VMware vCenter Configuration Manager - 5.6 Administrator’s Guide

VMware vCenter Configuration Manager

Administration Guide

vCenter Configuration Manager 5.6

This document supports the version of each product listed and supports all subsequent versions until the document is replaced by a new edition. To check for more recent editions of this document, see

http://www.vmware.com/support/pubs.

EN-001051-00

vCenter Configuration Manager Administration Guide

You can find the most up-to-date technical documentation on the VMware Web site at:

http://www.vmware.com/support/

The VMware Web site also provides the latest product updates.

If you have comments about this documentation, submit your feedback to:

docfeedback@vmware.com

http://www.vmware.com/go/patents.

VMware is a registered trademark or trademark of VMware, Inc. in the United States and/or other jurisdictions. All other marks and names mentioned herein may be trademarks of their respective companies.

VMware, Inc.

3401 Hillview Ave. Palo Alto, CA 94304 www.vmware.com

VMware, Inc.

About This Book 9

Getting Started with VCM 11

Understanding User Access 11

Running VCM as Administrator on the Collector 12 Log In to VCM 12 Getting Familiar with the Portal 13

General Information Bar 13

Toolbar 14

Sliders 15 Customizing VCM for your Environment 16

Installing and Getting Started with VCM Tools 19

Install the VCM Tools Only 19 VCM Import/Export and Content Wizard Tools 20

Run the Import/Export Tool 21

Run the Content Wizard to Access Additional Compliance Content 21 Run the Deployment Utility 21 Package Studio 22 Foundation Checker 22

Configuring VMware Cloud Infrastructure 23

Virtual Environments Configuration 23

Managing Agents 24

Managing vCenter Server Instances, Hosts, and Guest Virtual Machines 25

Managing Instances of vCloud Director and vApp Virtual Machines 25

Managing vShield Manager Instances 25 Configure Virtual Environments Collections 25 Configure Managing Agent Machines 26

Collect Machines Data From the Managing Agent Machines 27

Set the Trust Status for Managing Agent Machines 27

Configure HTTPS Bypass Setting 28

Enable Managing Agent Machines 28 Obtain the SSL Certificate Thumbprint 29 Configure vCenter Server Data Collections 30

Add vCenter Server Instances 30

Configure the vCenter Server Settings 31

Collect vCenter Server Data 32

vCenter Server Collection Results 33

Configure vCenter Server Scheduled Collections 33 Configure vCenter Server Virtual Machine Collections 35

Collect vCenter Server Virtual Machines Data 35

Manage vCenter Server Virtual Machines 36 Configure vCloud Director Collections 37

Add vCloud Director Instances 37

Configure the vCloud Director Settings 38

Collect vCloud Director Data 39

vCloud Director Collection Results 40 Configure vCloud Director vApp Virtual Machines Collections 41

Network Address Translation and vCloud Director vApp Discovery Rules 41

VMware, Inc.

vCenter Configuration Manager Administration Guide

Discover vCloud Director vApp Virtual Machines 43 Configure vShield Manager Collections 46 Configure ESX Service Console OS Collections 50

Configure the Collector as an Agent Proxy 50

Configure Virtual Machine Hosts 51

Copy Files to the ESX/ESXi Servers 53

Collect ESX Logs Data 55

Virtualization Collection Results 55 Configure the vSphere Client VCM Plug-In 56

Configuring the vSphere Client VCM Plug-In Integration Settings 57

Manage Machines from the vSphere Client 58

Troubleshooting the vSphere Client VCM Plug-In Registration 58

Running Compliance for the VMware Cloud Infrastructure 61

Create and Run Virtual Environment Compliance Templates 61 Create Virtual Environment Compliance Rule Groups 62 Create and Test Virtual Environment Compliance Rules 63 Create and Test Virtual Environment Compliance Filters 64 Preview Virtual Environment Compliance Rule Groups 64 Create Virtual Environment Compliance Templates 65 Run Virtual Environment Compliance Templates 66 Resolve Noncompliant Virtual Environments Template Results 67

Enforce Compliance Template Results Using VCM Actions 67

Manually Enforce Compliance Template Results 68

Create Virtual Environment Compliance Exceptions 68 Configure Alerts and Schedule Virtual Environment Compliance Runs 69

Create Virtual Environment Compliance Alert Rules 70

Create Virtual Environments Compliance Alert Configurations 70

Schedule Virtual Environments Compliance Template Runs 71

Configuring vCenter Operations Manager Integration 73

Configure vCenter Operations Manager Change Events 73 Standards Compliance for vCenter Operations Manager 74

Configure vCenter Operations Manager Standards Compliance 74

Scoring Badges for vCenter Operations Manager Standards Compliance 79

Auditing Security Changes in Your Environment 85

Configuring Windows Machines 87

Configure Windows Machines 87 Verify Available Domains 88 Check the Network Authority 88 Assign Network Authority Accounts 89 Discover Windows Machines 89 License Windows Machines 90 Install the VCM Windows Agent on Your Windows Machines 91

Locate the Enterprise Certificate 92

Manually Install the VCM Windows Agent 93

Manually Uninstall the VCM Windows Agent 97 Collect Windows Data 97 Windows Collection Results 98 Getting Started with Windows Custom Information 99

Prerequisites to Collect Windows Custom Information 100

Using PowerShell Scripts for WCI Collections 101

Windows Custom Information Change Management 111

Collecting Windows Custom Information 112

VMware, Inc.

Contents

Create Your Own WCI PowerShell Collection Script 113

Verify that Your Custom PowerShell Script is Valid 113

Install PowerShell 114

Collect Windows Custom Information Data 115

Run the Script-Based Collection Filter 116

View Windows Custom Information Job Status Details 116

Windows Custom Information Collection Results 117

Run Windows Custom Information Reports 118

Troubleshooting Custom PowerShell Scripts 119

Configuring Linux and UNIX Machines 121

Configure Linux and UNIX Machines 121 Upgrade Requirements for UNIX/Linux Machines 122 Add UNIX/Linux Machines 122 License UNIX/Linux Machines 123 Install the Agent on UNIX/Linux Machines 124

Installation Options for Linux or UNIX csi.config 128

Manually Uninstall the UNIX/Linux Agent 131 Collect UNIX/Linux Data 131

Updates to UNIXPatch Assessment Content Affects UNIX Agent Performance 132 UNIX/Linux Collection Results 132 Configuring Oracle Instances 133

Discover Oracle Instances 133

Edit Oracle Instances 134

Collect Oracle Data 138

Oracle Collection Results 139

Configuring Mac OS X Machines 141

Configure Mac OS X Machines 141 Add Mac OS X Machines 142 License Mac OS X Machines 143 Install the Agent on Mac OS X Machines 143

Installation Options for Max OS X csi.config 146

Manually Uninstall the Mac OS X Agent 149 Collect Mac OS X Data 149

Collected Mac OS X Data Types 150 Mac OS X Collection Results 151

Patching Managed Machines 153

VCM Patching for Windows Machines 153

VCM Patching for UNIX and Linux Machines 154 UNIXand Linux Patch Assessment and Deployment 154

New UNIX Patch Assessment Content 155 Getting Started with VCM Patching 156

Getting Started with VCM Patching for Windows Machines 156

Check for Updates to Bulletins 157

Collect Data from Windows Machines by Using the VCM Patching Filter Sets 157

Assess Windows Machines 158

Review VCM Patching Windows Assessment Results 159

Prerequisites for Patch Deployment 159

Default Location for UNIX/Linux Patches 161

Location for UNIX/Linux Patches 161

Default Location for UNIX/Linux Patches 162

vCenter Software Content Repository Tool 162

Deploy Patches to Windows Machines 163

Getting Started with VCM Patching for UNIX and Linux Machines 164

Check for Updates to Bulletins 164

VMware, Inc.

vCenter Configuration Manager Administration Guide

Collect Patch Assessment Data from UNIX and Linux Machines 165

Explore Assessment Results and Acquire and Store the Patches 166

Default Location for UNIX/Linux Patches 168

Deploy Patches to UNIX/Linux Machines 168

How the Deploy Action Works 169 Running VCM Patching Reports 170 Customize Your Environment for VCMPatching 170

Running and Enforcing Compliance 171

Getting Started with SCAP Compliance 171

Conduct SCAP Compliance Assessments 172

Provisioning Physical or Virtual Machine Operating Systems 175

Operating System Provisioning Components 175

How Operating System Provisioning Works 176 Configure Operating System Provisioning Servers 177

Add Operating System Provisioning Servers 178

Set the Trust Status for Operating System Provisioning Servers 178

Collect Operating System Distributions 179

Discover Provisionable Machines 179 Provision Machines with Operating System Distributions 180

Provision Windows Machines 180

Provision Linux Machines 183

Change Agent Communication 188 Provisioned Machines Results 189 Reprovision Machines 189

Provisioning Software on Managed Machines 193

Using Package Studio to Create Software Packages and Publish to Repositories 193

Software Repository for Windows 193

Package Manager for Windows 193

Software Provisioning Component Relationships 194 Install the Software Provisioning Components 194

Install Software Repository for Windows 195

Install Package Studio 196

Install Package Manager on Managed Machines 198 Using Package Studio to Create Software Packages and Publish to Repositories 199

Creating Packages 199 Using VCM Software Provisioning for Windows 201

Collect Package Manager Information from Machines 201

Collect Software Repository Data 202

Add Repository Sources to Package Managers 202

Install Packages 203 Related Software Provisioning Actions 205

Viewing Provisioning Jobs in the Job Manager 205

Create Compliance Rules Based on Software Provisioning Data 206

Create Compliance Rules Containing Software Provisioning Remediation Actions 207

Configuring Active Directory Environments 209

Configure Domain Controllers 209

Verify Available Domains 210

Check the Network Authority Account 210

Assign Network Authority Accounts 211

Discover Domain Controllers 211

License Domain Controllers 212

Install the VCM Windows Agent on Your Domain Controllers 213

Collect Domain Controller Data 214

VMware, Inc.

Contents

Configure VCM for Active Directory as an Additional Product 215

Install VCM for Active Directory on the Domain Controllers 215

Run the Determine Forest Action 216

Run the Domain Controller Setup Action 217 Collect Active Directory Data 217 Active Directory Collection Results 218

Configuring Remote Machines 221

VCM Remote Management Workflow 221

Configuring VCM Remote Connection Types 221

Using Certificates With VCM Remote 222 Configure and Install the VCM Remote Client 222

Configure the VCM Remote Settings 222

Install the VCMRemote Client 225

Connect VCM Remote Client Machines to the Network 232

VCM Remote Collection Results 232

Tracking Unmanaged Hardware and Software Asset Data 235

Configure Asset Data Fields 235

Review Available Asset Data Fields 236

Add an Asset Data Field 236

Edit an Asset Data Field 237

Delete a VCM for Assets Data Field 238

Change the Order of Asset Data Columns 238

Refresh Dynamic Asset Data Fields 239 Configure Asset Data Values for VCM Machines 239 Configure Asset Data for Other Hardware Devices 240

Add Other Hardware Devices 240

Add Multiple Similar Other Hardware Devices 241

Edit Asset Data for Other Hardware Devices 241

Edit Asset Data Values for Other Hardware Devices 242

Delete Other Hardware Devices 242 Configure Asset Data for Software 243

Add Software Assets 243

Add Multiple Similar Software Assets 244

Edit Asset Data for Software 245

Edit Asset Data Values for Software 245

Delete Software Data 246

Managing Changes with Service Desk Integration 247

Configure Service Desk Integration 247 View Service Desk Integration in the Console 247 View Service Desk Integration in Job Manager 248

Index 249

VMware, Inc.

vCenter Configuration Manager Administration Guide

VMware, Inc.

About This Book

The VMware vCenter Configuration ManagerAdministration Guide describes the steps required to configure VCM to collect and manage data from your virtual and physical environment.

Read this document and complete the associated procedures to prepare for a successful implementation of the components.

Intended Audience

This information is written for experienced Windows or UNIX/Linux/Mac OS X system administrators who are familiar with managing network users and resources and with performing system maintenance.

To use this information effectively, you must have a basic understanding of how to configure network resources, install software, and administer operating systems. You also need to fully understand your network topology and resource naming conventions.

Document Feedback

VMware welcomes your suggestions for improving our documentation. If you have comments, send your feedback to docfeedback@vmware.com.

VMware VCM Documentation

The vCenter Configuration Manager (VCM) documentation consists of the VCM Installation Guide, VCM Troubleshooting Guide, VCM online Help, and other associated documentation.

VMware, Inc.

vCenter Configuration Manager Administration Guide

Technical Support and Education Resources

The following technical support resources are available to you. To access the current version of this book and other books, go to http://www.vmware.com/support/pubs.

Online and Telephone Support

To use online support to submit technical support requests, view your product and contract information, and register your products, go to

http://www.vmware.com/support.

Customers with appropriate support contracts should use telephone support for priority 1 issues. Go to http://www.vmware.com/support/phone_

support.html.

Support Offerings To find out how VMware support offerings can help meet your business

needs, go to http://www.vmware.com/support/services.

VMware Professional Services

VMware Education Services courses offer extensive hands-on labs, case study examples, and course materials designed to be used as on-the-job reference tools. Courses are available onsite, in the classroom, and live online. For onsite pilot programs and implementation best practices, VMware Consulting

Services provides offerings to help you assess, plan, build, and manage your virtual environment. To access information about education classes, certification programs, and consulting services, go to

http://www.vmware.com/services.

VMware, Inc.

Getting Started with VCM

When you use VCM, you must understand user access and how to start VCM from any physical or virtual machine. You must also familiarize yourself with the VCM Web Console features.

This chapter includes the following topics:

Understanding User Access 11

Getting Familiar with the Portal 13

Customizing VCM for your Environment 16

Understanding User Access

User access determines who has access to VCM and with what roles. To manage your user access, create rules that are assigned to roles. VCM assigns the roles to each user login you create. User access is managed in the Administration User Manager node.

The user account that was used to install VCM is automatically granted access to VCM, placed in the roles of ADMIN and USER, and placed into the Admin role. This user can log in to VCM using the Admin role. The AD_Admin role allows full administration access to AD objects only.

When a user is added to the Admin role in VCM or granted access to the Administration User Manager node, that user is placed in the fixed machine roles Security Administrators and Bulk Insert Administrators Groups. They are also added to the database roles of public, ADMIN, and User in the VCM Database.

Users who will not have access to the Administration User Manager node will be assigned to public. Depending on the functions granted to a user, they might need additional or fewer privileges for their role to function properly.

VCM provides a Change Restricted role to limit users from making certain changes in your environment. With this role, users can discover, collect data from machines, assess machines, display bulletin and template details, check for updates, and view history. Users can add, edit, and delete reports, compliance rules and rule groups, and compliance and patch assessment templates.They can also install the Agent, upgrade VCM, and uninstall VCM.

When you apply the VCM Change Restricted role to a user’s VCM login, they cannot perform the following actions.

VMware, Inc.

vCenter Configuration Manager Administration Guide

Remote command execution

Change actions against target managed machines

Change rollback

Compliance enforcement

Patch deployment

Software deployment

OS provisioning

Machine reboots

All VCM user accounts must have the following rights on the VCM Collector machine.

Ability to log on locally to access IIS

Read access to the System32 folder

Write access to the CMFiles$\Exported_Reports folder to export reports

If default permissions have been changed, read access to the C:\Program Files (x86) \VMware\VCM\WebConsole directory and all subdirectories and files

Users who add machines to VCM using a file or the Available Machines Add Machines action must have write access to CMFiles$\Discovery_Files.

Running VCM as Administrator on the Collector

By default for localhost, Internet Explorer on Windows Server 2008 R2 runs with Protected Mode enabled. If you are logged in to VCM as an Administrator, because Protected Mode is enabled, problems can occur with the SQLServer Reporting Service (SSRS) Web service interface components such as dashboards and node summaries.

CAUTION Although you should not access VCM on the Collector using a Web console, to restore

the SSRS functionality you can run Internet Explorer as administrator or disable Protected Mode for the zone of the Collector (localhost). If you perform this action, you must take additional precautions to protect the Collector because of the increased exposure to attacks on the Collector through the Web browser, such as cross-site scripting.

Log In to VCM

Access VCM from any physical or virtual machine in your network. The level of access is determined by your VCM administrator.

Prerequisit es

Verify that the physical or virtual machines from which you are accessing VCM have a supported version of Internet Explorer installed. For supported platforms, see the VCM Installation Guide.

Configure the Internet Explorer Pop-up Blocker settings to add your Collector to your list of allowed Web sites, or disable Pop-up Blocker. Click Internet Explorer and select Tools > Pop-up Blocker > Pop- up Blocker Settings and then add the path for your Collector in the allowable address field.

VMware, Inc.

Procedu re

1. To connect to VCM from a physical or virtual machine on your network, open Internet Explorer and type http://<name-or-IP-address-of-Collector-machine>/VCM.

2. Type your user network credentials.

3. (Optional) Select Automatically log on using this role to have VCM log you in.

4. Click Log On.

Your VCM user account can have multiple roles. If you selected the Automatically log on using this role option, VCM will automatically log you on as the User Role displayed on the Logon screen. To change roles, you must use the Logoff button in the top right corner of the Console. This action will return you to the Logon screen so that you can use the drop-down menu to select a different role.

Getting Familiar with the Portal

The VCM Web Console provides access to all VCM features to manage your environment.

The Web Console uses a browser-based interface to run from any Windows machine that has access to the server on which VCM is installed. The Windows machine must be running Internet Explorer or Mozilla Firefox with the Internet Explorer tab plug-in installed.

The Web Console includes several major areas and controls.

Getting Started with VCM

General Information Bar

The general information bar displays the VCM Collector’s active SQL Server name, your VCM user name and active Role, and the following buttons.

VMware, Inc.

vCenter Configuration Manager Administration Guide

Log Out: Exits the Web Console. The Web Console closes and the VCM Logon screen appears.

About: Displays information about how to contact VMware Technical Support and version information for VCM and all of its components. This information may be important when you contact VMware Technical Support.

Help: Opens the online Help for the currently-active display.

Toolbar

The global toolbar provides you with easily-accessible options to enhance control of your environment and data.

The left and right arrow buttons navigate to the previous or next page in the data area.

The Jobs button opens the Jobs Running status window. This button provides access to the Collector status and allows you to stop and restart the Collector service.

The Collect button opens a wizard that allows you to define and initiate data collections.

The Remote Commands button allows you to invoke the Remote Commands wizard from the toolbar without having to access the node.

The Refresh data grid view button refreshes the data grid. Press F5 on the keyboard as an alternative action.

The View row cells button displays a vertically scrolling view of a single row of data, rather than the table-based data grid view in a separate window, and allows you to move between records.

The Select all displayed data rows button selects all the rows in the data grid.

The Copy button copies information from the selected rows in the data grid to the clipboard.

The Copy link to clipboard button copies the link of the content on-screen to the clipboard.

The View data grid in separate window button displays the data grid in a separate window.

The Export displayed d ata button exports data to a CSV formatted file. This file is exported to

Reports

The Options button opens the User Options window. These s ettings pertain to the User who is logged in to VCM. All VCM users can configure these settings to their individual preferences.

\\<name_of_Collector_machine>\CMfiles$\Exported

VMware, Inc.

Getting Started with VCM

Sliders

The sliders on the left side of the Web Console include the items listed and described in the following table. The individual items that you see in VCM will vary depending on the components that you have licensed.

Active Directory and AD objects based on your role.

Patching options are available based on your role.

Administration is visible only to users who have Administrative rights to VCM as part of their VCM role.

For detailed instructions about any of these features, see the online Help.

Slider Actio n

Console

Compliance

View, export, or print enterprise-wide, summary information.

Review or acknowledge current alert notifications.

Manage VCM discovered and non-VCM discovered hardware and software assets.

Review changes that occurred from one collection to the next.

Create, edit, or run remote commands on a VCM managed Windows or UNIX machine.

View information about VCM discovered domains.

Navigate and manage integrated service desk events.

Manage virtual machines.

View your Windows NT Domain and Active Directory related data.

View information for enterprise-level applications.

Review non-security related UNIX machine-specific information.

Review UNIX security data to ensure consistent security configurations across your environment.

Create and manage Compliance rule groups and templates based on AD objects or machine group data.

VMware, Inc.

Active Directory

View, export, or print enterprise-wide, summary information for Active Directory objects.

Review alert notifications for the selected AD location.

Review Active Directory-related changes that occurred from one collection to the next.

View collected information about Active Directory objects such as Users, Groups, Contacts, Computers, Printers, Shares, and Organizational Units.

Review Active Directory site lists, including Site Links, Site Link Bridges, Subnets, Intersite Transports, Servers, Connections and Licensing.

View Active Directory Group Policy Container Settings.

vCenter Configuration Manager Administration Guide

Slider Actio n

View information about Active Directory Domains, DCs, and Trusts.

Track and display access control entries and security descriptor data on all collected objects.

View Active Directory Schema information.

Reports

Patching

Administration

Run out-of-the-box reports against your collected data.

Write your own SQL and SSRS reports using VCM’s report wizard.

Review a list of bulletins available to VCM.

Create, run, or import VCM Patching templates to display the machines that require the patches described in each bulletin.

Monitor VCM Patching jobs.

Deploy patches.

Manage basic configuration options for VCM.

Establish filters to limit the data you collect from machines in your environment.

Review how your VCM licenses are being used.

Identify and manage your physical and virtual machines.

Manage VCM Logins and Roles.

Set options for assessment and deployment.

View the status of jobs that are currently running, scheduled to run, or completed.

Configure VCM to notify you of certain conditions in your environment.

Customizing VCM for your Environment

Create a machine group structure that matches the organization of the machines in your environment. With these machine groups, you can manage specific machines in your environment such as all SQL Servers in a particular location. You can apply specific changes or create roles and rules for those machines independently from other machines in your environment. This approach ensures that you can restrict access to critical machines to the appropriate users with rights to VCM.

You can customize the following options for your environment.

Alerts: Define the objects and types of changes that you are alerted to when they are detected in VCM. For example, you can set an alert to notify you if a registry setting changes in your environment.

Collection Filters and Filter Sets: Use collection filters to specify the data to collect from the VCM managed machines. A default collection filter is provided for each data type. You can add custom collection filters that are specific to your enterprise. You can apply filters during instant collections and scheduled collections if the filters are included in a filter set. After you create collection filters, organize them into filter sets. You can create specific filter sets or filter set groups for different machine groups. You can apply filter sets during instant collections or scheduled collections.

VMware, Inc.

Getting Started with VCM

Compliance Templates and Rule Groups: Use compliance templates and rule groups to define specific settings and verify whether the machines match those criteria. VCM provides prepackaged templates and rules to check the compliance of your machines with regulatory, industry, and vendor standards. VMware provides additional compliance packages that you can import into VCM.

Reports: Create and print tailored reports of information that does not appear in VCM. VCM provides prepackaged reports that you can run after you collect data from your VCM managed machines.

Roles and Rules: VCM roles and access rules work together to control user access to VCM. For example, you can create a role that allows a user to view all data, but not make changes to the environment. You can create a role to run certain reports or a role that allows unlimited access to a single machine group.

The VCM Change Restricted role limits users from making certain changes in your environment. See

"Understanding User Access" on page 11.

For information to import additional compliance packages into VCM, see Import/Export and Content

Wizard.

VMware, Inc.

vCenter Configuration Manager Administration Guide

VMware, Inc.

Installing and Getting Started with VCM Tools

VCM Installation Manager installs several VCM components and tools on the Collector machine during the installation.

This chapter includes the following topics:

Install the VCM Tools Only 19

VCM Import/Export and Content Wizard Tools 20

Run the Deployment Utility 21

Package Studio 22

Foundation Checker 22

Install the VCM Tools Only

You can install the VCM tools on a non-Collector Windows machine.

If you plan to install VCMon the non-Collector Windows machine later, you must uninstall the tools and then install VCM.

Prerequisit es

Perform the installation requirements for each tool in the Advanced Installation selection. For example, you can install Import/Export (I/E) and Content Wizard only on a machine that is running VCM.

VMware, Inc.

vCenter Configuration Manager Administration Guide

Procedu re

1. On the non-Collector Windows machine on which you want to install the tools, insert the installation CD.

2. In Installation Manager, click Run Installation Manager.

During the installation, follow the installation requirements that Installation Manager reports when Foundation Checker runs.

3. Complete the initial installation pages, and click Next on subsequent pages to access the Select Installation Type page.

a. Clear the VMware vCenter Configuration Manager check box.

b. Select Tools.

c. To install a subset of tools, clear the Tools check box and select only the individual tools to install.

4. Click Next.

5. Complete the remaining instructions and click Next.

6. On the Installation Complete page, click Finish.

7. On the Installation Manager page, click Exit.

VCM Import/Export and Content Wizard Tools

Use the Import/Export Tool and the Content Wizard Tool to move or update VCM business objects. These tools support the migration of any VCM Management Extension for Asset data that was added to VCM manually, but does not import or export any collected data.

The Import/Export Tool supports the following scenarios.

Back up (export) and restore (import) business objects to the same machine.

Back up (export) and import (if needed) business objects during a VCM upgrade.

Export and migrate (import) business objects to additional machines in a multi-Collector environment during setup or to move custom content.

Use the Content Wizard to download current Compliance Content from VMware and import it into an existing database.

Using the Command Line Interface, automate the propagation of content to other machines in a multicollector environment with a “golden machine”.

Aid in disaster recovery by using the Command Line Interface to automate and schedule the backup of VCM content and configuration parameters.

The Command Line Interface (CLI) is a powerful extension of the Import/Export graphic user interface (GUI). In addition to supporting the scenarios noted above, the CLI allows content to be overwritten, as opposed to “rename only”, and provides for automation through scripting suitable for customizations.

IMPORTANT Use of the CLI should be restricted to advanced users who exercise caution when testing

their scripts.

The Import/Export Tool and Content Wizard Tool were installed on your Collector machine during your VCM installation.

VMware, Inc.

Installing and Getting Started with VCM Tools

Run the Import/Export Tool

Use the Import/Export Tool to back up your VCM database business objects and import them into a new VCM database or into a recovered VCM database. This tool also supports the migration of any VCM Management Extension for Asset data that was manually added to VCM.

Prerequisit es

Install the Import/Export Tool. See "Installing and Getting Started with VCM Tools" on page 19.

Procedu re

1. On the Collector, click Start.

2. Select All Programs > VMware vCenter Configuration Manager > Tools > Import Export Tool.

3. For importing and exporting procedures, click Help > Contents and use the online help.

Run the Content Wizard to Access Additional Compliance Content

Use the Content Wizard to import additional VMware content such as VCM Compliance Content Packages. These packages are not available in VCM until you download and import them. Check the VCM Compliance Content Packages to determine if you need to import them.

Prerequisit es

Install the Content Wizard. See "Installing and Getting Started with VCM Tools" on page 19.

Procedu re

1. On the Collector, click Start.

2. Select All Programs > VMware vCenter Configuration Manager > Tools > Content Wizard Tool.

3. In the Content Wizard, select Get Updates from the Internet and click Next.

4. After the wizard identifies available content, click Next.

5. Select the updates to install on your Collector and click Install.

When the installation is finished, the Event Log Results window appears.

6. On the Event Log Results window, click Save and specify a location to save the logs.

7. Click Close.

8. On the Content Wizard page, click Exit.

What to do next

View the imported data in VCM. For example, click Compliance and select Machine Group Compliance > Templates. You can now run any imported compliance template against your collected data.

Run the Deployment Utility

The Deployment Utility for UNIX/Linux and ESX/vSphere copies files to multiple target machines when you configure UNIX/Linux and ESX/vSphere machines for management in VCM.

VMware, Inc.

vCenter Configuration Manager Administration Guide

Procedu re

1. On the Collector, navigate to C:\Program Files (x86)\VMware\VCM\Tools.

2. Copy the DeployUtility-<version>.zip file from the Collector to your Windows machine.

3. Extract the files.

4. Double-click DeployUtil.exe to start the application.

What to do next

In the Deployment Utility, click Help and review the procedure for the type of machine you are configuring.

Package Studio

Use Package Studio to create software packages that can be installed by VCM. It is one component of VCM Software Provisioning that includes the Software Repository for Windows and the Package Manager.

For procedures to run the Package Studio, see the Software Provisioning Components Installation and User's Guide.

Foundation Checker

Use the Foundation Checker tool to verify that a Windows machine designated as a VCM Collector meets all of the prerequisites necessary to install VCM.

Installation Manager uses VCM Foundation Checker to check a machine’s viability for a successful VCM deployment. Foundation Checker runs system checks that determine various conditions, settings, and requirements, and displays a results file that displays the system checks that passed, failed, or generated warnings.

If the checks run without error, you can install VCM. If the checks identify missing components or incorrect configurations, Foundation Checker instructs you where to verify the component or configuration and how to remedy the errors.

To run the Foundation Checker on a Windows machine on which you will install another instance of VCM, see the Foundation Checker User's Guide.

VMware, Inc.

Configuring VMware Cloud Infrastructure

VCM collects information from your instances of vCenter Server, vCloud Director, and vShield Manager so that you can then use the information to manage and maintain your virtual environment.

The collected data appears in the Console under the Virtual Environments node. The information is organized in logical groupings based on the information sources, including vCenter Server, vCloud Director, and vShield Manager.

Based on the collected virtual environments data, you can manage the objects and data at an enterprise and individual level, including running compliance rules and reports; running actions, such as changing settings and taking virtual machine snapshots; and managing the guest operating systems as fully managed VCM machines.

This chapter includes the following topics:

Virtual Environments Configuration 23

Configure Virtual Environments Collections 25

Configure Managing Agent Machines 26

Obtain the SSL Certificate Thumbprint 29

Configure vCenter Server Data Collections 30

Configure vCenter Server Virtual Machine Collections 35

Configure vCloud Director Collections 37

Configure vCloud Director vApp Virtual Machines Collections 41

Configure vShield Manager Collections 46

Configure ESX Service Console OS Collections 50

Configure the vSphere Client VCM Plug-In 56

Virtual Environments Configuration

To manage your virtual environments, you collect vCenter Server, vCloud Director, and vShield Manager data. To collect the data, you use one or more Managing Agent machines.

After configuring your Managing Agent machines, you add and configure your vCenter Server, vCloud Director, and vShield Manager instances in VCMto use the Managing Agent for communication. For a diagram illustrating how the components are configured together, see Figure 3–1. Virtual Environments

Configuration Diagram.

VMware, Inc.

vCenter Configuration Manager Administration Guide

Figure 3–1. Virtual Environments Configuration Diagram

Managing Agents

The Managing Agent machines must have the 5.5 Agent or later installed. They must also be configured to manage the secure communication between the vCenter Server, vCloud Director, and vShield Manager instances and the Collector. Depending on the size of your Cloud Infrastructure environment, you can use your Collector as a Managing Agent or you can use another Windows machine. If your individual vCenter Server instances manage no more than 1–30 hosts and a maximum of 1000 guests, then you can use the Collector as your Managing Agent. If any of your vCenter Server instances exceed this amount, you must use a Windows machine that is not your Collector as a Managing Agent.

VMware, Inc.

Configuring VMware Cloud Infrastructure

CAUTION Do not use the Windows machines on which your vCenter Server instances are running

as Managing Agent machines.

Managing vCenter Server Instances, Hosts, and Guest Virtual Machines

You collect data from vCenter Server instances regarding resources managed by the vCenter Server, and to identify and manage the host and guest machines. The host and guest machines are managed based on configured vCenter Server instances. From VCM, you can run vCenter Server actions such as configuring settings, turning the power on and off, or taking a snapshot. To fully manage the guest machines, install the VCM Agent on the virtual machines and manage their operating system.

Managing Instances of vCloud Director and vApp Virtual Machines

You collect data from vCloud Director instances regarding their configurations, resources managed by vCloud Director, and to identify and manage the vApp virtual machine guest operating systems. To fully manage the guest machines, you install the VCM Agent on the virtual machines and manage their operating system.

Managing vShield Manager Instances

You collect from vShield Manager instances to gather data regarding vShield App security groups. You can run reports on the collected data.

Configure Virtual Environments Collections

To manage your virtual environments, configure your Managing Agent and then implement the procedures that suit your environment.

Procedu re

1. "Configure Managing Agent Machines" on page 26

The Managing Agents are one or more physical or virtual machine running a supported Windows operating system that manages the communication between the Collector and your instances of vCenter Server, vCloud Director, and vShield Manager.

2. "Obtain the SSL Certificate Thumbprint" on page 29

When configuring the settings for your virtual environments systems, you can use an SSL certificate thumbprint file to ensure secure communication between the Collector and your instances of vCenter Server, vCloud Director, and vShield Manager.

3. "Configure vCenter Server Data Collections" on page 30

Collect data from your vCenter Server so that you can identify and manage your virtual environments, including ESX and ESXi hosts, and guest virtual machines.

4. "Configure vCenter Server Virtual Machine Collections" on page 35

Configure virtual machine collections so that you can identify and manage the guest operating systems on the vCenter Server virtual machines.

VMware, Inc.

5. "Configure vCloud Director Collections" on page 37

Configure collections from your vCloud Director instances so that you can run compliance and reports, and identify your vApp virtual machines.

6. "Configure vCloud Director vApp Virtual Machines Collections" on page 41

vCenter Configuration Manager Administration Guide

Collect vCloud Director data so that you can identify and manage the guest operating systems of the vApp virtual machines.

7. "Configure vShield Manager Collections" on page 46

Configure collections from your vShield Manager instances so that you can run reports on the collected data.

8. "Configure ESX Service Console OS Collections" on page 50

The ESX Service Console OS Linux data type data and the ESXlogs are collected directly from the ESX operating systems, not from vCenter Server. Configure the ESX servers so that you can collect the Linux data type and ESX log data from the ESX service console operating system.

9. "Configure the vSphere Client VCM Plug-In" on page 56

The vSphere Client VCM Plug-In provides contextual access to VCM change, compliance, and management functions. It also provides direct access to collected vCenter Server, virtual machine host, and virtual machine guest data.

Configure Managing Agent Machines

CAUTION Do not use the Windows machines on which your vCenter Server instances are running

as Managing Agent machines.

Procedu re

1. "Collect Machines Data From the Managing Agent Machines" on page 27

Collect data from your Managing Agent machines to ensure that VCM identifies the Windows machines as licensed and that the 5.5 Agent or later is installed.

2. "Set the Trust Status for Managing Agent Machines" on page 27

You set the trusted status is on machines where you verify that the connection is legitimate. When you set the trust status, you are marking the Agent certificate as trusted.

3. "Configure HTTPS Bypass Setting" on page 28

If your Collector is not configured to use HTTPS, you must configure the Collector to allow HTTP communication when entering sensitive parameter values.

4. "Enable Managing Agent Machines" on page 28

Managing Agent machines must be enabled to perform the necessary communication with your instances of vCenter Server, vCloud Director, and vShield Manager.

VMware, Inc.

Configuring VMware Cloud Infrastructure

Collect Machines Data From the Managing Agent Machines

Collect data from your Managing Agent machines to ensure that VCM identifies the Windows machines as licensed and that the 5.5 Agent or later is installed.

The Managing Agent is the Agent used to collect data from your instances of vCenter Server, vCloud Director and vShield Manager.

Prerequisit es

Verify that the Windows machine that you designated as the Managing Agent is licensed and that it has the VCM Agent 5.5 or later installed. See "Configure Windows Machines" on page 87.

Procedu re

1. Click Administration.

2. Select Machines Manager > Licensed Machines > Licensed Windows Machines.

3. Select the Managing Agent machines and click Collect on the VCM toolbar.

4. On the Collection Type page, select Machine Data and click OK.

5. On the Machines page, verify that the Selected list includes the Managing Agent machine and click Next.

6. On the Data Types page, expand Windows.

7. Select Machines, and click Next.

8. On the Important page, resolve any conflicts and click Finish.

9. When the job finishes, verify that the Agent Version value in the data grid is 5.5 or later.

What to do next

Configure the trust status for the Managing Agents. See "Set the Trust Status for Managing Agent

Machines" on page 27.

Set the Trust Status for Managing Agent Machines

You set the trusted status is on machines where you verify that the connection is legitimate. When you set the trust status, you are marking the Agent certificate as trusted.

When you transmit sensitive information, such as credentials, between the Collector and physical or virtual machines on which the Managing Agent is installed, the Agent certificate, including the Agent certificate on the Collector, must be trusted.

If you do not use this level of security, you can set the Allow sensitive parameters to be passed to agents not verified as Trusted option to Yes. To override the setting, click Administration and select Settings > General Settings > Collector.

Prerequisit es

Ensure that you collected the Machines data type from the Windows machines you are using as Managing Agents. See "Collect Machines Data From the Managing Agent Machines" on page 27.

VMware, Inc.

vCenter Configuration Manager Administration Guide

Procedu re

1. Click Administration.

2. Select Certificates.

3. Select the Managing Agent machines and click Change Trust Status.

4. Add any additional machines to trust to the lower data grid.

5. Select Check to trust or uncheck to untrust the selected machines and click Next.

6. Review the number of machines affected and click Finish.

What to do next

If your Collector is not configured to use HTTPS, set the HTTPS bypass. See "Configure HTTPS Bypass

Setting" on page 28.

Identify the Windows machines as Managing Agents. See "Enable Managing Agent Machines" on page

28.

Configure HTTPS Bypass Setting

If your Collector is not configured to use HTTPS, you must configure the Collector to allow HTTP communication when entering sensitive parameter values.

If your Collector is configured to use HTTPS, you do not need to modify this setting.

Procedu re

1. Click Administration.

2. Select Settings > General Settings > Collector.

3. Select Allow HTTP communication (HTTPS bypass) when entering sensitive parameter values and click Edit Settings.

4. Select Yes and click Next.

5. Review the summary and click Finish.

What to do next

Identify the Windows machines as Managing Agents. See "Enable Managing Agent Machines" on page 28.

Enable Managing Agent Machines

Managing Agent machines must be enabled to perform the necessary communication with your instances of vCenter Server, vCloud Director, and vShield Manager.

Prerequisit es

Ensure that the Managing Agent machines are trusted machines. See "Set the Trust Status for Managing

Agent Machines" on page 27.

If your Collector is not configured to use HTTPS, set the HTTPS bypass. See "Configure HTTPS Bypass

Setting" on page 28.

VMware, Inc.

Configuring VMware Cloud Infrastructure

Procedu re

1. Click Administration.

2. Select Administration > Machines Manager > Licensed Machines > Licensed Windows Machiens.

3. Select the Managing Agent machines and click Change Managing Agent Status.

4. Add any additional machines to the lower data grid.

5. Select Enable - allow the selected machines to be used as managing agents and click Next.

6. Review the number of machines affected and click Finish.

What to do next

To maintain secure communication, you need the SSLcertificates from your instances of vCenter Server, vCloud Director, and vShield Manager. See "Obtain the SSL Certificate Thumbprint" on page 29.

Configure the collections from your instances of vCenter Server, vCloud Director, and vShield Manager.

See "Configure vCenter Server Data Collections" on page 30.

See "Configure vCloud Director Collections" on page 37.

See "Configure vShield Manager Collections" on page 46.

Obtain the SSL Certificate Thumbprint

You can use this procedure to copy and save the thumbprint in advance of configuring the settings, or you can follow the process while you are using the wizard.

This procedure applies when your certificates are not properly trusted. If your certificates are configured and trusted, you must log onto the target machine to retrieve the thumbprint from the certificate store.

Prerequisit es

Ensure that you have network access to the target instances of vCenter Server, vCloud Director, and vShield Manager from which you need the thumbprint string.

Procedu re

1. Open Internet Explorer.

2. In the address bar, type https:\\<your vcenter server, vcloud director, or vshield manager instance>.

3. On the certificate error page, click Continue to this website.

4. On the address bar, click Certificate Error and select View Certificates.

5. Click the Details tab.

VMware, Inc.

6. In the list, select Thumbprint.

7. Copy the thumbprint string to your clipboard or to a file so that you can access it when needed.

vCenter Configuration Manager Administration Guide

Configure vCenter Server Data Collections

Collect data from your vCenter Server so that you can identify and manage your virtual environments, including ESX and ESXi hosts, and guest virtual machines.

Prerequist es

Configure your Managing Agent machines. See "Configure Managing Agent Machines" on page 26.

To maintain secure communication, you need the SSLcertificates from your instances of vCenter Server. See "Obtain the SSL Certificate Thumbprint" on page 29.

Procedu re

1. "Add vCenter Server Instances" on page 30

Add the vCenter Server instances to VCM so that you can license and collect vCenter Server data using the Managing Agent.

2. "Configure the vCenter Server Settings" on page 31

Configure the Managing Agent, communication, and vCenter Server access options so that VCM can collect host and guest data from the vCenter Server instances.

3. "Collect vCenter Server Data" on page 32

Collect the vCenter Server, host, and guest data from the vCenter Server instances. The data is displayed by detailed data type and appears in the VCM Console.

The collectedvCenter Server data appears in the Console in the Virtual Environments node. The collected vCenter Server data helps you identify and manage vCenter Server, host, and guest objects. See " vCenter

Server Collection Results" on page 33.

Add vCenter Server Instances

Add the vCenter Server instances to VCM so that you can license and collect vCenter Server data using the Managing Agent.

In addition to adding the vCenter Server instances, and you can also add the Windows machine on which the vCenter Server is installed and manage the underlying Windows operating system.

Prerequisit es

Know the names and domain information for the vCenter Server instances in your environment.

Procedu re

1. Click Administration.

2. Select Machines Manager > Available Machines.

3. Click Add Machines.

4. On the Add Machines page, select Basic: Name, Domain, Type, Automatically license machines, and click Next.

5. On the Manually Add Machines - Basic page, configure these options to identify the vCenter Server instances.

VMware, Inc.

+ 226 hidden pages