shortly (and the location noted).

The monitor_control.restrict_backdoor setting

Mon, 20 Feb 2017 00:00:00 +0000

TheÂ monitor_control.restrict_backdoor advanced setting is a strange one that I’ve encountered recently. It was set on a VM that had been (allegedly) security hardened, and researching this setting in a search engine indicated that this was to prevent the backdoor port from being accessed from anything other than ring 0 (source: https://communities.vmware.com/thread/464535).Â Most of the search results utilise this to hide a guest OS from knowing it is a VM - thus allowing a nested ESXi configuration.

According to the source above, VMware Tools runs on ring 3, so this has the side effect of preventing not only VMware Tools from being installed, but also from running. This is how I came to find out about this setting ;)

This is the error message you’ll see if you try and install VMware Tools:

“The VMware Tools should only be installed inside a virtual machine.”

This is what you’ll see (whether VMware Tools is installed or not) in the management view (Note the “Not running”):

When this setting is removed from the VMX file, everything is awesome again !:

http://www.vmware.com/uk/security/hardening-guides.htmlÂ contains the latest hardening guides from VMware, and “monitor_control.restrict_backdoor” is not mentioned in them for any of the listed versions. I believe this information negates the argument that this setting should be applied for security reasons.

So without any other good reason I can think or find, this setting should not be applied on a VM, especially since it is not needed for nested ESXi (anymore).

Hope this helps someone !

vSphere REST API and C++ (Part 1)

Fri, 27 Jan 2017 00:00:00 +0000

One of the new features in vSphere 6.5 is the vSphere REST API. I’ve usedÂ the Web Services SDK before and it has never appeared as elegant as other automation APIs I’ve worked with, so the introduction of this held a lot of promise.

I rarely see examples for REST services in C++ and as it’s my chosen language and I’ve occasionally used “cpprestsdk” (previously known as Casablanca) I wondered if I could put something together. This is the first article in a series playing around with what is possible.

We can browse the API by connecting to our local vCenter via the URL https:///apiexplorer/ and see what we can do.Â An overview of the process of a session is:

Send a POST request to /rest/com/vmware/cis/session and respond to the basic authentication request.
The responseÂ contains an authentication token which represents the session id.
For future requests pass the token in the headers as the value “vmware-api-session-id”.

The SDK and the reference guide for the REST API are available atÂ https://developercenter.vmware.com/web/sdk/65/vsphere-automation-rest.

The Code

The aim of this article is to show the authentication process and make a sample request.

This makes the authentication request:

web::http::client::http_client_config config;
config.set_validate_certificates(false);
credentials cred(U("administrator@vsphere.local"), "password");
config.set_credentials(cred);

http_client client(vcenter_url.c_str(), config);
uri_builder builder(U("/rest/com/vmware/cis/session"));

std::wstring token = L"";
create_task(client.request(methods::POST, builder.to_string())).then([](http_response response) {
  printf("SSO Request Response Status Code: %d\n", response.status_code());
  return response.extract_json();

}).then([&token](web::json::value v) {

  if (v.has_field(U("value"))) {
    json::value f = v.at(U("value"));
    token = f.as_string();
    wprintf(L"SSO Token value: %s.\n", f.as_string().c_str());
  }

}).then([](task t) {
  try {
    t.get();

  }
  catch (const std::exception& e) {
    printf("Exception: %s\n", e.what());

  }
}).wait();

if (token.length() > 0) {
  printf("Successfully authenticated against SSO.\n");
}

Most of the code above are is about how we use the cpprestsdk. The basic authentication response is handled by creating a credentials object and assigning it the configuration for our http_client. We also disable SSL certificate verification as we are using self signed certificates. If you are writing something for a secure environment then it’s probably a good idea not to do this ;)

The request is made at line 10 and the task returns the result in a json format (line 12). We then look for an entry with the name “value” and make a note of what it is set to - this is our token. The last part of the concurrency task chain is for handling any exceptions.

The code below will is an example request to vCenter that will use the newly retrieved session token.

web::http::client::http_client_config vc_config;
vc_config.set_validate_certificates(false);
http_client vc_client(vcenter_url.c_str(), vc_config);

uri_builder vc_vm_uri(U("/rest/vcenter/host"));

http_request vc_req(methods::GET);
vc_req.headers().add(U("vmware-api-session-id"), token.c_str());
vc_req.set_request_uri(vc_vm_uri.to_string());

create_task(vc_client.request(vc_req)).then([](http_response response) {
  printf("/rest/vcenter/host Request Status Code: %d\n", response.status_code());
  return response.extract_string();

}).then([](utility::string_t text) {
  printf("The response was:\n");
  wprintf(text.c_str());
  printf("\n");

}).wait();

The code above will create a request and pass the token as the “vmware-api-session-id” value. As can be seen, we are still disabling SSL certificate verification but we are not passing credentials - the session id is enough.

The request will be sent to “/rest/vcenter/host” (line 5), which retrieves information about the hosts added to the vCenter. Once the request is made, the output is printed out to the screen in the JSON format.

We could add a final task segment to catch any exceptions that occur in the chain - there is no particular reason for why it is missing.

An Example

Below is a screenshot of the output of the program - I’ve blanked out the address and password of my home lab, though you can see that after a successful authentication information about two hosts is returned.

Full Source

The source is available on GitHub - https://github.com/nelons/vSphereRestApi/tree/master/part1. It was written in Visual Studio 2015 Community Edition and uses the cpprestsdk nuget package (and has UNICODE enabled).

It is not optimised or efficient code, but is meant to be straight forward to read and understand for near beginners (as some understanding of concurrency task code is required).

Comments, suggestions or errors - please let me know !

Automating Brocade FC Configuration (Part 2)

Fri, 20 Jan 2017 00:00:00 +0000

From the first article we looked at how to use the SSH Sessions Powershell module to log into a Linux server that will, via a script, log into a Brocade FC switch and get the zoning configuration.

As per the disclaimer in the first part, these articles have been assembled from my notes and memory and may not be 100% correct. I worked with FOS 6.x and so 7.x/later releases might not need this approach - I no longer have access to any Brocade FC switches to test :)

Getting the switch config via a function

As we’re going to need to get the config from two switches, we’ll write a powershell function that will get the config from one switch, so we have one call for each. The function is as follows:

Function Get-BrocadeSwitchZoneConfig {
	[CmdletBinding()]
	Param (
		[Parameter(Mandatory=$true)][string] $Target,
		[Parameter(Mandatory=$true)][string] $Username,
		[Parameter(Mandatory=$true)][string] $Password,
		[switch] $VersionSix
	)
	Process {
		# Import the SSH-Sessions Module.
		Import-Module $PSScriptRoot\..\modules\SSH-Sessions\SSH-Sessions.psd1
		
		# Connect to the target.
		New-SshSession -ComputerName $Target -Username $Username -Password $Password | out-null
		
		# Invoke the command to get the config.
		$config = "";

		if ($VersionSix -eq $False) {
			$config = Invoke-SshCommand -ComputerName $Target -Command "zoneshow" -Quiet
			
		} else {
			$config = Invoke-SshCommand -ComputerName $Target -Command "bash --login -c 'zoneshow'" -Quiet;
		
		}
	
		# Disconnect from the target.
		Remove-SShSession -ComputerName $Target | out-null;
		
		# return the config.
		return $config;
	}
}

So, let’s get the config:

1
2

$config1 = Get-BrocadeSwitchZoneConfig -Target "switch1.fqdn" -Username "automation" -Password "password";
$config2 = Get-BrocadeSwitchZoneConfig -Target "switch2.fqdn" -Username "automation" -Password "password"

Sanity Checking the Zone Configuration

Before changing the configuration we need to make sure anything we create does not already exist. Namely, we’ll be checking:

WWPNs of the server HBAs.
The name of the server zone.

Function Check-FCConfig {
	[CmdletBinding()]
	Param (
        Parameter(Mandatory=$true)][string] $Config,
		[Parameter(Mandatory=$true)][string] $Hostname,
		[Parameter(Mandatory=$true)][string] $HBA
	)
	Process {
		# need to trim the "-" from the hostname as it is an illegal char on the brocades.
		$brocade_hostname = $Hostname.Replace("-", "");
		
		if ($HBA -ne $Null) {			
			# Check to see if the hostname is present
			if ($Config.ToLower().Contains($brocade_hostname.ToLower())) {
				Write-Host "Hostname exists in the current config.";
				return $False;
			}
			
			# Check to see if HBA address is present.
			if ($Config.ToLower().Contains($HBA.ToLower())) {
				Write-Host "HBA exists in the current config.";
				return $False;
			}

                        return $True;
		}

                return $False;
        }
}

So, we’ll then need to call this for each of the switch configs we got earlier. Our new script looks as follows:

$config1_ok = $false;
$config2_ok = $false;

$config1 = Get-BrocadeSwitchZoneConfig -Target "switch1.fqdn" -Username "automation" -Password "password";
if ($config1.Length -gt 0) {
  $config1_ok = Check-FCConfig -Config $config1 -Hostname "server01" -HBA "20:00:00:25:B5:40:02:0F";
}

$config2 = Get-BrocadeSwitchZoneConfig -Target "switch2.fqdn" -Username "automation" -Password "password"
if ($config2.Length -gt 0) {
  $config2_ok = Check-FCConfig -Config $config2 -Hostname "server01" -HBA "20:00:00:25:B5:40:02:1F";
}

if ($config1_ok -eq $true -And $config2_ok -eq $true) {
 // Here is where we create the config.

}

Hopefully the above is quite straight forward - we get the config for the both switches and check that it is ok for the servername and for the HBA address. We store the result in a local variable, and when both checks are complete we will only be making changes to the FC switches if both configs reported good.

The final proxy script

Our final Linux proxy script will change the configuration on a singleÂ switches, and we will call it twice, once for each server. This would allow us to provide different variables for each switch, in case they have not been configured identically. The variables that we will pass, and their position for the script are below:

Hostname of the filer.
Username for the filer.
Password for the filer.
Server hostname
WWPN for the HBA
Name of the active configuration

Our full script will be:

cat « _END_ | sshpass -p ${1} ssh ${3} -tt -o StrictHostKeyChecking=no -l ${2} alicreate ${4}_hba0, ${5} zonecreate ${4}, “${4}_hba0;san_hba0;san_hba1” cfgadd ${6}, ${4} echo y|cfgenable ${6} exit _END_

This is how we would call it:

$brocade_hostname = $Hostname.Replace("-", "");
$brocade_config_name = "config";
$fc_switch1 = "switch1.fqdn";
$fc_switch2 = "switch2.fqdn";
		
# Connect to the brocade scripting host.
New-SshSession -ComputerName $brocade_script_host -Username $brocade_script_host_username -Password $brocade_script_host_password | out-null;
		
# Run the Script.
$results = Invoke-SshCommand -ComputerName $brocade_script_host -Command "./create-fc-zone $fc_switch1 $brocade_username $brocade_password $brocade_hostname $HBA0 $brocade_config_name" -Quiet;

# Run the Script.
$results = Invoke-SshCommand -ComputerName $brocade_script_host -Command "./create-fc-zone $fc_switch2 $brocade_username $brocade_password $brocade_hostname $HBA1 $brocade_config_name" -Quiet;
		
# Disconnect from the host
Remove-SshSession -ComputerName $brocade_script_host | out-null;

Powershell Configuration Script

When we put the above together we will aim to have some powershell that will:

Get the config of each FC switch
Check the config to ensure there will be no clashes or problems.
Call the proxy script to update the config.

This would look like:

Function Create-FC-Zone {
	[CmdletBinding()]
	Param (
		[Parameter(Mandatory=$true)][string] $Hostname,
		[Parameter(Mandatory=$true)][string] $HBA0,
		[Parameter(Mandatory=$true)][string] $HBA1
	)
	Process {
		$brocade_hostname = $Hostname.Replace("-", "");
		$brocade_config_name1 = "config";
		$brocade_config_name2 = "config";
		
		# FC Switch Details.
		$fc_switch1 = "switch1.fqdn";
		$fc_switch2 = "switch2.fqdn";
		$fc_username = "automation";
		$fc_password = "password";
		
		# Proxy Details
		$proxy_host = "proxy.fqdn";
		$proxy_username = "automation";
		$proxy_password = "password";
		
		$config1_ok = $false;
		$config2_ok = $false;

		$config1 = Get-BrocadeSwitchZoneConfig -Target $fc_switch1 -Username $fc_username -Password $fc_password;
		if ($config1.Length -gt 0) {
			$config1_ok = Check-FCConfig -Config $brocade_config_name1 -Hostname $brocade_hostname -HBA $HBA0;
		}

		$config2 = Get-BrocadeSwitchZoneConfig -Target $fc_switch2 -Username $fc_username -Password $fc_password;
		if ($config2.Length -gt 0) {
			$config2_ok = Check-FCConfig -Config $brocade_config_name2 -Hostname $brocade_hostname -HBA $HBA1;
		}

		if ($config1_ok -eq $true -And $config2_ok -eq $true) {			
			# Connect to the brocade scripting host.
			New-SshSession -ComputerName $proxy_host -Username $proxy_username -Password $proxy_password | out-null;
					
			# Run the Script.
			$results = Invoke-SshCommand -ComputerName $proxy_host -Command "./create-fc-zone $fc_switch1 $fc_username $fc_password $brocade_hostname $HBA0 $brocade_config_name" -Quiet;

			# Run the Script.
			$results = Invoke-SshCommand -ComputerName $proxy_host -Command "./create-fc-zone $fc_switch2 $fc_username $fc_password $brocade_hostname $HBA1 $brocade_config_name" -Quiet;
					
			# Disconnect from the host
			Remove-SshSession -ComputerName $proxy_host | out-null;
		}	
    }
}

This uses the function “Get-BrocadeSwitchZoneConfig” at the beginning of this article, and most of the variables are configured in the script. For the sake of security you’ll want to remove these from being hardcoded and pass them in as parameters. I’ve left them as hardcoded to show what is required and where it is used.

This is available in a single file on my psscripts github repo.

Please let me know if anything is wrong or if this helped you !

Automating Brocade FC Configuration with Powershell (Part 1)

Wed, 04 Jan 2017 00:00:00 +0000

I’ve been looking at automating physical server creation, and there are tools from Cisco and NetApp that allow Powershell to do the heavy lifting for UCS and Storage. The missing part of theÂ process is the FC switches (Brocade in this case, though when I researched this I could not find a toolkit for Cisco MDS) - so we will cheat and use powershell to issue SSH commands to the switches. This post will look at automating Brocade FC Configuration on v6.00 and later switches.

There are two disclaimersÂ - this is what has worked for me, it may not work for you. I also don’t have access to the script files any more, so this has been assembled from notes and memory - I last looked at this about a year ago. If there is anything wrong you’ll need to troubleshoot.

My Linux skills are not so advanced that I think this is the best way of doing things. If you know of something better please leave a reply in the comments !

Throughout researching this I usedÂ The SAN Guy’s list of useful Brocade CLI commands as a crib sheet for using the CLI.

The diagram below shows a very basic overview of the infrastructure, with devices from top to bottom being the SAN, FC switches and the server - though if using Cisco UCS the server will be encapsulated within the appropriate domain.

Configuration used in this article

WeÂ will have a single physical server with 2 HBAs:

HBA0 WWPN: 20:00:00:25:B5:40:02:0F HBA1 WWPN: 20:00:00:25:B5:40:02:1F

The SAN has four WWPN’s (two for each FC switchÂ in the overview diagram above) and they are identified on the FC switches as “san_hba0” and “san_hba1” (connected to one switch) and “san_hba2” and “san_hba3” (connected to the other switch). These aliases have already been created on the FC switches.

The FC switch configuration is called “active_config”.

Creating the Script

We will need to create a zone for the server on each FC switch and include the appropriate server HBA initiator WWPN and the storage WWPN’s in each. I have seen some configs where a server zone will contain all WWPN’s - even for initiators that will never connect to the switch - but in this case the zone will only contain the minimum number of addresses.

We are going to have these steps:

Create an alias. alicreate
Create a zone. zonecreate
Add the zone to the current configuration. cfgadd
Save/Enable the current configuration. cfgenable

Using an SSH client we can run through the steps to do this. This would translate to the following for the first switch:

alicreate server01_hba0,Â 20:00:00:25:B5:40:02:0F
zonecreate server01, “server01_hba0, san_hba0, san_hba1”
cfgadd server01
cfgenable active_config

This for the second FC switch:

alicreate server01_hb1,Â 20:00:00:25:B5:40:02:1F
zonecreate server01, “server01_hba1, san_hba2, san_hba3”
cfgadd server01
cfgenable active_config

If you are doing this on your infrastructure please make sure that you run through your commands manually - automation should only be used for proven processes.

Getting it to work (or not)

The module “SSH-Sessions” allows us to run remote commands from Powershell and can be found atÂ http://www.powershelladmin.comÂ - install this.

Sadly, things are not always meant to be simple and if we run our SSH commands directly from powershell it will not work. You might already know this (which is why you’re here) but there is no way we can save the zoning configuration from Powershell because the “cfgenable” command presents an interactive prompt to confirm that the changes should be saved.

Thanks to this forum threadÂ we have a way to run these commands from a linux OS SSH session. So we’re going to use Powershell to SSH to a Linux OS and then run a script that will SSH to a FC switch and create and save the zone.

Using SSH-Session

If you don’t want to put the module into one of the modules paths in order to test it, you don’t have to. From the directory the files are stored in, run:

`1`	`Import-Module "\SSH-Sessions.psd1"`

You may receive the error message:

Could not load file or assembly “Renci.SshNet.dll” or one of its dependencies. Operation is not supported. (Exception from HRESULT: 0x80131515)

This postÂ solves this issue - we need to right-click the .dll file and open Properties and then click the “Unblock” button - though it is a good idea to do this for all the files. Once done,Â open a new powershell window and start again.

Once the module has been imported, it’s time to test it out. Let’s try a “zoneshow” command. We’ll do:

1
2

New-SshSession -ComputerName  -Username user -Password pass
Invoke-SshCommand -ComputerName  -Command "zoneshow"

If you’re running FOS 6.x you’ll probably run intoÂ the problem below,Â but happily there is a simple solution.

FOS 6.xx Command Problems

This only applies if the target FC switch is running FOS 6.xx. When attempting to run these commands from FOS 6.xx we get this error:

had an error: sh:
\[command\]
: command not found

The answer is available on this page, and the command needs to be phrased as:

`1`	`Invoke-SshCommand -ComputerName -Command "bash --login -c 'zoneshow'"`

Dealing with the cfgsave problem

To show what happens when we try and save the config when running the SSH command directly from Powershell (amend for FOS 6 with “-c” as necessary), run the command:

`1`	`Invoke-SshCommand -ComputerName -Command "cfgsave"`

This will hang the powershell window and you’ll have to force close the window.

To solve this problem we need a Linux proxy which we can connect via SSH to run scripts. Whether you’ll need to spin up a new VM or whether there is a current system you can use depends on your environment, but it is important that networking wise, our powershell host can connect to the proxy and the proxy can connect to both FC switches.

Setting up the Proxy

I used CentOS, installed SSHPass and configured a separate user for automation. Make sure that the SSH service is running, and enabled to start with the OS.

To install sshpass (the reference for epel-release is here):

1
2

yum install epel-release
yum install sshpass

As an FYI, to create a user that we will use to ssh:

1
2

useradd automation
passwd automation

We won’t need any special permissions for this user account, as we will create and run scripts as this user.

Scripting

Now we need to open up a SSH session to our Linux OS and log in as the automation user we just created.

We’re going to pass information to the script, and these are represented as ${x} in the script file, where x is the numerical position of the information. Our first simple script is going to log on to the filer and do a ‘zoneshow’.

Our parameters will be:

Hostname / Address of Filer
Username
Password

I’ve called the script “first-script” and the contents are below:

1
2
3

sshpass -p ${3} ssh ${1} -tt -o StrictHostKeyChecking=no -l ${2}
zoneshow
exit

Mark the script that it is executable:

`1`	`chmod 750 first-script`

Now let’s run it.

`1`	`./first-script username password`

You will see that we can log into the filer, but then nothing else happens. We need to change the script so we execute the commands properly, and the post by alknet on the Brocade Community forumsÂ explains how we should do it. Change to your script to match below:

cat << _END_ | sshpass -p ${1} ssh ${3} -tt -o StrictHostKeyChecking=no -l ${2}
zoneshow
exit
_END_

That’s it for this article, in part two we’ll do a basic sanity check that the WWPN’s and zones don’t already exist before changing the configuration.

PowerTool - Getting UCS Blades with SD Cards

Sun, 23 Oct 2016 00:00:00 +0000

This is a quick snippet that allows you to retrieve UCS Blades that have SD cards - this might be useful in determining if your blades are ready to have an OS installed on them. These scripts assume you’ve already connected to your UCS Central or UCS Domain.

This will get the blades if you’re using UCS Central:

Get-UCSCentralBlade | ? { $blade = $_; $cards = Get-UcsCentralStorageFlexFlashCard | ? { $_.Dn.StartsWith($blade.Dn); }; return ($cards.Count -gt 0); } | select @{L='Domain';E={ (Get-UcsCentralComputeSystem -Dn $_.Dn.Substring(0, 16)).Name }}, ServerId, ChassisId, SlotId, Name, @{l="Cards";e={$cards.Count}}, OperState, Association,Discovery, Model, TotalMemory, LsDn | Sort Domain, ServerId

If you’re not using UCS Central, we modify the commandlets by removing the “Central” from them, and remove resolving the domain (because you’ll know what domain you’re running it against). The following (currently untested) should work:

Get-UCSBlade | ? { $blade = $_; $cards = Get-UcsStorageFlexFlashCard | ? { $_.Dn.StartsWith($blade.Dn); }; return ($cards.Count -gt 0); } | select ServerId, ChassisId, SlotId, Name, @{l="Cards";e={$cards.Count}}, OperState, Association,Discovery, Model, TotalMemory, LsDn | Sort ChassisId, ServerId

Setting VM SDRS automation levels

Thu, 11 Jun 2015 00:00:00 +0000

I learnt recently that when you Storage vMotion a VM within a datastore cluster and you check the box to select which datastore you explicitly want the VM to be migrated to, it sets the SDRS automation level for the VM to disabled.

Finding out which VMs have an automation level of disabled can be achieved with the following line:

`1`	`Get-DatastoreCluster \| % { $_.ExtensionData.PodStorageDrsEntry.StorageDrsConfig.VmConfig } \| ? { $_.Enabled -eq $False } \| % { Get-View $_.VM \| select Name }`

Since I like to have VMs set to the cluster default we need a bit of PowerCLI to change the VMs back. The following code will look at all the datastore clusters on the vCenter, and all the VMs with a disabled automation level therein.

Credit goes to LucD whose posts in the VMware Communities forum formed the base of this script. The threads are here and here.

This script is designed to be used with PowerCLI 6, as per the “Import-Module” statements at the top. For previous versions of PowerCLI the lines should be replaced with adding the appropriate snapin.

param([Parameter(Mandatory=$true)][String] $VIServer)

Import-Module VMware.VimAutomation.Core;
Import-Module VMware.VimAutomation.Storage;

Connect-VIServer $VIServer

$storMgr = Get-View StorageResourceManager;

Get-DatastoreCluster |
	% { $vms = $_.ExtensionData.PodStorageDrsEntry.StorageDrsConfig.VmConfig;
		$spec = New-Object VMware.Vim.StorageDrsConfigSpec;
		$vms | ? { $_.Enabled -eq $False } | % {
			$entry = New-Object VMware.Vim.StorageDrsVmConfigSpec;
			$entry.Operation = "edit";
			$entry.Info = $_;
			$entry.Info.Enabled = $true;
			$spec.vmConfigSpec += $entry;
		}
		
		$storMgr.ConfigureStorageDrsForPod($_.ExtensionData.MoRef, $spec, $true);
	}
	
Disconnect-VIServer -Confirm:$False

If needed, this script can easily be expanded to check for Tags or Custom Attributes assigned to the VM, and only to change the automation level given the presence or absence of a tag or the value of a custom attribute.

VMware vCheck NTP and Syslog Plugin Amendments

Tue, 09 Jun 2015 00:00:00 +0000

I’m a big fan of the vCheck script by the very talented Alan Renouf and community, but a couple of the plugins don’t work as well as I’d like with our environment, where we have multiple NTP and Syslog servers and these settings can differ depending on the cluster within a single vCenter. So I’ve made a few changes to the vCheck NTP and Syslog plugins.

NTP Plugin

The file is called “31 NTP Name and Service.ps1” and kept in the “30 Host” folder.

I’m going to cut out the bottom part of the plugin script as there would only be cosmetic changes made there.

# Start of Settings
# The NTP server which should be set on your hosts
$ntpserver = "ntp-server1.cluster1 ntp-server2.cluster1", "ntp-server1.cluster2"
# End of Settings

$Result = @($VMH | Where {$_.Connectionstate -ne "Disconnected"} | Select Name, @{N="NTPServer";E={"$($_ | Get-VMHostNtpServer)"}}, @{N="ServiceRunning";E={(Get-VmHostService -VMHost $_ | Where-Object {$_.key -eq "ntpd"}).Running}} | Where {$_.ServiceRunning -eq $false -o $ntpserver -notcontains $_.NTPServer})
$Result

There are two changes here:

The line “$($_ | Get-VMHostNtpServer)” has been enclosed in quotation marks to expand the array into a string.
The check at the end has been changed so we are now checking if the NTP server values are in the provided array.

I’m fairly sure the list of NTP servers are ordered (but have been known to be wrong before), so I’m leaving the list of servers in the order that PowerCLI decides to return them. So when specifying a list of NTP servers, do it in the order they should be used/configured.

Syslog Servers

The syslog plugin file is called “51 Syslog Name.ps1” and it is also in the “30 Host” folder.

I don’t believe that the syslog hosts are ordered (they certainly shouldn’t be), so in the code below we’re looking at the list of syslog hosts sorted alphabetically.

The code is now:

# Start of Settings 
# The Syslog server which should be set on your hosts
# Multiple syslog entries per host must be space separated and in alphabetical order.
# Multiple possible entries per vCenter should be comma separated so an array is created.
$SyslogServer = "udp://syslog-server1 udp://yet-another-syslog-server"
# End of Settings

@($VMH | Where-Object {$_.ExtensionData.Summary.Config.Product.Name -eq 'VMware ESXi'} | Select-Object Name,@{Name='SyslogServer';Expression = {"$(($_ | Get-VMHostSysLogServer).Host | sort Host)"}} | Where-Object {$SyslogServer -notcontains $_.SyslogServer})

There’s a few changes:

The ‘SyslogSettings’ section, supporting ESXi 4.x has been removed.
The line “$(($_ | Get-VMHostSysLogServer).Host | sort Host)” sorts the names and expands the array into a string.
The comparison check at the end now checks for presence in the array.

Summary

This is very much a lazy fix to a problem I had, and there will be a better solution. For instance, it’s not going to check that hosts in a certain cluster have particular settings - just that all hosts have a valid setting permissable for the vCenter. But it’ll do the job, and for everything else there should be host profiles - and there is vCheck plugin that can be used unaltered to check on those ;)

Viewing VM CPU Masks via PowerCLI

Fri, 05 Jun 2015 00:00:00 +0000

This post was updated on 9th May 2017 to fix an error condition in the script.

Support for Windows Server 2012 was announced starting with ESXi 5.0 Update 2, but there was a little known flaw in this support - in that without a CPU mask, a VM could blue screen at any time. The support article KB2060019 was released which explained everything and the issue was fixed for Update 3.

It might be useful to try and track down which 2012 VM’s (it can be adjusted for Windows 8) had their CPU masked during this time, in order to remove. The following PowerCLI reports on all Windows 2012 (and R2) VM’s and displays any CPU masking they might have. You’ll then have to manually check the results and look for a 0 in the 5th most significant bit on the edx register, but I’m sure this could be automated further.

get-vm | ? { $_.ExtensionData.Config.GuestFullName -like "*2012*" -And $_.ExtensionData.Config.cpuFeatureMask -ne $null } | select Name, @{N="CPU";E={$_.ExtensionData.Config.cpuFeatureMask}} | select -Property Name -ExpandProperty CPU | Sort Name | fl

PowerCLI: Datastore Block Sizes

Wed, 01 Apr 2015 00:00:00 +0000

Before VMFS5 the block size of the datastore determined the maximum size of a hard disk that could be added to a virtual machine. In our new glorious future it now makes no difference, but VMFS datastores that have been upgraded to version 5 will retain their old block size.

The following PowerCLI will show all the datastores connected to the vCenter and their block size.

`1`	`Get-Datastore \| select Name, CapacityGB, @{Label="BlockSize";Expression={$_.ExtensionData.Info.vmfs.BlockSizeMb}}`

If we wish to show all datastores that have a block size larger than 1MB then we could do the following:

`1`	`Get-Datastore \| ? { $_.ExtensionData.Info.vmfs.BlockSizeMb -gt 1 } \| select Name, CapacityGB, @{Label="BlockSize";Expression={$_.ExtensionData.Info.vmfs.BlockSizeMb}}`

Installing ESXi 6 onto USB via Workstation 9

Sat, 28 Mar 2015 00:00:00 +0000

This is going to one of those blog posts that is mostly pictures ;) When installing ESXi 6 I decided to install onto (and therefore boot from) USB instead of installing and booting from local disk. This would allow my SSDs to be used for playing with Flash Cache. I had Workstation 9 available to me, so tried to use it (spoiler alert: it worked).

To begin, create a new Virtual Machine with the latest compatibility level.

Select to install VMware ESXi 5.

It needs to have a minimum of 2 processors.

As per ESXi 5.5 it requires 4 GB of RAM.

Workstation 9 forces you to configure a drive. Add a small drive and delete afterwards.

Follow the wizard through to the end to create the VM. Then edit the settings and delete the hard disk. I don’t know if it is important, but I made sure the VM had the same number of ethernet adapters as the target host.

We can now boot the VM and go through the standard installation procedure. Select the USB drive to install from, though make sure it is larger than 910 MB:

If we are installing to another usb drive (for another host) after this one completes we need to change the MAC address of the VM’s network adapter, or we will create another installation with the same MAC address for the management adapter. Which will make one host unusable. Go to the Virtual Machine settings, select the Network Adapter and then press the Advanced button.

Press the Generate button to create a new MAC address.

We’re now set to install ESXi again ;)

Creating a Cisco UCS Profile using PowerTool

Thu, 26 Mar 2015 00:00:00 +0000

Creating a Cisco UCS Profile using PowerTool

This post is going to walk through creating a powershell function to create a Service Profile on a Cisco UCS domain. Later posts in this series will look at how to assign it to a server, configure shared storage on a NetApp filer, and configure the zoning on Fiber Channel switches - essentially all the work we’d need to do to automate the creation of a physical server.

There are a few ways to create Service Profiles on a Cisco UCS domain, but if you’re looking for consistency, best practice and the possibility to automate then you’ll need to use templates - not just a Service Profile template, but templates within the Service Profile template - for vNICs, vHBAs and for any other policies. I have assumed that templates have been set up and are being used.

We are going to be using Cisco UCS PowerTool for this, so ensure you’ve got this installed on your system. You can get it from , but you’ll need a Cisco.com login.

The File

Open up your favourite IDE or text editor (personally I use Notepad++) and create a new file. Save it with a filename and a location of your choice. My file is going to be called “automate.ps1” and I keep everything in a “scripts” folder in the root of a hard drive. Powershell has a verb system, so the cmdlets are prepended (for example) with “New”, “Get” and “Set”. I’m going to use the verb “Automate” to make our functions stand out from anything else that might exist on your system, but you might wish to use your company name or something else.

Below is a sample function definition for “Automate-NewUCSProfile”.

Function Automate-NewUcsProfile {
	Param()
	Process {
		# Our code will go here
	}
}

The first line declares the function and the curly brackets open its contents. The “Param()” line will be expanded so we can pass parameters into the function, and the main body of code will reside in the curly brackets are the “Process {” section. We then close off every open curly bracket “{” with the opposite curly bracket “}”.

If you’d like to learn more about Powershell functions, your search engine of choice will direct you.

Connections

When we connect to a UCS domain we can be given a handle to it. PowerTool will support connections to multiple UCS domains, though I believe the default is one and it needs to be reconfigured through the Set-UcsPowerToolConfiguration cmdlet (see it and the Connect-UCS cmdlet help for more information). If we are connecting to one UCS domain then we won’t need to use the handle when using other cmdlets, however I believe it is good practice to do so, so I will.

To connect we use:

`1`	`Connect-UCS -Name ucspe01 -Credential (Get-Credential)`

When running the above connect cmdlet (and after entering correct credentials for the target UCS domain) we are given something similar to below (which is a platform emulator output running on VMware Workstation 9):

Proxy                       :
Cookie                      : 1427096220/c399b102-8234-4bad-a94d-4202ed62593a
Domains                     : org-root
LastUpdateTime              : 23/03/2015 07:36:59
Name                        : 192.168.117.135
NoSsl                       : False
NumPendingConfigs           : 0
NumWatchers                 : 0
Port                        : 443
Priv                        : {aaa, admin, ext-lan-config, ext-lan-policy...}
RefreshPeriod               : 600
SessionId                   :
TransactionInProgress       : False
PromptOnCompleteTransaction : False
Ucs                         : UCSPE-192-168-117-135
Uri                         : https://192.168.117.135
UserName                    : config
VirtualIpv4Address          : 192.168.117.135
Version                     : 2.2(2c)
WatchThreadStatus           : None

So, if we want to connect without this information being printed to the screen then we’ll need to accept the handle being returned from the cmdlet, as below:

`1`	`$ucs = Connect-UCS -Name ucspe01 -Credential (Get-Credential)`

Credential can be prompted for by using the “(Get-Credential)” input above, or it can be provided ahead of time, by putting the output of “Get-Credential” into a variable.

1
2

$cred = Get-Credential
$ucs = Connect-Ucs -Name ucspe1 -Credential $cred

To disconnect, we use the cmdlet

`1`	`Disconnect-UCS -Ucs $ucs`

So building our function it will start to look as below. We are passing in the name of the UCS domain and the credentials to connect to it.

Function Automate-NewUcsProfile {
	Param(
		[Parameter(Mandatory=$true)][String] $ucs_domain,
		[Parameter(Mandatory=$true)][System.Management.Automation.PSCredential] $credential = (Get-Credential)
	)
	Process {
		# Our code will go here
		$ucs = Connect-Ucs -Name $ucs_domain -Credential $credential
		if ($ucs -ne $null) {
		
		
		
			Disconnect-Ucs -Ucs $ucs;
		}
	}
}

One thing to note here is that if a Credential is not provided, then the person running the script is prompted to provide one.

Creating a Service Profile from a template

One line of code is required to create a Service Profile based upon a template, and it takes the following parameters:

- ServiceProfile is the name of the template upon which to base the new profile - NewName is the name of the new profile.

It returns a object to represent the service profiles that it creates. An example:

`1`	`$service_profile = Add-UcsServiceProfileFromTemplate -ServiceProfile "template-name" -NewName "new-profile" -Ucs $ucs;`

Note this this leaves the new profile bound to the template. We can change this later.

We should do some sanity checking though - I’m sure you are aware of the two types of templates - “initial” and “updating” (if not, Cisco have a useful page on Service Profiles). These are represented in PowerShell by being a Service Profile object, but with a type of either “initial-template” or “updating-template”. A Service Profile object that is actually a Service Profile has a type of “instance”. So let’s make sure that a profile with this name exists:

`1`	`$template = Get-UCSServiceProfile -Name "template-name" -Ucs $ucs \| ? { $_.type -ne "instance" }`

This code is retrieving all service profiles of the name “template-name”. It then runs a check on them to see if they have type set to “instance”, and if so, the object is returned.

If $template is equal to $null (i.e. $template -eq $null) then no template could be found. Putting our code together, outside of our function, it would look like:

$ucs = Connect-UCS -Name ucspe01 -Credential (Get-Credential)
if ($ucs) {

	$template = Get-UCSServiceProfile -Name "template-name" -Ucs $ucs | ? { $_.type -ne "instance" };
	if ($template -ne $null) {
		$service_profile = Add-UcsServiceProfileFromTemplate -ServiceProfile $template -NewName "new-profile" -Ucs $ucs;
	}

	Disconnect-UCS -UCS $ucs;
}

Optional: Unbinding from the Service Profile template

If you wish to unbind from the template, the line is simple:

`1`	`Set-UcsServiceProfile -ServiceProfile $service_profile -SrcTemplName '' -Force \| out-null;`

Though we could pipe the $service_profile variable to it, as per:

`1`	`$service_profile \| Set-UcsServiceProfile -SrcTemplName '' -Force \| out-null`

The “| out-null” just ensures that nothing is printed on the screen as it is being run.

Assembling our Function

From the above we need to know some things:

- The name of the UCS domain to connect to. - The credentials to connect with. - The name of the Service Profile we want to create. - The name of the Template we are going to bind to.

So when we put the code from above into the function, and configure our parameters, this is what it should look like:

Function Automate-NewUCSProfileFromTemplate {
	Param(
		[Parameter(Mandatory=$true)][String] $Domain,
		[Parameter(Mandatory=$true)][System.Management.Automation.PSCredential] $Credential,
		[Parameter(Mandatory=$true)][String] $new_profile_name,
		[Parameter(Mandatory=$true)][String] $template_name
	)
	Process {
		$ucs = Connect-Ucs -Name $Domain -Credential $Credential
		if ($ucs -ne $null) {			
		
			$template = Get-UCSServiceProfile -Name $template_name -Ucs $ucs | ? { $_.type -ne "instance" };
			if ($template -ne $null) {
				Add-UcsServiceProfileFromTemplate -ServiceProfile $template -NewName $new_profile_name -Ucs $ucs;
			}
		}

		Disconnect-UCS $ucs;	
	}
}

Organisations and checkingÂ Profile existence

We’ve got one last check that we should make - that the service profile doesn’t already exist. This is slightly more complicated due to Organisations - service profile names are unique within each organisation. This is represented in service profile objects by distinguished names which are formed of two parts, the location and the service profile name. Running the code:

`1`	`Get-UcsServiceProfile \| ft Name, Rn, Dn`

will show us the format:

PS C:\> get-ucsserviceprofile | ft Name, Rn, Dn

Name                                    Rn                                      Dn
---- -- --
test                                    ls-test                                 org-root/ls-test
test                                    ls-test                                 org-root/org-Finance/ls-test

As we can see, we have two service profiles with the name “test”, one in the “root” organisation, and one in the “Finance” organisation. Let’s get the details about the organisations:

PS C:\> Get-UcsOrg | ft Name, Dn

Name                                                        Dn
---- --
root                                                        org-root
Acme                                                        org-root/org-Acme
Finance                                                     org-root/org-Finance

So when we create our profile we must make a choice about where we create it - by default it will be in the root organisation. Our code will have to take a string that allows callers to provide an organisation (but have a default of “root”). We will then search for the service profile within that organisation:

`1`	`$existing_profile = Get-UcsServiceProfile -Name $sp_name -Org $org`

It looks simple, but there is a catch - it will still match against any service profiles in sub-organisations. We need to add the “-LimitScope” parameter in order to only match within our desired target organisation. If $existing_profile is equal to $null, then we can continue.

So our function will now look like:

Function Automate-NewUCSProfileFromTemplate {
	Param(
		[Parameter(Mandatory=$true)][String] $Domain,
		[Parameter(Mandatory=$true)][System.Management.Automation.PSCredential] $Credential,
		[Parameter(Mandatory=$true)][String] $NewName,
		[String] $Organisation = "root",
		[Parameter(Mandatory=$true)][String] $Template
	)
	Process {
		$ucs = Connect-Ucs -Name $Domain -Credential $Credential
		if ($ucs -ne $null) {			
			$org = Get-UcsOrg $Organisation;
			if ($org) {
				# Check to see if profile already exists.
				$existing_sp = Get-UcsServiceProfile -Name $NewName -Org $org -LimitScope;
				if ($existing_sp -eq $null) {
		
					# Check to see if template exists.
					$sp_template = Get-UCSServiceProfile -Name $Template -Ucs $ucs | ? { $_.type -ne "instance" };
					if ($sp_template -ne $null) {
						$sp = Add-UcsServiceProfileFromTemplate -ServiceProfile $Template -NewName $NewName -Ucs $ucs;
					}
				}
			}
		}

		Disconnect-UCS $ucs;	
	}
}

Note: Organisation names are not unique throughout the Domain and it is the Dn that will determine uniqueness. This is something that we’ll deal with next.

One Final Step

To make everything simple, we should do all our checks to see if any stage of this will fail at the start of code. For the sake of separation we’ll create a new function for this:

Function Automate-CheckUcsServiceProfileConflict {
	Param(
		[Parameter(Mandatory=$true)][Cisco.Ucs.UcsHandle] $Ucs,
		[Parameter(Mandatory=$true)][String] $NewName,
		[String] $Organisation = "root",
		[Parameter(Mandatory=$true)][String] $Template
	)
	Process {
		$result = $True;
	
		# Check the Organisation exists.
		$org = Get-UcsOrg $Organisation;
		if ($org -eq $null) {
			Write-Host "The Organisation does not exist.";
			$result = $False;
		
		} elseif ($org.Count -gt 1) {
			# We found more than one Organisation
			Write-Host "There is more than one Organisation with the name '$Organisation'. Please use the Org Dn to create Service Profiles.";
			$result = $False;
		
		} else {		
			# Check that a profile with the existing name doesn't already exist.
			$existing_sp = Get-UcsServiceProfile -Name $NewName -Org $org -LimitScope;
			if ($existing_sp -ne $null) {
				Write-Host "A Service Profile with the name '$NewName' already exists in the organisation '$Organisation'.";
				$result = $False;
				
			}			
		}
		
		# Check that the template exists.
		$sp_template = Get-UCSServiceProfile -Name $Template -Ucs $ucs | ? { $_.type -ne "instance" };
		if ($sp_template -eq $null) {
			Write-Host "The template $Template does not exist.";
			$result = $False;
		}
		
		return $result;
	}
}

There are a few differences to our original function - we are passing in the connection handle to the UCS Domain, so we don’t have to deal with any Connect-Ucs/Disconnect-Ucs and credentials. We are then going to run some checks and return whether we can go ahead with creating the service profile.

Let’s go through the code:

- We first get all the Organisations that have the name we supply. - If there are no Organisations then we output this to the user and ensure we will return failure. - We see if there is more than one Organisation with the name. - If there is one Organisation then we check to see if there is a service profile with the same name in it.

- We check to see if the service profile template exists. - We return the result.

This is where we are handling that we could have multiple Organisations could have the same name. If more than one is found, then we will fail and tell the person running our function to supply the Dn if they wish to continue.

When we alter our original function to use this one to do checks, and put everything together, it looks as per the below:

Function Automate-CheckUcsServiceProfileConflict {
	Param(
		[Parameter(Mandatory=$true)][Cisco.Ucs.UcsHandle] $Ucs,
		[Parameter(Mandatory=$true)][String] $NewName,
		[String] $Organisation = "root",
		[Parameter(Mandatory=$true)][String] $Template
	)
	Process {
		$result = $True;
	
		# Check the Organisation exists.
		$org = Get-UcsOrg $Organisation;
		if ($org -eq $null) {
			Write-Host "The Organisation does not exist.";
			$result = $False;
		
		} elseif ($org.Count -gt 1) {
			# We found more than one Organisation
			Write-Host "There is more than one Organisation with the name '$Organisation'. Please use the Org Dn to create Service Profiles.";
			$result = $False;
		
		} else {		
			# Check that a profile with the existing name doesn't already exist.
			$existing_sp = Get-UcsServiceProfile -Name $NewName -Org $org -LimitScope;
			if ($existing_sp -ne $null) {
				Write-Host "A Service Profile with the name '$NewName' already exists in the organisation '$Organisation'.";
				$result = $False;
				
			}			
		}
		
		# Check that the template exists.
		$sp_template = Get-UCSServiceProfile -Name $Template -Ucs $ucs | ? { $_.type -ne "instance" };
		if ($sp_template -eq $null) {
			Write-Host "The template $Template does not exist.";
			$result = $False;
		}
		
		return $result;
	}
}

Function Automate-NewUCSProfileFromTemplate {
	Param(
		[Parameter(Mandatory=$true)][String] $Domain,
		[Parameter(Mandatory=$true)][System.Management.Automation.PSCredential] $Credential = (Get-Credential),
		[Parameter(Mandatory=$true)][String] $NewName,
		[String] $Organisation = "root",
		[Parameter(Mandatory=$true)][String] $Template
	)
	Process {
		$ucs = Connect-Ucs -Name $Domain -Credential $Credential
		if ($ucs -ne $null) {			

			$checks_passed = Automate-CheckUcsServiceProfileConflict -Ucs $ucs -NewName $NewName -Organisation $Organisation -Template $Template;
			if ($checks_passed -eq $True) {
				$sp = Add-UcsServiceProfileFromTemplate -ServiceProfile $Template -NewName $NewName -Ucs $ucs;
				if ($sp) {
					Write-Host "Service Profile Created";
				
					# If you want to unbind from the template then put the code here.
					Set-UcsServiceProfile -ServiceProfile $sp -SrcTemplName '' -Force | out-null;
				}
			}			
		}

		Disconnect-UCS -Ucs $ucs;	
	}
}

And that’s it :). We now have some code that will create a UCS Service Profile from a template in a given organisation and will pass the obvious sanity checks.

We can now create (or at least attempt to) a service profile by doing the following:

1
2

C:\Scripts\>. .\automate.ps1
C:\Scripts\>Automate-NewUCSProfileFromTemplate -Domain ucspe01 -NewName server01 -Template init-windows

Next time, we’re going to get the HBA WWPNs and associate the service profile with a server.

Powershell: Getting a list of VM adapter types

Mon, 23 Mar 2015 00:00:00 +0000

The following code will list the VMs which have network adapters that are not VMXNET3. This is useful for knowing what you likely have to change ;)

It will output the Name of the VM, the Type of adapter and the Network (i.e. Virtual Machine Portgroup) that it is connected to.

The code will examine all the VMs on the vCenter, but you can pass parameters to the Get-VM cmdlet to reduce the scope (i.e. Get-VM -Location “Discovered Virtual Machines”).

`1`	`Get-VM \| Get-NetworkAdapter \| ? { $_.Type -ne "vmxnet3" } \| Select @{Name="Name";Expression={$_.Parent.Name}}, Type, NetworkName \| ft`

vSphere Web Client and SSH Warnings

Fri, 20 Mar 2015 00:00:00 +0000

I started using the vSphere C# client back when the product was called Virtual Infrastructure 3, and despite its many flaws it has become second nature to me. I’ve used the Web Client in 5.0 and 5.5 but never really gotten into it (for many reasons, speed being the main one).

I typically use Host Profiles to configure new hosts through the C# client, so have never been through the process manually with the Web Client before. Starting with 6.0 I decided to try that and found a pleasant surprise to the usual yellow warnings I had seen previously.

I always enable SSH as when there are problems I like to be able to see esxtop and get information first hand from hosts, and I typically enable SSH via the DCUI after configuring the management network settings. Following this I’d join the host to the cluster and apply the appropriate host profile (containing the advanced setting “UserVars.SuppressShellWarning”), so the warning that SSH is enabled is purely transitory.

When I join the host to the cluster in the Web Client, I see the warning icon against the host and select the host to see what it is:

The “Suppress Warning” link caught my eye, and when clicking on it I got this message:

After that the warning disappeared ! Looking in the Advanced Settings we can see that this sets the value for the “UserVars.SuppressShellWarning” setting to 1.

I know that this quality of life improvement was also present in the 5.5 version of the Web Client (and maybe before) but it’s a nice little touch for those small deployments where you can clear the alerts on your host with a couple of clicks instead of having to lookup the setting. Especially when you’re not licensed for host profiles !

Getting a NetApp volume size with Powershell

Tue, 17 Mar 2015 00:00:00 +0000

I ran into a problem recently where I needed to get the size of a volume from a NetApp filer so I could create a new volume (of the same size) and initialise a snapmirror relationship to it. The problem was that sometimes the snapmirror relationship would fail to start, reporting that the destination volume was too small. The fault was in how I was calculating the size of the source volume. I’m going to look at what I did wrong, and the right way to do it.

Using the Data ONTAP Powershell module, the below code shows the result of getting the properties that start with an “S” for the volume “random_volume”.

PS C:\> Get-NaVol "random_volume" | fl S*

Sis                                    :
SizeAvailable                          : 148084289536
SizeTotal                              : 154618822656
SizeUsed                               : 6534447104
SnapAutodelete                         : DataONTAP.Types.Volume.SnapAutodelete
SnaplockType                           :
SnaplockVolumeComplianceClock          :
SnapshotBlocksReserved                 : 37748736
SnapshotPercentReserved                : 20
SpaceReserve                           : volume
SpaceReserveEnabled                    : True
State                                  : online
SnaplockVolumeComplianceClockSpecified : False
SpaceReserveEnabledSpecified           : True

I was using the “SizeTotal” property in the output above to calculate the size of volume. When the number above is divided by 1GB it will translate to 144 GB, but this is incorrect, as System Manager reports the volume as 180 GB. So why is this number incorrect ?

The answer is also in the above output, as the “SnapshotBlocksReserved” and “SnapshotPercentReserved” values are not 0. As expected, this means a portion of the volume has been reserved for snapshots - in the above case, 20%. The catch is that “SnapshotBlocksReserved” is not in bytes, but in kilobytes. So to get the total size of the volume in bytes we must do the following:

1
2

$volume = Get-NaVol "random_volume";
$size = $volume.TotalSize + ($volume.SnapshotBlocksReserved * 1024)

If we then use the powershell magic of:

`1`	`$size / 1GB`

We get the correct result of 180 GB.

I wouldn’t recommend using the SnapshotPercentReserved property to calculate the correct total size - it is a better practice to use the exact number of blocks reserved for snapshots.

Moving UCS service profiles

Wed, 09 Jul 2014 00:00:00 +0000

Moving a Cisco UCS service profile between organisations should be a simple thing to do, but sadly it cannot be done in the UCS Manager GUI.

There is a useful post on the Cisco communities board here that has the PowerTool script that almost allows you to do this:

$sp = Get-UcsManagedObject -Dn org-root | Get-UcsServiceProfile -Name bob -LimitScope -Hierarchy | ? { $_.GetType().Name -ne "LsVersionBeh" }

$compare1 = Compare-UcsManagedObject ($sp) @()
$compare2 = Compare-UcsManagedObject @() ($sp) -xlateOrg org-root/org-Finance

start-ucstransaction
sync-ucsmo ($compare1) -deletenotpresent â€“Force
sync-ucsmo ($compare2) â€“Force
complete-ucstransaction

This didn’t work for me on the 2.2(2c) firmware, I got the following error:

Taking out the “Start-UCSTransaction” and “Complete-UCSTransaction” lines fixed this problem, allowing me to move a service profile - all thanks to Eric Williams at the link above :)

Unmounted NFS datastore after ESXi boots

Fri, 17 Jan 2014 00:00:00 +0000

In my home lab I recently found a problem where an NFS share I had mounted on my ESXi 5.5 device was unmounted after it had been turned on/restarted. My home lab is not that unusual, I have a N54L HP Microserver for shared storage - where I am using ZFS to carve up my 4x1TB disks - and a couple of Intel NUC’s for compute. All of this is joined together by a Cisco SG300-10 gigabit switch/router. I’ve been putting together some articles for this blog about a home lab and was curious as to the performance difference between running Windows Server 2012 Standard and CentOS 6.5 with ZFS for the shared storage. So I’ve been adding and deleting a lot of NFS and ISCSI datastores on my ESXi hosts. But since moving to CentOS to try out ZFS I’ve had a problem where one of my two compute devices will refuse to mount any shared VM exports. It will mount my ISO repository (which has slightly different permissions to allow anonymous SMB access), but nothing else. My other ESXi unit will mount everything.

So, knowing that one device has no problems, the permissions difference between the ISO repository and the shared vm’s can be eliminated. We can also discount the NFS permissions for root and read/write access as I am able to manually mount and use the datastores, it’s only on boot they are unmounted:

First thing I tried was looking at the /var/log/messages log on the storage. This is what I would see:

The ESXi device is not attempting to mount the share - confirming there is no problem with the storage server. So, turning to a recent purchase “Troubleshooting vSphere Storage” by Mike Preston (it was on offer at the start of the year and is a very good read), the section about troubleshooting NFS datastores tells us to look in the hostd logs. Let’s take a look:

“lb-fs-01” was the name of my Windows 2012 server (and is the hostname of the current storage server), but it’s not in DNS. In addition, all the datastores I’ve set up with the CentOS box have been defined by IP address:

So, it is strange that ESXi is trying to resolve “lb-fs-01”. For the answer, we’re going to need to look at the configuration - /etc/vmware/esx.conf. This is the point in the article where I wish I had a screenshot of the offending entries but I didn’t realise that ESXi purges /etc/vmware of all additional files on boot. So, sadly, there is no picture of what was causing the problem.

To find out what NFS storage entries your ESXi has, type the following from the console/ssh:

/etc/vmware # cat esx.conf | grep "/nas/"

This will display all your NFS datastore entries (and a few other lines). A working NFS entry looks like this:

There are four lines to define the storage - however there were only lines pertaining to lb-fs-01 and I’m only sure of “host” and “share” being present. I would imagine “enabled” would be the line that was missing.

Unlike me, you should take a backup of the file via WinSCP or FastSCP and not take a copy to the local file system. Once you’ve got a backup, delete the lines for the non-existent export/datastore and restart ("# reboot"). When the host came back up, I added one shared VM datastore, restarted again and whilst booting this is what I saw on the storage server:

Success :). After logging into the vSphere Client, I could confirm:

I have no idea why those entries where still in my esx.conf file. I deleted unused and non-existent datastores through the vSphere Client in the normal way and don’t recall any errors. It’s very strange as to how or why this occured.

That being said there is a main lesson - when backing up from ESXi, use WinSCP or FastSCP :)

Why, Apple, Why ?

Tue, 24 Dec 2013 00:00:00 +0000

iTunes 64bit installer.

I wasn’t allowed to install the 32bit version. For whatever reason.

LoadState not called in C++ Windows Store App

Mon, 14 Oct 2013 00:00:00 +0000

I had a problem recently where LoadState was not being called in my C++ based Windows Store App page that was based upon LayoutAwarePage.

This question from the Microsoft forums pointed me in the right direction - I had an OnNavigatedTo declared, this was being called and the LoadState was not. I moved the code from the OnNavigatedTo into LoadState and removed the former. Everything works again and I can now use Suspend/Resume properly on the page :)

Small developments

Sat, 12 Oct 2013 00:00:00 +0000

I haven’t updated in a little while since I’ve been quite busy - had a good family holiday a couple of weeks ago. I have purchased a home file server and two Intel NUC’s which are intended to be ESXi boxes.

Today has been an interesting day, but not so much good interesting. My first discovery was that if you want to play with VMware AutoDeploy on a vSphere evaluation license then you are not authorised to download the offline ESXi software depot bundle.

Now that this matters because both the NUC’s have faults - one is DOA and the other only has one working memory slot. Will have to RMA both of them on Monday.

I am starting to get my teeth into both Server 2012 and Lync 2013 (on premises). I’m also planning on running my file server as both Server 2012 and ZFS on Solaris/CentOS/to be decided later and see which is better. Right now I’m the Windows way for a quieter life. Seems to be working quite well, just need to find a place to put it so the missus can sleep at night !

To network all of this I’ve got a Cisco SG300-10 which I saw recommended on a couple of virtualisation-related blogs. It’s quiet and the CLI is pretty much the same as IOS, though they don’t like you changing the management IP. I had a stupid moment and did a “no ip address” on the interface, a groan and a reboot followed !

For the last couple of years I’ve been with O2 broadband as they have always had excellent reviews. Sadly they were bought by Sky and the offer to move completely has been too good to refuse (Broadband, Talk and Entertainment Extra+ HD for no installation fee and Â£14.50 pcm) but we’ve also decided to not take up their offer of joining their ADSL network and have FTTC being installed Monday with a minimum OFCOM-enforced speed of 35Mbps. Should be nice !

Importing UCS VLANs

Thu, 13 Jun 2013 00:00:00 +0000

I’ve had to deal with two UCS systems recently, ensuring that the configuration matches on them both, most of which I was happy to go through by hand. But the long list of VLANs was another story. I could see that they can be exported, but I couldn’t find an import ability. So, a quick search later, I found this webpage: http://www.mennodeliege.nl/cisco-ucs-powershell-toolkit-vlan butÂ is very nearly what I’m after, but we need to make a little modification.

Â This is because the VLANs are exported in the following format:

So we must adjust the powershell to take account of the format of the Name field (where the name always comes after the first “-”). This is what it looks like:

$vlancsv = import-csv "filename"
foreach ($row in $vlancsv) { 
    add-ucsvlan -id $row.ID -Name ($row.Name.SubString($row.Name.IndexOf("-") + 1)) -Sharing none -LanCloud (Get-UcsLanCloud) 
}

This does print out the details of each VLAN once it has been added. Adding a “| out-null” at the end of the line in the foreach loop should fix that if you want it to be nice and tidy.

UCS Default Keyring Certificate Regeneration

Fri, 24 May 2013 00:00:00 +0000

Recently our manually generated UCS certificate expired. Checking the manual (here) we needed to regenerate it with the following procedure:

UCS-A# scope security UCS-A /security # scope keyring default UCS-A /security/keyring* # set regenerate yes UCS-A /security/keyring* # commit-buffer UCS-A /security/keyring #

Piece of cake.

What isn’t said is that this will boot everyone using UCS Manager out of it and they have to reconnect. Might be useful to know in the future for scheduling purposes ;)

Listing Virtual Machines and Portgroups

Mon, 20 May 2013 00:00:00 +0000

vSphere 5.0 - If you need a list of Virtual Machines and the portgroups they are attached to:

`1`	`Get-VM -Location "somewhere" \| ft Name, @{Expression={$_.NetworkAdapters.NetworkName};Label="Network Name"}`

If you need to export this to a CSV:

`1`	`Get-VM -Location "somewhere" \| select-object Name, @{Expression={$_.NetworkAdapters.NetworkName};Label="Network Name"} \| export-csv "vm-networks.csv"`

Getting a vSphere VM's Network Adapters

Tue, 26 Mar 2013 00:00:00 +0000

Getting all the network adapters for a VM is an easy task:

`1`	`get-networkadapter -vm [vm name]`

When you remove a network adapter, vSphere will remove it’s entry in the .vmx file. In the .vmx file, the adapter configuration options are prepended by an “ethernetX” string, where X is a number between 0 and 9. Removing the adapter, removes all the appropriate “ethernetX” entries from the file. Adding an adapter to a VM will use the first available number, so if in a 5 NIC VM “ethernet2” is not present, this is where the adapter will be placed. This has the effect of calling the NIC “Network Adapter 3”.

Why does this matter ? Because we want to get our adapters in a reliable order, regardless of the number of NICs present.

`1`	`get-networkadapter -vm [vm name] \| sort Name`

The above line will work for all VM’s with less than 10 NICs. When we have 10 NICs we need to do a little bit of regex on the sort code:

`1`	`get-networkadapter -vm [vm name] \| sort { if ($_.Name -match '(\d+)') { [int] $matches[1] } }`

This strips out the number from the name of the adapter, converts it to an int and sorts based upon that.

This was all done with PowerCLI 5.0.0.3501.

Sidenote: I really need to find a decent plugin for code highlighting :-/

C++ Windows 8 Store Apps: The series

Mon, 11 Mar 2013 00:00:00 +0000

So I’m going to start writing my own apps - I’ve been doing C++ for a while now (15 odd years) and fancy a new project to occupy my commute each day. I’ve equipped an old laptop with a cheap SSD and Windows 8 and installed Visual Studio. The SSD really makes a difference !

Some things I’ve noticed: - System Restore Protection was not enabled for drive C: out of the box. I suffered some registry corruption (old laptop) and had to rebuild because of this. - It took about an hour to build my refresh/reset image in case I suffered more problems. I really feel there should be UI elements advertising this feature.

I’ve been using it on my desktop (dual monitor) for a little while now, and while the base of the OS is good, it is hampered by a slightly unclear UI design. The ModernMix application that changes full screen Store apps to windowed apps is very welcome, but I still don’t like the number of clicks required to restart/shutdown, or that Control Panel/Preferences exists in two places.

Finally, some C++ and the class scope “internal”. I didn’t catch this in my first reading and it is essential to building your application. As you can’t have public class members which are not a Windows Runtime type, this is the only way of allowing classes to have accessible non-private members. For more information, see Namespaces and Type Visibility (C++/CX ) at MSDN.

Swapfile Datastores

Wed, 16 Jan 2013 00:00:00 +0000

If you have more than one swap file datastore for your hosts, then you might want to see which hosts are connected to what datastores.

`1`	`get-vmhost -location "<cluster/datacenter name>" \| sort-object Name \| ft Name, VMSwapfileDatastore`

Quick PowerCLI #1

Mon, 17 Dec 2012 00:00:00 +0000

I may or may not make this a series ;) PowerShell with VMware is very useful. Ignoring the Connect-VIServer and Disconnect-VIServer commands, here are some tips.

Getting the Swap File Datastore for all hosts in a cluster

If you store VM swap files away from the VM folder (faster disk I would hope) and have more than one datastore for doing this then you’ll want to separate the datastores used for each host.

`1`	`get-vmhost -location "(cluster name)" \| sort Name \| ft Name, VMSwapfileDatastore`

Getting the Tools Version for a VM

I prefer the first way because it’s slightly less to type ;). With get-vm (the second query) you can target containers that you can’t with get-vmguest. So it’s all a matter of choice !

1
2

get-vmguest "(name/match query)" | ft VM, @{Name="ToolsVersion";Expression={$_.ExtensionData.ToolsVersion}}
get-vm "(name/match query)" | ft Name, @{Name="ToolsVersion";Expression={$_.ExtensionData.Config.Tools.ToolsVersion}}

DHCP authorisation for subdomains

Tue, 23 Oct 2012 00:00:00 +0000

While setting up multi-forest, multi-domain environment to test an Exchange 2010 deployment I decided to do something that I hadn’t done when setting up these tests before - I implemented DHCP on one of the domains - all so I could bring up clients as required.

Installing the DHCP service was as easy as usual. Then I came to authorising the server in my child active directory domain.

Lucky I found a MS article on it -Â http://support.microsoft.com/kb/303351. I logged onto a first-forest-domain as an enterprise administrator and ran the command:

netsh dhcp add server

And then to verify that it worked:

netsh dhcp show server

No need for GUI tools, always a good thing :). But whenÂ I went back to my DHCP server it was still showing as unauthorised - after a quick restart of the service everything was working as it should.

adamsync

Fri, 24 Aug 2012 00:00:00 +0000

Following on from my post about getting ADAM to work with Openfire, using adamsync to pull in information from the source domains was also an interesting experience.

Adamsync uses an xml file to define what it should pull in, and what it should do with it. There are plenty of references out there to adamsync and the XML file, so I won’t go into any general detail.

Groups and Users

The ‘object-filter’ tag in the file can be used to look for Groups in the same file as is used to sync users. The ‘user-proxy’ tag is only used for the appropriately specified classes, so groups will just be imported as groups (with all the attributes that you set to include).

The caveat of this is that the ampersand (at least - I haven’t come across any other characters) will need to be encoded ala HTML. So a valid value for object-filter is:

(|(&(objectCategory=person)(objectClass=user))(objectClass=group))

This will find users who are persons and groups. Just ensure you include the attributes you want for the group ! (i.e. ‘member’)

Narrowing the scope / Multiple sources

The ‘base-dn’ tag can be used more than once - so you can specify more than one OU/Container that your users/groups are saved within to sync with ADAM. This becomes important a bit later in this post ;)

Universal Groups

When syncing a Universal Group that contains members outside of the domain in which it resides, the log file for the sync can contain:

Will not synchronize dn-ref to . Target does not exist.

adamsync cannot find the member outside of the domain and so does not include it in the group. I have no idea how to fix this - I put in a workaround - I create a universal group in the adam instance and have a script that runs on a schedule that will populate it with userProxy objects that have been created in certain OU/Containers within the instance.

Deleting a user from a source domain

If you delete Â a user from the directory that ADAM is synchronising with, it can haveÂ unforeseenÂ consequences. This thread led me discover this.

What I found (so YMMV) is that if a user is deleted from AD then the next time that adamsync runs it will state “ldap error occured” for that object. If the user is moved to a container that adamsync does not have visibility on then adamsync will delete the user from ADAM. The userProxy object also appears to be deleted from ADAM groups aswell !

There is a blog entryÂ here that mentions that permissions could be given on the deleted objects container - this isn’t something I’ve tried yet so have no idea if that would work.

Error: 317 when running sync

This I’ve had when installing an XML file with adamsync as one user and trying to run it as a user. The only way I’ve avoided this is to either:

a) Log on interactively or b) Run a cmd windowÂ as the user I will be running the /sync or /fs command as.

If you opt for (b) then you’ll need to log on with the profile of the user, so the command to start the cmd window would be:

runas /profile /user:DOMAIN\user cmd

That’s it !

This has just been a compilation of my experiences with adamsync and Openfire for 3 domains and 2 forests. It’s been reliable and easy to use since setting it up, though I wish the ageing of entries would be better. Hope this helps !

VMware Orchestrator workflow failing

Mon, 20 Aug 2012 00:00:00 +0000

Had an interesting issue the other week involving VMware Orchestrator. Workflows have been set up to use Configuration elements, and one of the attributes in the element was a VC:VmFolder. This would be set, but the workflow would fail, and when I went back to look at the attribute it was “not set”.

This had started happening after upgrading to vCenter 5, which includes Orchestrator by default. There was a relevant error in the logs:

ERROR
\[VimSession\]
getOrCreateVimObject() –> Cannot create com.vmware.vmo.plugin.vi4.model.VimVmFolder

Luckily the first link in a Google Search found the answer - - this was that the default vCenter plugin for vCO has an issue and needed to be updated.

After updating, the scheduled workflows complete without any problems … but the logs do still say “vi4” …

Windows 8 and recent hotfixes

Tue, 31 Jul 2012 00:00:00 +0000

So I bought a laptop about 6+ years ago and it died about 4 1/2 years ago, refusing to take a charge when plugged into the mains. Now I’m pretty sure I tried everything I could to get it to work, considering that I had a University assignment due in 2 days later and I was half way through writing it up and my only recourse was to drive back to work and grab an spare, old, bad, slow laptop to complete it (it’s good to be in charge !). This laptop (not the work one, that got taken back as soon as I was done) was on a shelf in our spare room (I do hoard some things) and I decided to give it a go. Plugged it in. Green light. Oooohhhhh.

I got it to boot once, but soon determined that there were hard drive errors. So, as much as I don’t like not being able to take a backup of a drive, I wiped it and installed the Release Preview of Windows 8.

The laptop is an Acer Aspire 5020 and has a single core AMD Turion 1.8Ghz and 1.25Gb RAM and runs Windows 8 surprisingly well. Apps are quick to start, switching is responsive. I can’t get the wireless to work yet (Acer require their launcher software to be installed to allow the wireless to be enabled) and the screen resolution isn’t quite right yet (working on) but no real complaints yet. I’ve installed the Office preview and Visual Studio 2012 so the test over the next few weeks is putting together a c++ metro app. Windows 8 is different, but better to be in front of it properly rather than running it in a VM.

Two issues I’ve run into recently:

Group Policy Preferences and item levelÂ targetingÂ - on Windows 7 and Server 2008 R2. There is a bug that creates additional ldap connections and leaves them in a CLOSE_WAIT state. Had a server that had *lots* of ldap connections building up until it was unable to service any more socket requests.

The knowledge base article and hotfix is here -> http://support.microsoft.com/kb/2561285

If you use PerfMon to track TCP Connections then you’ll see the number of connections slowly rising. “netstat -o” will show you the connections and their state.

IIS with Integrated security set doesn’t fall back to NTLM if Negotiate fails - I had this on Windows Server 2008 (I think, could have been R2 but was a long weekend !). I was trying to visit a /certsrv site on a DC and I was being prompted for credentials - but I could not provide DC credentials that worked.

Looking at the providers for the Windows Integrated authentication method showed that Negotiate was ahead of NTLM - the workaround was to swap them round. The kb and hotfix is here -> http://support.microsoft.com/kb/2522623/en-us.

This article led me to the solution, so I can’t take any credit ;)

ADAM / LDS

Mon, 30 Jul 2012 00:00:00 +0000

A recent project has been to configure an ADAM instance to allow Openfire (homepage) to allow users from multiple domains to connect to it. It has been interesting and at times frustrating. I wanted to sync to two domains, both in the same forest and create userProxy objects in the ADAM instance to allow for binding.

There is a source document for using ADAM with Openfire at this link.Â

The first thing I tried wasn’t ADAM running on Server 2003 - it was Lightweight Directory Services running on Server 2008. This worked for the most part - I set up two domains and my adamsync XML files to sync them to the domainDNS objects that I had created. They synced without any problems. Then I tried to use Openfire with the root partition object and immediately found 0 users.

The root cause of this issue is that when you create a domainDNS object in LDS, the instanceType attribute has a value of 5 - this indicates it is writeable and at the top of the partition. So by creating two domainDNS objects I had created two additional partitions in my instance and Openfire does not appear to be able to traverse partitions when looking for users.

Fair enough. I tore the instance down and started again from scratch, thinking “I’ll just put all the users in the one partition I create”. This didn’t work either - adamsync in LDS will only sync to the top of a partition, and you can only have one adamsync configuration per partition. So I could sync one domain and nothing else - leaving me in exactly the same situation as I am if I point Openfire to a single domain.

There was only one thing for it Â - going back to ADAM on Server 2003. This worked ! How come ?

- domainDNS objects have instanceType set to 4 (writeable) and because they do not have the “top of partition” bit set, they do not represent a new partition. - adamsync can sync to these domainDNS objects, which aren’t at the top of a partition, without a complaint. I didn’t try syncing to CN’s or OU’s though ;)

Hence I can put the users from two domains into one ADAM instance. So, if you are looking at using Openfire with multiple domains and you decide to go the ADAM route - ignore LDS, stick to 2003 !

Firefox information via DDE

Fri, 16 Mar 2012 00:00:00 +0000

For a while I’ve been looking into how to work out what browser URL’s a user has open with some code. Internet Explorer is easy - I’ll post that code later - but Firefox and others, that’s where it gets interesting.

From my searching there seems to be two ways to do this - DDE or by using looking through some child windows. This article isn’t going to tell you how to achieve this aim as I haven’t looked too closely at the second option but I have looked at the first and can write about it. But why ? for the sole reason that whilst trying to find this out I found many questions, but no clear answers and very little code. Everything in this article has been pieced together from the many to produce this one. Hopefully it will be helpful.

What really helped was finding this article, which referenced the NDde project (link) which allows DDE to be used in C#/etc. I’ve not dealt with DDE before, so it was all new to me but diving into the source code gave me pointers towards the correct part of MSDN - the DDE Management Library. From here I could start crafting a C++ solution that fitted my needs.

And this is where it all went wrong ! This link details how DDE works with Internet Explorer, but I have been unable to find a single official reference for Firefox. In particular are the topics WWW_GetWindowInfo and WWW_ListWindows - this would allow an application to get URL’s and information for each tab or browser window.

Problem is, Firefox doesn’t appear to support WWW_ListWindows and it doesn’t matter what parameter you pass to WWW_GetWindow, it only returns the active tab for the current window (and if no Firefox window is the active one, then the last window that was active). And what’s more, the return is in ANSI encoding rather than unicode. The string that is returned will give you the title of the window/tab/page in addition to the URL.

Here’s a win32 console application (compiles in VS210) that will return the one Firefox DDE result. Sorry about the lack of indenting, need to work out my code tags ;)

#include <Windows.h> #include <stdio.h> #include <conio.h>

void wmain(int argc, wchar_t** argv) { DWORD dwApp = 0;

if (DdeInitialize(&dwApp, NULL, APPCLASS_STANDARD, 0) != DMLERR_NO_ERROR) { return; }

HSZ server = DdeCreateStringHandle(dwApp, L"Firefox", CP_WINUNICODE); HSZ topic = DdeCreateStringHandle(dwApp, L"WWW_GetWindowInfo", CP_WINUNICODE);

HCONV conv = DdeConnect(dwApp, server, topic, NULL); if (conv == 0L) { DdeUninitialize(dwApp); return; }

HSZ url = DdeCreateStringHandle(dwApp, L"URL", CP_WINUNICODE);

HDDEDATA pData = DdeClientTransaction(NULL, 0, conv, url, CF_TEXT, XTYP_REQUEST, 500, NULL); if (pData == 0) { DdeUninitialize(dwApp); return; }

DWORD dwData = DdeGetData(pData, NULL, 0, 0); if (dwData > 0) { BYTE* p = (BYTE*) malloc(dwData); if (p != NULL) { DWORD dwRes = DdeGetData(pData, p, dwData, 0); if (dwRes > 0) { printf(“ANSI URL = %s,\n”, (char*) p); }

free(p); } }

DdeFreeStringHandle(dwApp, url); DdeFreeStringHandle(dwApp, server); DdeFreeStringHandle(dwApp, topic);

DdeDisconnect(conv);

DdeUninitialize(dwApp); _getch(); }

I’ll post how to get information from IE soon

\[which no doubt exists somewhere else on the web\]

and need to investigate more into getting information from windows classes. Right now it looks like the best and most reliable to get URL information would be to use a plugin.

NTFS permissions to modify files but not folder structure

Sat, 03 Mar 2012 00:00:00 +0000

I had a request a little while ago where an end-user wanted a set of users to be able to fully manage the folder structure below a certain folder in share, and for another set of users to be able to create/modify/delete files anywhere within that structure, but be unable to change the structure itself. Sounds very straight forward, but there’s slightly more to it than meets the eye

\[especially if you're used to applying one ACE (Access Control Entry) per security group/user\]

I’ve created three security groups and am setting permissions on the folder in the share that will contain the managed structure. The groups are:

Root Owners Root Contributers Root Â Viewers

Root Viewers is purely good practice for limiting access to shares - this could be left out and be replaced with domain users or authenticated users if you wish.

Root Owners have the standard “just less than full administrator” permissions - they do not have Full Control on the parent folder, and are also missing delete, change permissions and take ownership. This ACE is applied to the parent folder, it’s subfolders and files.

It’s the ACE for the Contributers that is where it’s at. Or more importantly, the two ACE’s - one for browsing folders and creating files, and another for modify access on the files.

Let’s start with the files ACE first. Here’s what it looks like:

This is fairly straight forward - it applies to Files Only and contains the permissions to read/write and delete. The important distinction comes from the permissions with two explanations listed:

Traverse Folder / Execute File List Folder / Read Data Create Files / Write Data Create Folders / Append Data

The first items listed are the permissions if the ACE was applied to a folder - the second if the ACE is applied to files. Typically the ACE is applied to “This folder, subfolders and files” so there is no need to separate them out. Since this ACE is being applied to files and we want the security group to be able to save files, we tick the permissions for “Write Data” and “Append Data”. This will not grant this security group the right to create files or folders and the ACE will apply to all files (even ones within subfolders) below the folder where the ACE is applied.

Bearing in mind that the following article applies to Windows 2000 -Â http://support.microsoft.com/kb/220167Â - there is the following stated regarding applying to files only:

“Files only” Apply Onto value, (IO), (OI) ACE flags: ACE does not apply to this container, but propagates to the files it contains. Subfolders do not receive this ACE.

If you were to examine a subfolder you would see that the ACE is received by it and it applies to the files contained within. The same article states the meanings of OI and OI, and it is OI that defines this behaviour:

IO: Inherit Only - This flag indicates that this ACE does not apply to the current object. CI: Container Inherit - This flag indicates that subordinate containers will inherit this ACE. OI: Object Inherit - This flag indicates that subordinate files will inherit the ACE. NP: Non-Propagate - This flag indicates that the subordinate object will not propagate the inherited ACE any further.

The ACE onto folders is somewhat simpler:

We want users in the group to be able to traverse the folder, read data and to be able to create files within subfolders - thus all the relevant boxes are ticked as per the image above - just ensure that this ACE only applies to the main folder and subfolder though.

And that’s it - creating an ACE for read access to the folder is simple enough - but through these two main ACE’s you can deny user’s the ability to alter the folder structure but still allow them to create all the files they like. Quotas notwithstanding of course, but that’s a different matter ;)

VCP5

Sat, 03 Mar 2012 00:00:00 +0000

I passed the VMware VCP510 exam earlier this week, so am now waiting on VMware to confirm it

\[and send the Workstation 8 license !\]

. It was a tough exam, seemed to be a fair test of experience with the product and the time allocated was balanced to the questions quite well.

Many sites offer advice for revision (read the VCP510 blueprint !) and what I found most useful were various mock exams on other sites (including VMware’s own) and Forbes Guthries’ vSphere 5 Reference Card.

First !

Tue, 21 Feb 2012 00:00:00 +0000

Been meaning to start a blog for a while, to note down all the interesting things I find out each day. Typically this blog will focus on IT and anything I learn whilst implementing infrastructure technologies. As a hobbyist programmer there might be the occasional C++ or some other language.

Hopefully you’ll find something useful here ;)

About Me

Mon, 01 Jan 0001 00:00:00 +0000

My day job for the last 25 years has been on-prem infrastructure, typically working in smaller teams and datacenters. I’m a bit of a generalist and willing to get my hands dirty with anything !

In my spare time I like to code …

And sometimes I think this whole website thing was easier when we had geocities and had to code the HTML by hand !

Network Subnet Scanner

Mon, 01 Jan 0001 00:00:00 +0000

Network Subnet Scanner

Sends ICMP ping requests to IPv4 addresses on a defined subnet and displays the results, which can be filtered by whether there was a response of not. It also displays the DNS and MAC addresses if able to be discovered and allows a quick launch of RDP or SSH (separate application required) to remotely manage.

Link: https://www.microsoft.com/store/apps/9NDCL69LZ04V
Windows Store Link: ms-windows-store://pdp/?productid=9NDCL69LZ04V
Privacy Policy

Waking Up the Network

Mon, 01 Jan 0001 00:00:00 +0000

Waking Up the Network

Take control of your energy bills and starting up the computers on your network with this useful tool.

Sends ‘Wake On Lan’ packets to target devices to get them to turn on. Devices can be added into groups and commands issued to all devices in a group.

There is an add-on available that will scan the local network and allow results to be automatically added as devices in the application. The add-on also works with Active Directory to import security groups of devices.

The application automatically detects when devices are online, via ICMP ping, and will show the status of devices and groups to the user.

Link: https://www.microsoft.com/store/apps/9N0MNLDX6K2N
Windows Store Link: ms-windows-store://pdp/?productid=9N0MNLDX6K2N
Privacy Policy

Neale's Corner

Remove network adapters attached to specific portgroups from VMs using PowerCLI

Setting vSphere Round Robin multipath policy with PowerCLI

Expand/Collapse Animation with UWP

Get VMHost Swap datastore using PowerCLI

WSUS, Powershell and Computers

Get-WSUSComputer

Object Methods

Enabling SSH on ESXi with vRO

Web Client

HTML5 Client

vRealize Orchestrator

Building the workflow

Download

Cisco UCS Central - getting free slots from connected domains

Reporting on vSphere Replication transfer sizes

Finding what to report upon

Determining accurate numbers

Bringing it all together

Managing a DRS group with vRealize Orchestrator

Core

Where next

Summary

Updating a HP iLO using Rest API and vRealize Orchestrator

Using Postman

Using vRealize Orchestrator

Wrapping it Up !

Updating multiple iLOs

Updating an ESXi Cluster using a custom attribute

vSphere Client Integration

Further Automation / Improvements

Summary

Modifying cross forest members of Active Directory groups

Managing Snapshots with vRO

Requirements

Workflows

Virtual Machine

Cluster Workflow

Clusters / vCenter Servers Workflow

Configuration Element

Emails

Download

Improvements

ScaleIO 2.5 Upgrade advice

MDM certificates

SLES uploads

LIA Passwords

Upgrade the SDCs automatically

ScaleIO GUI Tools

Enabling SSH on ESXi hosts

Updating SDCs

Switch the Primary/Master MDM

Rebalance/Rebuild

Detach old ESXi installation devices

vRealize Orchestrator: Finding a REST Host from a vCenter SDK connection

Comparing Values

Next Steps

Summary

Multiple service vROPs dashboard

Custom Group Type

Custom Groups

Access Control

The multiple service dashboard

Sharing the dashboard

vRealise Log Insight and Orchestrator

Environment

Integration

WebHook Shims

Workflow problems

Node.js

Trying it out

Summary

Detaching Devices from a Cluster

Finding a UCS Service Profile from the MAC Address

vSphere REST API and C++ (Part 2)

Connecting

Handling JSON

Tasks

Example

Next Time