VMware vCenter Configuration Manager - 5.7 Administrator’s Guide

VMware vCenter Configuration Manager

Administration Guide

vCenter Configuration Manager 5.7

This document supports the version of each product listed and supports all subsequent versions until the document is replaced by a new edition. To check for more recent editions of this document, see

http://www.vmware.com/support/pubs.

EN-001187-00

vCenter Configuration Manager Administration Guide

You can find the most up-to-date technical documentation on the VMware Web site at:

http://www.vmware.com/support/

The VMware Web site also provides the latest product updates.

If you have comments about this documentation, submit your feedback to:

docfeedback@vmware.com

http://www.vmware.com/go/patents.

VMware is a registered trademark or trademark of VMware, Inc. in the United States and/or other jurisdictions. All other marks and names mentioned herein may be trademarks of their respective companies.

VMware, Inc.

3401 Hillview Ave. Palo Alto, CA 94304 www.vmware.com

VMware, Inc.

About This Book 9

Getting Started with VCM 11

Understanding User Access 11

Running VCM as Administrator on the Collector 12 Log In to VCM 12 Getting Familiar with the Portal 13

General Information Bar 13

Toolbar 14

Navigation Sliders 15 Customizing VCM for your Environment 16

Installing and Getting Started with VCM Tools 19

Install the VCM Tools Only 19 VCM Import/Export and Content Wizard Tools 20

Run the Import/Export Tool 20

Run the Content Wizard to Access Additional Compliance Content 21 Run the Deployment Utility 21 Package Studio 21 Foundation Checker 22

Configuring VMware Cloud Infrastructure 23

Virtual Environments Configuration 23

Managing Agents Virtual Environments 24

Managing vCenter Server Instances, Hosts, and Guest Virtual Machines 24

Managing Instances of vCloud Director and vApp Virtual Machines 25

Managing vShield Manager Instances 25 Configure Virtual Environments Collections 25 Configure Managing Agent Machines for Virtual Environment Management 26

Collect Machines Data From the Managing Agent Machines 26

Set the Trust Status for Managing Agent Machines 27

Configure HTTPS Bypass Setting for Virtual Environments 28

Enable Managing Agent Machines for Virtual Environments 28 Obtain the SSL Certificate Thumbprint 29 Configure vCenter Server Data Collections 29

Add vCenter Server Instances 30

Configure the vCenter Server Settings 31

Collect vCenter Server Data 32

vCenter Server Collection Results 33

Configure vCenter Server Scheduled Collections 34 Configure vCenter Server Virtual Machine Collections 35

Collect vCenter Server Virtual Machines Data 35

Manage vCenter Server Virtual Machines 36 Configure vCloud Director Collections 37

Add vCloud Director Instances 37

Configure the vCloud Director Settings 38

Collect vCloud Director Data 39

vCloud Director Collection Results 40 Configure vCloud Director vApp Virtual Machines Collections 41

Network Address Translation and vCloud Director vApp Discovery Rules 41

VMware, Inc.

vCenter Configuration Manager Administration Guide

Discover vCloud Director vApp Virtual Machines 43 Configure vShield Manager Collections 47 Configure ESX Service Console OS Collections 50

Configure the Collector as an Agent Proxy 51

Configure Virtual Machine Hosts 52

Copy Files to the ESX/ESXi Servers 54

Collect ESX Logs Data 55

Virtualization Collection Results 56 Configure the vSphere Client VCM Plug-In 56

Configuring the vSphere Client VCM Plug-In Integration Settings 57

Manage Machines from the vSphere Client 58

Running Compliance for the VMware Cloud Infrastructure 59

Create and Run Virtual Environment Compliance Templates 59 Create Virtual Environment Compliance Rule Groups 60 Create and Test Virtual Environment Compliance Rules 61 Create and Test Virtual Environment Compliance Filters 62 Preview Virtual Environment Compliance Rule Groups 62 Create Virtual Environment Compliance Templates 63 Run Virtual Environment Compliance Templates 64 Create Virtual Environment Compliance Exceptions 65 Resolve Noncompliant Virtual Environments Template Results 66

Enforce Compliance Template Results by Using VCM Actions 66

Manually Enforce Compliance Template Results 67

Create Virtual Environment Compliance Exceptions 67 Configure Alerts and Schedule Virtual Environment Compliance Runs 68

Create Virtual Environment Compliance Alert Rules 69

Create Virtual Environments Compliance Alert Configurations 69

Schedule Virtual Environments Compliance Template Runs 70

Configuring vCenter Operations Manager Integration 73

VCM Registration in vCenter Operations Manager for Integration 73 Configure vCenter Operations Manager Change Events 73 Standards Compliance for vCenter Operations Manager 74

Configure vCenter Operations Manager Standards Compliance 74

Scoring Badges for vCenter Operations Manager Standards Compliance 80

Auditing Security Changes in Your Environment 85

Configuring Windows Machines 87

Configure Windows Machines 87

Verify Available Domains 88

Check the Network Authority 89

Assign Network Authority Accounts 89

Discover Windows Machines 90

License Windows Machines 90

Install the VCM Windows Agent on Your Windows Machines 91

Collect Windows Data 93 Windows Collection Results 94 Getting Started with Windows Custom Information 95 Prerequisites to Collect Windows Custom Information 96 Using PowerShell Scripts for WCI Collections 97

Guidelines in PowerShell Scripting for WCI 98

Challenges in PowerShell Scripting for WCI 98

PowerShell Script Signing Policies 101

Create an Example PowerShell Script for Scheduled Tasks 102

VMware, Inc.

Contents

Windows Custom Information Change Management 107 Collecting Windows Custom Information 108 Create Your Own WCI PowerShell Collection Script 108 Verify that Your Custom PowerShell Script is Valid 109 Install PowerShell 110 Collect Windows Custom Information Data 110 Run the Script-Based Collection Filter 111 View Windows Custom Information Job Status Details 112 Windows Custom Information Collection Results 113 Run Windows Custom Information Reports 114 Troubleshooting Custom PowerShell Scripts 115

Configuring Linux, UNIX, and Mac OS X Machines 117

Linux, UNIX, and Mac OS X Machine Management 117

Linux, UNIX, or Mac OS X Installation Credentials 119 Configure Collections from Linux, UNIX, and Mac OS X Machines 120

Configure Installation Delegate Machines to Install Linux, UNIX, and Mac OS X Agents 121

Configure the HTTPS Bypass Setting for Linux Agent Installations 123

Enable Linux, UNIX, and Mac OS X Agent Installation 123

Add and License Linux, UNIX, and Mac OS X Machines for Agent Installation 124

Install the VCM Agent on Linux, UNIX, and Mac OS X Operating Systems 125

Collect Linux, UNIX, and Mac OS X Data 132 Linux, UNIX, and Mac OS X Collection Results 133 Configure Scheduled Linux, UNIX, and Mac OS X Collections 133

Create a Dynamic Machine Group for Linux, UNIX, or Mac OS X Machines 134

Schedule Linux, UNIX, and Mac OS X Collections 135

Patching Managed Machines 137

Patch Assessment and Deployment 137 Prerequisite Tasks and Requirements 138

General Requirements 138

Requirements to Patch Solaris Machines in Single-User Mode 140

Requirements to Patch Managed Machines Without Changing the Run Level 140

Requirements to Patch AIX Machines 141 Manually Patching Managed Machines 141 Getting Started with VCM Manual Patching 143

Getting Started with VCM Manual Patching for Linux and UNIX Managed Machines 143

Getting Started with VCM Manual Patching for Windows Managed Machines 150 Configuring An Automated Patch Deployment Environment 156

Configuring the Patching Repository Machine 158

(Optional) Configuring the Alternate Location Patch Repository Machines 161

Configuring VCM to Work with the Patching Repository and Alternate Locations 162 Deploying Patches with Automated Patch Assessment and Deployment 169

Configure VCM for Automatic Event-Driven Patch Assessment and Deployment 170

Generate a Patch Assessment Template 171

Run a Patch Assessment on Managed Machines 172

Add Exceptions for Patching Managed Machines 172

Configure the VCMAdministration Settings 173

Generate a Patch Deployment Mapping 175

Configure VCM for Automatic Scheduled Patch Assessment and Deployment 176 How the Linux and UNIX Patch Staging Works 177 How the Linux and UNIX Patching Job Chain Works 178 How the Deploy Action Works 178 Patch Deployment Wizards 179 Running Patching Reports 180

Running and Enforcing Compliance 181

VMware, Inc.

vCenter Configuration Manager Administration Guide

Running Machine Group Compliance 181 Getting Started with SCAP Compliance 194

Conduct SCAP Compliance Assessments 195

Provisioning Physical or Virtual Machine Operating Systems 199

Operating System Provisioning Components 199

How Operating System Provisioning Works 200 Configure Operating System Provisioning Servers 201

Add Operating System Provisioning Servers 202

Set the Trust Status for Operating System Provisioning Servers 202

Collect Operating System Distributions 203

Discover Provisionable Machines 203 Provision Machines with Operating System Distributions 204

Provision Windows Machines 204

Provision Linux Machines 208

Change Agent Communication 213 Provisioned Machines Results 213 Reprovision Machines 214

Provisioning Software on Managed Machines 217

Using Package Studio to Create Software Packages and Publish to Repositories 217

Software Repository for Windows 217

Package Manager for Windows 217

Software Provisioning Component Relationships 218 Install the Software Provisioning Components 218

Install Software Repository for Windows 219

Install Package Studio 220

Install Package Manager on Managed Machines 222 Using Package Studio to Create Software Packages and Publish to Repositories 223

Creating Packages 223 Using VCM Software Provisioning for Windows 225

Collect Package Manager Information from Machines 225

Collect Software Repository Data 226

Add Repository Sources to Package Managers 227

Install Packages 228 Related Software Provisioning Actions 229

Viewing Provisioning Jobs in the Job Manager 230

Create Compliance Rules Based on Software Provisioning Data 230

Create Compliance Rules Containing Software Provisioning Remediation Actions 231

Configuring Active Directory Environments 233

Configure Domain Controllers 233

Verify Available Domains 234

Check the Network Authority Account 234

Assign Network Authority Accounts 235

Discover Domain Controllers 235

License Domain Controllers 236

Install the VCM Windows Agent on Your Domain Controllers 237

Collect Domain Controller Data 238 Configure VCM for Active Directory as an Additional Product 239

Install VCM for Active Directory on the Domain Controllers 240

Run the Determine Forest Action 240

Run the Domain Controller Setup Action 241 Collect Active Directory Data 242 Active Directory Collection Results 242

Configuring Remote Machines 245

VMware, Inc.

Contents

VCM Remote Management Workflow 245

Configuring VCM Remote Connection Types 245

Using Certificates With VCM Remote 246 Configure and Install the VCM Remote Client 246

Configure the VCM Remote Settings 246

Install the VCMRemote Client 249

Connect VCM Remote Client Machines to the Network 256

VCM Remote Collection Results 256

Tracking Unmanaged Hardware and Software Asset Data 259

Configure Asset Data Fields 259

Review Available Asset Data Fields 260

Add an Asset Data Field 260

Edit an Asset Data Field 261

Delete a VCM for Assets Data Field 262

Change the Order of Asset Data Columns 262

Refresh Dynamic Asset Data Fields 263 Configure Asset Data Values for VCM Machines 264 Configure Asset Data for Other Hardware Devices 264

Add Other Hardware Devices 265

Add Multiple Similar Other Hardware Devices 265

Edit Asset Data for Other Hardware Devices 265

Edit Asset Data Values for Other Hardware Devices 266

Delete Other Hardware Devices 266 Configure Asset Data for Software 267

Add Software Assets 267

Add Multiple Similar Software Assets 268

Edit Asset Data for Software 269

Edit Asset Data Values for Software 270

Delete Software Data 270

Managing Changes with Service Desk Integration 271

Configure Service Desk Integration 271 View Service Desk Integration in the Console 271 View Service Desk Integration in Job Manager 272

Index 273

VMware, Inc.

vCenter Configuration Manager Administration Guide

VMware, Inc.

About This Book

The VCM Administration Guide describes the steps required to configure VCM to collect and manage data from your virtual and physical environment.

Read this document and complete the associated procedures to prepare for a successful implementation of the components.

Intended Audience

This information is written for experienced Windows, Linux, UNIX, or Mac OS X, and virtual environments system administrators who are familiar with managing network users and resources and with performing system maintenance.

To use this information effectively, you must have a basic understanding of how to configure network resources, install software, and administer operating systems. You also need to fully understand your network topology and resource naming conventions.

Document Feedback

VMware welcomes your suggestions for improving our documentation. If you have comments, send your feedback to docfeedback@vmware.com.

VMware VCM Documentation

The vCenter Configuration Manager (VCM) documentation consists of the VCM Installation Guide, VCM Troubleshooting Guide, VCM online Help, and other associated documentation.

VMware, Inc.

vCenter Configuration Manager Administration Guide

Technical Support and Education Resources

The following technical support resources are available to you. To access the current version of this book and other books, go to http://www.vmware.com/support/pubs.

Online and Telephone Support

To use online support to submit technical support requests, view your product and contract information, and register your products, go to

http://www.vmware.com/support.

Customers with appropriate support contracts should use telephone support for priority 1 issues. Go to

http://www.vmware.com/support/phone_support.html.

Support Offerings To find out how VMware support offerings can help meet your business

needs, go to http://www.vmware.com/support/services.

VMware Professional Services

VMware Education Services courses offer extensive hands-on labs, case study examples, and course materials designed to be used as on-the-job reference tools. Courses are available onsite, in the classroom, and live online. For onsite pilot programs and implementation best practices, VMware Consulting

Services provides offerings to help you assess, plan, build, and manage your virtual environment. To access information about education classes, certification programs, and consulting services, go to

http://www.vmware.com/services.

VMware, Inc.

Getting Started with VCM

When you use VCM, you must understand user access and how to start VCM from any physical or virtual machine. You must also familiarize yourself with the VCM Web Console features.

This chapter includes the following topics:

Understanding User Access 11

Getting Familiar with the Portal 13

Customizing VCM for your Environment 16

Understanding User Access

User access determines who has access to VCM and with what roles. To manage your user access, create rules that are assigned to roles. VCM assigns the roles to each user login you create. User access is managed in the Administration User Manager node.

The user account that was used to install VCM is automatically granted access to VCM, placed in the roles of ADMIN and USER, and placed into the Admin role. This user can log in to VCM using the Admin role. The AD_Admin role allows full administration access to AD objects only.

VMware, Inc.

When a user is added to the Admin role in VCM or granted access to the Administration User Manager node, that user is placed in the fixed machine roles Security Administrators and Bulk Insert Administrators Groups. They are also added to the database roles of public, ADMIN, and User in the VCM Database.

Users who will not have access to the Administration User Manager node will be assigned to public. Depending on the functions granted to a user, they might need additional or fewer privileges for their role to function properly.

VCM provides a role named Change Restricted to limit users from making certain changes in your environment. With this role, users can discover machines, collect data from machines, assess machines, display bulletin and template details, check for updates, and view history. Users can add, edit, and delete reports, compliance rules and rule groups, and compliance and patch assessment templates.Users with the Change Restricted role can also install the VCM Agent, upgrade VCM, and uninstall VCM.

When you apply the Change Restricted role to a user’s VCM login, they cannot perform the following actions.

vCenter Configuration Manager Administration Guide

Remote command execution

Change actions against target managed machines

Change rollback

Compliance enforcement

Patch deployment

Software deployment

OS provisioning

Machine reboots

All VCM user accounts must have the following rights on the VCM Collector machine.

Ability to log on locally to access IIS

Read access to the System32 folder

Write access to the CMFiles$\Exported_Reports folder to export reports

If default permissions have been changed, read access to the C:\Program Files (x86) \VMware\VCM\WebConsole directory and all subdirectories and files

Users who add machines to VCM using a file or the Available Machines Add Machines action must have write access to CMFiles$\Discovery_Files.

Running VCM as Administrator on the Collector

By default for localhost, Internet Explorer on Windows Server 2008 R2 runs with Protected Mode enabled. If you are logged in to VCM as an Administrator, because Protected Mode is enabled, problems can occur with the SQLServer Reporting Service (SSRS) Web service interface components such as dashboards and node summaries.

CAUTION Although you should not access VCM on the Collector using a Web console, to restore

the SSRS functionality you can run Internet Explorer as administrator or disable Protected Mode for the zone of the Collector (localhost). If you perform this action, you must take additional precautions to protect the Collector because of the increased exposure to attacks on the Collector through the Web browser, such as cross-site scripting.

Log In to VCM

Access VCM from any physical or virtual machine in your network. The level of access is determined by your VCM administrator.

Prerequisites

Verify that the physical or virtual machines from which you are accessing VCM have a supported version of Internet Explorer installed. For supported platforms, see the VCM Installation Guide.

Configure the Internet Explorer Pop-up Blocker settings to add your Collector to your list of allowed Web sites, or disable Pop-up Blocker. Click Internet Explorer and select Tools > Pop-up Blocker > Pop- up Blocker Settings and then add the path for your Collector in the allowable address field.

VMware, Inc.

Procedure

1. To connect to VCM from a physical or virtual machine on your network, open Internet Explorer and type http://<name-or-IP-address-of-Collector-machine>/VCM.

2. Type your user network credentials.

3. (Optional) Select Automatically log on using this role to have VCM log you in.

4. Click Log On.

Your VCM user account can have multiple roles. If you selected the Automatically log on using this role option, VCM will automatically log you on as the User Role displayed on the Logon screen. To change roles, you must use the Logoff button in the top right corner of the Console. This action will return you to the Logon screen so that you can use the drop-down menu to select a different role.

Getting Familiar with the Portal

The VCM Web Console provides access to all VCM features to manage your environment.

The Web Console uses a browser-based interface to run from any Windows machine that has access to the server on which VCM is installed. The Windows machine must be running Internet Explorer or Mozilla Firefox with the Internet Explorer tab plug-in installed.

The Web Console includes several major areas and controls.

Getting Started with VCM

Figure 1–1. VCM Portal

VMware, Inc.

General Information Bar

The general information bar displays the VCM Collector’s active SQL Server name, your VCM user name and active Role, and the following buttons.

vCenter Configuration Manager Administration Guide

Log Out: Exits the Web Console. The Web Console closes and the VCM Logon screen appears.

About: Displays information about how to contact VMware Technical Support and version information for VCM and all of its components. This information may be important when you contact VMware Technical Support.

Help: Opens the online Help for the currently-active display.

Toolbar

The global toolbar provides you with easily-accessible options to enhance control of your environment and data.

The left and right arrow buttons navigate to the previous or next page in the data area.

The Jobs button opens the Jobs Running status window. This button provides access to the Collector status and allows you to stop and restart the Collector service.

The Collect button opens a wizard that allows you to define and initiate data collections.

The Remote Commands button allows you to invoke the Remote Commands wizard from the toolbar without having to access the node.

The Refresh data grid view button refreshes the data grid. Press F5 on the keyboard as an alternative action.

The View row cells button displays a vertically scrolling view of a single row of data, rather than the table-based data grid view in a separate window, and allows you to move between records.

The Select all displayed data rows button selects all the rows in the data grid.

The Copy button copies information from the selected rows in the data grid to the clipboard.

The Copy link to clipboard button copies the link of the content on-screen to the clipboard.

The View data grid in separate window button displays the data grid in a separate window.

The Export displayed d ata button exports data to a CSV formatted file. This file is exported to

Reports

The Options button opens the User Options window. These s ettings pertain to the User who is logged in to VCM. All VCM users can configure these settings to their individual preferences.

\\<name_of_Collector_machine>\CMfiles$\Exported

VMware, Inc.

Getting Started with VCM

Navigation Sliders

The navigation sliders on the left side of the Web Console include the items listed and described in the following table. The individual items that you see in VCM vary depending on the components that you have licensed.

Active Directory and AD objects based on your role.

Patching options are available based on your role.

Administration is visible only to users who have Administrative rights to VCM as part of their VCM role.

For detailed instructions about any of these features, see the online Help.

Slider Actio n

Console

Compliance

View, export, or print enterprise-wide, summary information.

Review or acknowledge current alert notifications.

Manage VCM discovered and non-VCM discovered hardware and software assets.

Review changes that occurred from one collection to the next.

Create, edit, or run remote commands on a VCM managed Windows or UNIX machine.

View information about VCM discovered domains.

Navigate and manage integrated service desk events.

Manage virtual machines.

View your Windows NT Domain and Active Directory related data.

View information for enterprise-level applications.

Review non-security related UNIX machine-specific information.

Review UNIX security data to ensure consistent security configurations across your environment.

Create and manage Compliance rule groups and templates based on AD objects or machine group data.

VMware, Inc.

vCenter Configuration Manager Administration Guide

Slider Actio n

Active Directory

Reports

Patching

View, export, or print enterprise-wide, summary information for Active Directory objects.

Review alert notifications for the selected AD location.

Review Active Directory-related changes that occurred from one collection to the next.

View collected information about Active Directory objects such as Users, Groups, Contacts, Computers, Printers, Shares, and Organizational Units.

Review Active Directory site lists, including Site Links, Site Link Bridges, Subnets, Intersite Transports, Servers, Connections and Licensing.

View Active Directory Group Policy Container Settings.

View information about Active Directory Domains, DCs, and Trusts.

Track and display access control entries and security descriptor data on all collected objects.

View Active Directory Schema information.

Run out-of-the-box reports against your collected data.

Write your own SQL and SSRS reports using VCM’s report wizard.

Review a list of bulletins available to VCM.

Create, run, or import VCM Patching templates to display the machines that require the patches described in each bulletin.

Monitor VCM Patching jobs.

Deploy patches.

Administration

Manage basic configuration options for VCM.

Establish filters to limit the data you collect from machines in your environment.

Review how your VCM licenses are being used.

Identify and manage your physical and virtual machines.

Manage VCM Logins and Roles.

Set options for assessment and deployment.

View the status of jobs that are currently running, scheduled to run, or completed.

Configure VCM to notify you of certain conditions in your environment.

Customizing VCM for your Environment

Customization of your environment is essential to fine-tune the visibility of configuration information so that the policies you develop and the actions you take are appropriate for your IT infrastructure.

VMware, Inc.

Getting Started with VCM

Create a machine group structure that matches the organization of the machines in your environment. With these machine groups, you can manage specific machines in your environment such as all SQL Servers in a particular location. You can apply specific changes or create roles and rules for those machines independently from other machines in your environment. This approach ensures that you can restrict access to critical machines to the appropriate users with rights to VCM.

You can customize the following options for your environment.

Alerts: Define the objects and types of changes that you are alerted to when they are detected in VCM. For example, you can set an alert to notify you if a registry setting changes in your environment.

Collection Filters and Filter Sets: Use collection filters to specify the data to collect from the VCM managed machines. A default collection filter is provided for each data type. You can add custom collection filters that are specific to your enterprise. You can apply filters during instant collections and scheduled collections if the filters are included in a filter set. After you create collection filters, organize them into filter sets. You can create specific filter sets or filter set groups for different machine groups. You can apply filter sets during instant collections or scheduled collections.

Compliance Templates and Rule Groups: Use compliance templates and rule groups to define specific settings and verify whether the machines match those criteria. VCM provides prepackaged templates and rules to check the compliance of your machines with regulatory, industry, and vendor standards. VMware provides additional compliance packages that you can import into VCM.

Reports: Create and print tailored reports of information that does not appear in VCM. VCM provides prepackaged reports that you can run after you collect data from your VCM managed machines.

Roles and Rules: VCM roles and access rules work together to control user access to VCM. For example, you can create a role that allows a user to view all data, but not make changes to the environment. You can create a role to run certain reports or a role that allows unlimited access to a single machine group.

The VCM Change Restricted role limits users from making certain changes in your environment. See

"Understanding User Access" on page 11.

VMware, Inc.

vCenter Configuration Manager Administration Guide

VMware, Inc.

Installing and Getting Started with VCM Tools

VCM Installation Manager installs several VCM components and tools on the Collector machine during the installation.

This chapter includes the following topics:

Install the VCM Tools Only 19

VCM Import/Export and Content Wizard Tools 20

Run the Deployment Utility 21

Package Studio 21

Foundation Checker 22

Install the VCM Tools Only

You can install the VCM tools on a non-Collector Windows machine.

If you plan to install VCMon the non-Collector Windows machine later, you must uninstall the tools and then install VCM.

Prerequisites

Perform the installation requirements for each tool in the Advanced Installation selection. For example, you can install Import/Export (I/E) and Content Wizard only on a machine that is running VCM.

Procedure

1. On the non-Collector Windows machine on which you want to install the tools, insert the installation CD.

2. In Installation Manager, click Run Installation Manager.

During the installation, follow the installation requirements that Installation Manager reports when Foundation Checker runs.

3. Complete the initial installation pages, and click Next on subsequent pages to access the Select Installation Type page.

a. Clear the VMware vCenter Configuration Manager check box.

b. Select Tools.

VMware, Inc.

vCenter Configuration Manager Administration Guide

c. To install a subset of tools, clear the Tools check box and select only the individual tools to install.

4. Click Next.

5. Complete the remaining instructions and click Next.

6. On the Installation Complete page, click Finish.

7. On the Installation Manager page, click Exit.

VCM Import/Export and Content Wizard Tools

Use the Import/Export Tool and the Content Wizard Tool to move or update VCM business objects. These tools support the migration of any VCM Management Extension for Asset data that was added to VCM manually, but does not import or export any collected data.

The Import/Export Tool supports the following scenarios.

Back up (export) and restore (import) business objects to the same machine.

Back up (export) and import (if needed) business objects during a VCM upgrade.

Export and migrate (import) business objects to additional machines in a multi-Collector environment during setup or to move custom content.

Use the Content Wizard to download current Compliance Content from VMware and import it into an existing database.

Using the Command Line Interface, automate the propagation of content to other machines in a multicollector environment with a “golden machine”.

Aid in disaster recovery by using the Command Line Interface to automate and schedule the backup of VCM content and configuration parameters.

The Command Line Interface (CLI) is a powerful extension of the Import/Export graphic user interface (GUI). In addition to supporting the scenarios noted above, the CLI allows content to be overwritten, as opposed to “rename only”, and provides for automation through scripting suitable for customizations.

IMPORTANT Use of the CLI should be restricted to advanced users who exercise caution when testing

their scripts.

The Import/Export Tool and Content Wizard Tool were installed on your Collector machine during your VCM installation.

Run the Import/Export Tool

Use the Import/Export Tool to back up your VCM database business objects and import them into a new VCM database or into a recovered VCM database. This tool also supports the migration of any VCM Management Extension for Asset data that was manually added to VCM.

Prerequisites

Install the Import/Export Tool. See "Installing and Getting Started with VCM Tools" on page 19.

Procedure

1. On the Collector, click Start.

2. Select All Programs > VMware vCenter Configuration Manager > Tools > Import Export Tool.

3. For importing and exporting procedures, click Help > Contents and use the online help.

VMware, Inc.

Installingand Getting Started with VCM Tools

Run the Content Wizard to Access Additional Compliance Content

Use the Content Wizard to import additional VMware content such as VCM Compliance Content Packages. These packages are not available in VCM until you download and import them. Check the VCM Compliance Content Packages to determine if you need to import them.

Prerequisites

Install the Content Wizard. See "Installing and Getting Started with VCM Tools" on page 19.

Procedure

1. On the Collector, click Start.

2. Select All Programs > VMware vCenter Configuration Manager > Tools > Content Wizard Tool.

3. In the Content Wizard, select Get Updates from the Internet and click Next.

4. After the wizard identifies available content, click Next.

5. Select the updates to install on your Collector and click Install.

When the installation is finished, the Event Log Results window appears.

6. On the Event Log Results window, click Save and specify a location to save the logs.

7. Click Close.

8. On the Content Wizard page, click Exit.

What to do next

View the imported data in VCM. For example, click Compliance and select Machine Group Compliance > Templates. You can now run any imported compliance template against your collected data.

Run the Deployment Utility

The Deployment Utility for UNIX/Linux and ESX/vSphere copies files to multiple target machines when you configure Linux, UNIX, and ESX/vSphere machines for management in VCM.

Procedure

1. On the Collector, navigate to C:\Program Files (x86)\VMware\VCM\Tools.

2. Copy the DeployUtility-<version>.zip file from the Collector to your Windows machine.

3. Extract the files.

4. Double-click DeployUtil.exe to start the application.

What to do next

In the Deployment Utility, click Help and review the procedure for the type of machine you are configuring.

Package Studio

Use Package Studio to create software packages that can be installed by VCM. It is one component of VCM Software Provisioning that includes the Software Repository for Windows and the Package Manager.

For procedures to run the Package Studio, see the Software Provisioning Components Installation and User's Guide.

VMware, Inc.

vCenter Configuration Manager Administration Guide

Foundation Checker

Use the Foundation Checker tool to verify that a Windows machine designated as a VCM Collector meets all of the prerequisites necessary to install VCM.

Installation Manager uses VCM Foundation Checker to check a machine’s viability for a successful VCM deployment. Foundation Checker runs system checks that determine various conditions, settings, and requirements, and displays a results file that displays the system checks that passed, failed, or generated warnings.

If the checks run without error, you can install VCM. If the checks identify missing components or incorrect configurations, Foundation Checker instructs you where to verify the component or configuration and how to remedy the errors.

To run the Foundation Checker on a Windows machine on which you will install another instance of VCM, see the Foundation Checker User's Guide.

VMware, Inc.

Configuring VMware Cloud Infrastructure

VCM collects information from your instances of vCenter Server, vCloud Director, and vShield Manager so that you can then use the information to manage and maintain your virtual environment.

The collected data appears in the Console under the Virtual Environments node. The information is organized in logical groupings based on the information sources, including vCenter Server, vCloud Director, and vShield Manager.

Based on the collected virtual environments data, you can manage the objects and data at an enterprise and individual level, including running compliance rules and reports; running actions, such as changing settings and taking virtual machine snapshots; and managing the guest operating systems as fully managed VCM machines.

This chapter includes the following topics:

Virtual Environments Configuration 23

Configure Virtual Environments Collections 25

Configure Managing Agent Machines for Virtual Environment Management 26

Obtain the SSL Certificate Thumbprint 29

Configure vCenter Server Data Collections 29

Configure vCenter Server Virtual Machine Collections 35

Configure vCloud Director Collections 37

Configure vCloud Director vApp Virtual Machines Collections 41

Configure vShield Manager Collections 47

Configure ESX Service Console OS Collections 50

Configure the vSphere Client VCM Plug-In 56

Virtual Environments Configuration

To manage your virtual environments, you collect vCenter Server, vCloud Director, and vShield Manager data. To collect the data, you use one or more Managing Agent machines.

After configuring your Managing Agent machines, you add and configure your vCenter Server, vCloud Director, and vShield Manager instances in VCMto use the Managing Agent for communication. For a diagram illustrating how the components are configured together, see Figure 3–1. Virtual Environments

Configuration Diagram.

VMware, Inc.

vCenter Configuration Manager Administration Guide

Figure 3–1. Virtual Environments Configuration Diagram

Managing Agents Virtual Environments

The Managing Agent machines must have the 5.5 Agent or later installed. They must also be configured to manage the secure communication between the vCenter Server, vCloud Director, and vShield Manager instances and the Collector. Depending on the size of your Cloud Infrastructure environment, you can use your Collector as a Managing Agent or you can use another Windows machine. If your individual vCenter Server instances manage no more than 1–30 hosts and a maximum of 1000 guests, then you can use the Collector as your Managing Agent. If any of your vCenter Server instances exceed this amount, you must use a Windows machine that is not your Collector as a Managing Agent.

CAUTION Do not use the Windows machines on which your vCenter Server instances are running

as Managing Agent machines.

Managing vCenter Server Instances, Hosts, and Guest Virtual Machines

You collect data from vCenter Server instances regarding resources managed by the vCenter Server, and to identify and manage the host and guest machines. The host and guest machines are managed based on configured vCenter Server instances. From VCM, you can run vCenter Server actions such as configuring settings, turning the power on and off, or taking a snapshot. To fully manage the guest machines, install the VCM Agent on the virtual machines and manage their operating system.

VMware, Inc.

Managing Instances of vCloud Director and vApp Virtual Machines

You collect data from vCloud Director instances regarding their configurations, resources managed by vCloud Director, and to identify and manage the vApp virtual machine guest operating systems. To fully manage the guest machines, you install the VCM Agent on the virtual machines and manage their operating system.

Managing vShield Manager Instances

You collect from vShield Manager instances to gather data regarding vShield App security groups. You can run reports on the collected data.

Configure Virtual Environments Collections

To manage your virtual environments, configure your Managing Agent and then implement the procedures that suit your environment.

Procedure

1. "Configure Managing Agent Machines for Virtual Environment Management" on page 26

The Managing Agents are one or more physical or virtual machines running a supported Windows operating system that manages the communication between the Collector and your instances of vCenter Server, vCloud Director, and vShield Manager.

Configuring VMware Cloud Infrast ructure

2. "Obtain the SSL Certificate Thumbprint" on page 29

When configuring the settings for your virtual environments systems, you can use an SSL certificate thumbprint file to ensure secure communication between the Collector and your instances of vCenter Server, vCloud Director, and vShield Manager.

3. "Configure vCenter Server Data Collections" on page 29

Collect data from your vCenter Server so that you can identify and manage your virtual environments, including ESX and ESXi hosts, and guest virtual machines.

4. "Configure vCenter Server Virtual Machine Collections" on page 35

Configure virtual machine collections so that you can identify and manage the guest operating systems on the vCenter Server virtual machines.

5. "Configure vCloud Director Collections" on page 37

Configure collections from your vCloud Director instances so that you can run compliance and reports, and identify your vApp virtual machines.

6. "Configure vCloud Director vApp Virtual Machines Collections" on page 41

Collect vCloud Director data so that you can identify and manage the guest operating systems of the vApp virtual machines.

7. "Configure vShield Manager Collections" on page 47

Configure collections from your vShield Manager instances so that you can run reports on the collected data.

VMware, Inc.

8. "Configure ESX Service Console OS Collections" on page 50

The ESX Service Console OS Linux data type data and the ESXlogs are collected directly from the ESX operating systems, not from vCenter Server. Configure the ESX servers so that you can collect the

vCenter Configuration Manager Administration Guide

Linux data type and ESX log data from the ESX service console operating system.

9. "Configure the vSphere Client VCM Plug-In" on page 56

The vSphere Client VCM Plug-In provides contextual access to VCM change, compliance, and management functions. It also provides direct access to collected vCenter Server, virtual machine host, and virtual machine guest data.

Configure Managing Agent Machines for Virtual Environment Management

CAUTION Do not use the Windows machines on which your vCenter Server instances are running

as Managing Agent machines.

Procedure

1. "Collect Machines Data From the Managing Agent Machines" on page 26

Collect data from your Managing Agent machines to ensure that VCM identifies the Windows machines as licensed and that the 5.5 Agent or later is installed.

2. "Set the Trust Status for Managing Agent Machines" on page 27

You can set the trusted status on machines where you have verified that the connection is legitimate. When you set the trust status, you are marking the Agent certificate as trusted.

3. "Configure HTTPS Bypass Setting for Virtual Environments " on page 28

If your Collector is not configured to use HTTPS, you must configure the Collector to allow HTTP communication when entering sensitive parameter values.

4. "Enable Managing Agent Machines for Virtual Environments" on page 28

Managing Agent machines must be enabled to perform the necessary communication with your instances of vCenter Server, vCloud Director, and vShield Manager.

Collect Machines Data From the Managing Agent Machines

Collect data from your Managing Agent machines to ensure that VCM identifies the Windows machines as licensed and that the 5.5 Agent or later is installed.

The Managing Agent is the Agent used to collect data from your instances of vCenter Server, vCloud Director and vShield Manager.

VMware, Inc.

Configuring VMware Cloud Infrast ructure

Prerequisites

Verify that the Windows machine that you designated as the Managing Agent is licensed and that it has the VCM Agent 5.5 or later installed. See "Configure Windows Machines" on page 87.

Procedure

1. Click Administration.

2. Select Machines Manager > Licensed Machines > Licensed Windows Machines.

3. Select the target machines and click Collect on the VCM toolbar.

4. Select Machine Data and click OK.

5. Verify that the Selected list includes the target machines and click Next.

6. Expand the Windows tree, select Machines, and click Next.

7. Resolve any conflicts and click Finish.

What to do next

When the job is finished, verify that the Agent Version value in the data grid is 5.5 or later.

Configure the trust status for the Managing Agents. See "Set the Trust Status for Managing Agent

Machines" on page 27.

Set the Trust Status for Managing Agent Machines

You can set the trusted status on machines where you have verified that the connection is legitimate. When you set the trust status, you are marking the Agent certificate as trusted.

When you transmit sensitive information, such as credentials, between the Collector and virtual or physical machines on which the Managing Agent is installed, the Agent certificate, including the Agent certificate on the Collector, must be trusted.

If you do not use this level of security, you can set the Allow sensitive parameters to be passed to agents not verified as Trusted option to Yes. To override the setting, click Administration and select Settings > General Settings > Collector.

Prerequisites

Ensure that you collected the Machines data type from the Windows machines you are using as Managing Agents. See "Collect Machines Data From the Managing Agent Machines" on page 26.

Procedure

1. Click Administration.

2. Select Certificates.

3. Select the target machines and click Change Trust Status.

4. Add any additional machines to trust to the lower data grid.

5. Select Check to trust or uncheck to untrust the selected machines and click Next.

VMware, Inc.

6. Review the number of machines affected and click Finish.

vCenter Configuration Manager Administration Guide

What to do next

If your Collector is not configured to use HTTPS, set the HTTPS bypass. See "Configure HTTPS Bypass

Setting for Virtual Environments " on page 28.

Identify the Windows machines as Managing Agents. See "Enable Managing Agent Machines for

Virtual Environments" on page 28.

Configure HTTPS Bypass Setting for Virtual Environments

If your Collector is not configured to use HTTPS, you must configure the Collector to allow HTTP communication when entering sensitive parameter values.

If your Collector is configured to use HTTPS, you do not need to modify this setting.

Procedure

1. Click Administration.

2. Select Settings > General Settings > Collector.

3. Select Allow HTTP communication (HTTPS bypass) when entering sensitive parameter values and click Edit Settings.

4. Select Yes and click Next.

5. Review the summary and click Finish.

What to do next

Identify the Windows machines as Managing Agents. See "Enable Managing Agent Machines for Virtual

Environments" on page 28.

Enable Managing Agent Machines for Virtual Environments

Managing Agent machines must be enabled to perform the necessary communication with your instances of vCenter Server, vCloud Director, and vShield Manager.

Prerequisites

Ensure that the Managing Agent machines are trusted machines. See "Set the Trust Status for Managing

Agent Machines" on page 27.

If your Collector is not configured to use HTTPS, set the HTTPS bypass. See "Configure HTTPS Bypass

Setting for Virtual Environments " on page 28.

Procedure

1. Click Administration.

2. Select Administration > Machines Manager > Licensed Machines > Licensed Windows Machines.

3. Select the Managing Agent machines and click Change Managing Agent Status.

4. Add any additional machines to the lower data grid.

5. Select Enable - allow the selected machines to be used as managing agents and click Next.

6. Review the number of machines affected and click Finish.

VMware, Inc.

What to do next

To maintain secure communication, you need the SSLcertificates from your instances of vCenter Server, vCloud Director, and vShield Manager. See "Obtain the SSL Certificate Thumbprint" on page 29.

Configure the collections from your instances of vCenter Server, vCloud Director, and vShield Manager.

See "Configure vCenter Server Data Collections" on page 29.

See "Configure vCloud Director Collections" on page 37.

See "Configure vShield Manager Collections" on page 47.

Obtain the SSL Certificate Thumbprint

You can use this procedure to copy and save the thumbprint in advance of configuring the settings, or you can follow the process while you are using the wizard.

This procedure applies when your certificates are not properly trusted. If your certificates are configured and trusted, you must log onto the target machine to retrieve the thumbprint from the certificate store.

Configuring VMware Cloud Infrast ructure

Prerequisites

Ensure that you have network access to the target instances of vCenter Server, vCloud Director, and vShield Manager from which you need the thumbprint string.

Procedure

1. Open Internet Explorer.

2. In the address bar, type https://<your vcenter server, vcloud director, or vshield manager instance>.

3. On the certificate error page, click Continue to this website.

4. On the address bar, click Certificate Error and select View Certificates.

5. Click the Details tab.

6. In the list, select Thumbprint.

7. Copy the thumbprint string to your clipboard or to a file so that you can access it when needed.

Configure vCenter Server Data Collections

Collect data from your vCenter Server so that you can identify and manage your virtual environments, including ESX and ESXi hosts, and guest virtual machines.

Prerequisites

VMware, Inc.

Configure your Managing Agent machines. See "Configure Managing Agent Machines for Virtual

Environment Management" on page 26.

To maintain secure communication, you need the SSLcertificates from your instances of vCenter Server. See "Obtain the SSL Certificate Thumbprint" on page 29.

vCenter Configuration Manager Administration Guide

Procedure

1. "Add vCenter Server Instances" on page 30

Add the vCenter Server instances to VCM so that you can license and collect vCenter Server data using the Managing Agent.

2. "Configure the vCenter Server Settings" on page 31

Configure the Managing Agent, communication, and vCenter Server access options so that VCM can collect host and guest data from the vCenter Server instances.

3. "Collect vCenter Server Data" on page 32

Collect the vCenter Server, host, and guest data from the vCenter Server instances. The data is displayed by detailed data type and appears in the VCM Console.

The collectedvCenter Server data appears in the Console in the Virtual Environments node. The collected vCenter Server data helps you identify and manage vCenter Server, host, and guest objects. See " vCenter

Server Collection Results" on page 33.

Add vCenter Server Instances

Add the vCenter Server instances to VCM so that you can license and collect vCenter Server data using the Managing Agent.

In addition to adding the vCenter Server instances, and you can also add the Windows machine on which the vCenter Server is installed and manage the underlying Windows operating system.

Prerequisites

Know the names and domain information for the vCenter Server instances in your environment.

Procedure

1. Click Administration.

2. Select Machines Manager > Available Machines.

3. Click Add Machines.

4. On the Add Machines page, select Basic: Name, Domain, Type, Automatically license machines, and click Next.

5. On the Manually Add Machines - Basic page, configure these options to identify the vCenter Server instances.

Option Descript ion

Machine Name of the vCenter Server.

Domain Domain to which the vCenter Server belongs.

Type Domain type.

Machine Type Select vCenter (Windows).

6. Click Add.

VMware, Inc.

+ 252 hidden pages