A typical configuration for a high-availability environment is two or more UCMDB Servers connecting to the same database server. The server are configured to work behind a load balancer, that is, the load balancer serves as the entry point to the UCMDB Servers. All of the UCMDB Servers are active at any given time and can handle both read and write requests. Requests are distributed to the UCMDB Servers in the cluster by the load balancer. While read requests are shared evenly among all of the UCMDB Servers (Readers), only one UCMDB Server (Writer) is also responsible for write requests at one time. Any write requests received by a Reader are passed to the Writer. Moreover, any of the UCMDB Servers can take over the Writer role in the case that the Writer becomes unavailable.

1. Install one or more additional UCMDB Servers to create a UCMDB Server cluster

   Install the UCMDB Servers as you did the first UCMDB Server with one difference: when running the Server Configuration wizard to configure the database on the additional UCMDB Server, select Connect to an existing schema, and provide the details of the schema you created for the first UCMDB Server.

   For details on installing UCMDB Servers, see Installing the UCMDB Server - Installation.

   Note:  

   • The machines used for all of the UCMDB Servers in the cluster should have similar hardware (and the same amount of memory) and should be running the same operating system.

   • UCMDB Servers in the cluster must work on the same port number for HTTP, HTTPS, and so on. You cannot configure the two UCMDB Servers to work on different ports.

   • If you are working in an IPv6-only environment, ensure that the UCMDB Server machines are configured for IPv6.

     1. In the wrapper.conf file, locate the following line:

        wrapper.java.additional.<#>=-Djava.net.preferIPv4Stack=true

     2. If it is not commented out, then comment it out.

2. Complete the Server Startup

   1. If the first UCMDB Server (preferably the writer server) is not started, start the process. Wait until the startup process is complete.

   2. Copy the <UCMDBServer>/conf folder from the first server (the writer) to the other servers.

   3. Start the other UCMDB Servers.

3. Configure the Load Balancer

   The load balancer is used to balance load sent to the UCMDB Servers in the cluster. Configure the load balancer as follows:

   1. Configure VIP addresses. On the load balancer:

      • Configure a Cluster VIP address to send requests to the whole UCMDB Server cluster.

      • Configure a Writer VIP address to send requests to the Writer only (for Universal Discovery only).

      Note: Keep a note of the defined VIP addresses.

      • When defining the communication settings between the UCMDB Server and the Data Flow Probes, always use the Writer VIP address when prompted for the UCMDB Server name.

      • When defining the communication settings between the UCMDB Server and other applications, always use the Cluster VIP address when prompted for the UCMDB Server name.

   2. Configure two identical pools of backend servers that represent all of the UCMDB Servers in the cluster. The two pools will be monitored by different health monitors. One pool will be sent requests that are intended solely for the Writer server (only for Universal Discovery), and the other pool will be sent requests that can be processed by any server in the cluster.

   3. Configure the health monitors (keepalive addresses). The health monitors check for the keepalive page of each of the UCMDB Servers.

      • Configure the following URL for the Cluster VIP address:

        /ping/

      • Configure the following URL for the Writer VIP address:

        /ping/?restrictToWriter=true

      Possible responses from both of these URLs are Up or Down with http response codes 200 OK or 503 Service unavailable respectively.

      The expected response should be Up.

      For more details, see How to monitor High Availability cluster with endpoint /ping below.

   4. Connect the health monitors to the respective UCMDB Server pools configured above.

   5. Configure "session stickiness" on the load balancer:

      1. Configure the load balancer to insert cookies to the responses sent back to UCMDB clients.

         Using the Insert method, add a persistence profile of type cookie for each VIP address.

         Note: The cookie name and value are unimportant, as long as the load balancer knows how to maintain stickiness with the cookies it sends out.

      2. Important! Since F5 BIG-IP adds a session cookie only to the first request per connection to the server, you must do the following:

         1. Log into UCMDB.

         2. Go to Administration > Infrastructure Settings, and change the Force connection closing for SDK clients to true.

            When this setting is set to true, the UCMDB SDK clients add a Connection:close header to each authentication request and class download request sent to the server. This way the load balancer will think this is a first request in a connection and add the session cookie to the response.

         Note: This is relevant to load balancers which, like F5 BIG-IP version 10.x, add a session cookie to the first request per connection to the server only.

         If the load balancer you are using adds a session cookie to every response, Force connection closing for SDK clients should be set to false (as is the default). In this case, setting it to true can lead to a decline in system performance.

   6. If the VIP is configured to accept secure connections and the load balancer forwards the requests to the UCMDB servers over HTTP, you must configure redirect rewrites. In the F5 UI, configure the HTTP profile associated with the VIP to rewrite all redirects by enabling the following option: Redirect Rewrite select All.

   Note: If the load balancer is configured to forward requests to backend over HTTP, an extra setting is required to be done on the load balancer. The load balancer admin should configure the load balancer to rewrite the Location header to correctly point to the load balancer URL. This needs to be done for HTTP connections that go to the jmx-console. This can be achieved through a regular expression like the following:

   (https:\/\/(.*)):(\d*)(.*) \1\4

   where the yellow part is the matching part and the green part is the replacing part.

4. Configure Data Flow Probes

   When you install a Data Flow Probe, use the load balancer's Writer VIP address when defining the Universal CMDB Server name.

   If you already have a Data Flow Probe installed:

   1. Stop the Probe.

   2. In the /opt/UCMDB/DataFlowProbe/conf/DataFlowProbe.propertiesc:\UCMDB\DataFlowProbe\conf\DataFlowProbe.properties file, change the serverName attribute to point to the Writer VIP address.

   3. Restart the Probe.

How to monitor High Availability cluster with endpoint /ping

The endpoint /ping allows monitoring of the High Availability cluster. So far the endpoint could be configured to ask for the status of:

• entire cluster (writer + readers)
• only writer

The restrictToReader parameter was added to the aforementioned endpoint that returns the status of only the readers in the cluster.

To configure this, the endpoint /ping should be called with the following parameter: restrictToReader=true

For example, /ping:8443?restrictToReader=true

As a best practice for deployments that rely heavily on UCMDB Browser, we recommend the use of a UCMDB HA Cluster with at least three nodes (one writer and two readers).

For this type of deployment, we recommend that two virtual IPs are created on the load balancer:

• One that points only to the writer, the endpoint for health check is: <UCMDB_URL>/ping?restrictToWriter=true

• In case that the cluster contains 2 or more reader servers, one endpoint that points to all the reader servers. The endpoint for health check is: <UCMDB_URL>/ping?restrictToReader=true

• In case that the cluster contains 1 reader server, one endpoint that points to all the servers (reader and writer). The endpoint for health check is: <UCMDB_URL>/ping

The health check endpoint will return:

• status code 200 and the payload "Up" if the application is started successfully.
• status code 503 and the payload "Down" if the application is not yet fully started.

Note that other elements can affect the health check process, in this case the load balancer can get an error similar to "Connection refused".

This end-to-end use case describes how to set up a high-availability UCMDB and UCMDB Browser environment with F5 BIG-IP load balancer and WebSEAL reverse proxy.

The diagram below illustrates the overall architecture of the environment we will set up.

This case contains the following key tasks:

1. UCMDB Server configuration
2. F5 load balancer configuration
3. WebSEAL reverse proxy configuration
4. UCMDB Browser configuration

UCMDB Server configuration

1. Prerequisites

   1. You have installed the UCMDB Server and UCMDB Browser.

   2. (Optional) You have set up high availability mode by following the instructions in the Deployment Guide: "Set Up High Availability Mode".

2. Export the out-of-the-box UCMDB server keystore to a cert file

   If using the out-of-the-box (OOTB) UCMDB cert, export it for later use.

   To export the UCMDB server keystore (server.keystore) to a cert file (server.cert), do the following:

   1. Open the command prompt and run the following command:

      C:\UCMDB\UCMDBServer\bin\jre\bin\keytool.exe -export -alias <certificate alias> -keystore <Keystore file path> -file C:\UCMDB\UCMDBServer\conf\security\server.cert

      where:

      • certificate alias is the name given to the certificate.

      • Keystore file path is the full path of the location of the keystore file.

      For example, for the out-of-the-box server.keystore use the following command:

      C:\UCMDB\UCMDBServer\bin\jre\bin\keytool.exe -export -alias hpcert -keystore C:\ucmdb\ucmdbserver\conf\security\server.keystore -file C:\UCMDB\UCMDBServer\conf\security\server.cert

      Note: If self-signed certificate is not used, but a company generated certificate, use the following command to get the alias for this certificate:

      C:\UCMDB\UCMDBServer\bin\jre\bin\keytool.exe -list -keystore c:\ucmdb\ucmdbserver\conf\security\server.keystore

      Keystore type: JKS

      Keystore provider: SUN

      Your keystore contains 1 entry.

      <alias>, 14 Sept. 2012, PrivateKeyEntry.

      Certificate fingerprint (SHA1): 2A:52:DF:17:D9:A5:37:2D:1F:1D:BA:4B:41:46:33:A8:18:42:5B:D7

      The alias will look like: {45789-15478-1236-7895}

      Use this alias to export the certificate.

   2. Enter the keystore password.

   3. Verify that the certificate was created in the following directory: C:\UCMDB\UCMDBServer\conf\security\server.cert

   4. Convert the generated JKS file into PKCS12 format using UCMDB key tool keytool.exe (located in the <UCMDBServer>\bin\jre\bin directory). (WebSEAL requires PKCS12 format cert.)

      Run the following command:

      C:\UCMDB\UCMDBServer\bin\jre\bin\keytool.exe -importkeystore -srckeystore server.keystore -destkeystore server.p12 -srcalias <source serverkey> -destalias <target serverkey> -srcstoretype jks -deststoretype pkcs12 -srcstorepass <keystore password> -deststorepass <keystore password> -noprompt
      

      The server.p12 file is the resulting PKCS12 format cert.

3. (Single Sign-On only) Set IDM User Name

   1. Go to UCMDB server JMX console.
   2. Locate the setUserName JMX operation under the UCMDB-UI:name=LW-SSO Configuration category.

   3. Provide the following parameter values for the setUserName JMX method:

      • Is inbound handler enabled: True
      • LW-SSO IDM User Name: <The real value for the IDM user name>. For example, iv-user (if you are using LDAP with user iv-user).
   4. Click Invoke.

4. Set UCMDB Browser URL

   1. In UCMDB UI, go to Administration > Infrastructure Settings Manager.
   2. Locate the UCMDB Browser URL infrastructure setting, and set the value to your WebSEAL URL.

F5 load balancer configuration

1. Make sure you have a working F5 BIG-IP load balancer environment.
2. Log in to the F5 BIG-IP load balancer environment.

3. Make sure you have created the following in the F5 BIG-IP load balancer environment (Local Traffic > Virtual Servers > Nodes|Pools):

   • A node for each of the virtual machines on which UCMDB server and/or UCMDB Browser are running.
   • A pool that contains all the above nodes.

4. Import the UCMDB CA cert/key into F5.

   1. In the navigation pane, go to Main > System > Certificate Management.
   2. Click Import .

   3. In the SSL Certificate/Key Source page, select Import Type:

      • When selecting Certificate, do the following:

        • Certificate Name: Keep Create New selected and provide the certificate name.
        • Certificate Source: Keep Upload File selected, click Browse... to select the UCMDB server.cert file you exported earlier.

      • When selecting Key, do the following:

        • Key Name: Keep Create New selected and provide the key name.
        • Certificate Source: Keep Upload File selected, click Browse... to select the UCMDB key file.
   4. Click Import .

5. Add UCMDB CA cert/key to Certificate Key Chain.

   1. In F5, go to Local Traffic > Virtual Servers > Profiles > SSL.

   2. Select and click an existing UCMDB cert profile.

      Note: Create a SSL profile for HTTPS by clicking Create if you do not have one.

   3. Go to the Certificate Key Chain configuration setting, click Add .

   4. In the Add SSL Certificate to Key Chain dialog, select or provide values for the following settings as appropriate and click Add :

      Certificate: Select the UCMDB certificate file.

      Key. Select the UCMDB key.

      Chain. Select the UCMDB chain.

      Passphrase. Provide a pass phrase.

6. Create a cookie-based persistence profile.

   1. In F5, go to Local Traffic > Virtual Servers > Persistence, and click Create .
   2. Select Cookie for Persistence Type and provide a name for the persistence profile.
   3. Click Finished.

7. Create a virtual server.

   1. In F5, go to Local Traffic > Virtual Servers, and click Create .

   2. Specify values the following settings:

      • Configuration > HTTP Profile: http
      • Configuration > SSL Profile (Client): Select the UCMDB cert you imported in step 5 from the Available column and add it into the Selected column.
      • Configuration > Source Address Translation: Auto Map (If you select SNAT, make sure you configure SNAT related settings properly)
      • Resources > Default Persistence Profile: Select the persistence profile you created in step 6.
   3. Provide values for other settings as appropriate.
   4. Click Finished.

WebSEAL reverse proxy configuration

1. Configure WebSEAL reverse proxy by following IBM official documentation: IBM Security Access Manager (ISAM) Reverse Proxy Scenario.

   Important: During the configuration, in the Identity tab of the Edit a Standard Junction window, make sure you set the following settings as described below:

   • Junction Cookie: Leave the checkbox unselected
   • Include session cookie: Select the checkbox

   • HTTP Basic Authentication Header: For UCMDB Browser and RESTful API authentication to work properly, select Ignore from the dropdown list.

   • (Optional) HTTP Header Identity Information: Select IV-USER if you are using LDAP with user iv-user.

2. Import UCMDB cert (OOTB or self-signed).

   1. In IBM Security Access Manager, go to Manage > Secure Settings > SSL Certificate.
   2. Go to Manage > Edit SSL certificate database menu option, and select pdsrv.
   3. Go to the Personal Certificates tab, check if the OOTB UCMDB cert (for example, ucmdbcert) is already listed in this tab.

   4. If no, select Manage > Import from the menu.

      Provide the self signed certificate from the UCMDB Browser/UCMDB Server or the OOTB UCMDB cert.

      Make sure the cert type is PKCS12. If not PKCS12, you may need to convert it to PKCS12 from JKS.

      Note: The OOTB UCMDB cert can be converted to PKCS12 using UCMDB key tool keytool.exe (located in the <UCMDBServer>\bin\jre\bin directory). For the conversion command, see step 2.d in UCMDB Server configuration.

UCMDB Browser configuration

1. Configure the ucmdb_browser_config.xml file.

   1. Open the ucmdb_browser_config.xml file (located in the <UCMDB_Browser_install_dir>\conf folder) using a text editor.
   2. Set the <hostname> parameter value to the VIP that you set in F5.
   3. Set the <host_port> parameter to the Port that you set in F5.

   4. (Single Sign-on only) If you are using LDAP with user iv-user, locate the <webui> tags, then the <validation> tags, copy and paste the following into the file:

      <in-ui-identity-management>
          <identity-management> 
              <userNameHeaderName>iv-user</userNameHeaderName> 
          </identity-management>
      </in-ui-identity-management>
      

   5. Save the file.

2. Create and configure a credentials file.

   1. Create a credentials.txt file and put it in the same directory as the ucmdb_browser_config.xml file.

   2. In the file credentials.txt, enter the following content:

      • user=UISysadmin
      • password=<your-password>
   3. Save the file.

Verify the configured environment works

To do so, log in to any of the following:

1. Download Apache Solr 6.2.1 (or a later version) from http://archive.apache.org/dist/lucene/solr/, and then extract the package to a local folder.

2. Create and configure the Solr home. To do this, follow these steps:

   1. Create a directory that will be the Solr home.
   2. Copy the solr.xml file under the <UCMDB_Server_Home>\search\solr_dp folder to the Solr home.

   3. Create the following folder structure in the Solr home:

      configsets\ucmdb_configs\conf

   4. Copy the following files from the <UCMDB_Server_Home>\search\solr_dp\configsets\ucmdb_configs\conf folder to the <Solr_home>\configsets\ucmdb_configs\conf folder:

      • mappings.txt
      • protwords.txt
      • schema.xml
      • solrconfig.xml
      • stopwords.txt
      • stopwords_en.txt
      • synonyms.txt

3. Start Solr.

   To do this, go to the <Solr_install_dir>\bin directory in a command prompt, and then run the following command:

   solr start -s <Solr_home>

   Note:  

   • <Solr_install_dir> is the directory where the Solr package is extracted. <Solr_home> is the full path to the Solr home you created in Step 2.a.
   • To check if Solr is started, go to http://localhost:8983/solr, which is the URL for Solr dashboard.
   • To stop Solr, run the solr stop -all command in the same directory.

4. Add the following settings into <UCMDB_Server_Home>\conf\settings.override.properties.

   cmdb.search.solr.standalone=true

   cmdb.search.solr.standalone.url=http://localhost:8983/solr

   Note: The value for cmdb.search.solr.standalone.url should be the URL verified in Step 3.

5. Increase Solr memory size.

   By default Solr allocates only 512MB RAM. You might need to increase this setting, depending on the server’s RAM and other processes that run on the same server.

   To increase Solr memory size,

   1. Open the following file using a text editor:

      Windows: <UCMDB_install_dir>\solr\bin\solr.in.cmd

      Linux: <UCMDB_install_dir>/solr/bin/solr.in.sh

   2. Locate the following setting and increase the setting to a desired value:

      • Windows:

        set SOLR_JAVA_MEM=-Xms512m -Xmx2048m

        where Xms is the initial amount, Xmx is the total amount of memory allocated.

      • Linux:

        SOLR_JAVA_MEM="-Xms512m -Xmx2048m"

   3. Save the file.

6. Restart the UCMDB Server.

To deploy Solr HA cluster based on Zookeeper, follow these steps:

1. Install the Apache Zookeeper. To do this follow these steps:

   1. Download Apache zookeeper 3.4.6 (https://archive.apache.org/dist/zookeeper/zookeeper-3.4.6/).

   2. Unzip the downloaded package.

      The path where you unzip the package will be later referred as <zookeeper_install_dir>.

   3. Go to the <zookeeper_install_dir>\conf folder and rename the zoo_sample.cfg file to zoo.cfg.

   4. Open the zoo.cfg file using a text editor.

      1. Locate the dataDir property in line 12.

      2. Set its value to a folder of your choice.

         Example: dataDir=D:/zookeeper/dataDir

      3. At the end of the file, add the IP to which you want Zookeeper to listen.

         Example:

         clientPortAddress=192.168.168.68

         Otherwise Zookeeper will listen to 0.0.0.0:2181 by default.

      4. Save the file.

   5. Go to the <zookeeper_install_dir>\bin folder and start the zookeeper by executing the following from the command line:

      Windows:zkServer.cmd

      Linux:zkServer.sh start

      Now zookeeper is running at HTTP://<zookeeper_ip>:<zookeeper_port> (You can change the port in the zoo.cfg file).

2. Install Solr in cloud mode. To do this follow these steps:

   1. Download Solr 6.2.1 distribution (http://archive.apache.org/dist/lucene/solr/6.2.1/) on a different machine from the zookeeper.

      Note: Solr 6.2.1 requires JAVA 8.

      JAVA_HOME needs to be set as a system path or environment variable.

   2. Unzip the downloaded package.

   3. Create a directory where Solr is to be located and used as a running directory. You can call this directory <Solr_installDir>. Example: D:\Solr\6.2.1

      1. Copy the contents of the Solr package into this directory.

      2. Go to the <UCMDB_Server>\search\solr_dp directory and copy the solr.xml file and the configsets directory file to <Solr_installDir>.

   4. Start Solr in cloud mode:

      1. To start Solr in cloud mode, execute the following command from the bin folder:

         bin/solr start -cloud -s <Solr_installDir> -p 8987 -z <zookeeper_ip>:<zookeeper_port>

         Examples:

         solr start -cloud -s "D:\Solr\6.2.1\index\solr -p 9999 -z myzookeeper:2181

         solr start -cloud -s "D:\Solr\6.2.1\index\solr -p 9999 -z 16.66.166.166:2181

         Now Solr is started in cloud mode and it is connected to the zookeeper.

   5. On a different machine, install another Solr and connect to the zookeeper in the same way.

      After this you have a Solr cloud cluster up and running with 1 zookeeper and 2 Solr nodes.

   6. You can extend Solr cloud culster by adding more Solr machines to the zookeeper.

3. Configure UCMDB for Solr cloud. To do this follow these steps:

   1. Go to the UCMDB server JMX console > UCMDB:service=Topology Search Services.
   2. Locate the setupSolrCloudConfiguration operation.

   3. Provide values for the parameters and make sure that the setup meets both of the following requirements:

      • numberOfShards * replicationFactor) % numberOfNodes == 0
      • numberOfShards * replicationFactor) / numberOfNodes == maxShardsPerNode
   4. Click Invoke.

   5. Restart UCMDB server.

      UCMDB server will create the index in Solr based on the configurations you provided in the JMX console.

   Note:  

   • For more information about Solr terminology, see https://cwiki.apache.org/confluence/display/solr/Solr+Glossary.

   • To view the configurations, invoke the viewSolrCloudConfigurations JMX method.

   • To revert the configurations, and also clean the Solr cluster, invoke the cleanupSolrCluster JMX method.

     To view the Zookeeper configuration details, go to https://zookeeper.apache.org/doc/r3.4.6/zookeeperAdmin.html#sc_configuration

Example

Below is an example of how the index will look like for a UCMDB with 2 customers with the following Solr cloud configuration:

Solr Cloud Configuration:
Number of nodes: 2
Number of shards: 2
Replication Factor: 2
Zookeeper URL: 16.66.166.166:2181
Is Solr Cloud enabled: true

You can see that the there are 2 indexes, one for each customer, customer1 and customer2.

Each index is split into 2 shards, with shard 1 being on the Solr machine 16.66.66.66:9999 and replicated on Solr machine 16.66.66.66:8888. Shard 2 is also present on both machines. So if a Solr machine shuts down, the index will still be available from the other one, and the users can still perform searches.

For all out-of-the-box adapters: If you modified adapter configurations in your current version, it is strongly recommended that you save all adapter files before starting the upgrade. After the upgrade, you will need to make the same changes to the relevant adapters.

For example, if you have an adapter default template, copy aside the relevant part of the adapter XML (the tag “<adapterTemplates>”). After the upgrade, you will copy this tag back to the XML of the relevant adapter.

To uninstall a Data Flow Probe:

A typical configuration for a high-availability environment is two or more UCMDB Servers connecting to the same database server. The server are configured to work behind a load balancer, that is, the load balancer serves as the entry point to the UCMDB Servers. All of the UCMDB Servers are active at any given time and can handle both read and write requests. Requests are distributed to the UCMDB Servers in the cluster by the load balancer. While read requests are shared evenly among all of the UCMDB Servers (Readers), only one UCMDB Server (Writer) is also responsible for write requests at one time. Any write requests received by a Reader are passed to the Writer. Moreover, any of the UCMDB Servers can take over the Writer role in the case that the Writer becomes unavailable.

1. Install one or more additional UCMDB Servers to create a UCMDB Server cluster

   Install the UCMDB Servers as you did the first UCMDB Server with one difference: when running the Server Configuration wizard to configure the database on the additional UCMDB Server, select Connect to an existing schema, and provide the details of the schema you created for the first UCMDB Server.

   For details on installing UCMDB Servers, see Installing the UCMDB Server - Installation.

   Note:  

   • The machines used for all of the UCMDB Servers in the cluster should have similar hardware (and the same amount of memory) and should be running the same operating system.

   • UCMDB Servers in the cluster must work on the same port number for HTTP, HTTPS, and so on. You cannot configure the two UCMDB Servers to work on different ports.

   • If you are working in an IPv6-only environment, ensure that the UCMDB Server machines are configured for IPv6.

     1. In the wrapper.conf file, locate the following line:

        wrapper.java.additional.<#>=-Djava.net.preferIPv4Stack=true

     2. If it is not commented out, then comment it out.

2. Complete the Server Startup

   1. If the first UCMDB Server (preferably the writer server) is not started, start the process. Wait until the startup process is complete.

   2. Copy the <UCMDBServer>/conf folder from the first server (the writer) to the other servers.

   3. Start the other UCMDB Servers.

3. Configure the Load Balancer

   The load balancer is used to balance load sent to the UCMDB Servers in the cluster. Configure the load balancer as follows:

   1. Configure VIP addresses. On the load balancer:

      • Configure a Cluster VIP address to send requests to the whole UCMDB Server cluster.

      • Configure a Writer VIP address to send requests to the Writer only (for Universal Discovery only).

      Note: Keep a note of the defined VIP addresses.

      • When defining the communication settings between the UCMDB Server and the Data Flow Probes, always use the Writer VIP address when prompted for the UCMDB Server name.

      • When defining the communication settings between the UCMDB Server and other applications, always use the Cluster VIP address when prompted for the UCMDB Server name.

   2. Configure two identical pools of backend servers that represent all of the UCMDB Servers in the cluster. The two pools will be monitored by different health monitors. One pool will be sent requests that are intended solely for the Writer server (only for Universal Discovery), and the other pool will be sent requests that can be processed by any server in the cluster.

   3. Configure the health monitors (keepalive addresses). The health monitors check for the keepalive page of each of the UCMDB Servers.

      • Configure the following URL for the Cluster VIP address:

        /ping/

      • Configure the following URL for the Writer VIP address:

        /ping/?restrictToWriter=true

      Possible responses from both of these URLs are Up or Down with http response codes 200 OK or 503 Service unavailable respectively.

      The expected response should be Up.

      For more details, see How to monitor High Availability cluster with endpoint /ping below.

   4. Connect the health monitors to the respective UCMDB Server pools configured above.

   5. Configure "session stickiness" on the load balancer:

      1. Configure the load balancer to insert cookies to the responses sent back to UCMDB clients.

         Using the Insert method, add a persistence profile of type cookie for each VIP address.

         Note: The cookie name and value are unimportant, as long as the load balancer knows how to maintain stickiness with the cookies it sends out.

      2. Important! Since F5 BIG-IP adds a session cookie only to the first request per connection to the server, you must do the following:

         1. Log into UCMDB.

         2. Go to Administration > Infrastructure Settings, and change the Force connection closing for SDK clients to true.

            When this setting is set to true, the UCMDB SDK clients add a Connection:close header to each authentication request and class download request sent to the server. This way the load balancer will think this is a first request in a connection and add the session cookie to the response.

         Note: This is relevant to load balancers which, like F5 BIG-IP version 10.x, add a session cookie to the first request per connection to the server only.

         If the load balancer you are using adds a session cookie to every response, Force connection closing for SDK clients should be set to false (as is the default). In this case, setting it to true can lead to a decline in system performance.

   6. If the VIP is configured to accept secure connections and the load balancer forwards the requests to the UCMDB servers over HTTP, you must configure redirect rewrites. In the F5 UI, configure the HTTP profile associated with the VIP to rewrite all redirects by enabling the following option: Redirect Rewrite select All.

   Note: If the load balancer is configured to forward requests to backend over HTTP, an extra setting is required to be done on the load balancer. The load balancer admin should configure the load balancer to rewrite the Location header to correctly point to the load balancer URL. This needs to be done for HTTP connections that go to the jmx-console. This can be achieved through a regular expression like the following:

   (https:\/\/(.*)):(\d*)(.*) \1\4

   where the yellow part is the matching part and the green part is the replacing part.

4. Configure Data Flow Probes

   When you install a Data Flow Probe, use the load balancer's Writer VIP address when defining the Universal CMDB Server name.

   If you already have a Data Flow Probe installed:

   1. Stop the Probe.

   2. In the /opt/UCMDB/DataFlowProbe/conf/DataFlowProbe.propertiesc:\UCMDB\DataFlowProbe\conf\DataFlowProbe.properties file, change the serverName attribute to point to the Writer VIP address.

   3. Restart the Probe.

How to monitor High Availability cluster with endpoint /ping

The endpoint /ping allows monitoring of the High Availability cluster. So far the endpoint could be configured to ask for the status of:

• entire cluster (writer + readers)
• only writer

The restrictToReader parameter was added to the aforementioned endpoint that returns the status of only the readers in the cluster.

To configure this, the endpoint /ping should be called with the following parameter: restrictToReader=true

For example, /ping:8443?restrictToReader=true

As a best practice for deployments that rely heavily on UCMDB Browser, we recommend the use of a UCMDB HA Cluster with at least three nodes (one writer and two readers).

For this type of deployment, we recommend that two virtual IPs are created on the load balancer:

• One that points only to the writer, the endpoint for health check is: <UCMDB_URL>/ping?restrictToWriter=true

• In case that the cluster contains 2 or more reader servers, one endpoint that points to all the reader servers. The endpoint for health check is: <UCMDB_URL>/ping?restrictToReader=true

• In case that the cluster contains 1 reader server, one endpoint that points to all the servers (reader and writer). The endpoint for health check is: <UCMDB_URL>/ping

The health check endpoint will return:

• status code 200 and the payload "Up" if the application is started successfully.
• status code 503 and the payload "Down" if the application is not yet fully started.

Note that other elements can affect the health check process, in this case the load balancer can get an error similar to "Connection refused".

This end-to-end use case describes how to set up a high-availability UCMDB and UCMDB Browser environment with F5 BIG-IP load balancer and WebSEAL reverse proxy.

The diagram below illustrates the overall architecture of the environment we will set up.

This case contains the following key tasks:

1. UCMDB Server configuration
2. F5 load balancer configuration
3. WebSEAL reverse proxy configuration
4. UCMDB Browser configuration

UCMDB Server configuration

1. Prerequisites

   1. You have installed the UCMDB Server and UCMDB Browser.

   2. (Optional) You have set up high availability mode by following the instructions in the Deployment Guide: "Set Up High Availability Mode".

2. Export the out-of-the-box UCMDB server keystore to a cert file

   If using the out-of-the-box (OOTB) UCMDB cert, export it for later use.

   To export the UCMDB server keystore (server.keystore) to a cert file (server.cert), do the following:

   1. Open the command prompt and run the following command:

      C:\UCMDB\UCMDBServer\bin\jre\bin\keytool.exe -export -alias <certificate alias> -keystore <Keystore file path> -file C:\UCMDB\UCMDBServer\conf\security\server.cert

      where:

      • certificate alias is the name given to the certificate.

      • Keystore file path is the full path of the location of the keystore file.

      For example, for the out-of-the-box server.keystore use the following command:

      C:\UCMDB\UCMDBServer\bin\jre\bin\keytool.exe -export -alias hpcert -keystore C:\ucmdb\ucmdbserver\conf\security\server.keystore -file C:\UCMDB\UCMDBServer\conf\security\server.cert

      Note: If self-signed certificate is not used, but a company generated certificate, use the following command to get the alias for this certificate:

      C:\UCMDB\UCMDBServer\bin\jre\bin\keytool.exe -list -keystore c:\ucmdb\ucmdbserver\conf\security\server.keystore

      Keystore type: JKS

      Keystore provider: SUN

      Your keystore contains 1 entry.

      <alias>, 14 Sept. 2012, PrivateKeyEntry.

      Certificate fingerprint (SHA1): 2A:52:DF:17:D9:A5:37:2D:1F:1D:BA:4B:41:46:33:A8:18:42:5B:D7

      The alias will look like: {45789-15478-1236-7895}

      Use this alias to export the certificate.

   2. Enter the keystore password.

   3. Verify that the certificate was created in the following directory: C:\UCMDB\UCMDBServer\conf\security\server.cert

   4. Convert the generated JKS file into PKCS12 format using UCMDB key tool keytool.exe (located in the <UCMDBServer>\bin\jre\bin directory). (WebSEAL requires PKCS12 format cert.)

      Run the following command:

      C:\UCMDB\UCMDBServer\bin\jre\bin\keytool.exe -importkeystore -srckeystore server.keystore -destkeystore server.p12 -srcalias <source serverkey> -destalias <target serverkey> -srcstoretype jks -deststoretype pkcs12 -srcstorepass <keystore password> -deststorepass <keystore password> -noprompt
      

      The server.p12 file is the resulting PKCS12 format cert.

3. (Single Sign-On only) Set IDM User Name

   1. Go to UCMDB server JMX console.
   2. Locate the setUserName JMX operation under the UCMDB-UI:name=LW-SSO Configuration category.

   3. Provide the following parameter values for the setUserName JMX method:

      • Is inbound handler enabled: True
      • LW-SSO IDM User Name: <The real value for the IDM user name>. For example, iv-user (if you are using LDAP with user iv-user).
   4. Click Invoke.

4. Set UCMDB Browser URL

   1. In UCMDB UI, go to Administration > Infrastructure Settings Manager.
   2. Locate the UCMDB Browser URL infrastructure setting, and set the value to your WebSEAL URL.

F5 load balancer configuration

1. Make sure you have a working F5 BIG-IP load balancer environment.
2. Log in to the F5 BIG-IP load balancer environment.

3. Make sure you have created the following in the F5 BIG-IP load balancer environment (Local Traffic > Virtual Servers > Nodes|Pools):

   • A node for each of the virtual machines on which UCMDB server and/or UCMDB Browser are running.
   • A pool that contains all the above nodes.

4. Import the UCMDB CA cert/key into F5.

   1. In the navigation pane, go to Main > System > Certificate Management.
   2. Click Import .

   3. In the SSL Certificate/Key Source page, select Import Type:

      • When selecting Certificate, do the following:

        • Certificate Name: Keep Create New selected and provide the certificate name.
        • Certificate Source: Keep Upload File selected, click Browse... to select the UCMDB server.cert file you exported earlier.

      • When selecting Key, do the following:

        • Key Name: Keep Create New selected and provide the key name.
        • Certificate Source: Keep Upload File selected, click Browse... to select the UCMDB key file.
   4. Click Import .

5. Add UCMDB CA cert/key to Certificate Key Chain.

   1. In F5, go to Local Traffic > Virtual Servers > Profiles > SSL.

   2. Select and click an existing UCMDB cert profile.

      Note: Create a SSL profile for HTTPS by clicking Create if you do not have one.

   3. Go to the Certificate Key Chain configuration setting, click Add .

   4. In the Add SSL Certificate to Key Chain dialog, select or provide values for the following settings as appropriate and click Add :

      Certificate: Select the UCMDB certificate file.

      Key. Select the UCMDB key.

      Chain. Select the UCMDB chain.

      Passphrase. Provide a pass phrase.

6. Create a cookie-based persistence profile.

   1. In F5, go to Local Traffic > Virtual Servers > Persistence, and click Create .
   2. Select Cookie for Persistence Type and provide a name for the persistence profile.
   3. Click Finished.

7. Create a virtual server.

   1. In F5, go to Local Traffic > Virtual Servers, and click Create .

   2. Specify values the following settings:

      • Configuration > HTTP Profile: http
      • Configuration > SSL Profile (Client): Select the UCMDB cert you imported in step 5 from the Available column and add it into the Selected column.
      • Configuration > Source Address Translation: Auto Map (If you select SNAT, make sure you configure SNAT related settings properly)
      • Resources > Default Persistence Profile: Select the persistence profile you created in step 6.
   3. Provide values for other settings as appropriate.
   4. Click Finished.

WebSEAL reverse proxy configuration

1. Configure WebSEAL reverse proxy by following IBM official documentation: IBM Security Access Manager (ISAM) Reverse Proxy Scenario.

   Important: During the configuration, in the Identity tab of the Edit a Standard Junction window, make sure you set the following settings as described below:

   • Junction Cookie: Leave the checkbox unselected
   • Include session cookie: Select the checkbox

   • HTTP Basic Authentication Header: For UCMDB Browser and RESTful API authentication to work properly, select Ignore from the dropdown list.

   • (Optional) HTTP Header Identity Information: Select IV-USER if you are using LDAP with user iv-user.

2. Import UCMDB cert (OOTB or self-signed).

   1. In IBM Security Access Manager, go to Manage > Secure Settings > SSL Certificate.
   2. Go to Manage > Edit SSL certificate database menu option, and select pdsrv.
   3. Go to the Personal Certificates tab, check if the OOTB UCMDB cert (for example, ucmdbcert) is already listed in this tab.

   4. If no, select Manage > Import from the menu.

      Provide the self signed certificate from the UCMDB Browser/UCMDB Server or the OOTB UCMDB cert.

      Make sure the cert type is PKCS12. If not PKCS12, you may need to convert it to PKCS12 from JKS.

      Note: The OOTB UCMDB cert can be converted to PKCS12 using UCMDB key tool keytool.exe (located in the <UCMDBServer>\bin\jre\bin directory). For the conversion command, see step 2.d in UCMDB Server configuration.

UCMDB Browser configuration

1. Configure the ucmdb_browser_config.xml file.

   1. Open the ucmdb_browser_config.xml file (located in the <UCMDB_Browser_install_dir>\conf folder) using a text editor.
   2. Set the <hostname> parameter value to the VIP that you set in F5.
   3. Set the <host_port> parameter to the Port that you set in F5.

   4. (Single Sign-on only) If you are using LDAP with user iv-user, locate the <webui> tags, then the <validation> tags, copy and paste the following into the file:

      <in-ui-identity-management>
          <identity-management> 
              <userNameHeaderName>iv-user</userNameHeaderName> 
          </identity-management>
      </in-ui-identity-management>
      

   5. Save the file.

2. Create and configure a credentials file.

   1. Create a credentials.txt file and put it in the same directory as the ucmdb_browser_config.xml file.

   2. In the file credentials.txt, enter the following content:

      • user=UISysadmin
      • password=<your-password>
   3. Save the file.

Verify the configured environment works

To do so, log in to any of the following:

1. Download Apache Solr 6.2.1 (or a later version) from http://archive.apache.org/dist/lucene/solr/, and then extract the package to a local folder.

2. Create and configure the Solr home. To do this, follow these steps:

   1. Create a directory that will be the Solr home.
   2. Copy the solr.xml file under the <UCMDB_Server_Home>\search\solr_dp folder to the Solr home.

   3. Create the following folder structure in the Solr home:

      configsets\ucmdb_configs\conf

   4. Copy the following files from the <UCMDB_Server_Home>\search\solr_dp\configsets\ucmdb_configs\conf folder to the <Solr_home>\configsets\ucmdb_configs\conf folder:

      • mappings.txt
      • protwords.txt
      • schema.xml
      • solrconfig.xml
      • stopwords.txt
      • stopwords_en.txt
      • synonyms.txt

3. Start Solr.

   To do this, go to the <Solr_install_dir>\bin directory in a command prompt, and then run the following command:

   solr start -s <Solr_home>

   Note:  

   • <Solr_install_dir> is the directory where the Solr package is extracted. <Solr_home> is the full path to the Solr home you created in Step 2.a.
   • To check if Solr is started, go to http://<FQDN of Solr Hostname>:8983/solr, which is the URL for Solr dashboard.
   • To stop Solr, run the solr stop -all command in the same directory.

4. Add the following settings into <UCMDB_Server_Home>\conf\settings.override.properties.

   cmdb.search.solr.standalone=true

   cmdb.search.solr.standalone.url=http://<FQDN of Solr Hostname>:8983/solr

   Note: The value for cmdb.search.solr.standalone.url should be the URL verified in Step 3.

5. Increase Solr memory size.

   By default Solr allocates only 512MB RAM. You might need to increase this setting, depending on the server’s RAM and other processes that run on the same server.

   To increase Solr memory size,

   1. Open the following file using a text editor:

      Windows: <UCMDB_install_dir>\solr\bin\solr.in.cmd

      Linux: <UCMDB_install_dir>/solr/bin/solr.in.sh

   2. Locate the following setting and increase the setting to a desired value:

      • Windows:

        set SOLR_JAVA_MEM=-Xms512m -Xmx2048m

        where Xms is the initial amount, Xmx is the total amount of memory allocated.

      • Linux:

        SOLR_JAVA_MEM="-Xms512m -Xmx2048m"

   3. Save the file.

6. Restart the UCMDB Server.

To deploy Solr HA cluster based on Zookeeper, follow these steps:

1. Install the Apache Zookeeper. To do this follow these steps:

   1. Download Apache zookeeper 3.4.6 (https://archive.apache.org/dist/zookeeper/zookeeper-3.4.6/).

   2. Unzip the downloaded package.

      The path where you unzip the package will be later referred as <zookeeper_install_dir>.

   3. Go to the <zookeeper_install_dir>\conf folder and rename the zoo_sample.cfg file to zoo.cfg.

   4. Open the zoo.cfg file using a text editor.

      1. Locate the dataDir property in line 12.

      2. Set its value to a folder of your choice.

         Example: dataDir=D:/zookeeper/dataDir

      3. At the end of the file, add the IP to which you want Zookeeper to listen.

         Example:

         clientPortAddress=192.168.168.68

         Otherwise Zookeeper will listen to 0.0.0.0:2181 by default.

      4. Save the file.

   5. Go to the <zookeeper_install_dir>\bin folder and start the zookeeper by executing the following from the command line:

      Windows:zkServer.cmd

      Linux:zkServer.sh start

      Now zookeeper is running at HTTP://<zookeeper_ip>:<zookeeper_port> (You can change the port in the zoo.cfg file).

2. Install Solr in cloud mode. To do this follow these steps:

   1. Download Solr 6.2.1 distribution (http://archive.apache.org/dist/lucene/solr/6.2.1/) on a different machine from the zookeeper.

      Note: Solr 6.2.1 requires JAVA 8.

      JAVA_HOME needs to be set as a system path or environment variable.

   2. Unzip the downloaded package.

   3. Create a directory where Solr is to be located and used as a running directory. You can call this directory <Solr_installDir>. Example: D:\Solr\6.2.1

      1. Copy the contents of the Solr package into this directory.

      2. Go to the <UCMDB_Server>\search\solr_dp directory and copy the solr.xml file and the configsets directory file to <Solr_installDir>.

   4. Start Solr in cloud mode:

      1. To start Solr in cloud mode, execute the following command from the bin folder:

         bin/solr start -cloud -s <Solr_installDir> -p 8987 -z <zookeeper_ip>:<zookeeper_port>

         Examples:

         solr start -cloud -s "D:\Solr\6.2.1\index\solr -p 9999 -z myzookeeper:2181

         solr start -cloud -s "D:\Solr\6.2.1\index\solr -p 9999 -z 16.66.166.166:2181

         Now Solr is started in cloud mode and it is connected to the zookeeper.

   5. On a different machine, install another Solr and connect to the zookeeper in the same way.

      After this you have a Solr cloud cluster up and running with 1 zookeeper and 2 Solr nodes.

   6. You can extend Solr cloud culster by adding more Solr machines to the zookeeper.

3. Configure UCMDB for Solr cloud. To do this follow these steps:

   1. Go to the UCMDB server JMX console > UCMDB:service=Topology Search Services.
   2. Locate the setupSolrCloudConfiguration operation.

   3. Provide values for the parameters and make sure that the setup meets both of the following requirements:

      • numberOfShards * replicationFactor) % numberOfNodes == 0
      • numberOfShards * replicationFactor) / numberOfNodes == maxShardsPerNode
   4. Click Invoke.

   5. Restart UCMDB server.

      UCMDB server will create the index in Solr based on the configurations you provided in the JMX console.

   Note:  

   • For more information about Solr terminology, see https://cwiki.apache.org/confluence/display/solr/Solr+Glossary.

   • To view the configurations, invoke the viewSolrCloudConfigurations JMX method.

   • To revert the configurations, and also clean the Solr cluster, invoke the cleanupSolrCluster JMX method.

     To view the Zookeeper configuration details, go to https://zookeeper.apache.org/doc/r3.4.6/zookeeperAdmin.html#sc_configuration

Example

Below is an example of how the index will look like for a UCMDB with 2 customers with the following Solr cloud configuration:

Solr Cloud Configuration:
Number of nodes: 2
Number of shards: 2
Replication Factor: 2
Zookeeper URL: 16.66.166.166:2181
Is Solr Cloud enabled: true

You can see that the there are 2 indexes, one for each customer, customer1 and customer2.

Each index is split into 2 shards, with shard 1 being on the Solr machine 16.66.66.66:9999 and replicated on Solr machine 16.66.66.66:8888. Shard 2 is also present on both machines. So if a Solr machine shuts down, the index will still be available from the other one, and the users can still perform searches.

This section covers the pre-deployment requirements that your organization should meet when planning the SSA deployment.

• System Requirements
• Get Installation Resources
• Security Consideration

System Requirements

• Hardware

  Component	Requirement
  Operating System	64-bit
  Memory	16G
  Number of Processors	8 or more processors

  Note: SSA would consume more resources on the UCMDB server and the Data Flow Probe server. It is strongly recommended to assign adequate hardware resources.

• Operating System

  Hardware Platform	OS Type	OS Version and Edition	Supported	Recommended
  x86-64	Windows Server 2016	Datacenter and Standard, 64-bit (without the Nano Server installation option)	Yes	Yes
  x86-64	Windows Server 2012 R2	Standard/Datacenter editions, 64-bit	Yes
  x86-64	Windows Server 2012	Standard/Datacenter editions, 64-bit	Yes
  x86-64	Windows Server 2008	SP2, Standard/Enterprise editions, 64-bit R2 and R2 SP1, Standard/Enterprise editions, 64-bit	Yes

• Additional Requirement

  • Microsoft Visual C++ 2010 x64 Redistributable Package

     

Get Installation Resources

Before deploying Smart Software Analytics, make sure that you have installed and configured the following:

• UCMDB Server 11.0

• UCMDB Browser 11.0

Also, get the following resources ready:

• SSA installation package

• (Optional) The latest Discovery Knowledge (DK) package for SSA, which is a monthly released .zip file including the full DK package and some configuration files specific to SSA.

Security Consideration

To enable SSA to work with UCMDB Browser and UCMDB Server, make sure you deploy SSA service on the same domain as UCMDB Browser's.

For example, if you can visit UCMDB Browser via https://<Browser_hostname>.microfocus.com:8090. Your SSA service should be deployed on https://<SSA_hostname>.microfocus.com as well.

Before the installation, review the "Pre-deployment Considerations" section above and make sure that you meet all the requirements.

Installing SSA server

To install the SSA server, follow these steps:

1. Extract the ZIP packages for Windows platform.

2. Check if there is a newer version of master SAI files that have been released. If yes, download the latest master SAI files it and replace the older ones under the <SSA installation directory>\ssa-server\ssa\data\masterSAI folder.

3. Execute the <SSA installation directory>\install_ssa_service.bat script to register SSA as the Windows service: CMS SSA Server.

4. Execute the <SSA installation directory>\start_ssa_service.bat script to start the service.

Now you can launch and configure SSA from UCMDB Browser.

Post-Installation Setup

To ensure that Smart Software Analytics works in the best condition, it is recommended that you perform the following after installing Smart Software Analytics:

• Monitor SSA

• Back up User SAI Files

• Maintain the Master SAI Files

Monitor SSA

To monitor SSA, perform the following in a regular basis:

• Confirm that the SSA service is running properly.
• Check the log file for errors. In the log file, every change to the user SAI file and the autoteach.zsai file should be logged.

• Check the <SSA installation directory>\ssa-server\ssa\data\scanFile folder. By checking the last modified time of each scanfile, you can have a clear understanding of the work done by SSA.

Back up User SAI Files

Always back up user SAI files timely in a regular basis to avoid potential data loss. All user SAI files are saved under the <SSA installation directory>\ssa-server\ssa\data\masterSAI folder.

Maintain the DK Package

The auto teach results would be more accurate with the latest DK package. Therefore, it is strongly recommended that you keep the DK package content on SSA up to date by downloading the latest package, which is released on ITOM Marketplace in a monthly base. Upload the master SAI files contained in the latest package when you finish downloading.

Before starting SSA, to make sure that SSA could work with UCMDB Browser and UCMDB Server, configure SSA as follows:

1. Go to <SSA_HOME>\ssa-server\config\ssa_lwsso_config.xml and then modify the following configuration:

   initString="This string should be replaced"
   <domain></domain>

   Note:  

   • The initstring should be the same as configured in UCMDB's LWSSO configuration. It can be retrieved by using the JMX method retrieveLWSSOConfiguration.
   • A value for the <domain></domain> element is required. Specify here the domain which can be visited by both the SSA service and the UCMDB Browser service.

   In the meantime, the LW-SSO configuration for UCMDB Browser should be modified in the same way. For details about configuring LW-SSO for UCMDB Browser, see "Configure LW-SSO" in the Universal CMDB Browser Online Help.

2. Go to <SSA_HOME>\ssa-server\config\config.properties and modify the settings as shown below:

   UCMDB connection configuration:

   ucmdb.schema=https
   ucmdb.domain=FQDN or IP
   ucmdb.port=8443

   UCMDB Browser domain information:

   browser.schema=https
   browser.domain=FQDN Only
   browser.port=8090
   allowed.access.ip=*
   

3. (Optional) Change the certificate.

   SSA could work with UCMDB and Data Flow Probe with the out-of-the-box certificate configuration.

   If you want to change the OOTB certificate in the ecosystem, follow the procedure as described below:

   1. When UCMDB's certificate is changed, make sure that you perform the following steps:

      1. Export UCMDB's public certificate.

         1. Open the command prompt and run the command:

            C:\UCMDB\UCMDBServer\bin\jre\bin\keytool.exe -export -alias <keystore alias> -keystore <Keystore file path> -file C:\UCMDB\UCMDBServer\conf\security\server.cert

            where:

            • keystore alias is the name given to the keystore.

            • Keystore file path is the full path of the location of the keystore file.

            For example, for the out-of-the-box server.keystore use the following command:

            C:\UCMDB\UCMDBServer\bin\jre\bin\keytool.exe -export -alias hpcert -keystore C:\ucmdb\ucmdbserver\conf\security\server.keystore -file C:\HP\UCMDB\UCMDBServer\conf\security\server.cert

         2. Enter the keystore password.

         3. Verify that the certificate was created in the following directory: C:\UCMDB\UCMDBServer\conf\security\server.cert

      2. Delete the old certificate in SSA server's Truststore by using the following command:

         <SSA_HOME>\jre\bin\keytool -delete -alias "ucmdb server" -keystore <SSA_HOME>\ssa-server\config\interface.truststore -storepass ssapass

      3. Import the new certificate which comes from UCMDB by using the following command:

         <SSA_HOME>\jre\bin\keytool -import -trustcacerts -keystore <SSA_HOME>\ssa-server\config\interface.truststore -storepass ssapass -alias "ucmdb server" -file <UCMDB CERT FILE>

   2. When SSA server's certificate is changed, make sure that you perform the following steps:

      1. Generate a new keystore (by using the command below to replace the ssa-server keystore under <SSA_HOME>\ssa-server\config\interface.keystore:

         <SSA_HOME>\jre\bin\keytool -keystore <temp folder>\interface.keystore -genkey -alias interface -keyalg RSA -keysize 2048 -storepass ssapass -keypass ssapass

      2. Export the public certificate from new keystore of ssa-server:

         <SSA_HOME>\jre\bin\keytool -export -alias interface -keystore <SSA_HOME>\ssa-server\config\interface.keystore -storepass ssapass -file <temp folder>\interface.crt

      3. Import interface.crt to the Data Flow Probe's Truststore.

         1. Open the command prompt and execute the following command:

            C:\UCMDB\DataFlowProbe\bin\jre\bin\keytool.exe -import -v -keystore C:\UCMDB\DataFlowProbe\conf\security\HPProbeTrustStore.jks -file C:\UCMDB\DataFlowProbe\conf\security\interface.crt -alias ssa

         2. Enter the keystore password: logomania

         3. When asked Trust this certificate?, press y and then Enter.

            The following message is displayed:

            Certificate was added to keystore.

   3. When Data Flow Probe's certificate is changed, make sure that you perform the following steps:

      1. Export Data Flow Probe's public certificate.

         1. Open the command prompt and run the command:

            C:\UCMDB\DataFlowProbe\bin\jre\bin\keytool.exe -export -alias <ProbeName> -keystore C:\UCMDB\DataFlowProbe\conf\security\client.keystore -file C:\UCMDB\DataFlowProbe\conf\security\<ProbeName>.cert

         2. When asked, enter the keystore password.

            The following message is displayed:

            Certificate stored in file <C:\UCMDB\DataFlowProbe\conf\security\<ProbeName>.cert>

      2. Replace the certificate in ssa-server using the following command:

         <SSA_HOME>\jre\bin\keytool -import -trustcacerts -keystore <SSA_HOME>\ssa-server\config\interface.truststore -storepass ssapass -alias <ProbeName> -file <PROBE CERT FILE>

To enable and configure Smart Software Analytics, follow these steps:

1. Access the Smart Software Analytics module.

   1. Access UCMDB Browser, using the following URL: https://<server_name or IP>:<port>/ucmdb-browser. Provide user name and password if required. Once you are logged in, you are on the UCMDB Home landing page.

      It is recommended that you access UCMDB Browser using Chrome.

   2. Click the UCMDB Modules menu icon in the upper left corner to expand the navigation bar, and then select Smart Software Analytics.

2. On the top right of the Smart Software Analytics, click the SSA CONFIGURATION button. The Settings window is displayed.

3. Enable and configure SSA settings as described in the following table.

   UI Element	Description
   Enable SSA	Switch to enable or disable SSA.
   SSA Server Domain	Type the fully qualified domain name (FQDN) of your SSA server here, for example, ssa.microfocus.com. UCMDB Browser automatically checks whether the SSA server can be connected. If not, the following message is displayed: "SSA Server is not available." Note: For the first time to connect to an SSA server with self-signed certificate, you need to open another web browser window to accept the certificate by visiting the following URL: https://<SSA_domainname>:9554
   Define the schedule to send scanfile to SSA	Select the Data Flow Probe for which you will define the schedule. You can define the schedule for all probes or a specific probe.
   <The frequency drop-down list>	Define how frequently the selected probe or probes are scheduled to send scan files.
   Hour	Define the exact hour when the selected probe or probes are scheduled to send scan files. Important: Before using SSA, check the Date and Time settings on the machines where SSA server, UCMDB server and UCMDB Browser are deployed. Make sure that these settings are consistent with each other. Otherwise, there might be overtime issues when SSA runs.
   SUBMIT	Click this button to submit the SSA schedule configuration to the UCMDB server.

This section includes:

• Is My SSA working
• How to Reset SSA
• Overtime Issues Occur When SSA Runs

Is My SSA Working

To check if SSA works properly, perform the following:

1. Check if the SSA service is still running.
2. Check the log files for errors.
3. Monitor <SSA installation directory>\ssa-server\ssa\data\runtime\scanFile folder against accumulated files, which indicate that error occurs.

4. If SSA does not work, restart the SSA service. Then, SSA will reload all SAI files.

   If SSA still fails to work normally after you restart the SSA service, it is possible that some SAI files are corrupted and a reset is needed.

How to Reset SSA

Restarting the SSA service could solve most problems. But if any SAI file is corrupted, you will need to reset SSA.

To reset SSA, follow these steps:

1. Delete all runtime folders.
2. Clean <SSA installation directory>\ssa-server\ssa\data\report if you do not need the report information.
3. Back up the user SAI files and only leave Master SAI files under SSA installation directory\ssa-server\ssa\data\masterSAI.
4. Restart the SSA service.

5. Re-import all user SAI files. For details, see "How to Upload SAI Files to Through User Interface" in the Universal CMDB Browser Online Help.

   Note: In addition to uploading the SAI files to SSA server using SSA UI on UCMDB Home, you can also manually copy back the user SAI files into <SSA installation directory>\ssa-server\ssa\data\masterSAI. But you need to restart the SSA service after doing so.

Overtime Issues Occur When SSA Runs

Check the Date and Time settings on the machines where SSA server, UCMDB server and UCMDB Browser are deployed. Make sure that these settings are consistent with each other. Otherwise, there might be overtime issues when SSA runs.

This version of SSA has the following limitations:

• Multiple-session is not supported. Only one user has write permission on the SAI data via the SSA UI. Other users only have read rights.
• As part of the security mechanism, a self-signed certificate is used for the communication between UCMDB Browser and UCMDB Server. When the UCMDB Browser is accessed for the first time on a machine, the web browser would pop up a warning message for the self-signed certificate. Users need to acknowledge that to continue with the log-in. You can refer to the Universal CMDB Hardening Guide for instructions about how to replace it with a more secure certificate.

• Data Flow Probes that are upgraded to version 11.0 do not contain the out-of the-box certificate from SSA. Therefore, these Data Flow Probes cannot upload scan files to SSA server.

  Tip: Import SSA’s certificate into these Data Flow Probes. To do so, follow the instructions in step 3.b.iii. "Import interface.crt to the Data Flow Probe's Truststore" in Smart Software Analytics - Security Configuration.

Note the following before installing the Data Flow Probe:

• UCMDB and the Data Flow Probe should be installed within the company’s firewall and should not be deployed via the Internet.

• The Probe can be installed before or after you install the Universal CMDB Server. However, during the installation of the Probe, you need to provide the UCMDB Server name, so it is preferable to install the UCMDB Server before installing the Probe.

• Ensure that the network adapter on the machine on which you are installing Data Flow Probe is configured with the desired IP interface (IPv4/IPv6).

  Note: Configure these settings from the Windows Control Panel. DO NOT use the netsh interface install/uninstall <ip interface version> command. Configure these settings from the configuration file in /etc/sysconfig/network-scripts/ifcfg-eth0.

• High-availability environment: Have your load balancer's Writer virtual IP address available. You will need this when defining the UCMDB Server name in the Data Flow Probe installation wizard.

• Verify that you have enough hard disk space available before beginning installation. For details, see the section about Data Flow Probe requirements in the Support Matrix section of the UCMDB Help.

• For details about licensing, contact Software Sales Assist team (sw_ssa@microfocus.com).

• Before installing the Data Flow Probe, open the following file on the machine on which you are installing the Probe, and ensure that any lines containing "localhost" are commented out:

  %systemroot%\system32\drivers\etc\hosts

  /etc/hosts

• If you are upgrading a Data Flow Probe, it is strongly recommended, before you start the upgrade procedure, to back up the following folder and restore it after performing the upgrade. This retains your manually imported customer certificates.

  C:\UCMDB\UCMDBServer\bin\jre\lib\security\cacerts

  /opt/UCMDB/UCMDBServer/bin/jre/lib/security/cacerts

Before you install the Data Flow Probe, ensure that the relevant ports are open.

• Data Flow Probe Machine Ports
• Remote Machine Ports

Data Flow Probe Machine Ports

The following ports are used by the Data Flow Probe process on the Data Flow Probe machine:

# Make rmi listen on localhost only

wrapper.java.additional.<the number>=-Djava.rmi.server.hostname=localhost

Remote Machine Ports

The following ports are used by the Data Flow Probe process on remote machines:

The following procedure explains how to install the Data Flow Probe on a Windows machine.

To install the Data Flow Probe:

1. Extract the package for the Windows platform, and then double-click UCMDB_DataFlowProbe_11.0.exe.

2. A progress bar is displayed. After the initial process is complete, the splash screen opens. Choose the locale language and click OK.

3. The Introduction page opens. Click Next.

4. The License Agreement page opens.

   Accept the terms of the end-user license agreement and click Next.

5. The UCMDB Data Flow Probe Setup Type page opens.

   Select Full Data Flow Probe Installation. This installs the Data Flow Probe with all its components, including the Inventory Tools (Analysis Workbench, Viewer, SAI Editor, and MSI Scanner) required for application teaching.

   Note: The Inventory Tools option is used to install only the Inventory Tools. For details about application teaching, see the Data Flow Management section of the UCMDB Help.

   Click Next.

   Note: If an existing Data Flow Probe is detected, a prompt pops up asking you if you would like to install a second Data Flow Probe. Click OK to proceed, or click Cancel to exit the installation.

6. The Select Installation Type page opens.

   Select New Installation if you are installing a new probe.

   Note: Select Upgrade when you upgrade an existing probe.

7. The Select Installation Folder page opens.

   Accept the default installation folder, C:\UCMDB\DataFlowProbe, or click Choose to select a different installation folder.

   (Second Probe only) For the second Data Flow Probe on the same Windows machine, specify a different installation folder or click Choose to select a different installation folder for the second probe, instead of using the one for the existing probe.

   Note:  

   • The installation folder that you select must be empty.

   • To restore the default installation folder, after selecting a different folder, click Restore Default Folder.

8. The UCMDB Data Flow Probe Configuration page opens, enabling you to configure the details of the application server to which the Data Flow Probe will report.

   • Under Application to report to select Universal CMDB and in the Application Server address box, enter the name or the IP address of the UCMDB server with which the Probe is to connect.

     Note:  

     • Two Data Flow Probes installed on the same Windows machine should report to two different UCMDB servers respectively. For the second Probe you install, in the Application Server address box, make sure you enter the name or the IP address of a different UCMDB server.
     • In a High Availability environment, use the Writer virtual IP address of the load balancer.

   • In the Data Flow Probe address box, enter the IP address or DNS name of the machine on which you are currently installing the Probe, or accept the default.

     Note: If the Data Flow Probe machine has more than one IP address, enter a specific IP address, and not the DNS name.

   Click Next.

   Note: If you do not enter the address of the application server, or if there is no TCP connection to the application server via default ports (8080,8443,80) (possibly because the application server has not fully started yet), a message is displayed. You can choose to continue to install the Probe without entering the address, or return to the previous page to add the address.

9. A second Data Flow Probe Configuration page opens, enabling you to configure an identifier for the Probe.

   • In the Data Flow Probe identifier box, enter a name for the Probe that is used to identify it in your environment.

     Note:  

     • The Probe identifier is case sensitive, must be unique for each Probe in your deployment, and it must not exceed 50 characters.

     • (Second Probe only) Make sure you enter a unique identifier for the second Probe.

     • (Applicable for the first Probe only) When installing the Probe in separate mode, that is, the Probe Gateway and Probe Manager are installed on separate machines, you must give the same name to the Probe Gateway and all its Probe Managers. This name appears in UCMDB as a single Probe node. Failure to give the same name may prevent jobs from running.

   • To use the default UCMDB IP address or machine name, as defined in the UCMDB Server installation, select Use Default CMDB Domain.

     The Default UCMDB Domain is also configurable in UCMDB's Infrastructure Settings module (Administration > Infrastructure Settings > Class Model Settings > Default Domain Property Value). For details, see the Administer section of the UCMDB Help.

   Click Next.

10. If you cleared the Use Default CMDB Domain box in the previous step, the Domain Configuration page opens.

    • Data Flow Probe domain type. Select the type of domain on which the Probe is to run:

      • Customer. Select if you are installing one or more Probes in your deployment.

        Note: Always use this option for new installations.

      • External. Select this option for upgraded 6.x systems.

    • Data Flow Probe domain. If you are not using the default domain defined in UCMDB enter the name of the domain here.

      Note: For external domains, this value must be identical to the Data Flow Probe identifier defined in the previous step.

    Click Next.

11. The UCMDB Data Flow Probe Working Mode page opens.

    Note: When installing a second Probe, this step is skipped.

    You can run the Probe Gateway and Probe Manager as one Java process or as separate processes.

    Note: The Probe can be configured in separate mode in IPv4 environments, and in IPv4/IPv6 environments, but not in pure IPv6 environments.

    Click No to run the Probe Gateway and Probe Manager as one process.

    Click Yes to run the Probe Gateway and Probe Manager as two processes on separate machines.

    Note: When running the Probe Gateway and Probe Manager as two processes ensure the following:

    • At least one Probe Gateway component must be installed. The Probe Gateway is connected to the UCMDB Server. It receives tasks from the Server and communicates with the collectors (Probe Managers).

    • Several Probe Managers can be installed. The Probe Managers run jobs and gather information from networks.

    • The Probe Gateway should contain a list of attached Probe Managers.

    • The Probe Managers must know to which Probe Gateway they are attached.

    Click Next.

12. The UCMDB Data Flow Probe Memory Size page opens.

    Define the minimum and maximum memory, in megabytes (MB), to be allocated to the Probe.

    Note: For information about changing the maximum heap size value at a later point in time, see the Data Flow Management section of the UCMDB Help.

    Click Next.

13. The PostgreSQL Account Configuration page opens.

    The PostgreSQL Data Flow Probe account is used by the Data Flow Probe to connect to the PostgreSQL database. This account is less privileged compared to the PostgreSQL root account. Its password is encrypted in the DataFlowProbeOverride.properties configuration file.

    Enter the password for the PostgreSQL Data Flow Probe account and enter it a second time for confirmation.

    Click Next.

14. A second PostgreSQL Account Configuration page opens where you configure the PostgreSQL root account. The PostgreSQL root account is the account used to administer the PostgreSQL database. When set, it may need to be provided while executing scripts under the Probe's installation.

    Enter the password for the PostgreSQL Data Flow Probe account, and enter it a second time for confirmation.

    Note: Changing the root account password does not affect operation of the Probe.

    Click Next.

15. The Configuration for System Administrator Password page opens.

    Set the password for the system administrator (sysadmin), who has the ability to log into the JMX console.

    Click Next.

16. The Account Configuration for Uploading Scan Files page opens. This is used for Manual Scanner Deployment mode. It enables uploading scan files directly to the XML Enricher's incoming directory on the Data Flow Probe using HTTP or HTTPS.

    Enter the user name and password for this account, and enter the password a second time for confirmation. The default user name is UploadScanFile.

    Click Next.

17. The Pre-Installation Summary page opens.

    Review the selections you have made and click Install to complete the installation of the Probe.

18. When the installation is complete, the Install Complete page opens.

    Note:  

    • Any errors occurring during installation are written to the following file:

      <DataFlowProbe_InstallDir>\UninstallerData\Logs\UCMDB_Data_Flow_Probe_Install_<install date and time>.log

      For example, C:\UCMDB\DataFlowProbe\UninstallerData\Logs\UCMDB_Data_Flow_Probe_Install_<install date and time>.log for the first Probe on the Windows machine.

    • Any database-related errors occurring during installation are written to the following log:

      <DataFlowProbe_InstallDir>\runtime\log\postgresql.log

      For example, C:\UCMDB\DataFlowProbe\runtime\log\postgresql.log for the first Probe on the Windows machine.

    Click Done.

19. If you customized the key.bin file, copy the key.bin that you saved earlier to <DataFlowProbe_InstallDir>\conf\security.

20. Start the Probe by using one of the following methods:

    Click Start > All Programs > UCMDB > Start Data Flow Probe.

    Note: To start the second Probe: Select Start > All Programs > UCMDB (2) > Start Data Flow Probe.

    To start the Probe from the console, at the command prompt execute the following script:

    <DataFlowProbe_InstallDir>\bin\gateway.bat console

    For example, C:\UCMDB\DataFlowProbe\bin\gateway.bat console for the first Probe on the Windows machine.

    Execute the following command:

    /opt/UCMDB/DataFlowProbe/bin/ProbeGateway.sh start

    To activate the Probe in a console, execute the following command:

    /opt/UCMDB/DataFlowProbe/bin/ProbeGateway.sh console

    Note:  

    • In order for the Probe to connect to the application server, the application server must be fully started.

    • On Linux, the user running the Probe service must be a member of the Administrators group.

    • The Probe installed on Windows is displayed in UCMDB in the Data Flow Management module, under Data Flow Probe Setup > <Domain> > Probes.

    • A Probe installed on Linux is displayed when creating a new integration point in the Data Flow Management Integration Studio. For details, see the section describing how to create integration points in the Data Flow Management section of the UCMDB Help.

    • A Probe installed on Linux does not appear in the list of Data Flow Probes in the Data Flow Probe Setup window.

21. (Windows only, the first Probe only) If you selected to run the Probe Gateway and Probe Manager as two processes on separate machines, you must configure the Probe Gateway and Probe Manager components. For details, see Data Flow Probe - Configure the Database Scripts (Optional) below.

The following procedure explains how to install the Data Flow Probe on a Linux platform.

To install the Data Flow Probe:

1. Extract the package for the Linux platform, and then execute the following command:

   sh <path to the installer>/UCMDB_DataFlowProbe_11.0.xx.bin

   Caution: Console mode is not supported.

   The following commands are executed:

   Preparing to install...
   Extracting the JRE from the installer archive...
   Unpacking the JRE...
   Extracting the installation resources from the installer archive...
   Configuring the installer for this system's environment...

   Launching installer...

2. When the initial process is complete, the splash screen opens. Choose the locale language and click OK.

3. The Introduction page opens. Click Next.

4. The License Agreement page opens.

   Accept the terms of the end-user license agreement and click Next.

5. The Select Installation Folder page opens.

   Accept the default installation folder, opt/UCMDB/DataFlowProbe, or click Choose to select a different installation folder.

   Note:  

   • You can change the location of the installation, but the folder must be located under /opt/.
   • If you selected a different folder and you want to restore the default installation folder, click Restore Default Folder.
   • When installing the probe using a non-root account, the default installation folder is /home/<account_name>/UCMDB/DataFlowProbe.

   Click Next.

6. The Data Flow Probe Configuration page opens, enabling you to configure the details of the application server to which the Data Flow Probe will report.

   • Under Application to report to select Universal CMDB and in the Application Server address box, enter the name or the IP address of the UCMDB server with which the Probe is to connect.

     Note: In a High Availability environment, use the Writer virtual IP address of the load balancer.

   • In the Data Flow Probe address box, enter the IP address or DNS name of the machine on which you are currently installing the Probe, or accept the default.

     Note: If the Data Flow Probe machine has more than one IP address, enter a specific IP address, and not the DNS name.

     Click Next.

     Note: If you do not enter the address of the application server, or if there is no TCP connection to the application server via default ports (8080,8443,80) (possibly because the application server has not fully started yet), a message is displayed. You can choose to continue to install the Probe without entering the address, or return to the previous page to add the address.

7. A second Data Flow Probe Configuration page opens, enabling you to configure an identifier for the Probe.

   • In the Data Flow Probe Identifier box, enter a name for the Probe that is used to identify it in your environment.

     Note: The Probe identifier is case sensitive, must be unique for each Probe in your deployment, and it must not exceed 50 characters.

   • Select Use Default CMDB Domain to use the default UCMDB IP address or machine name, as defined in the UCMDB Server installation.

     The Default UCMDB Domain is also configurable in UCMDB's Infrastructure Settings module (Administration > Infrastructure Settings > Class Model Settings > Default Domain Property Value). For details, see the Administer section of the UCMDB Help.

   Click Next.

8. If you cleared the Use Default CMDB Domain box in the previous step, the UCMDB Data Flow Probe Domain Configuration page opens.

   • Data Flow Probe domain type. Select the type of domain on which the Probe is to run:

     • Customer. Select this option if you are installing one or more Probes in your deployment.

       Note: Always use this option for new installations.

     • External. Select this option for upgraded systems.

   • Data Flow Probe domain. If you are not using the default domain defined in UCMDB enter the name of the domain here.

     Note: For external domains, this value must be identical to the Data Flow Probe Identifier defined in the previous step.

   Click Next.

9. The UCMDB Data Flow Probe Memory Size page opens.

   Define the minimum and maximum memory, in megabytes, to be allocated to the Probe.

   Note: For information about changing the maximum heap size value at a later point in time, see the Data Flow Management section of the UCMDB Help.

   Click Next.

10. The PostgreSQL Account Configuration page opens.

    The PostgreSQL Data Flow Probe account is used by the Data Flow Probe to connect to the PostgreSQL database. This account is less privileged compared to the PostgreSQL root account. Its password is encrypted in the DataFlowProbe.properties configuration file.

    Enter the password for the PostgreSQL Data Flow Probe account and enter it a second time for confirmation.

    Note: Changing this password requires an update to the DataFlowProbe.properties file.

    Click Next.

11. A second PostgreSQL Account Configuration page opens where you configure the PostgreSQL root account. The PostgreSQL root account is the account used to administer the PostgreSQL database. When set, it may need to be provided while executing scripts under the Probe's installation.

    Enter the password for the PostgreSQL Data Flow Probe account, and enter it a second time for confirmation.

    Note: Changing the root account password does not affect operation of the Probe.

    Click Next.

12. The Configuration for System Administrator Password page opens.

    Enter the password for the sysadmin account.

13. The Account Configuration for Uploading Scan Files page opens.

    Enter the user name and password for this account, and enter the password a second time for confirmation. The default user name is UploadScanFile.

    Click Next.

14. The Pre-Installation Summary page opens. Review the selections you have made and click Install to complete the installation of the Probe.

    Note: When installing the probe using a non-root account, you may see a popup message window indicating "Manual Probe Registration Required".

    Make sure you register the probe service manually using a root account after the installation by running the registerService.sh script from the /home/<account_name>/UCMDB/DataFlowProbe/tools directory.

15. When installation is complete the Installation is Complete page opens.

    Note:  

    • Any errors occurring during installation are written to the following log:

      /opt/UCMDB/DataFlowProbe/UCMDB_Data_Flow_Probe_InstallLog.log. If you installed the Probe to another directory under /opt/, the log file is located there.

    • Any database-related errors occurring during installation are written to the following log:/opt/UCMDB/DataFlowProbe/runtime/log/postgresql.log
    • When installing the probe using a non-root user account, the default probe folder is /home/<account_name>/UCMDB/DataFlowProbe.

    Click Done.

    Note: After installing the Probe, we recommend disabling virus scanning on the main directory that is used to store your PostgreSQL table data. The default directory is /opt/UCMDB/DataFlowProbe/pgsql/data.

16. (Non-root user account only) Register the probe manually using a root account.

    Log in to the Linux system using a root account, go to the /home/<account_name>/UCMDB/DataFlowProbe/tools directory and run the registerService.sh script:

    sh /home/<account_name>/UCMDB/DataFlowProbe/Tool/registerService.sh <your password>

17. Activate the Probe.

    Note:  

    • The root user running the Probe service must be a member of the Administrators group.

    • In order for the Probe to connect to the application server, the application server must be fully started.

    • Root user can run the probe service for all probes; non-root user can only run the probe service for the probes installed using the non-root user account.

    Execute the following command:

    /opt/UCMDB/DataFlowProbe/bin/ProbeGateway.sh start

    Note: For non-root user account, execute the following command:

    /home/<account_name>/UCMDB/DataFlowProbe/bin/ProbeGateway.sh start

    To activate the Probe in a console, execute the following command:

    /opt/UCMDB/DataFlowProbe/bin/ProbeGateway.sh console

    Note: For non-root user, execute the following command:

    /home/<account_name>/UCMDB/DataFlowProbe/bin/ProbeGateway.sh console

    Tip:  

    • A Probe installed on a Linux machine is displayed when creating a new integration point in the Data Flow Management Integration Studio. For details, see the section describing how to create integration points in the Data Flow Management section of the UCMDB Help.
    • The Linux Probe does not appear in the list of Data Flow Probes in the Data Flow Probe Setup window.

The installer supports the product installation with no user interaction. This mode is useful for running the installation via automation tools or for running the installation on Linux when no GUI access is possible on the target server.

Install Data Flow Probe 11.0

1. Download UCMDB_DataFlowProbe_11.0.xxx.bin, then run the following command:

   chmod a+x UCMDB_DataFlowProbe_11.0.xxx.bin

2. Prepare the response file

   To produce the response file, execute the installer with the -r command line switch:

   <Probe installer file name> -r <Directory for response file> 

   Note: Instead of the directory name, you can also specify the complete file name for the response file, for example, C:\temp\ResponseFileForProbe.txt:

   UCMDB_DataFlowProbe_11.0.xxx.exe –r C:\temp\ResponseFileForProbe.txt 

   ./UCMDB_DataFlowProbe_11.0.xxx.bin –r /tmp/ResponseFileForProbe.txt

   Once executed, follow the user interface installation wizard to complete the installation, and the response file ResponseFileForProbe.txt will be stored in the directory specified in the -r switch.

   Note:  

   • The response file contains a number of NAME=VALUE pairs, one on each line of the file. The lines containing comments start with the # character. You can edit the content of the file to provide an alternative configuration that needs to be used for the unattended installation. For example, you can customize the target installation directory as well as other settings.

   • The file needs to be in the following character encoding:

     UTF-8 without BOM (Byte Order Mark) or UTF-16 little endian

     UTF-8 without BOM

   • If you have no GUI access, you can find a test machine with GUI access and produce the response file, then copy the generated response file to the Linux machine where you want to execute silent installation of Data Flow Probe.

3. Execute the silent installation

   <Probe installer file name> -i silent –f <Response File path and name>

   For example:

   UCMDB_DataFlowProbe_11.0.xxx.exe –i silent –f C:\temp\ResponseFileForProbe.txt

   ./UCMDB_DataFlowProbe_11.0.xxx.bin –i silent –f /tmp/ResponseFileForProbe.txt

4. Start the Data Flow Probe

The table below lists the Data Flow Probe database scripts. These scripts can be modified for administration purposes, both in Windows and Linux environments.

When the Probe Manager and Probe Gateway run as separate processes on two machines, set up the Data Flow Probe as follows:

1. Set up the Probe Gateway machine.

   1. Open the following file:

      C:\UCMDB\DataFlowProbe\conf\probeMgrList.xml

   2. Locate the line beginning <probeMgr ip= and add the Manager machine name or IP address, for example:

      <probeMgr ip="OLYMPICS08">

   3. Open the following file:

      C:\UCMDB\DataFlowProbe\conf\DataFlowProbe.properties

   4. Locate the lines beginning appilog.collectors.local.ip = and appilog.collectors.probe.ip = and enter the Gateway machine name or IP address, for example:

      appilog.collectors.local.ip = STARS01
      appilog.collectors.probe.ip = STARS01

2. Set up the Probe Manager machine.

   In C:\UCMDB\DataFlowProbe\conf\DataFlowProbe.properties:

   1. Locate the line beginning appilog.collectors.local.ip = and enter the Manager machine name or IP address, for example:

      appilog.collectors.local.ip = OLYMPICS08

   2. Locate the line beginning appilog.collectors.probe.ip = and enter the Gateway machine name in uppercase, for example:

      appilog.collectors.probe.ip = STARS01

3. Start the services.

   1. On the Probe Manager machine, start the Manager service:

      Start > All Programs > UCMDB > Start Data Flow Probe Manager

   2. On the Probe Gateway machine, start the Gateway service:

      Start > All Programs > UCMDB > Start Data Flow Probe Gateway

You can connect a Data Flow Probe to a customer that is not the default customer. The default customer ID is 1.

1. Open the following file in a text editor:

   • C:\UCMDB\DataFlowProbe\conf\DataFlowProbe.properties

   • ../DataFlowProbe/conf/DataFlowProbe.properties

2. Locate the customerID entry.

3. Update the value with the customer ID, for example, customerId = 2.

4. Restart the Probe so that it is updated with your changes.

The Probe reports its version when connecting to the server. The Probe version is displayed in Data Flow Management, in the Details pane of the Data Flow Probe Setup module. If the Probe version is not compatible with the server version (and there is no supported upgrade), an error is generated and the Probe is forced to shut down.

When you apply a new Cumulative Update Patch (CUP) to the UCMDB Server, the Probes do not shut down automatically, and are able to report new data to the server. However, this is not recommended. Therefore, when you apply a CUP to the server, you must also apply it to the Probes—either manually or automatically.

Probe Downgrade or Rollback

Automatic downgrade or rollback of the probe version is not supported. To perform downgrade or to rollback a version upgrade, uninstall the probe and then install the required version.

Probe Restart

There are several situations where the Probe automatically restarts itself. For example, when deploying a new Content Pack or applying a CUP. In these cases, the Probe waits for 15 minutes to allow the running jobs to finish, and only then shuts down. Jobs that did not finish in that time (for example, long integrations) start running again when the Probe restarts.

How to Change the PostgreSQL Database Default Port

To change the port for the PostgreSQL database, that is defined by default in the Data Flow Probe installation:

1. Stop the Probe (if already started).

2. Stop the UCMDB Probe DB Service.

3. Modify the port in the following file:

   • C:\UCMDB\DataFlowProbe\pgsql\data\postgresql.conf
   • /opt/UCMDB/DataFlowProbe/pgsql/data/postgresql.conf

   The following shows how to change the port from 5432 to 5433:

   Note: If two probes coexist on the same machine, plan the port usage carefully so that the ports used by the two probes do not conflict.

   #port = 5432 # (change requires restart) < Old line

   port = 5433 # (change requires restart) < New line

4. Make the following changes in the DataFlowProbe.properties file (in C:\UCMDB\DataFlowProbe\conf on Windows, and /opt/UCMDB/DataFlowProbe/conf on Linux):

   • Change:

     jdbc:postgresql://localhost/dataflowprobe

     to

     jdbc:postgresql://localhost:5433/dataflowprobe

   • Change:

     appilog.agent.local.jdbc.uri = jdbc:postgresql://localhost/dataflowprobe

     to

     appilog.agent.local.jdbc.uri = jdbc:postgresql://localhost:5433/dataflowprobe

   • Change:

     appilog.agent.normalization.jdbc.uri = jdbc:postgresql://localhost/dataflowprobe

     to

     appilog.agent.normalization.jdbc.uri = jdbc:postgresql://localhost:5433/dataflowprobe

   • Change:

     appilog.agent.netflow.jdbc.uri = jdbc:postgresql://localhost/dataflowprobe

     to

     appilog.agent.netflow.jdbc.uri = jdbc:postgresql://localhost:5433/dataflowprobe

This section contains the following:

• Data Flow Probe Upgrade Overview
• Data Flow Probe Auto Upgrade Overview
• Data Flow Probe Auto Upgrade Workflow
• Data Flow Probe Manual Upgrade Workflow

Data Flow Probe Upgrade Overview

When upgrading Data Flow Probes, you have the following options:

• Data flow probe auto upgrade. For supported probes of version 10.22 or later (with or without a CUP, union and non-FIPS mode on Windows machine), you can select the Automatically update Data Flow Probe with the new version option in the Install Data Flow Probe wizard page when upgrading the UCMDB server to perform auto upgrade of connected probes. For more information, see Data Flow Probe - Unattended Silent Installation.

• Data flow probe manual upgrade. In the following scenarios, you may need to perform manual upgrade of data flow probes:

  • You selected the Update the Data Flow Probe manually option in the Install Data Flow Probe page of the UCMDB server upgrade wizard while upgrading the UCMDB server.

  • For probes on Linux or probes of versions not supported for auto upgrade in your environment, you need to manually uninstall the old version probe first, and then install the latest version probe.

Data Flow Probe Auto Upgrade Overview

The Data Flow Probe auto upgrade mechanism is fully available since version 10.33. That is, once UCMDB server is upgraded to version 10.33 or later, the probe auto upgrade capability is in place. This capability enables you to upgrade all the connected probes of version 10.22 (or later, with or without a CUP) in your environments with just several clicks while upgrading UCMDB server, without having to access the probe servers anymore.

Compared to the traditional manual probe deployment approach (uninstall the old probe and then install the new probe), in general it takes 20-40 minutes to upgrade multiple probes in parallel with the probe auto upgrade mechanism.

The time required for upgrading all the connected probes equals to that of the probe that takes the longest duration to finish upgrade among all the connected probes. The network latency would be a impact factor, which has impact on the time the probe downloads resources from the UCMDB Server. Micro Focus lab testing shows the following results: A total of 60 connected probes finished upgrade in 40 minutes, while the majority of them finished around 20-30 minutes with network latency less than 1 millisecond.

Supported Probes

Data Flow Probes that satisfy the following criteria are supported for auto upgrade:

• Supported probe versions. The probe auto upgrade and deployment mechanism supports upgrading probes from any of the following versions to version 11.0 automatically:

  • 10.22 (with or without a CUP)
  • 10.3x
• Union and non-FIPS mode probes on Windows machine

The following probes are not supported for auto upgrade in version 11.0:

• FIPS mode probes
• Separate mode probes
• Probes on Linux machine

• Integration service

• Two probes installed on a same Windows machine

Data Flow Probe Auto Upgrade Workflow

The Data Flow Probe Auto Upgrade workflow contains the following steps:

1. The UCMDB Administrator upgrades UCMDB server from version 10.22 (or later, with or without a CUP) to version 11.0.

   During the upgrade, the Administrator selects the Automatically update Data Flow Probe with the new version option. As a result, the probe auto upgrader package is placed under the <UCMDB_Server>\content\probe_patch folder, and the Data Flow Probe installer package is placed under the <UCMDB_Server>\content\probe_installer folder.

   

2. The probe auto upgrader performs the following operations:

   1. Performs pre-check to decide if the probe is ready for upgrade. For example, if there is enough disk space available or not, and if the probe is of a supported version.
   2. Generates the response file required for silent installation.

   3. Downloads the Data Flow Probe installer file for Windows platform (for example, UCMDB_DataFlowProbe_11.0.exe) from the UCMDB server.

   4. Stops the following services:

      • UCMDB_Probe
      • UCMDB_Probe_DB
      • UCMDB_Probe_XmlEnricher

   5. Performs silent installation with the Update option.

      During this step, the upgrader performs post-upgrade tasks, including merging customized settings, creating and adjusting database tables, such as splitting tables (version 10.22 to version 11.0), columns, indexes, and so on.

   6. Starts all three services after the installation is done: UCMDB_Probe, UCMDB_Probe_DB, and UCMDB_Probe_XmlEnricher.

   7. Reports probe upgrade status to the UCMDB server, and save probe auto upgrade logs to UCMDB Server. For example: <UCMDB_Server>\runtime\log\probeUpgradeLogs\10.22to11.0\success.

      Note: If the upgrade is successful, the log would be placed under the success folder; if failed, the logs would be placed under the failed folder.

Data Flow Probe Manual Upgrade Workflow

• For probes that are supported by the probe auto upgrade mechanism, do either of the following:

  Important: There is no need to uninstall the old version probes first for probes supported by the probe auto upgrade mechanism.

  • Perform probe auto upgrade from UCMDB server.

    To leverage the probe auto upgrade feature after the UCMDB server upgrade, then when you have finished upgrading the UCMDB server,

    1. Go to the <UCMDB_Server>\content\probe_patch directory.
    2. Copy the probe-patch-11.0-windows.zip package to the <UCMDB_Server>\runtime\probe_upgrade directory.

    3. Restart the UCMDB server.

       UCMDB server will then perform auto upgrade of all supported and connected probes.

  • Perform manual upgrade of probes on the probe servers.

    1. Extract the package for the Windows platform, and then launch the probe installer UCMDB_DataFlowProbe_11.0.exe.

    2. On the UCMDB Data Flow Probe Setup Type wizard page, select Full Data Flow Probe Installation. This installs the Data Flow Probe with all its components, including the Inventory Tools (Analysis Workbench, Viewer, SAI Editor, and MSI Scanner) required for application teaching.
    3. On the Select Installation Type wizard page, select Upgrade.
    4. Follow wizard instructions to complete the probe upgrade.

    For details, see Data Flow Probe - Manual Windows Upgrade.

• For probes on Linux or probes of versions not supported for auto upgrade in your environment, perform manual install of probes on the probe servers.

  This workflow contains the following steps:

  1. On the probe server, uninstall the old version probe.

     For details, see the "Upgrading UCMDB - Uninstall the Data Flow Probes" section in the Deployment Guide.

  2. Install the latest version Data Flow Probes manually.

     On Windows platform:

     1. Extract the package for the Windows platform, and then launch the probe installer UCMDB_DataFlowProbe_11.0.exe.

     2. On the UCMDB Data Flow Probe Setup Type wizard page, select Full Data Flow Probe Installation.

     3. On the Select Installation Type wizard page, select New Installation.
     4. Follow wizard instructions to complete the probe installation.

     For details, see Data Flow Probe - Windows Installation.

     On Linux platform:

     1. Extract the package for the Linux platform, and then execute command to launch the installation.

     2. Follow the on-screen instructions to complete the probe installation.

     For details, see the Data Flow Probe - Linux Installation.

1. Check permissions for the user account that starts the Data Flow Probe service.

   • Make sure you grant the user full control of the <DataFlowProbe> folder before the upgrade, and revert the control after the upgrade.
   • If the UCMDB_Probe and the UCMDB_Probe_DB services run under a custom account, make sure you grant the custom account full control of the <DataFlowProbe> folder before the probe auto upgrade starts, and revert the control after the upgrade.

   For details, see "Troubleshooting Probe Upgrade > Permission Check".

2. Turn off Basic Authentication (BA) if it is enabled.

   Check if Basic Authentication (BA) is enabled. If yes, turn off Basic Authentication via the UCMDB UI:

   1. Log in to UCMDB as an administrator, and then go to Administration > Infrastructure Settings Manager.

   2. Locate the Enable Basic Authentication for HTTP connections from probe setting, and then set the value to False.

   3. Restart UCMDB server.

3. Check communication port between UCMDB Server and Data Flow Probe.

   1. Launch the UCMDB server JMX console (default username: sysadmin).
   2. Locate the getComponentConfiguration JMX method from the UCMDB:service=Ports Management Services category.
   3. In the Value field for componentName, enter mam-collectors and click Invoke.

   4. Check the Current Mapped Ports value in the returned result.

      • HTTP. (For version 10.2x only) It means UCMDB Server and Data Flow Probe communicate via the HTTP protocol. You need to change the HTTPS protocol to HTTP protocol after upgrading UCMDB Server and Data Flow Probe. For details, see "How to Enable HTTP Communication for UCMDB Server" in the Administer section of the UCMDB Help (make sure you replace the HTTPS-related values with HTTP related values).
      • HTTPS. It means UCMDB Server and Data Flow Probe communicate via the HTTPS protocol. You do not need to change the Current Mapped Ports after the upgrade.
      • HTTPS_CLIENT_AUTH. It means UCMDB Server and Data Flow Probe communicate by mutual (two-way) certificate authentication. You do not need to change the Current Mapped Ports after the upgrade.

4. Check available disk space.

   Check available disk space of the probe installation folder. At least 10 GB disk space is required to perform the probe auto upgrade.

5. Check probe status.

   Log in to the UCMDB server UI, and navigate to Data Flow Management > Data Flow Probe Setup, check the Domains and Probes navigation pane. Only connected probes of supported versions can be upgraded automatically.

6. Check probe versions to ensure the probes you plan to upgrade are supported.

   For probe versions supported by the auto upgrade mechanism, see "Supported probe versions" in Data Flow Probe - Upgrade Overview.

7. Back up the <DataFlowProbe> folder.

8. Also make sure that:

   • all Data Flow Probe related command line windows and probe related folders are closed. Otherwise automatic backing up of those folders and files may fail as they are occupied.
   • ports 5436 and 5437 are free, as these two ports will be used during the probe upgrade.
   • stop the UCMDB_Probe and UCMDB_Probe_DB services.

9. And you are aware of the following:

   • For version 10.22 probes (with or without a CUP), the probe upgrade includes the PostgreSQL database , data, and the probe. (Probes of version 10.30 or later are already using the latest version of PostgreSQL).

   • For probe auto upgrade, the probe upgrader will merge the following configuration files:

     • DataFlowProbe.properties
     • DataFlowProbeOverride.properties (If exists)

     The result is that all the custom configuration settings will be written into the DataFlowProbeOverride.properties file.

     Note:  

     • The recommended value of the appilog.agent.probe.sendtouchResultsToServer.maxObjects setting in DataFlowProbe.properties for version 10.33 is 500. So if your value is greater than 500, it will be modified to 500.
     • During the upgrade, the probe installer backs up all your existing probe data and configuration to the <DataFlowProbe>\old folder. If you need to recover any old data, just go to <DataFlowProbe>\old folder.

     • During the upgrade, Micro Focus does not keep the configuration files for <DataFlowProbe>\pgsql\data\postgresql.conf, so make sure you reconfigure it after the upgrade (if necessary).

To manually upgrade the Data Flow Probe on Windows:

1. Extract the package for the Windows platform, and then double-click UCMDB_DataFlowProbe_11.0.exe.

2. A progress bar is displayed. After the initial process is complete, the splash screen opens. Choose the locale language and click OK.

3. The Introduction page opens. Click Next.

4. The License Agreement page opens.

   Accept the terms of the end-user license agreement and click Next.

5. The UCMDB Data Flow Probe Setup Type page opens.

   Select Full Data Flow Probe Installation. This installs the Data Flow Probe with all its components, including the Inventory Tools (Analysis Workbench, Viewer, SAI Editor, and MSI Scanner) required for application teaching.

   Note: The Inventory Tools option is used to install only the Inventory Tools. For details about application teaching, see the Data Flow Management section of the UCMDB Help.

   Click Next.

   Note: If an existing Data Flow Probe is detected, a prompt pops up asking you if you would like to install a second Data Flow Probe. Click OK to proceed, or click Cancel to exit the installation.

6. The Select Installation Type page opens.

   Select Upgrade and click Next.

   Note: Select New Installation if you are installing a new probe.

7. The Select Installation Folder page opens.

   Accept the default installation folder, C:\hp\UCMDB\DataFlowProbe, or click Choose to select a different installation folder for the existing probe.

   Note: To restore the default installation folder, after selecting a different folder, click Restore Default Folder.

8. The Pre-Installation Summary page opens.

   Review the selections you have made and click Install to complete the probe upgrade.

9. When the installation is complete, the Install Complete page opens.

   Click Done.

10. Start the Probe by using one of the following methods:

    Click Start > All Programs > UCMDB > Start Data Flow Probe.

    To start the Probe from the console, at the command prompt execute the following script:

    <DataFlowProbe_InstallDir>\bin\gateway.bat console

    For example, C:\hp\UCMDB\DataFlowProbe\bin\gateway.bat console.

• (Version 10.30 and earlier only) If UCMDB Server and Data Flow Probe communicate via the HTTP protocol before the upgrade, then after the upgrade, you need to enable HTTP communication on the UCMDB server.

  For details, see "How to Enable HTTP Communication for UCMDB Server""How to Enable HTTP Communication for UCMDB Server" in the Administer section of the UCMDB Help.

• Enable Basic Authentication

  If you disabled the Basic Authentication as described in Data Flow Probe - Pre-Check List for Upgrade, you can enable it after all probes are upgraded successfully.

1. Probe version and status: Probe version has changed to the new version.

   1. Log in to the UCMDB server UI, and go to Data Flow Management > Data Flow Probe Setup.

   2. Check the details pane for each probe.

      If the probe has been successfully upgrade, the Status should display Connected, and the Version should show the new version information.

2. Check the probe auto upgrade log file in UCMDB server's success folder

   To check if a probe has been upgraded successfully, you can:

   • Check the probe_auto_upgrade.log file (in the C:\UCMDB\DataFlowProbe\runtime\log\probeUpgradeLogs folder), if the probe is upgraded successfully, you should be able to see the following message in the log file:

     Finished probe upgrade. Probe has been upgraded to [version] [Build]. Probe auto upgrade agent will exit.

   • Check the success folder in UCMDB server.

     The log files shows as <domain_name>_<probename>_auto_upgrade.log in the <UCMDB_Server>\runtime\log\probeUpgradeLogs\<source_version>to<target_version>\success folder. For example, <UCMDB_Server>\runtime\log\probeUpgradeLogs\10.22to11.0\success. The log files in the success folder indicate the probes that have been successfully upgraded.

     For more details about the probe_auto_upgrade.log file, see "Data Flow Probe Log Files" in the Data Flow Management section of the UCMDB Help.

3. Run some basic jobs.

   Run IPs by ICMP job via the connected probe, the job should run successfully.

1. Probe version and status: Probe version remains the old version,

   • The Status shows Connected. This indicates the probes are not broken. In this case, if the upgrade fails, the probe upgrader will try to recover the probe to its old version.
   • The Status shows Disconnected. This indicates the probes are broken. If the upgrade fails, you need to perform troubleshooting by following the instructions in .

2. Probe upgrade log file in the failed folder on UCMDB server.

   1. Go to <UCMDB_Server>\runtime\log\probeUpgradeLogs\<source_version>to<target_version>\failed folder. For example, <UCMDB_Server>\runtime\log\probeUpgradeLogs\10.22to11.0\failed.

   2. Check the <domain_name>_<probename>_auto_upgrade.log files.

      The log files in the failed folder indicate probes with upgrade failure. Open each upgrade log and check the error messages.