How to migrate OnCommand Core Package (DFM) servers?

[MARIKOTAGAWA]

Hi,

I'm in the process of migrating OnCommand Core (DFM) from a VM server (Server_A) to another VM server (Server_B) since Server_A is used for other monitoring service from other team.

I've just installed OnComand Core package 5.1 on Server_B and setup administrators login. The OnCommand version on Server_A is 5.02. I can downgrade to 5.02 on Server_B, if necessary.

My goal is to transfer all performance historical data on Server_A to Server_B. And if possible I want to migrate all filers' info (IP address, hostname etc) from Server_A to Server_B.

Is it possible? I looked at dfm commands. If I run "dfm backup create server_A_backup" on Server_A then copy the file to Server_B. And then run "

dfm backup restore server_A_backup" on the Server_B, the original DB is migrated to Server_B?

If you have any comments or suggestion, I appreciate.

Thank you in advance.

Mariko

----------------------------------------------------------------------------------------------

NAME

    backup -- manage backup copies of the database

SYNOPSIS

    dfm backup create [ -t <backup-type> ] [ -e ] [ -p passphrase-file ] [ -n ] [ [ -f ] backup-name | backup-path ]

    dfm backup restore [ -k ]  [ -p passphrase-file ] [ -n ] [-T restart-timeout] { backup-filepath | backup-name }

  ----------------------------------------------------------------------------------------------

[ppavagad · Accepted solution]

Hi Mariko,

You are right. Here is the procedure:

• Run the command: dfm backup create
• This creates a backup file (.ndb format) which is stored in the <install_dir>\Netapp\DataFabric Manager\DFM\data folder.
• Copy the .ndb file to the new server.
• Run the command: dfm backup restore <backup file-name with location>

Please revert back if you have further queries.

Thanks & Regards,

Pavan

[arunchak]

HI,

You need not downgrade serverB. Just backup from ServerA, transfer the ndb file to serverB and restore the db on serverB.

Thanks,

  Arun

[adaikkap]

Hi Mariko-san,

               I suggest you rather install version 5.2RC1 on server B, as it would be a GA candidate in couple of weeks.

You would need to change/update the following if the server B's Hostname and IP address will be different than server A and if you have configured the following

1. SnapManagers Integration with Protection Manager
2. SNMP trap hosts configured in ONTAP/Filer
3. Third party trap host configure to receive SNMP traps from OCUM.
   

Regards

adai

[MARIKOTAGAWA]

Hi, Pavan. thanks so much for the confirmation of the dfm command usage. I'll try the backup and restore.

I'll let you know if I have further questions.

Mariko

[MARIKOTAGAWA]

Thanks  Arun.

[MARIKOTAGAWA]

Hi, adai.

Thanks for the info. I have setup SNMP traps in the original DFM so I must need to modify that part.

I have an additional question.

If I migrate the DB from the original DFM to the new one, LDAP info in the original DFM will be imported to the new DFM?  I use the same LDAP server for user authenticaion. To setup the LDPA authentication, I have to get an LDAP server admin to setup it in the DFM. If I can import it, no need to bother him. He is a nice guy but if I don't need to ask him, I don't want to.

Mariko

[adaikkap]

Hi Mariko-san,

Hi, adai.
Thanks for the info. I have setup SNMP traps in the original DFM so I must need to modify that part.

Yes if required, due to change of IP address or hostname of the DFM server.

I have an additional question.
If I migrate the DB from the original DFM to the new one, LDAP info in the original DFM will be imported to the new DFM?  I use the same LDAP server for user authenticaion. To setup the LDPA authentication, I have to get an LDAP server admin to setup it in the DFM. If I can import it, no need to bother him. He is a nice guy but if I don't need to ask him, I don't want to.

You don't need to do anything new unless there is connectivity between the new DFM server and your LDAP server.

Regards

adai

[MARIKOTAGAWA]

Hi, all. I need you guys help.

I backed up the DB on Server_A then restore it on Server_B.

The operation was successful without any errors.

But when I restarted dfm services on Server_B and tried to login to http://<Server_B>:8080/start.html or http://<Server_B>:8080/dfm/,

I got the following error. I restarted services again and checked the files and directories permission etc.

-----------------------------------------------

Internal Server Error

The server encountered an internal error or misconfiguration and was unable to complete your request.

Please contact the server administrator, root@localhost and inform them of the time the error occurred, and anything you might have done that may have caused the error.

More information about this error may be available in the server error log.

Apache/2.2.21 (Unix) mod_ssl/2.2.21 OpenSSL/1.0.0e Server at 127.0.0.1 Port 80

-----------------------------------------------

I found the below errors in dfm.log. Do you know what I missed ?

Jul 02 08:01:12 [dfm: INFO]: [18289:0x2acd4261d640]: Started watchdog service (pid 23569).

Jul 02 08:01:52 [dfm:ERROR]: [13006:0x2b1ac560e640]: Error opening the keystore: 13

Jul 02 08:01:52 [dfm:ERROR]: [13006:0x2b1ac560e640]: Unable to load keystore.

Jul 02 08:02:00 [dfm:ERROR]: [16286:0x2b2d3a7a3640]: Error opening the keystore: 13

Jul 02 08:02:00 [dfm:ERROR]: [16286:0x2b2d3a7a3640]: Unable to load keystore.

Jul 02 08:02:11 [dfm:ERROR]: [16501:0x2b4e938e6640]: Error opening the keystore: 13

Jul 02 08:02:11 [dfm:ERROR]: [16501:0x2b4e938e6640]: Unable to load keystore.

[peter_lehmann]

One thing that is not ported over with the DB restore is the SLL Config/Certificates...

Try to run this command: dfm ssl server setup

This recreates the certificates.

Hope this helps,

Peter

[adaikkap]

Hi Mariko-san,

                 This looks like some issue with the encryption keys. I suggest you open a case with netapp support. You can also try what peter said, but that is more with respect to certificates and not keys.

also you can you paste the error message from error.log ?

Regards

adai

[MARIKOTAGAWA]

Thanks Peter and all.

Actually the command dfm ssl server setup ended up fail but I got a hint from your comment.

I checked and compared the files under /opt/xxx/conf/keys/  between Server_A and Server_B.

[E3][root@Server_A keys]# ls -la

drwxr-xr-x 5 root root 4096 Feb 28 02:21 .

drwxrwxr-x 3 root root 4096 Feb 28 02:21 ..

drwxr-xr-x 2 root root 4096 Feb 28 02:21 certs

-rw-r--r-- 1 root root  150 Feb 28 02:17 dfmenc.keys  <--- Permission 644

drwxr-xr-x 2 root root 4096 Feb 28 02:21 private_keys

drwxr-xr-x 2 root root 4096 Feb 28 02:21 truststore

[root@Server_B keys]# ls -la

drwxr-xr-x 5 root root 4096 Jul  2 07:52 .

drwxrwxr-x 3 root root 4096 Jul  3 01:11 ..

drwxr-xr-x 2 root root 4096 Jul  2 06:28 certs

-rw------- 1 root root  150 Jul  2 06:38 dfmenc.keys    <----- permission 600

drwxr-xr-x 2 root root 4096 Jul  2 06:28 private_keys

drwxr-xr-x 2 root root 4096 Jul  2 06:29 truststore

[root@Server_B keys]# chmod 644 dfmenc.keys

I changed permission of dfmenc.keys to 644. then I successfully login to the new server. Everything on the Server_A is migrated to Server_B.

Thank you so much for your help!

Mariko

[adaikkap]

Hi Mariko-san,

         Good to know that the issue got solved. But I would like to know how the permission of the dfm encyc key got changed ?

Do you have any idea how this could have happended ?

Regards

adai

[MARIKOTAGAWA]

Hi, Adai.

I'm not sure why the permission of dfmenc.keys was 600.

I found dfmenc.keys.0 file existing under /opt/xxx/conf/keys. The permission was 644 while dfmenc.key  was 600.

It may be a hint.

Mariko

[adaikkap]

When we restore there is no change in the permissions of the folders. If it was 600 before then even that server should have encountered that problem right ?

Regards

adai

[MARIKOTAGAWA]

Adai,

I thing you are right.   I just restored the DB in server_B right after installing OnCommand from the scratch. So I'm not sure what permission it had before restoring in server_B.

Mariko