jftwp's Posts

Hi all.  Quick question.  We're upgrading from 6.0 U2 ESXi hosts to 6.7 U1. Just wanted to confirm that this is a POST 6.7U1 patch (given 6.7U1 went GA in mid October and this patch was releas... See more...
Hi all.  Quick question.  We're upgrading from 6.0 U2 ESXi hosts to 6.7 U1. Just wanted to confirm that this is a POST 6.7U1 patch (given 6.7U1 went GA in mid October and this patch was released Nov 9). VMware ESXi 6.7, Patch Release ESXi670-201811001 So... upgrade 6.0 U2 hosts >>> 6.7 U1 >>> then apply ESXi670-201811001 as final step for hosts.  All caught up?  Thanks!
Here we are, a year later, and in the Update 2 flavor, and we are seeing the same (or very similar) issues with web client failing to provide the expected rights while the thick client is absolut... See more...
Here we are, a year later, and in the Update 2 flavor, and we are seeing the same (or very similar) issues with web client failing to provide the expected rights while the thick client is absolutely fine with rights.  Very similar deployment model (external PSC).  Both are appliances in our case. Switching from AD Integrated to LDAP as identity source into the same AD domain made no difference for us, unfortunately. Case opened/escalated with VMware as this appears to be an issue for some deployments from the GA of 6.0 (when this thread began) up through the current timeframe (6.0 U2).  This only affects SOME accounts, but not all.  Only sure-fire workaround is to log on using a native SSO account outside of AD that has global rights---this is currently the only way we can confidently access all solution user/extensions such as vSphere Replication or SRM and other 'web client only' functionality.  Very disturbing problem here, and a fundamental flaw with the web client's authentication versus that of the thick client, absolutely.  Will see what the escalation yields.
Thanks very much.  I'll probably go ahead and open up a case.
SRM 6.1.1 build 3884620 2 SRM sites deployed/paired. vCenter 6.0 U2, build 3634794 Single SSO domain, single SSO logical site. External PSC deployment model. Everything working fine, ins... See more...
SRM 6.1.1 build 3884620 2 SRM sites deployed/paired. vCenter 6.0 U2, build 3634794 Single SSO domain, single SSO logical site. External PSC deployment model. Everything working fine, install went fine, but most times when I go into the web client to administer the SRM environment, I need to "Reconfigure Pairing" to the alternate site (depending on which vCenter server I'm logged on to primarily) because the 'Paired Site' will show 'Not Connected' under the site summary tab and there will be authentication-related errors in the other tabs (such as under Manage) until I reconfigure pairing.  Once I reconfigure, all is fine.  I reconfigure using the same credentials I am already logged on with since my account (AD directory source within vSphere SSO/PSC) has GLOBAL administrator level permissions. That all said, in our 'legacy' SRM+vCenter v5.1 environment, every time you go in to the thick client to administer via the SRM plugin, the remote site requests credentials and, once provided, it's all good. So is it 'by design' that one must authenticate (5.1) or 'reconfigure' (6.x) when using SRM, or is something amiss with my configuration.  I really only care about the 6.x environment going forward since the 5.x will soon be retired.  Thought I'd put out the feelers here first before going so far as to open a ticket only to be told that's expected (need to re-up token or whatever within SSO/SRM6 environment).  Thanks.
Thanks.  One thing I noticed about the backup process noted in the install guide is that you don't necessarily have to stop the SRM service itself.  I was able to generate a backup file via runni... See more...
Thanks.  One thing I noticed about the backup process noted in the install guide is that you don't necessarily have to stop the SRM service itself.  I was able to generate a backup file via running the script shown in the guide, so I think I'll just schedule a weekly command to run backups.  I'm also backing up the entire SRM server itself as part of a regular rotation, via VADP/Commvault. Anyone else have comments/experience using the embedded database?  I'll give it a week before marking gs_khalsa comment as 'Correct'.
Is anyone who is using the embedded database experiencing any issues?  I've read the install/config guide and apparently the embedded db is just as scalable as using an external SQL db where maxi... See more...
Is anyone who is using the embedded database experiencing any issues?  I've read the install/config guide and apparently the embedded db is just as scalable as using an external SQL db where maximums, etc are concerned.  Other than that, the guide (and release notes) mention no caveats and provide backup/restore procedures via cmd line which is fine (and which I will do).  Just being cautious before implementing, because we've experienced some vendor's variants of PostgreSQL db's wherein the 'vacuuming' can become problematic or other issues have arisen.  I just don't want to kick myself in the future for not having used an external SQL database instead, as I've done for prior versions of SRM going back nearly 10 years, but using the embedded makes the overall deployment infinitely easier.  Trade off? For what it's worth, I can't FIND anything/anyone complaining about the Postgre database in either SRM 5.8 or 6.1.x Thanks for any feedback.
I just did some digging on this myself (we have 6.0 U2 deployed now) after I tried the same things (adding AD users into the SSO domain groups, etc. etc.) with no success. What I finally found... See more...
I just did some digging on this myself (we have 6.0 U2 deployed now) after I tried the same things (adding AD users into the SSO domain groups, etc. etc.) with no success. What I finally found is that this is just plain a KNOWN ISSUE with 6.0 U2 and perhaps they'll fix it with 6.0 U3 whenever that comes out (later this Summer)?  Maybe it'll be 6.5 by then, with an announcement at VMworld 2016 or something---who knows. The workaround is a joke --- suggesting deploying via only the default SSO domain.  Well, that's never going to happen of course, so what they should have said as a workaround is, if you really need to get in and view the status, etc. from within the web client, just log on with your administrator@vsphere.local account that was created at original time of installation. VMware vCenter Server 6.0 Update 2 Release Notes ***** Attempts to configure and view information about the vCenter Server Appliance by using the System Configuration page in the vSphere Web Client fail with errors Log in to the vCenter Server instance in the vCenter Server Appliance with a user who is in a custom-named (different from the default vsphere.local) Single Sign-On domain by using the vSphere Web Client. On the vSphere Web Client Home page, click System Configuration and under System Configurationselect Nodes. If you attempt to edit the settings, restart or power off a node of the vCenter Server Appliance, the operation fails with one of the following errors: An internal error has occurred - Error # 1009 and Not authorized to use this API . If you click the Summary, Monitor, or Manage tabs, some information about the appliance might not be displayed. Workaround: Deploy the vCenter Server Appliance only by using the default Single Sign-On domain: vsphere.local.
Hi all.  We are in the process of migrating hosts/clusters from old Windows+SQL-based vCenter 5.1 installations to vCenter 6 U2 appliances. A colleague of mine has expressed concerns about how... See more...
Hi all.  We are in the process of migrating hosts/clusters from old Windows+SQL-based vCenter 5.1 installations to vCenter 6 U2 appliances. A colleague of mine has expressed concerns about how the PostgreSQL database in the 6.0 U2 appliance will behave given a couple factors.  First, let's say we're going to move about 100 hosts running 1000 VMs and perhaps 10 total distributed virtual switches from 1 vCenter 5.1 instance to 1 vCenter 6 U2 appliance.  Then, as we upgrade and/or remove old ESXi hosts (we're in the midst of a hardware refresh at the same time these vCenter migrations are going on) and formally 'remove' those old ESXi hosts and associated inventory from vCenter 6/PostgreSQL database, how will the PostgreSQL database 'maintain' or otherwise 'clean itself up'? The concern he has is probably more along the lines of "I'm familiar with MS SQL far more than the comparatively mysterious PostgreSQL world of new vCenter 6 appliances". From what I can tell, despite being somewhat 'undocumented' as to its inner-workings and any automated maintenance it has inherently, the PostgreSQL database included in vCenter 6U2 appliances shouldn't have any issues with an admin adding or removing inventory all day long as long as the total number of objects doesn't exceed the sizing of the vCenter appliance itself (Tiny, Small, Medium, Large and their associated maximums).  In our case, even though it's probably overkill, we're going to err on the side of caution and size our 2 'largest' vCenters as 'Medium' which is up to 400 hosts / 4000 VMs. So are my colleague's concerns unfounded?  In PostgreSQL 'we trust'?  Does anyone have any under-the-hood information about how the PostgreSQL database in 6.0 maintains itself (cleaning, pruning, db consistency checks, and so on)?  Thanks.
Hi All - If I take an ESXi 5.1 host, previously managed (and licensed) via a given vCenter (also v5.1) and its management keys in inventory, then I disconnect/remove that host from the 5.1 vCe... See more...
Hi All - If I take an ESXi 5.1 host, previously managed (and licensed) via a given vCenter (also v5.1) and its management keys in inventory, then I disconnect/remove that host from the 5.1 vCenter and connect it to a completely new vCenter, what happens to the host licensing? Does it disappear and become a 60 day eval, or does its license key move WITH the host into the new vCenter?  (The new vCenter in this scenario would have absolutely zero ESXi host license keys with which to apply to existing ESXi 5.1 hosts moved under it) Just wondering what 'happens' in this scenario as I document our would-be steps for migration.  Yes, I know this could/should all be tested 'in the lab' but don't get me started on that.  Thanks for any feedback on what I can expect. My best guess is that the host will LOSE its license the moment it becomes a 'standalone' ESXi host when disconnected and removed from the old vCenter (via 'Remove' command).  I just want to make sure it's otherwise fully functional, whether it has running VMs on it at the time or not (although yes, I'll put it into maintenance mode prior to removing from the old vCenter and joining the new one). And yes, of course I have old sets of ESXi 5.1 license keys from the existing environment.  I'm just trying to set expectations as to what happens licensing-wise once I move the host from the old to new vCenter.  I have all technical pieces pretty much figured out, including SVS and DVS networking considerations.  Thanks.
Thanks Mattias.  That's the type of feeback I was looking for.  I have yet to come across any blog or VMware documentation that suggests NOT deploying geo-dispersed PSC's into their own SSO sites... See more...
Thanks Mattias.  That's the type of feeback I was looking for.  I have yet to come across any blog or VMware documentation that suggests NOT deploying geo-dispersed PSC's into their own SSO sites. However, I don’t agree that you need more than one site where load balancing is concerned.  You can for example have 2 PSC’s in a single site/location with 1 or more vCenters pointing to those PSC's via VIP.  This approach is documented in VMware KB 2108548.  4th option from the top. Anyone else beg to differ or care to comment on this topic?
Thanks, but you're not understanding my original question. I am most definitely going to deploy everything within a single SSO DOMAIN.  Absolutely.  No question there. My question is about ... See more...
Thanks, but you're not understanding my original question. I am most definitely going to deploy everything within a single SSO DOMAIN.  Absolutely.  No question there. My question is about whether to have more than one SSO SITE when I bring up a 2nd PSC in a 2nd physical location/data center from the 1st PSC. Why would anyone---given they have low latency WAN links between 2 or 3 or more sites that are planned vCenter locations if their design calls for it---create more than one SSO SITE?
Thanks for your comment.  I am still looking for a definitive answer (else debate/discussion) as to whether I can (or whether I should) just have one logical SSO 'site' despite having the PSC's (... See more...
Thanks for your comment.  I am still looking for a definitive answer (else debate/discussion) as to whether I can (or whether I should) just have one logical SSO 'site' despite having the PSC's (2 in my case, 1 in each city) in separate physical locations.  Why create a 2nd SSO site at all, given my intended layout of 1 vCenter and 1 PSC, per site, in 2 geographical/physical locations?  Why not just have a single SSO site within the context of the SSO domain?  What's the drawback, if any, of such a layout? From what I've seen of the topology options (yes I've read that KB already), there's nothing that suggests I can't/shouldn't have a single SSO site for my 2 physical locations.  vCenter 'repointing' options that are supported as of 6.0 U1 are of 2 types:  'Intrasite' and 'Intersite', suggesting that I can repoint a vCenter from one PSC to another PSC 'intrasite' (in my case across a very low latency WAN link) in the single SSO site design I'm considering.  So why not go with a single SSO site and simplify things?  What are the cons there?  (Note: Load balancer approach remains off the table---I see very little gain for the setup effort and potential tshooting when something goes wrong with the LBs/VIPs).
I'm wondering how best to configure our vCenter environment.  We only need 2 vCenters (external PSC model) for the entire US.  Originally, I've been thinking that I'll install a first PSC, then p... See more...
I'm wondering how best to configure our vCenter environment.  We only need 2 vCenters (external PSC model) for the entire US.  Originally, I've been thinking that I'll install a first PSC, then point vCenter in that physical site to that PSC in that newly created 'SSO site'.  Then, install a PSC in the other city/physical site, joining to the existing SSO domain by pointing to the first installed PSC and configuring as a new SSO site.  Finally, install the 2nd vCenter and point it to the 2nd installed PSC in the same SSO domain but in its own SSO site. Then I started thinking---why configure a 2nd SSO site in the 2nd physical location at all?  The WAN links are plenty fast if I ever needed to repoint a vCenter to the other physical site's PSC (documented KB's for both inter and intra repointing available with 6.0 U1 I know).  Couldn't I simplify my deployment further by not creating a 2nd SSO site in the SSO domain?  Why not just have the 2nd PSC join the existing SSO site that was created when the 1st PSC was deployed?  Each vCenter would use the PSC specified in its PHYSICAL location at deployment time, sure/absolutely.  Having just a single SSO site with 2 PSC's in it doesn't appear to be one of the many deployment topologies that VMware has made available in various KB's etc UNLESS it's behind a hardware load balancer----and I just plain don't want to use a LB for this deployment because I don't think the complexity is worth it.  Thoughts?
Thanks for the response --- keep them coming!  Yes, the DVS piece is a drag but it's not horrible.  We've done a similar migration before (5.1 to 5.1 for SRM related reasons) so I know it works o... See more...
Thanks for the response --- keep them coming!  Yes, the DVS piece is a drag but it's not horrible.  We've done a similar migration before (5.1 to 5.1 for SRM related reasons) so I know it works out ok. Upgrading DVS's is no big deal and is non-disruptive.  But I do wonder if I can export the DVS from the 5.1 side and import that into the new vCenter as a v5.1 DVS and avoid at least manually re-creating the DVS in the new vCenter.  Guess I can test in lab. But yes, with the networking changes inherent in a new vCenter / new DVS's / host migrations from old to new vCenter, etc, we're looking at the need to go from DVS to StdVS to DVS again, adding/removing uplinks as needed through the migration, and utilizing the 'Migrate Virtual Machine Networking' along the way. I'm wondering what true BENEFIT we can gain from moving the hosts over from old to new vCenters and DVS's and if it'll be worth all the effort where the networking piece is concerned, so I'm keeping this thread 'open' for additional comments.
I have a plan that would allow for our 10 version 5.1 vCenters to be consolidated down to 4 running version 6.0U1.  This would entail spinning up the new vCenters and moving the 'old' vCenter obj... See more...
I have a plan that would allow for our 10 version 5.1 vCenters to be consolidated down to 4 running version 6.0U1.  This would entail spinning up the new vCenters and moving the 'old' vCenter objects/hosts into them.  This will entail a bit of work where dVS's are concerned, but we have that piece more or less figured out using 'swing NICs'.  It's a bit tedious but it's not that bad, and perhaps I can just export existing dVS's and import them into the new vCenters to save a step or two where building any new dVS's are concerned. The issue is that I have a colleague who thinks we should just leave the old environment up on version 5.1 and not migrate ANY of those 'old' clusters/hosts into it and instead build new hosts into the new environment.  We would subsequently move the VMs over to new hosts via swing LUNs, reconfigure their networking, etc.  Of course, that approach would entail VM downtime whereas my approach would not. I like the idea of moving older vCenter resources into the new vCenters but I guess I need more reasons to go the route of my colleague and wait for new host hardware and storage (which we do plan to procure, albeit eventually).  Only about half of our hosts in the 'old' environment would get upgraded in-place, with the other half being replaced with new hardware within the next 6-12 months or so. Which approach would YOU take?  What are the pros/cons to my approach vs that of my colleague?
Hi all.  We have 9 vCenters (5.1 U1, all Windows/no appliances), spanning several geographical locations over relatively high speed WAN links. It was previously 6 vCenters at 4.1 back in 2010, th... See more...
Hi all.  We have 9 vCenters (5.1 U1, all Windows/no appliances), spanning several geographical locations over relatively high speed WAN links. It was previously 6 vCenters at 4.1 back in 2010, then we upgraded all to 5.1 and have added 3 since. 2 of these 9 vCenters are SRM-enabled.  The other 7 are in linked-mode.  We have a single SSO server (centralized) for the 7 in linked-mode, and the 2 SRM servers are 'isolated' and have their own SSO's.  Together, these 9 vCenters manage 'only' about 75 hosts and 750 vm's combined. Having just come from VMworld, one session on vCenter discussed SSO's, the Inventory service, web client, deployment scenarios and everything else and as the slide deck went on, and it made me think, "Hmmm... why DO we have so many vCenters??? In planning for vSphere 6, why not just consolidate the 7 non-SRM vCenters into a SINGLE vCenter?  That single vCenter could run within the SRM cluster in our primary site, and be recoverable in the SRM cluster in the recovery site. What are some of the pitfalls of just having a single vCenter for the majority of our virtual datacenters and hosts?  vMotion and svMotion wouldn't suffer since all such operations would still only occur within those virtual datacenters (which happen to be located in different geographical regions).  We have high speed links (nothing slower than gigabit except for our London vCenters).  Authentication might be a little bit slow for remote admins outside of the SSO site but we're already used to that.  vCenter<>ESXi host agent communication would be affected since it would no longer be at LAN speed but again our WAN links are pretty fast overall.  We don't have any 'political' barriers where administration and security and so on might necessitate such administrative boundaries. I'm just trying to think of any gotchas before planning on a pre-vSphere 6 consolidation of vCenters.  Thanks for any feedback.
Okay, thanks for the comments/suggestion.  Their statement, then, is interpreted as:  "While you may elect to configure VR for virtual machines that are already part of an existing array-based pr... See more...
Okay, thanks for the comments/suggestion.  Their statement, then, is interpreted as:  "While you may elect to configure VR for virtual machines that are already part of an existing array-based protection group, do not create a VR-based PG (and its RP) in the recovery site to avoid potentially starting up 2 identical virtual machines in the recovery site." True, that the underlying datastore/array replication is ongoing and the datastore could be mounted with a manual approach to recovery of the given VM(s) on it, if worst came to worst while we transition replication from array-based to VR-based. Any other thoughts/comments from basher or anyone else before I mark this topic 'Answered'?
Software:  SRM 5.1.2 on vCenter 5.1 U1, adding vSphere Replication 5.1.2 into the mix. We are using array-based replication and want to 'cutover' our array-based Protection Groups to vSphere R... See more...
Software:  SRM 5.1.2 on vCenter 5.1 U1, adding vSphere Replication 5.1.2 into the mix. We are using array-based replication and want to 'cutover' our array-based Protection Groups to vSphere Replication-based PG's, and, ultimately, stop using array-based replication altogether. I did not install the vSphere Replication components during the original SRM installation so I'm aware that I need to run the SRM installer in repair/maint mode and select for VR.  But in my reading, I came across the following statement on page 17 of the SRM 5.1 Installation and Configuration Guide:  NOTE: Do not attempt to configure vSphere Replication on a virtual machine that resides on a datastore that you replicate by using array-based replication. I would like to know 'why'---what might happen?  Why would this be a bad thing?  Host-based replication should not be 'aware' of array-based replication and vice-versa given they are 2 totally separate replication mechanisms. Ideally, I would get my VR appliances up and running, and, once VR components were installed on SRM, I could then create VR-based PG's for all of the same VM's that are currently array-based PG's, have respective RP's for them, and, once I'm satisfied with the new PG's and RP's on the VR side of things, then just delete all the array-based PG's and RP's, get rid of the SRA's, and array-level replicated devices, and call it a day. We don't use SRM 'extensively' at all here, and given our WAN pipes and other factors, we have decided that, after some satisfactory initial testing of VR (without SRM), we've decided to rid ourselves of the complexity/costs associated with array-based SRM.  I would just rather run them in parallel (array-based PG's/RP's and VR-based PG's/RP's) so we're not 'exposed' while I would otherwise have to sVmotion these same VM's off of the currently array-level replicated datastores that they now sit on, then setup new PG's based on VR.  Thanks for any feedback.
The UUID factor is worthy of note... thanks for that.  I searched further and found this:  vXpress: &quot;Target disk UUID validation failed&quot; Error while configuring vSphere Replication on a... See more...
The UUID factor is worthy of note... thanks for that.  I searched further and found this:  vXpress: &quot;Target disk UUID validation failed&quot; Error while configuring vSphere Replication on a Pre-seeded VMDK However, when I restore the VM's VMDKs from backup, into the target site datastores, I won't be registering those VMs and starting them up and answering the question incorrectly such that the UUIDs would be regenerated---so in short I won't need to worry about that. 
Okay, so when pre-seeding, I just need to make sure that the destination disks are in separate directories and have unique names in each.  Also, it would seem that for pre-seeding to prompt me, t... See more...
Okay, so when pre-seeding, I just need to make sure that the destination disks are in separate directories and have unique names in each.  Also, it would seem that for pre-seeding to prompt me, the disk names must MATCH EXACTLY on both ends... correct?