Jonathan Marrott's VM Scripting Blog

Firewall - XML Changes (Updated)

froboy — Fri, 18 Jan 2008 18:54:00 GMT

I decided that I didn't like changing the firewall by executing esxcfg-firewall all the time. So I edited the appropriate XML file to include the nececssary ports for TSM and VMM (HP) agent. This is different for ESX 3.0.x and 3.5. One word of caution: In ESX 3.5 if you add a service to services.xml and it exists in another XML file. You can render your system inaccessible.

ESX 3.5
Service - TSM
Location - ibmTSM.xml


<ConfigRoot>
<service>
<id>TSM</id>
<rule id='0000'>
<direction>inbound</direction>
<protocol>tcp</protocol>
<port type='dst'>1500</port>
<flags>-m state --state NEW</flags>
</rule>
<rule id='0001'>
<direction>outbound</direction>
<protocol>tcp</protocol>
<port type='dst'>1500</port>
<flags>-m state --state NEW</flags>
</rule>
<rule id='0002'>
<direction>inbound</direction>
<protocol>tcp</protocol>
<port type='dst'>
<begin>1581</begin>
<end>1583</end>
</port>
<flags>-m state --state NEW</flags>
</rule>
<rule id='0003'>
<direction>outbound</direction>
<protocol>tcp</protocol>
<port type='dst'>
<begin>1581</begin>
<end>1583</end>
</port>
<flags>-m state --state NEW</flags>
</rule>
</service>
</ConfigRoot>

ESX 3.0.x
Service - TSM
Location - services.xml
<service id='0023'>
<id>TSM</id>
<rule id='0000'>
<direction>inbound</direction>
<protocol>tcp</protocol>
<port type='dst'>1500</port>
<flags>-m state --state NEW</flags>
</rule>
<rule id='0001'>
<direction>outbound</direction>
<protocol>tcp</protocol>
<port type='dst'>1500</port>
<flags>-m state --state NEW</flags>
</rule>
<rule id='0002'>
<direction>inbound</direction>
<protocol>tcp</protocol>
<port type='dst'>
<begin>1581</begin>
<end>1583</end>
</port>
<flags>-m state --state NEW</flags>
</rule>
<rule id='0003'>
<direction>outbound</direction>
<protocol>tcp</protocol>
<port type='dst'>
<begin>1581</begin>
<end>1583</end>
</port>
<flags>-m state --state NEW</flags>
</rule>
</service>

Service - VMM
Location - services.xml
Note: We discontinued use of VMM do to VM reboots.

<service id='0028'>
<id>VmmService</id>
<rule id='0000'>
<direction>inbound</direction>
<protocol>tcp</protocol>
<port type='dst'>
<begin>1124</begin>
<end>1126</end>
</port>
<flags>-m state --state NEW</flags>
</rule>
<rule id='0001'>
<direction>outbound</direction>
<protocol>tcp</protocol>
<port type='dst'>
<begin>1124</begin>
<end>1126</end>
</port>
<flags>-m state --state NEW</flags>
</rule>
</service>

Enable VMotion on VMKernel port

froboy — Fri, 18 Jan 2008 18:32:00 GMT

This will enable VMotion on a VMKernel port. I am writing this one because it changed between verisons of ESX. This command uses the very useful vimsh.

ESX 3.0.x:
vimsh -n -e "/hostsvc/vmotion/vnic_set portgroup2"
portgroup# - Determined by the order of portgroup creation. The system automatically makes one to begin with.

ESX 3.5:
vimsh -n -e "/hostsvc/vmotion/vnic_set vmk0"
vmk# - Determined by the order of the VMKernel port creation. The first one created is '0'.

Create NFS Mount on ESX (Updated)

froboy — Fri, 18 Jan 2008 18:30:00 GMT

I like to have a mount on each of my ESX servers to allow for quick installations and centralized scripting for cron jobs.

NFS Mount visible from host and service console:
<Required to have a Service Console and VMKernel port>
This can be accessed from /vmfs/volumes/<datastore>
esxcfg-firewall -e nfsClient
esxcfg-nas -a -o nfsserver.yourdomain.com -s /vol/vm nfs01

Manual mount visible from the service console only:
1. Edit /etc/rc.d/rc.local
2. Add: mount nfsserver.yourdomain.com:/vol/vm /mnt/vm
This will allow it to mount on boot.
3. Execute: mkdir /mnt/vm
4. Execute: chkconfig portmap on
5. Execute: service portmap start
6. Execute: esxcfg-firewall -e nfsClient
7. Execute: mount nfsserver.yourdomain.com:/vol/vm /mnt/vm
This will immediately mount.

DNS - Set Servers (Updated)

froboy — Fri, 18 Jan 2008 18:22:00 GMT

Simple script to set DNS servers. This sets muplitle DNS servers while kickstart by default only sets one.

Set DNS servers using vimsh:
vimsh -n -e "/hostsvc/net/dns_set --dns-addresses=192.168.0.1,192.168.0.2 --dns-searchdomain=yourdomain.com"

Set DNS servers by manually creating resolv.conf:
cat > /etc/resolv.conf << EOF1

search yourdomain.com
nameserver 192.168.0.4
nameserver 192.168.0.6

EOF1

Set Service Console Memory (Updated)

froboy — Fri, 18 Jan 2008 17:09:00 GMT

The service console memory should be increased if you are running apps other than the default install. This includes management agents, backups, etc. Here is a simple command that I ran across to accomplish this. It requires a reboot to take effect. I incorporate this in my kickstart script. Don't forget to set your swap partition to be 2x the Service Console memory.

See Current Setting:
The setting shown is in bytes (MB * 1024 * 1024)
vimsh -n -e "/hostsvc/memoryinfo"
serviceConsoleReserved - Current setting
serviceConsoleReservedCfg - Setting after next reboot

Set to 800MB with vimsh:
vimsh -n -e "/hostsvc/memoryinfo 838860800"

Set by manual edit of files:
mv -f /etc/vmware/esx.conf /tmp/esx.conf.bak
sed -e 's/boot\/memSize = \"272\"/boot\/memSize = \"512\"/g' /tmp/esx.conf.bak >> /etc/vmware/esx.conf

mv -f /boot/grub/grub.conf /tmp/grub.conf.bak
sed -e 's/uppermem 277504/uppermem 523264/g' -e 's/mem=272M/mem=512M/g' /tmp/grub.conf.bak >> /boot/grub/grub.conf

If you feel like setting it to the maximum of 800 MB.

mv -f /etc/vmware/esx.conf /tmp/esx.conf.bak
sed -e 's/boot\/memSize = \"272\"/boot\/memSize = \"800\"/g' /tmp/esx.conf.bak >> /etc/vmware/esx.conf

mv -f /boot/grub/grub.conf /tmp/grub.conf.bak
sed -e 's/uppermem 277504/uppermem 818176/g' -e 's/mem=272M/mem=800M/g' /tmp/grub.conf.bak >> /boot/grub/grub.conf

VC Licensing Spreadsheet

froboy — Wed, 21 Nov 2007 16:17:00 GMT

I put my licensing script into a spreadsheet...

You need to populate your own hostnames and licensing server, but it will query the licensing log against those hostnames.

VC Licensing

froboy — Fri, 16 Nov 2007 22:40:00 GMT

Do you know which servers have got a hold of your VC licenses? I had a tedious time looking through the log on VC to get an exact count. All of the check in's and out's complicated things to. So here is a script to parse the VC licensing log to see who has what.

Usage:
vclic.vbs /s:<VC License Server>

TSM - Restore VM Images

froboy — Fri, 05 Oct 2007 14:09:00 GMT

Procedure Overview:

Restore Files
VM Registration
Restore Files:

Browse to http://<servername>:1581
Click 'Restore'
Enter username and password. Press <Enter>
Click 'View' -> 'Display active/inactive files'
Click 'Yes'
Under 'File Level' browse to the location of the guest to restore.
Place a check mark next to the latest versions of: *.vmx, *.vmxf, *.vmdk
Click Restore
VM Registration

Browse to the guest folder
Edit the .vmx file.
Remove the "-00000?" from the 'scsi0:0.fileName' parameter so that it matches the main vmdk file.
Execute: vmware-cmd -s register <path to vmx file>
Power on VM using Virtual Center.
Troubleshooting:

"The system cannot find the file specified" - This is caused by 'scsi0:0.fileName' parameter in the vmx file pointing to an incorrect vmdk file or to the *-00000?.vmdk file

"A file was not found." - Same as "The system cannot find the file specified"

List Snapshots on ESX Host

froboy — Fri, 28 Sep 2007 20:16:00 GMT

This script will list all snapshots for guests assigned to a specific host.

SSH - Enable for Root

froboy — Fri, 28 Sep 2007 19:53:00 GMT

Here is a quick 2 line change to enable ssh for root.

cp /etc/ssh/sshd_config /etc/ssh/sshd_config.orig
sed 's/PermitRootLogin no/PermitRootLogin yes/' /etc/ssh/sshd_config > /etc/ssh/sshd_config

If you want the changes immediately before a reboot also execute:
service sshd restart

Again, very handy in kickstart.

Firewall - Sync with Virtual Center

froboy — Fri, 28 Sep 2007 19:42:00 GMT

One of the initial issues I had with Virtual Center is that it did not always show the correct firewall settings. The command esxcfg-firewall seemed to be the authority on open ports. By executing 'service mgmt-vmware restart' at the command prompt it syncs up VC with esxcfg-firewall. If you decide to script this and plan on having commands after this, you will want to add a 'sleep 20' command on the next line so that the VM management service has a chance to finish the sync.