Tivoli Policy Driven Software Distribution (TPDSD) Quick Overview

General Comments
We have been hearing about this product since Pulse 2008. The idea was to target a product on the desktop segment rather than one the covers both the server and desktop markets. This was done as these are two different worlds when it comes to management. IBM was hearing from customers that they wanted a more hands-off approach to dealing with desktops, in other words “set and forget” (my term I just made up, so don’t blame IBM for this possible bad phrasing). This was also what other vendors have been doing in the desktop market.

I have been involved with the beta of this product since it was available and will cover a few components of the product.

During the beta, this product was known as DTM. At release, it was renamed to Tivoli Policy Driven Software Distribution (TPDSD), which at least let you know that it was policy driven, but seemed to state that it only did software distribution, which it does, but also does more. It looks like this could be renamed in the next release to Tivoli Endpoint Manager (TEM). Which may seem to be a better name to some, it is actually really confusing to others that have been involved with Framework as this was the name of the component that responsible for managing information regarding the endpoints. For the purposes of this blog, I will use the current name of TPDSD. Who knows, maybe it will change again before TEM comes out ;)

Operating System Support
With the first release of TPDSD, there is very limited support for just Windows on both the server and target. The server can run on Windows 2003 and 2008 on 32 or 64 bit. The agents are supported on Windows XP, Vista, 2003 (32/64), 2008 (32/64).

The next release is supposed to have more support for both the servers and agents. There is even talk of MacOS support.

Agent Communications
In TPMfSW you were able to handle tasks to the targets using either RXA or the TCA. TPDSD only uses the agents for these tasks and the only time RXA is used is for the remote agent installation.

The great news is that the agent is now natively compiled, so no more JRE! The new agent is approx 30MB and that is the core agent and all other required support files.

Like TPMfSW, the agent also has various polling intervals. There are intervals for:
1. Checking local cached policies
2. Checking for new policies
3. Sending reports

All of these variables can be set at installation time or by an agent configuration policy.

What is a Policy?
The policies within TPDSD are what are used to do anything to an agent. If you want to install a piece of software, that is a policy. Scan the system, another policy. Configure the agent, you guessed it, a policy. When a policy is created, it is assigned to a target or a group of targets and will stay with that target until it is withdrawn or the machine is rebuilt.

Policies can be setup to either require or prohibit software from being installed. In order to require software to be installed, you need to first define the software to TPDSD and then define how the software is to be recognized on the target. For the recognition of software, there quite a few different ways that can be used to define how to detect software on a target.
1. If it is an MSI, you can define the GUID as the key. When importing an MSI, this is done automatically
2. If using a SPB, the state code is used when importing. This would take the name and version of the SPB and verify that it is in a successful install state on the target (IC--- for those familiar with TCM)
3. File existence – check for a specific file in a directory
4. Registry existence – check for a specific registry key

There are 35 different checks that can be done and multiple checks can be combined to determine if a product is installed or not. This can make the detection very flexible.

To prohibit software, you still need to create the software definition which would also define how to remove the software. The definition needs to exist so that the policy can be created and the uninstall instructions need to exist to actually do the removal.

Self Service Catalog
The self service catalog is a web interface that can be used be the client system to request the installation of software. The catalog contains a searchable section and a “Popular Software” section. The “Popular Software” could be something like a core set of products or free software that is allowed to be installed. This interface also allows the end user to remove software that is currently installed.

When the user requests software from the catalog, it is submitted and a new policy is created for the software to the specific target. This means that the agent will keep checking if the software is installed even after the initial request is completed.

The “set and forget” is the policy part of the product. You set a policy for a target, or group of targets, to have or not have software and the product takes care of maintaining the state of the target.

Integration with TPMfOSD
TPMfOSD is not included with TPDSD, but can be easily integrated using a couple global variables. It is very easy to include the TPDSD agent as a software module so that it will automatically be installed and connected with the TPDSD server. Once installed, the agent can be set to automatically install application or perform other configurations based on policies.

Conclusion
This product is looking really good and I cannot wait for the next release. Right now, due to the limited OS support and a few other things, it is not really ready for the primetime, and I do not believe that IBM is even stating that it is. It is really close and the concepts will continue from this version to the next. The next version will include much more OS support and I have heard of many new (and cool, as in good) features that people have been saying are missing. I do believe that this is a way better solution that has been designed from the ground up for the distributed environment, unlike TPMfSW, which will good, really was designed more for a datacenter.

Shameless Plug
Look for Gulf Breeze Software Partners at Pulse 2010. I will also be doing a presentation called “End to End computer management with Tivoli Policy Driven Software Distribution”. This session will be demoing the use of TPDSD along with TPMfOSD to perform a bare-metal install all the way to installing applications via polcy.

Hope to see you there!

How to find the GUID of an object in the TADDM GUI

The TADDM GUI only shows you a subset of the information that's stored in the database. The rest of the information can be found by accessing the database directly or using the command line ($COLLATION_HOME/dist/sdk/bin/api.sh). If you use the command line, the easiest way to get information about an object is if you have its GUID, with:

api.sh find [--depth num] --guid THE_GUID

but you need to get the GUID first. It's actually easy - just drag and drop an icon from the GUI into Notepad, and what you'll see will be similar to:

<DragInformation><Node><Name>SVC-2145-GYUR0XSVC01-IBM</Name><ClassName>com.collation.platform.model.topology.storage.StorageSubSystem</ClassName><SubType>com.collation.platform.model.topology.storage.StorageSubSystem</SubType><CollationType>topology.storage.StorageSubSystem</CollationType><ID>459DBBF7B68832D98A1C414EA1E5E2EF</ID><IconName>storagesub</IconName></Node></DragInformation>

The part in bold is the GUID. Easy as that.

Framework Monitoring in ITM

If you are looking to monitor Tivoli Framework from ITM, the best way is to develop an Universal agent or agent builder to pull framework metrics using your custom script. Needless to say, Framework provides a vast array of commands that can easily be scripted to get you the metrics you needed.



If you are looking to monitor basic server components such as TMR, ManagedNode, epmgr and gateways and if you are at Framework 4.3.1 or later, you are in luck. You don't even need to develop an MDL. Framework 4.3.1 provides a new component called tmfmon that provides necessary MDLs and commands that can be readily imported into Universal agent.



You need to take a look at $BINDIR/../generic/tmfmon/README file on how to implement this solution.

Some quick notes on CCMDB 7.2

These aren't clear or verbose at this point, but I wanted to get the info out to anyone who wants it:

TADDM 7.2 and CCMDB 7.2 are out now, and they seem to work just great.

The TADDM 7.1.1.5 -> 7.2 upgrade works amazingly well, tho it takes several hours if you have lots of data

Java 1.6_17 (the latest as of a couple of weeks ago) JRE doesn't work with the TADDM GUI. You need to use an older version (1.6_07 works like a champ).

New in TADDM 7.2 is an "explore" feature in a topology view. This lets you add additional relationships to a view. So you can right-click a machine and select "Explore", then select what relationships you want displayed, then you can select which other objects that are associated via those relationships will be displayed. Kinda nifty.

CCMDB 7.2 has a new CI topology view. This is a nice feature so you don't have to launch over to TADDM just to see topology info.

In CCMDB 7.2, the "Admin" workstation is no longer limited to just Windows - Linux is supported (so you can run the CCMDB Launchpad from a Linux machine).

SQLite Database

If you have been using CSV/flat file as a persistent storage for your scripts, you should really checkout, SQLite. It gives you the power of RDBMS while without the complexity that comes with it. Any SQLite database you create is nothing but a file. It provides locking, transaction support, joins, etc. With ".dump" command, it can generate the SQL commands to reproduce the whole schema.

Did I mention, this database format is supported by ActivePerl, by default? You can use the standard Perl DBI module to manage this database.

Also, there is a CLI tool called sqlite3 (~500K) that lets you run all database manipulation and SQL commands. And, if it is good enough for Google Android and Apple Safari, chances are it should be robust enough for my needs.

Here is a simple Perl script to access this database from Perl.

#!/usr/bin/perl

use DBI;

my $dbh = DBI->connect('dbi:SQLite:dbname=sample.db',',');

$sql = qq{ CREATE TABLE MYCERT ( num int not null, name varchar(20) ); };
$dbh->do($sql);
$sql = qq{ INSERT INTO MYCERT VALUES(1, 'ITM'); };
$dbh->do($sql);
$sql = qq{ INSERT INTO MYCERT VALUES(2, 'Omnibus'); };
$dbh->do($sql);

$dbh->disconnect();

To AB, or not to AB

If you are looking to develop custom monitoring solution in ITM, ITM gives you two options, viz. an eclipse GUI based Agent Builder tool or Universal Agent (UA). Which one would you choose? While the agent builder is shiny and easy to use, UA solution has its own advantages. Read on to know some of the pros and cons of each approach.

Agent Builder based solution makes sense for the following scenarios.

1) If you want to deploy something real quick and easy, then Agent Builder is a good candidate for your needs. Once you are familiar with the agent builder interface, you can create a custom monitoring agent literally in minutes. Moreover, there are not many typos/mistakes you can make with the Agent Builder's GUI based approach.

2) If you generally prefer GUI method over CLI methods, you will like Agent Builder more.

3) If you want to pull from data sources such as JDBC, WMI, NT Event Log, Service Control Manager, etc, then you should be build an agent builder agent with few clicks. UA will require lot of work as you may have write your own code to pull data from these data sources.

4) If you want to integrate the custom monitoring deployement with your current agent deployment methods, then obviously agent builder is the way to go. Deploying agent builder is very much the same as deploying any other agent.


Universal Agent based solution makes sense for the following scenarios.

1) If you want to minimize the number of agents you want to manage, then you are better of with UA. For example, if your requirement is to deploy 'n' custom monitoring solutions, typically agent builder would require 'n' agents, whereas in case of UA, one agent should be able to perform all 'n' monitoring activities.

2) Let me prefix this statement with a caveat. Check with your IBM representative for all licensing related information. Since one UA can handle multiple monitoring tasks, the licensing costs of UA based solution is typically lower than that of Agent Builder.

3) If you have been using UA for a long time, you can deploy the UA solution as quickly as an Agent Builder solution. More over, UA works pretty reliably.

4) If your monitoring requirements needs advanced summarization capabilities, then UA provides more advanced features than agent builder. Again, some of these tasks can be done using by modifying the itm_agent_toolkit.xml file, but it is just that the Agent Builder capabilities in this regard is not fully known yet.

Hope this information is helpful in your next custom monitor deployment.

Including Javascript functions in your BIRT reports

BIRT provides a very tight integration with Java/Java Script for customizing your reports. Most of the time, you embed your JavaScript within your reports and you have to modify each of the reports if something need to be changed.

However, there is a better way especially for some frequently used functions. You can put them in a .js file and re-use them across your reports. Here is how to do it.

1. Create a set of Java Script functions (such as for logging, modifying your queries, etc) and put it in a file. (e.g. GbsFunctions.js)

2. Save the file under somewhere under your resource directory, which can be set using Window->Preferences->Report Design->Resource->Resource folder within Eclipse. (e.g. resourcedir/GBS/scripts/GbsFunctions.js).

3. Now add the following XML tag to your XML source of the reports. Make sure that the XML you add doesn't result in malformed XML. (e.g. add just before <data-sources> tag).
<list-property name="includeScripts">
<property>GBS/scripts/GbsFunctions.js</property>
</list-property>

4. Now, you can access the functions listed in GbsFunctions.js within BIRT.

Hope you find this useful.

A great new draft Redbook is available

Integrating Tivoli Products

It's got lots of good information on integrating ITM, ITNM, TADDM, CCMDB, TBSM, etc., and is well worth the read.

ITNM 3.8 Running as SUID root on AIX 6.1 Requires GSKit 7.0.4.14

If you plan to install ITNM 3.8 on AIX 6.1 as a non-root user and have it run as SUID root (as opposed to having the processes actually run as root, which is your other option after you go through the install), you will need to install at least GSKit 7.0.4.11.

The reason I'm posting this is that you may unwittingly encounter these issues:

1. If you've already installed an ITM 6.2.1 agent on your AIX, you've got GSKit installed, but it's the wrong version. The version included with ITM 6.2.1 is 7.0.3.18. This version will cause several of the ITNM processes to fail.

2. ITNM actually ships with the correct GSKit libraries, but it simply copies those libraries to your AIX machine underneath your ITNM install location. So you might think that you can just set your LIBPATH environment variable to use these GSKit libraries. HOWEVER, you would be wrong - when a process is running as SUID root on AIX, the ONLY directories it searches for necessary libraries are those that are HARD-CODED into the binary! You can see this library path for any binary with the command 'dump -Hv executable_file_name'.

3. If you choose to run ITNM as root (rather than SUID root), you won't have this problem because you can just set the LIBPATH environment variable appropriately.

Converting TDW Timestamps in MySQL

Hope you read my previous articles on converting TDW Timestamps into "normal" timestamps in DB2 and in JavaScript (BIRT). Recently, I had to re-write this function in MySQL. In case you wonder, ITNM uses MySQL as the poll data collection database and again the same problem manifested.

The solution in MySQL is similar to that of DB2 based solution. Create a function in MySQL database and call that function in your SQL. But here is how to do it.

1. Bring up MySQL Administrator client and connect to the database in question.
2. Goto Catalogs in your left pane and select the appropriate database schema.
3. Goto Stored Procedure tab and click the "Create Stored Proc".
   
4. In the name field, give a Name for the function (e.g. TDW_TO_NORMAL_TS) and click "Create FUNCTION" button.
5. MySQL will create a skeleton function like below.
   CREATE FUNCTION `ncpolldata`.`TDW_TO_NORMAL_TS` () RETURNS INT
   BEGIN
   END
   
6. Replace the "CREATE FUNCTION" to look like below.
   CREATE FUNCTION `ncpolldata`.`TDW_TO_NORMAL_TS` (tdw_time bigint) RETURNS DATETIME DETERMINISTIC
   
7. Between the "BEGIN" and "END" blocks, paste the following code.
   BEGIN
   Declare normal_time datetime;
   Declare tdw_trunc bigint;
   Set tdw_trunc = substr(tdw_time,2,12);
   Set normal_time = DATE_FORMAT(tdw_trunc, '%y%m%d%H%i%s');
   return(normal_time);
   END
   
8. That's it. Click on the "Execute SQL" button to save the newly created function.
9. Call the function in your SQL Statements like below.
   SELECT TDW_TO_NORMAL_TS(poll_time) from KNP_POLL_DATA_COLLECTION LIMIT 100

Hope you find this useful.

How to resolve odaconsumer.CannotPrepareStatement error in BIRT

I was just trying to create a simple report in BIRT using a flat file and got this error when trying to preview the data:

A BIRT exception occurred.
Plug-in Provider:Eclipse.org
Plug-in Name:BIRT Data Engine
Plug-in ID:org.eclipse.birt.data
Version:2.2.2.r22x_v20071212
Error Code:odaconsumer.CannotPrepareStatement
Error Message:Failed to prepare the following query for the data set type org.eclipse.datatools.connectivity.oda.flatfile.dataSet.
[select "COLUMN_1", "COLUMN_2", "COLUMN_3" from mydata.txt : {}]
Invalid table name:mydata.txt

The problem turns out to be the location of my stupid file. I had placed it in C:\ and BIRT apparently doesn't like that at all. So I moved the file to a folder named C:\deleteme, then updated my Data Source and Data Set, and then all was well.

Configuring SNMPv3 on Linux

The two large differences between SNMPv3 and SNMPv2 (or v1, for that matter), are that:

1. it supports authentication via userid and password., and
2. it supports encryption

v1 and v2 don't support either of these. Their only means of authentication is via a "community string", which is basically like a password, but since it's always transferred over the network in the clear, it's not considered very secure.

On to the configuration:

First, read this post: http://www.linickx.com/archives/246/snmp-v3-on-redhat-linux

It gives you the basics, but leaves out one VERY critical step. Specifically:

You must now edit the line created in /etc/snmp/snmpd.conf. Specifically, I changed it from:

rwuser MYUSER

to

rwuser MYUSER priv .1

This allows this user full access to all SNMP data. You can use a more specific OID to limit access to a specific portion of the MIB tree.

Basic Filters You Should add for ITCAM for Transactions 7.1

The WRT component of ITCAM for Transactions can identify a number of transactions that, when processed by the AMC component, will create Managed System names that WILL corrupt your EIB (and you can't delete them). To guard against this, you should create the following filters (in the Application Configuration Tool):

URL *%* exclude
URL ~* exclude
URL *"* exclude
URL *\* exclude
URL *(* exclude
URL *)* exclude
URL *^* exclude
URL *@* exclude
URL *|* exclude
URL *{* exclude
URL *}* exclude
URL *`* exclude (that's a backtick)

Basically, Managed Systems should only have characters that match this regular expression: [-A-Za-z0-9_:.] (that's a literal "period"). If a Managed System has characters NOT in that expression, then 'tacmd cleanms' will fail. 'gbscmd clearoffline' can be used, and it will succeed in at least submitting the request, but your TEMS will soon crash.

Some other filters you may want to include are:

BrowserDescription msnbot* exclude
BrowserDescription Googlebot* exclude
BrowserDescription *Googlebot* exclude
BrowserDescription WebTrends* exclude
BrowserDescription *Robot* exclude
BrowserDescription gsa-crawler* exclude
BrowserDescription ShopWiki* exclude

Rebuilding a corrupt EIB without completely reinstalling

"Restore from a backup (the /opt/IBM/ITM/tables directory)" is the best option, but that's not always an option. These steps will remove ALL data in the TEMS, HOWEVER, you don't have to reinstall all of the application support; you need to re-apply it, but you don't need to reinstall it. Here are the steps that I went through with ITM 6.2.1 IF2 on 32-bit Red Hat:

1. stop the TEMS and all other agents on the box.
2. remove the /opt/IBM/ITM/tables/YOUR_TEMS_NAME directory
3. uninstall the TEMS component by running /opt/IBM/ITM/bin/uninstall.sh and only select the TEMS component.
4. run the install from the CD/DVD and choose to install the TEMS
5. The install will create a directory named /opt/IBM/ITM/todata. Rename this directory to "YOUR_TEMS_NAME".
6. run 'itmcmd -S -t YOUR_TEMS_NAME ms' to configure the TEMS
7. restart the TeMS and all other agents
8. open up the "Manage Tivoli Monitoring Services" and add all application support (it's all still installed; you just need to re-apply it to the TEMS)

IMO, the reinstall (or re-configure) should recreate the /opt/IBM/ITM/tables/YOUR_TEMS_NAME directory, but it doesn't (it creates the directory, but not the EIB files). So the whole trick is copying the "todata" folder.

IBM JRE or Sun JRE does it matter?

If you are using TEPS Java Webstart client, does it matter which JRE TEPS uses? You should be able to bring up the portal using either one, but in my experience IBM JRE works better for TEPS. With Sun JRE version 1.6.0.11, you may encounter issues with popups. While the situation editor and other tools worked correctly, I had problem with deploying non-OS agents from portal. The popup prompting for agent selection didn't appear at all. I encountered similar issue with the Database agent configuration window. Switching to IBM JRE resolved the issue.

So, how do you switch to IBM JRE? Assuming you're using Windows XP, goto Control Panel->Java->Java Tab->Java Application Runtime Settings -> View. In the list of JREs, disable the Sun JREs and enable only IBM JRE. Can't find IBM JRE? You can add the IBM JRE, by clicking either Find or Add button.

Hope you find it useful.

Enabling the TTAPI feature of the ITCAMfWAS 6.1.0.4 Data Collector on 64-bit Linux

The xLinux 64-bit libttapi.so file for Linux is not included with the ITCAMfWAS 6.1.0.4 data collector, so if you enable the TTAPI you'll get error messages about ttapi not found in java.library.path in your WebSphere SystemOut.log file. You can find this file buried a little deeply in the ITCAM for Transactions 7.1.0.2 Collector Agent installation image, however. It is buried in a file called sdk/examples/linux-64.tar.gz. Untar this file and you'll file lib/libttapi.so and lib/libkbb.so, both of which you'll need to copy to your DC/toolkit/lib/linux-ix64/ directory, then restart WebSphere.

Changing the max connections in FireFox

One of the things that started to annoy me when using FireFox was that it seemed to only allow meI to do 6 downloads from a site at a time. I would click on 6 downloads and they would all start, but when I click the 7th link, it would sit there until one of the previous downloads completed.

So after some digging I found that this is actually quite simple.

1. In the address bar type about:config. This will list all the possible configuration options with FireFox. Be Careful!
2. In the filter type http.max
3. Double click on the network.http.max-persistent-connections-per-server. This will display the Enter Integer Value dialog box.
4. Set the value to whatever new value you want.
5. Press OK to set the value

FireFox does not need to be restarted for this value to be set.

I would not set this number too high as it could slow down the overall speed of the download. I set it to 10 as there were 10 files I needed to download and I did not want to wait for one to finish before I started the next. I just wanted to click and walk away and come back in an hour :)

How to find SQL Server Version?

If you need to deploy the SQL Server agents, one of the items prompted for is the SQL Server Version. Most of us know the SQL Server by the year it was released as in SQL Server 2000, 2005 or 2008, but it is not the version number. (Version 2000 of SQL Server would be a rock-solid SQL Server, wouldn't it? :)).

Here is how to identify the version. Connect to the database server in question using Query Analyzer or SQL Server Management Studio and run the following SQL.

SELECT SERVERPROPERTY('productversion')

The above query on SQL 2005 returned 9.00.3042.00 and your result may vary depending on the Service Pack level. Generally speaking, SQL Server 2000 is version 8.x, 2005 is version 9.x and 2008 is version 10.x.

Hope this helps.

Installing TCM 4.3.1 on Red Hat 5 x64

I finally had a chance to try an install on RH 5 x64 since it is now supported in 4.3.1. I have done some installs on Windows and RH 4 i386 and had no issues, but the 64 bit threw a couple problems.

1. The setup_linux_intel.bin file did not handle x64. When you ran the script the message "OS not supported" would be displayed. To correct this problem look for the case statement "case `uname -m` in" under this there is not a check for a return of 64 bit. So I modified the case to look like:

case `uname -m` in
*86) FRESH='setup_linux_intel.bin'
;;
*64) FRESH='setup_linux_intel.bin'
;;
*390*) FRESH='setup_linux_390.bin'
;;
*) echo "OS not supported."
exit 1
;;
esac

Once this was done, the installer would start.

2. With the setup_linux_intel.bin fixed I was now getting the message "The installer is unable to run in graphical mode. Try running the installer with the -console or -silent flag". I made sure I had all the prereqs according to the doc, but still nothing. So after some playing around, I found out that I was missing the libraries libXmu-1.0.2-5.i386.rpm and libXp-1.0.0-8.1.e15.i386.rpm. The 64bit versions were there but not the 32 bit.

Hopefully this saves someone some grief if they need to install on RH5 x64.

Having problems with TEPS JWS Client shortcut?

It happened to me and it could happen to you too! The first time Tivoli Portal Java Web Start Client is launched, it creates a desktop shortcut. When you use the shortcut for subsequent portal use, the TEPS Client "Unable to launch application" error.

The error may happen on systems where IBM Java is not installed as System JVM and the TEPS shortcut points to the javaws.exe under C:\Windows\System32 and NOT the one under C:\Program Files\IBM.

The simplest way to correct the issue is to create a new desktop shortcut manually to point to the javaws.exe under C:\Program Files\IBM\JAVA50\jre\bin. When you do that, Java Webstart will prompt you to select the application every time by bringing up "Application Cache Viewer".

To skip this step, simply copy the command line argument to the javaws.exe from old shortcut to the new shortcut. You can get the argument to javaws.exe by right clicking the old shortcut -> go to Properties->Target.

Hope you find this useful.

Using Custom SQL Queries with MSLs to Get Real-Time Data from Agents

Thanks to Venkat for this tip:

Here is an example SQL statement you can use in a query to pull real-time NT Logical Disk data from all of the agents that have been added to the "MYWIN" Managed System List:

SELECT ORIGINNODE,TIMESTAMP,INSTCNAME,PCUSED FROM KNT.WTLOGCLDSK AT ("HUB_ITMSERVER") WHERE SYSTEM.PARMA("NODELIST", "MYWIN",5 )

In this statement, "HUB_ITMSERVER" is the label (not the hostname) of the TEMS the agents are connected to, "MYWIN" is the MSL name, and the "5" is simply the length of the string "MYWIN".

To find other available table names, the easiest way is to look in the agent application support SQL files on the TEMS.