view counter
Home › The Oracle Cloud Cookbook

Register Oracle VM Manager in Oracle Enterprise Manager 12c

Engage the Author Roddy Rodstein Today for your Oracle Project!

CAPTCHA
This question is for testing whether you are a human visitor and to prevent automated spam submissions.
Image CAPTCHA
Enter the characters shown in the image.
 
Copyright © 2013 Mokum Solutions, Inc. All rights reserved.
Distribution of the Oracle Cloud Cookbook or derivative of the work in any form for commercial purposes is prohibited unless prior permission is obtained from the copyright holder.
 
Author: Roddy Rodstein
 
Change Log
Revision
Change Description
Updated By
Date
1.0
First Release
Roddy Rodstein
09/20/11
1.2 Oracle VM 3.1.1 Updates Roddy Rodstein 05/23/12
1.3 Enterprise Manager Cloud Control 12c Release 2 (12.1.0.2)  Updates Roddy Rodstein 10/06/12
 
Table of Contents

Oracle VM and Oracle Enterprise Manager 12c Introduction
Oracle VM Manager Registration Prerequisites
How to enable TCPS on Oracle VM Manager 3.1 and Above
...Export the Oracle VM Manager keystore
...Import the Oracle VM Manager keystore into the Oracle Management Agent keystore
...List the Oracle VM Manager keystore
...List the Oracle Management Agent keystore
...Delete an Entry in the Oracle Management Agent keystore
How to Register Oracle VM Manager in Oracle Enterprise Manager 12c Cloud Control
How to Deregister Oracle VM Manager in Oracle Enterprise Manager 12c Cloud Control

 

Oracle VM and Oracle Enterprise Manager 12c Introduction

The Oracle VM product family; Oracle VM Server, Oracle VM Manager, Oracle VM Templates and Assemblies can be managed with Oracle VM Manager and Oracle Enterprise Manager 12c Cloud Control. Unlike Oracle VM 2.x, which could only be managed by Oracle VM Manager or Oracle Enterprise Manager, not both, Oracle VM 3 and above can be managed simultaneously by Oracle VM Manager along with Oracle Enterprise Manager 12c Cloud Control.
 
Oracle VM is a default Oracle Enterprise Manager 12c feature that provides Infrastructure as a Service (IaaS), Database as a Service (DaaS), and Platform as a Service (PaaS) provisioning with a self-service portal. Oracle VM can be enabled in Cloud Control by installing an Oracle Management Agent with the Virtualization plug-in on a managed Linux target with Oracle VM Manager. Once Oracle VM is enabled, Oracle VM Servers, virtual machines, Oracle VM Templates and Assemblies can be managed, monitored and provisioned with Cloud Control.
 
Tip: Oracle VM Servers, pools, storage, networks, virtual machines, templates, assemblies, etc, can be setup using Oracle VM Manager and/or Cloud Control.
 
Figure 1 shows the Infrastructure Cloud home page. The Infrastructure Cloud home page is Oracle Enterprise Manager's Oracle VM Manager equivalent. 
Oracle Enterprise Manager 12c Infrastructure Cloud
 
The Oracle Virtualization plug-in must be enabled on the Oracle Management Service host(s) as well as be deployed to the Oracle VM Manager host. The Oracle Virtualization plug-in along with the Oracle Enterprise Manager 12c agent can be managed and deployed using Cloud Control. A plug-in is an Enterprise Manager module that extends the managing and monitoring capabilities of the Oracle Management Service (OMS). Oracle Enterprise Manager 12c plug-ins have a server (OMS) and an agent (Oracle Management Agent (OMA) component. The Oracle Management Service collects plug-in data in XML format. The plug-in data is stored in the Oracle Management Repository (OMR) and is visualized by the Oracle Management Service in Cloud Control.
 
Figure 2 shows each of the Enterprise Manager 12c Cloud Control components.
Oracle Enterprise Manager 12c Cloud Control components
 

Oracle VM Manager Registration Prerequisites

The following prerequisites must be meet before Oracle VM Manager can be registered in Oracle Enterprise Manager 12c Cloud Control Release 1 (12.1.0.1) and above.
  1.  Oracle Enterprise Manager Release 1 (12.1.0.1) and above.
  2. The Oracle Virtualization plug-in must be install and enabled on the Oracle Management Service.
  3. The Oracle VM Manager host must have the Oracle Management Agent (OMA) and be a monitored target in Oracle Enterprise Manager 12c Cloud Control.
  4. The Oracle VM Manager host must have the Oracle Virtualization plug-in.
  5. The preferred credentials for the Oracle VM Manager host must be configured in Oracle Enterprise Manager 12c Cloud Control.
  6. The Oracle Management Service and the Oracle VM Manager host must have consistent name resolution using DNS with both forward and reverse lookups.
  7. Oracle VM Manager 3.1 and above require TCPS authentication.
  8. Oracle Enterprise Manager Release 2 (12.1.0.2) and above with Oracle VM Manager 3.1 and above must have the Oracle VM Manager keystore imported into the Oracle VM Manager host's Oracle Management Agent keystore. 

How to enable TCPS on Oracle VM Manager 3.1 and Above

Oracle Enterprise Manager Release 1 (12.1.0.1) introduced a new security model that requires Oracle VM Manager 3.x to use tcps on port 54322 to communicate with Oracle Enterprise Manager Release 1 (12.1.0.1) and above. Oracle Enterprise Manager Release 2 (12.1.0.2) and above with Oracle VM Manager 3.1.x and above requires the Oracle VM Manager keystore to be imported into the Oracle VM Manager host's Oracle Management Agent (OMA) keystore. 
 
Enabling tcps on a fresh Oracle VM Manager installation is a two step process. The first step is to generate the keystore using the secureOvmmTcpGenKeyStore.sh script located in the /u01/app/oracle/ovm-manager-3/bin directory. The second step is to enable the tcps service using the secureOvmmTcp.sh script, which is also located in the /u01/app/oracle/ovm-manager-3/bin directory. 
 
Enabling tcps on an upgraded Oracle VM Manager system is a three step process. The first step is to download My Oracle Support patch 14067211 and untar the keystore.tar in /u01/app/oracle/ovm-manager-3/bin directory. The second step is to generate the keystore as root using the secureOvmmTcpGenKeyStore.sh script located in the /u01/app/oracle/ovm-manager-3/bin directory. The third step is to enable the tcps service as root using the secureOvmmTcp.sh script, which is also located in the /u01/app/oracle/ovm-manager-3/bin directory.
 
The next example shows how to create the keystore on the Oracle VM Manager host. As root, type the following commands, when prompted enter the keystore password (save this password!), your first and last name, the name of your organizational unit, the name of your organization, the name of your State or Province, your two-letter country code and the keystore password (TIp: use the same password as the initial keystore password):
# cd /u01/app/oracle/ovm-manager-3/bin
# ./secureOvmmTcpGenKeyStore.sh

Generate OVMM TCP over SSH key store by following steps:
Enter keystore password: password
Re-enter new password: password
What is your first and last name?
[Unknown]:  name     
What is the name of your organizational unit?
[Unknown]:  unit       
What is the name of your organization?
[Unknown]:  organization
What is the name of your City or Locality?
[Unknown]:  City
What is the name of your State or Province?
[Unknown]:  State
What is the two-letter country code for this unit?
[Unknown]:  country_code
Is CN=name, OU=unit, O=organization, L=City, ST=State, C=country_code correct?
[no]:  yes

Enter key password for <ovmm>
Re-enter new password: password
 
Next, enable the keystore using the secureOvmmTcp.sh script located in the same directory as the secureOvmmTcpGenKeyStore.sh script. As root, type the following command, when prompted enter the OVM manager user name (admin), the OVM manager user password, and the password for TCPS keystore (the keystore password that was entered 2x above):

# ./secureOvmmTcp.sh

Enabling OVMM TCP over SSH service
Please enter the OVM manager user name: username
Please enter the OVM manager user password: password
Please enter the password for TCPS key store : password
The job of enabling OVMM TCPS service is committed, please restart OVMM to take effect.
 
After successfully running the secureOvmmTcpGenKeyStore.sh and secureOvmmTcp.sh scripts, the Oracle VM Manager keystore file named ovmmCoreTcps.ks is created in the <OVM_MANAGER_HOME> directory, i.e. /u01/app/oracle/ovm-manager-3/ovmmCoreTcps.ks.
 
Tip: Before restarting Oracle VM Manager and enableding the TCP over SSH service, the Core API will be listening on 127.0.0.1/localhost tcp 54321. After restarting Oracle VM Manager, the Core API will be listening on tcps 54322 using the FQDN. To verify the listening port, as root, type "netstat -a | grep  54321" for tpc localhost, and "netstat -a | grep  54322" for tcps with FQDN.
 
Next, restart Oracle VM Manager. As root, type:

# /sbin/service ovmm stop
# /sbin/service ovmm start
 
To verify the TCP over SSH service is running, as root type:
netstat -a | grep  54322
tcp        0      0 *:54322                     *:*                         LISTEN
 
The above example shows that the TCP over SSH service is indeed running and listening on port 54233.
 
Oracle Enterprise Manager 12c Cloud Control Release 2 (12.1.0.2) and above with Oracle VM Manager 3.1.x and above requires the Oracle VM Manager keystore to be imported into the Oracle VM Manager host's Oracle Management Agent (OMA) keystore.
 

1. Export the Oracle VM Manager keystore:

As root, change to the <OVM_MANAGER_HOME> directory and type:
#<JAVA_HOME>/bin/keytool -keystore <OVM_MANAGER_HOME>/ovmmCoreTcps.ks -exportcert -alias ovmm -file <file_loc_for_certificate>

For example, as root, change to the "/u01/app/oracle/ovm-manager-3" directory, i.e. "cd /u01/app/oracle/ovm-manager-3". Next, create a keystore directory, i.e. "mkdir keystore", then change the ownership of the keystore directory to the group with the Oracle Management Agent user account, i.e. "chown :dba ./keystore". Next, type the following command and when prompted for a password, enter the Oracle VM Manager keypass password you entered in the previous examples:
 
Note: Substitute the $JAVA_HOME path and the <OVM_MANAGER_HOME> path with your paths.

# /u01/app/oracle/java/bin/keytool -keystore /u01/app/oracle/ovm-manager-3/ovmmCoreTcps.ks -exportcert -alias ovmm -file ./keystore/export.jks
Enter keystore password:
Certificate stored in file <./keystore/export.jks>
#
 
The above example exports the Oracle VM Manager keystore to a file named export.jks in the /u01/app/oracle/ovm-manager-3/keystore directory.
 
Tip: Backup the keystore directory along with the ovmmCoreTcps.ks file. If Oracle VM manager is rebuilt using the backup files will save lots of time. 
 

2. Import the Oracle VM Manager keystore into the Oracle Management Agent keystore:

As the Oracle Management Agent user (the user the owns the $AGENT_HOME), import the Oracle VM Manager keystore into the Oracle Management Agent keystore. Use the default keystore password "welcome", not the Oracle VM Manager keystore password:
 
$ cd  /u01/app/oracle/ovm-manager-3/
$ <AGENT_INSTANCE_HOME>/bin/emctl secure add_trust_cert_to_jks -trust_certs_loc ./keystore/export.jks -alias ovmm

Oracle Enterprise Manager Cloud Control 12c Release 2
Copyright (c) 1996, 2012 Oracle Corporation.  All rights reserved.
Password:

Message   :   Certificate was added to keystore
ExitStatus: SUCCESS

 
Note: Substitute the  <AGENT_INSTANCE_HOME> path and the ./keystore/export.jks path with your paths.
 

List the Oracle VM Manager keystore

You can list the Oracle VM Manager keystore using the Oracle VM Manager keystore password by typing the following command as root or the Oracle Management Agent user account:
 
Note: Substitute the $JAVA_HOME path with your path.

$ /u01/app/oracle/java/bin/keytool -list -keystore ./ovmmCoreTcps.ks
Enter keystore password:

Keystore type: JKS
Keystore provider: SUN

Your keystore contains 1 entry

ovmm, Jul 12, 2012, PrivateKeyEntry,
Certificate fingerprint (MD5): 0D:77:0D:7F:DC:EA:9C:9E:8D:59:6E:82:20:A5:FF:F7
$
 
The above examples shows the keystore alias name ovmm and the Certificate fingerprint.  
 

List the Oracle Management Agent keystore

The Oracle Management Agent keystore can be listed by typing the following command as the Oracle Management Agent user with the default "welcome" password. In this example we will confirm that the Oracle VM Manager keystore has been imported.
 
Note: Substitute the $JAVA_HOME path and the $AGENT_HOME path with your paths.

$ /u01/app/oracle/java/bin/keytool -list -keystore /u01/app/oracle/product/agent/agent_inst/sysman/config/montrust/AgentTrust.jks
Enter keystore password:

Keystore type: JKS
Keystore provider: SUN

Your keystore contains 10 entries

ovmm, Oct 4, 2012, trustedCertEntry,
Certificate fingerprint (MD5): 0D:77:0D:7F:DC:EA:9C:9E:8D:59:6E:82:20:A5:FF:F7
verisignclass1pca, Oct 20, 2009, trustedCertEntry,
Certificate fingerprint (MD5): 51:86:E8:1F:BC:B1:C3:71:B5:18:10:DB:5F:DC:F6:20
verisignclass3ca, Oct 20, 2009, trustedCertEntry,
Certificate fingerprint (MD5): 10:FC:63:5D:F6:26:3E:0D:F3:25:BE:5F:79:CD:67:67
gtecybertrustglobalca, Oct 20, 2009, trustedCertEntry,
Certificate fingerprint (MD5): CA:3D:D3:68:F1:03:5C:D0:32:FA:B8:2B:59:E8:5A:DB
entrustsslca, Oct 20, 2009, trustedCertEntry,
Certificate fingerprint (MD5): DF:F2:80:73:CC:F1:E6:61:73:FC:F5:42:E9:C5:7C:EE
entrust2048ca, Oct 20, 2009, trustedCertEntry,
Certificate fingerprint (MD5): BA:21:EA:20:D6:DD:DB:8F:C1:57:8B:40:AD:A1:FC:FC
verisignserverca, Oct 20, 2009, trustedCertEntry,
Certificate fingerprint (MD5): 74:7B:82:03:43:F0:00:9E:6B:B3:EC:47:BF:85:A5:93
gtecybertrustca, Oct 20, 2009, trustedCertEntry,
Certificate fingerprint (MD5): C4:D7:F0:B2:A3:C5:7D:61:67:F0:04:CD:43:D3:BA:58
entrustgsslca, Oct 20, 2009, trustedCertEntry,
Certificate fingerprint (MD5): 9D:66:6A:CC:FF:D5:F5:43:B4:BF:8C:16:D1:2B:A8:99
verisignclass2ca, Oct 20, 2009, trustedCertEntry,
Certificate fingerprint (MD5): B3:9C:25:B1:C3:2E:32:53:80:15:30:9D:4D:02:77:3E

 

Delete an Entry in the Oracle Management Agent keystore

An entry in the Oracle Management Agent keystore, for example the ovmm alias, can be deleted by typing the following command:
 
Note: Substitute the $JAVA_HOME path and the $AGENT_HOME path with your paths.
 
$ /u01/app/oracle/java/bin/keytool -delete -keystore /u01/app/oracle/product/agent/agent_inst/sysman/config/montrust/AgentTrust.jks -alias ovmm
Enter keystore password:
$
 
Then confirm that the entry has been deleted by typing listing the keystore, i.e.:
$ /u01/app/oracle/java/bin/keytool -list -keystore /u01/app/oracle/product/agent/agent_inst/sysman/config/montrust/AgentTrust.jks
Enter keystore password:  

Keystore type: JKS
Keystore provider: SUN

Your keystore contains 9 entries
verisignclass1pca, Oct 20, 2009, trustedCertEntry,
Certificate fingerprint (MD5): 51:86:E8:1F:BC:B1:C3:71:B5:18:10:DB:5F:DC:F6:20
verisignclass3ca, Oct 20, 2009, trustedCertEntry,
Certificate fingerprint (MD5): 10:FC:63:5D:F6:26:3E:0D:F3:25:BE:5F:79:CD:67:67
gtecybertrustglobalca, Oct 20, 2009, trustedCertEntry,
Certificate fingerprint (MD5): CA:3D:D3:68:F1:03:5C:D0:32:FA:B8:2B:59:E8:5A:DB
entrustsslca, Oct 20, 2009, trustedCertEntry,
Certificate fingerprint (MD5): DF:F2:80:73:CC:F1:E6:61:73:FC:F5:42:E9:C5:7C:EE
entrust2048ca, Oct 20, 2009, trustedCertEntry,
Certificate fingerprint (MD5): BA:21:EA:20:D6:DD:DB:8F:C1:57:8B:40:AD:A1:FC:FC
verisignserverca, Oct 20, 2009, trustedCertEntry,
Certificate fingerprint (MD5): 74:7B:82:03:43:F0:00:9E:6B:B3:EC:47:BF:85:A5:93
gtecybertrustca, Oct 20, 2009, trustedCertEntry,
Certificate fingerprint (MD5): C4:D7:F0:B2:A3:C5:7D:61:67:F0:04:CD:43:D3:BA:58
entrustgsslca, Oct 20, 2009, trustedCertEntry,
Certificate fingerprint (MD5): 9D:66:6A:CC:FF:D5:F5:43:B4:BF:8C:16:D1:2B:A8:99
verisignclass2ca, Oct 20, 2009, trustedCertEntry,
Certificate fingerprint (MD5): B3:9C:25:B1:C3:2E:32:53:80:15:30:9D:4D:02:77:3E
 
The above example shows the same keystore as in the previous example less the ovmm key.
 

How to Register Oracle VM Manager in Oracle Enterprise Manager 12c Cloud Control

The first step to register Oracle VM Manager is to authenticated to the Oracle Enterprise Manager 12c Cloud Control console. Once authenticated, click the Enterprise menu, then select Infrastructure Cloud, and click Home to access the Infrastructure Cloud page.
 
Note: Upgraded Oracle VM Manager 3.0.3 systems with TCPS enabled should be edited with the new TCPS details in Oracle Enterprise Manager. Do not de-register 3.0.x versions of Oracle VM Manager from Oracle 12c Cloud console. De-registering Oracle VM Manager wipes all of the Oracle VM target information from Oracle Enterprise Manager repository.
 
Figure 3 shows the path from the Enterprise menu.
Oracle Enterprise Manager 12c Infrastructure Cloud Home Page
 
From the Infrastructure Cloud page, there are two options to access the Register Oracle VM Manager page.
  1. Right click the Infrastructure Cloud link under the Target Navigation section, then on the submenu click Register Oracle VM Manager
  2. Click the Infrastructure Cloud drop down menu under the History menu, then click Register Oracle VM Manager.
Figure 4 shows both menu options to select Register Oracle VM Manager.
Register Oracle VM Manager
 
From the Register Oracle VM Manager page, enter the Name, EM Agent URL, Oracle VM Manager Core, Automatic Synchronization, Monitoring Credentials for Oracle VM Manager, Administration Credentials for Oracle VM Manager / Use Administration Credentials, Oracle VM Manager Console URL, then click the Submit button.
 
Figure 5 shows the Oracle VM Manager registration page with the required entries listed in Table 1.
Oracle VM Manager registration page
 
Table 1 shows the syntax of the required entries on the Oracle VM Manager registration page.
 
Table 1
Oracle VM Manager Registration Page Title
Entry Selections and Entry Syntax
  1. Name
The name entered in the “Name” text box is displayed on the Infrastructure Cloud page.
 
Tip: The name can not be changed after the Oracle VM Manager host has been registered. Consider using the hostname of the Oracle VM Manager host for the name.
  1. EM Agent URL
The EM Agent URL is selected by clicking the magnifying glass icon. A pop-up window will appear, select the Oracle VM Manager agent from the list. The EM Agent URL syntax is: “https://<AGENT-FQDN>:3872/emd/main/”
Note: The Oracle VM Manager host can be selected as long as the host is managed target by OEM with the Oracle Virtualization plug-in.
  1. Oracle VM Manager Core
Oracle VM 3.1 and above: Enter “tcps://<ORACLE VM MANAGER HOST FQDN>:54322” in the
Oracle VM Manager Core URL text box.
Up to Oracle VM 3.0: Enter “tcp://<ORACLE VM MANAGER HOST FQDN>:54321” in the
Oracle VM Manager Core URL text box.
  1. Automatic Synchronization
Select the Automatic Synchronization check box to enable automated synchronization between OMS and the Oracle VM API Core in a fixed time interval. The default time interval is 5 minutes.
  1. Monitoring Credentials for Oracle VM Manager
Enter the Oracle VM Manager admin user name and the admin password in the Monitoring Credentials for Oracle VM Manager text fields.
  1. Administration Credentials for Oracle VM Manager / Use Administration Credentials
Enter the Oracle VM Manager admin user name and the admin password in the Administration Credentials for Oracle VM Manager text fields.
 
Select the Use Administration Credentials check box.
  1. Oracle VM Manager Console URL
Enter the non-SSL Oracle VM Manager URL, i.e.http://<ORACLE VM MANAGER HOST FQDN>:7001/ovm/console/faces/login.jspx in the Oracle VM Manager Console URL text box.
  1. Submit
Once all of the information has been entered, click the Submit button to start the registration job.
 
After the Submit button is clicked, a job named REGISTEROVMMANAGER_SYSTEM is started. The REGISTEROVMMANAGER_SYSTEM job can be accessed from a link on the Job Activity page. The Job Activity page is accessed by clicking the Enterprise menu, Job, then Activity.
 
Figure 6 show the REGISTEROVMMANAGER_SYSTEM job.
REGISTEROVMMANAGER_SYSTEM job
 
Once the REGISTEROVMMANAGER_SYSTEM job successfully completes, the registered Oracle VM Manager system can be used to manage and monitor your virtual infrastructure in Oracle Enterprise Manager 12c Cloud Control. For example, storage, networking, pools, virtual machines and assemblies can be managed and monitored from Oracle VM Manager as well as from Oracle Enterprise Manager 12c Cloud Control.
 

How to Deregister Oracle VM Manager in Oracle Enterprise Manager 12c Cloud Control

The ability to quickly deregister and register Oracle VM Manager in Cloud Control is an essential lifecycle operation. When a registered Oracle VM Manager system is decommissioned or rebuild, it must be deregistered from Cloud Control before it can be registered and used again in Cloud Control.
 
Tip: To reuse a deregistered Oracle VM Manager system, a copy of the original keystore should be used for the registration job in Cloud Control. If a copy of the original keystore is not available, the previous keystore must be removed from the Oracle Management Agent, recreated, enabled and imported into the Oracle Management Agent.
 
The first step to Deregister an Oracle VM Manager system is to authenticated to Cloud Control. Once authenticated, click the Enterprise menu, then select Infrastructure Cloud, and click Home to access the Infrastructure Cloud page. From the Infrastructure Cloud page highlight and right click the Oracle VM Manager system to be Deregistered, click the Deregister menu item to proceed.
 
Figure 7 shows how to access the menu to Deregister Oracle VM Manager.
Deregister Oracle VM Manager Oracle Enterprise Manager 12c
 
From the Confirmation page click the Deregister Oracle VM Manager button to submit the DEREGISTEROVMMANAGER_SYSTEM job.
 
Figure 8 shows the Deregister Oracle VM Manager confirmation page.
Deregister Oracle VM Manager Confirmation Oracle Enterprise Manager 12c
 
From the Confirmation page click Close to close the Confirmation page or click the Job Details button to access the Job Activity page to track the progress of the DEREGISTEROVMMANAGER_SYSTEM job.
 
Figure 9 shows the Confirmation page with the Job Details and Close buttons.
Deregister Oracle VM Manager Job Details Oracle Enterprise Manager 12c
 
Once the DEREGISTEROVMMANAGER_SYSTEM job successfully completes, the registered Oracle VM Manager system and all of its targets are removed from Cloud Control.
 
From the Job Activities page click the Status link to view the job details and if necessary to review and troubleshoot any failed operations.
 
Figure 10 shows the Job Activities page.
Deregister Oracle VM Manager Job Activity Oracle Enterprise Manager 12c
view counter