To upgrade BSM Connector 9.2x to Operations Connector 2019.05, first install Operations Connector 2019.05 on a separate system and then copy your configuration and policies from the old BSM Connector 9.2x server to the new Operations Connector 2019.05 server where you can upgrade them.

The configuration and policy upgrade is partially automated. However, copying and upgrading the policies might require additional manual steps. If you upgrade any metric policies, you must open and at least validate them.

Upgrade procedure

1. Back up your BSM Connector 9.2x customizations and policies before upgrading.

2. Install and configure Operations Connector 2019.05 on a separate system.

3. Prepare the existing 9.2x configuration using the Operations Connector 2019.05 preparation tool.

4. Copy the BSM Connector 9.2x configuration and policies to the new system and upgrade them using the Operations Connector 2019.05 bsmc-migration tool.

5. Validate the upgraded policies and perform the necessary manual changes using the Operations Connector 2019.05 policy management and policy editor UIs.

6. Activate the upgraded policies.

7. If applicable, import the topology synchronization package configuration of BSM Connector 9.2x Topology-XML policies on the OMi server.

What is upgraded?

• Operations Connector configurations for the following areas: local user configuration, port configuration, logging, LW-SSO settings, and client authentication (for example CAC).

• Policies:

  • Event integrations: Database, Log File, Open Message Interface, Scheduled Task, SNMP Trap, Web Service Listener, and XML File policies.

  • Metric integrations: Database, Log File, and Web Service Listener policies.

  • Topology integrations: Topology-XML policies (for BSM Connector 9.22 or later releases).

  Note Other polices are not upgraded. Although they are shown in the 10.00 policy user interface, the only available action for them is 'Delete'.

  Table of changes in supported channels

  Source	Channel	BSMC 9.2x	OpsCx 10
  Database	Event	YES	YES
  	Metric	YES	YES
  	Topology	YES	NO
  	Topology from data	YES	NO
  Log File	Event	YES	YES
  	Metric	YES	YES
  	Topology	YES	NO
  	Topology from data	YES	NO
  Web service Listener	Event	YES	YES
  	Metric	YES	YES
  	Topology	YES	YES
  	Topology from data	YES	NO
  XML File	Event	YES	YES
  	Metric	NO	YES
  	Topology	YES	YES
  Open Message Interface	Event	YES	YES
  Scheduled Task	Event	YES	YES
  SNMP Interceptor	Event	YES	YES

  Changes compared to BSM Connector 9.2x are marked in bold text. For details, see Validate the upgraded policies.

• Topology-XML Mapping configurations (for BSM Connector 9.22 or later releases):

  • Topology synchronization packages for Topology-XML policies that define the mapping to the RTSM model.

    Directory: <OpsCx_HOME>/conf/topology/packages/* (all subdirectories)

Operations Connector 2019.05 requires the following:

• OBM 2019.05 or later versions

• Operations Agent 12.11 or later versions

Operations Connector coexistence with other software on the same host

This version of Operations Connector can coexist with the following applications on the same host:

• Network Node Manager i 2019.05 and later

This version of Operations Connector cannot coexist with the following applications on the same host:

• OBM Gateway or Data Processing Server

• Operations Manager for Linux, UNIX, or Windows

• Operations Manager managed node with Operations Agent version 11.x

Operations Connector deployments can use lightweight single sign-on (LW-SSO) for the user authentication strategy, which allows the Operations Connector users to be managed in the same way as the OBM users and groups. LW-SSO is the recommended strategy for OBM.

The installation program prompts for the following LW-SSO information. You should obtain the information before installing Operations Connector if possible, however you can also specify it after the installation.

OBM domain name

You need to know the domain of the OBM gateway server to which the Operations Connector will send collected data. You can determine the domain name by viewing the URL used to access the OBM user interface:

http://<server_name>.<domain_name>/topaz

For example, if the URL to access OBM in your environment is http://omi1.example.com/topaz, the domain name is example.com.

Even if OBM is deployed in a distributed architecture or load balancing scenario, the URL reference still provides the correct domain name for the purposes of Operations Connector.

If the OBM gateway servers and the Operations Connector run in different subdomains, for example, deu.example.com and ind.example.com, specify only the name of the parent domain, which is example.com in this example.

Operations Connector and the OBM gateway server to which it is reporting must run in the same top-level domain.

LW-SSO token key from OBM

Obtain the token key defined in Operations Bridge Manager as follows:

1. In the OBM user interface, navigate to the Users and Permissions manager as follows:

   Administration > Users > Authentication Management

2. In the Single Sign-On Configuration group, view the value of the Token Creation Key (initString) setting.

3. Record the value so it will be available to you when you run the Operations Connector installation program.

   If the setting is not defined, work with an OBM administrator to define it as follows:

   1. Click Configure to open the Authentication Wizard.

   2. Click Single Sign-On to view the Single Sign-On panel, and select Lightweight for the Single Sign-On Authentication mode.

   3. Generate the Token Creation Key (initString). Record the value so it will be available to you when you run the Operations Connector installation program.

   4. Define the domain or subdomains that are participating in the LW-SSO configuration:

      • If OBM and the Operations Connector instances are running in different subdomains type the name of the parent domain in theOperations Bridge Manager Domain field.
      • If OBM and the Operations Connector instances are running in the same domain, select Parse automatically and add the domain to the Trusted Hosts/Domains list.
   5. Click Finish to save your changes and close the wizard.

Groups and users that can access Operations Connector

During the Operations Connector installation, you can specify the users and groups that will be allowed to log into the Operations Connector. Users and groups must be defined in OBM before you can specify them in the Operations Connector installation. They must be enabled as LW-SSO tokens as follows: 

1. In the OBM user interface, navigate to the Infrastructure Settings manager as follows:

   Administration > Setup and Maintenance > Infrastructure Settings

2. Click Foundation and select Single Sign-On from the drop-down list.

3. Set Add user groups information to LW-SSO token to True.

   The default group for Operations Connector is BSMC_ADMINS.

4. Set Add user roles information to LW-SSO token to true.

LW-SSO security warnings

This section describes security warnings relevant to LW-SSO configuration. For more information about LW-SSO, see the OBM Administration Guide.

• Confidential initString parameter in LW-SSO security.

  LW-SSO uses symmetric encryption to validate an LW-SSO token. The initString parameter within the configuration is used for initialization of the secret key. An application creates a token, and each application that uses the same initString parameter validates the token.

  Caution  

  • You cannot use LW-SSO without setting the initString parameter.

  • The initString parameter is confidential information and should be treated as such in terms of publishing, transporting, and persistency.

  • The initString should be shared only between applications that integrate with each other by using LW-SSO.

  • The minimum length of the initString parameter is 12 characters.

• Disable LW-SSO unless it is specifically required.

• Symmetric encryption implication.

  LW-SSO uses symmetric cryptography for issuing and validating LW-SSO tokens. Therefore, any application using LW-SSO can issue a token to be trusted by all other applications sharing the same initString. This potential risk is relevant when an application sharing the initString either resides or is accessible in an untrusted location.

It is recommended that you read the Operations Connector section of the Operations Bridge Manager and Operations Agent release notes before you start the installation or upgrade. The latest versions of the Operations Bridge Manager and Operations Agent release notes are available from the Software Product Manuals page at Software Support Online:

https://softwaresupport.softwaregrp.com/

Review the information on the Introduction panel. Click Next.

Review the license agreement. To continue, select I accept the terms of the License Agreement, and then click Next.

The Installing panel is displayed which includes a progress bar showing the progress of this phase of the installation. It can take up to several minutes for the installation program to complete this phase.

Note If you click Cancel during the installation, the installation begins to roll back. The roll back removes Operations Connector files, but does not remove Operations Agent files.

If you want to uninstall the Operations Agent, you have to uninstall the agent manually, after the Operations Connector roll back is complete.

To manually uninstall the agent on Windows, open a command prompt and type the following command:

cscript %OvInstallDir%bin\win64\OpC\install\oainstall.vbs -remove -agent -ascomponent

To manually uninstall the agent on Linux, open a shell prompt and type the following commands:

1. chmod u+x /opt/OV/bin/OpC/install/oainstall.sh

2. /opt/OV/bin/OpC/install/oainstall.sh -remove -agent -ascomponent

In a distributed OBM environment with a reverse proxy or a load balancer, the OBM data processing server and the Operations Connector server may not be able to communicate with each other in order to request and install a certificate. To provide the agent with a certificate, you must issue the certificate manually on the BSM certificate server and then import it manually on the Operations Connector system.

In addition, you must manually set the MANAGER_ID configuration variable. The MANAGER_ID defines who is allowed to access the agent from outside.

1. On the Operations Connector system, use ovcoreid to show the core ID of the system:

   ovcoreid

   /opt/OV/bin/ovcoreid

2. On the BSM certificate server (usually the data processing server), use ovcert to export the trusted certificate, type:

   %ovinstalldir%bin\win64\ovcert -exporttrusted -file omi.cer

   /opt/OV/bin/ovcert -exporttrusted -file omi.cer

3. On the BSM certificate server (usually the data processing server), use ovcm to generate a certificate, type:

   ovcm -issue -file cert.cer -name <FQDN of BSM Connector> -coreid <OvCoreId of BSM Connector> -pass <password>

   /opt/OV/bin/ovcm -issue -file cert.cer -name <FQDN of BSM Connector> -coreid <OvCoreId of BSM Connector> -pass <password>

4. Securely transfer the generated files to the Operations Connector system.

5. Use ovcert to import the certificates from the generated files, type:

   ovcert -importtrusted -file omi.cer

   ovcert -importcert -file cert.cer

   /opt/OV/bin/ovcert -importtrusted -file omi.cer

   /opt/OV/bin/ovcert -importcert -file cert.cer

   The command prompts you for the password that you specified when you generated the certificates. Type the password and press Enter.

6. On any of the gateway server systems, use ovcoreid to show the core ID of the system:

   ovcoreid -ovrg server

   /opt/OV/bin/ovcoreid -ovrg server

7. On the Operations Connector system, set the manager and certificate server manually, type:

   %ovinstalldir%bin\win64\ovconfchg -ns sec.cm.client -set CERTIFICATE_SERVER <FQDN of reverse proxy or load balancer>

   %ovinstalldir%bin\win64\ovconfchg -ns sec.core.auth -set MANAGER <FQDN of reverse proxy or load balancer>

   %ovinstalldir%bin\win64\ovconfchg -ns sec.core.auth -set MANAGER_ID <OvCoreId of any gateway server>

   /opt/OV/bin/ovconfchg -ns sec.cm.client -set CERTIFICATE_SERVER <FQDN of reverse proxy or load balancer>

   /opt/OV/bin/ovconfchg -ns sec.core.auth -set MANAGER <FQDN of reverse proxy or load balancer>

   /opt/OV/bin/ovconfchg -ns sec.core.auth -set MANAGER_ID <OvCoreId of any gateway server>

8. Run oainstall to complete the Operations Agent setup, type:

   cscript "%OvInstallDir%\bin\win64\OpC\install\oainstall.vbs" -a -c

   /opt/OV/bin/OpC/install/oainstall.sh -a -c

9. Review the agent installation log file:

   %OvDataDir%log\oainstall.log

   /var/opt/OV/log/oainstall.log

   If the log file contains errors relating to the OvControl service failing to start or restart, complete the following steps:

   1. Manually reinstall ovcd as a Windows service, type:

      ovcd -install

   2. Rerun oainstall.

10. Securely delete any copies of the files that contain the certificates. Depending on how you generate and transfer the files, you may, for example, have copies in the following locations:

    • on the OBM data processing server

    • on the Operations Connector system

    • on a USB flash drive, CD, or other portable media

This section contains some tasks that may be necessary after Operations Connector is installed.

Review the installation log files

The installation log file contains error, warning, and informational messages related to the installation. If you need to investigate a problem with the Operations Connector installation, view the log file after the installation has completed at:

%temp%\HPOvInstaller\BSMConnector_<Version>\BSMConnector_<Version>_<TimeStamp>_HPOvInstallerLog.txt

There is also a log file specifically related to post-configuration steps located at: %temp%\HPBSMC_postinstall.log.

C:\Windows\Temp\HPOvInstaller\BSMConnector_<Version>\BSMConnector_<Version>_<TimeStamp>_HPOvInstallerLog.txt

/tmp/HPOvInstaller/BSMConnector_<Version>/BSMConnector_<Version>_<TimeStamp>_HPOvInstallerLog.txt

There is also a log file specifically related to post-configuration steps located at: /tmp/HPBSMC_postinstall.log.

Change the domain or token key

For Operations Connector installations that are configured for LW-SSO, the installation program prompts for the domain name and token key of the associated OMi system. If you do not specify the domain name and token key, default values are supplied.

To change the domain name or token key manually after installation:

1. Navigate to and open: %OVDataDir%\conf\HPOprBSMC\lwsso-config.xml.

   By default, %OVDataDir% is set to:

   Windows 2008, 2012: C:\ProgramData\HP\HP BTO Software\

2. Navigate to and open: /var/opt/OV/conf/HPOprBSMC/lwsso-config.xml.

3. Change the <DNSDomain> value to the desired domain name, for example my_bsm_domain: 

   - <multiDomain>
   - <trustedHosts>
       <DNSDomain>my_bsm_domain</DNSDomain>
     - <!--
                  <DNSDomain>company.com</DNSDomain>
                  <NetBiosName>host</NetBiosName>
                  <IP>16.59.34.64</IP>
                  <FQDN>host.company.com</FQDN>
        -->
      </trustedHosts>
   </multiDomain>

4. Change the initString value to the desired initString, for example my_initString:

   - <in-ui-lwsso>
     - <lwssoValidation id="ID000001">
         <domain /> <crypto cipherType="symmetricBlockCipher" engineName="AES"
         paddingModeName="CBC" keySize="256" encodingMode="Base64Url"
         initString="my_initString" />
      </lwssoValidation>
 </in-ui-lwsso>

5. Save the file with your changes.

6. Restart ovc.

Operations Connector is shipped with a self-signed certificate. If you do not replace the certificate with a certificate issued by your Certificate Authority (CA) or an intermediate CA, your browser will display a warning when you access the user interface, because the certificate is not signed by a trusted authority.

To replace the certificate, execute the following steps:

1. Obtain a server certificate issued for the Operations Connector server from your CA or an intermediate CA. Typically this certificate is issued in PKCS12 format with a password-protected private key.

2. Change the OV Tomcat configuration to use the PKCS12 certificate instead of the default self-signed Java certificate.

   The file server.xml used by OV Tomcat is recreated on each ovc start, with XPL values that replace the values from templates. Therefore run the Operations Agent tool ovconfchg to change the keystore settings in the XPL configuration:

   • Run ovconfchg -edit to open the default system editor (Notepad on Windows, vi on Linux) and load the current XPL configuration.

     The Tomcat related XPL settings are in the XPL namespace NONOV.TomcatB. The relevant XPL parameters for OV Tomcat are:

     KeystoreType
     KeystoreFile
     KeystorePass

     Change them to:

     KeystoreType=PKCS12 
     KeystoreFile=<path to server certificate in PKCS12 format>  
     KeystorePass=<password for the private key>

   • Alternatively, change the settings directly, by using the -set option:

     /opt/OV/bin/ovconfchg -ns <namespace> -set <parameter> <value>

     %ovinstalldir%bin\win64\ovconfchg -ns <namespace> -set <parameter> <value>

     For example:

     /opt/OV/bin/ovconfchg -ns NONOV.TomcatB -set KeystoreType "PKCS12"
-set KeystoreFile "<path to server certificate in PKCS12 format>"
-set KeystorePass "<password for the private key>"

     %ovinstalldir%bin\win64\ovconfchg -ns NONOV.TomcatB -set KeystoreType "PKCS12"
-set KeystoreFile "<path to server certificate in PKCS12 format>"
-set KeystorePass "<password for the private key>"

3. Restart OVTomcat.

If you cannot obtain a server certificate from a CA in PKCS12 format, manually generate a server certificate using a Java Keystore (JKS) and have it signed by your CA. See the section "Creating a Keystore" in the OMi Administration Guide.

Make sure that you grant the certificate request on the OBM system:

• Log on to the OMi server and check pending certificate requests with the ovcm command:

  /opt/OV/bin/ovcm -listpending

  %ovinstalldir%bin\win64\ovcm -listpending

  and grant any pending ones:

  /opt/OV/bin/ovcm -grant <request_id>

  %ovinstalldir%bin\win64\ovcm -grant <request_id>

  where <request_id> is the ID of the certificate as listed by the -listpending option.

• Alternatively, use the OBM user interface to grant the certificate request:

  1. Log on to OBM as a user with administrative privileges.

  2. Grant the pending certificate request:

     1. Navigate to Administration > Setup and Maintenance > Certificate Requests.

     2. On the Certificate Requests tab, select the certificate request and then click the button.

  For details, see the Operations Connector User Guide.

To verify the successful certificate exchange, execute the command

Each Operations Connector instance must be configured to integrate with a OBM Gateway Server:

1. On the Operations Connector server, close any running instances of the command ovconfchg -edit.

2. In OBM, open the Connected Servers manager page:

   Administration > Setup and Maintenance > Connected Servers

   In the right pane, click New and select Operations Connector. The New Operations Connector page displays.

   The information you need to enter depends on the type of integration data you plan to collect with this Operations Connector:

   • General

     Complete the mandatory Display name and Host name fields.

   • Server Properties

     Enter the Fully Qualified DNS name of the server. Optionally, set the Advanced Delivery Options.

   • Policy Management

     Set the communication port. To restore the port to the default value (30000), click Set default port.

   • Event Drilldown Settings. These settings apply to event data only and are optional.

     Event drilldown enables OBM users to launch the user interface of the third-party system in the context of an event collected through Operations Connector. Event synchronization sends event lifecycle changes back to the event source. For example, if an OBM operator closes an event originating from NNMi, a notification can be automatically sent to NNMi.

3. Click Finish to save the new connected server.

For more details about how to configure an OBM connected server, see the OBM online help or the OBM Administration Guide.