Вы находитесь на странице: 1из 64

VMware vSphere:

Troubleshooting Workshop
Lab Manual
ESXi 6.5 and vCenter Server 6.5

VMware® Education Services


vmware® VMware, Inc.
www.vmware.com/education
VMware vSphere:
Troubleshooting Workshop
ESXi 6.5 and vCenter Server 6.5
Part Number EDU-EN-VTSW65-LAB (6/2017)
Lab Manual
Copyright© 2017 VMware, Inc. All rights reserved. This manual and its accompanying materials
are protected by U.S. and international copyright and intellectual property laws. VMware products
are covered by one or more patents listed at http://www.vmware.com/go/patents. VMware is a
registered trademark or trademark of VMware, Inc. in the United States and/or other jurisdictions.
All other marks and names mentioned herein may be trademarks of their respective companies.
The training material is provided "as is," and all express or implied conditions, representations,
and warranties, including any implied warranty of merchantability, fitness for a particular purpose
or noninfringement, are disclaimed , even if VMware, Inc., has been advised of the possibility of
such claims . This training material is designed to support an instructor-led training course and is
intended to be used for reference purposes in conjunction with the instructor-led training course.
The training material is not a standalone training tool. Use of the training material for self-study
without class attendance is not recommended.
These materials and the computer programs to which it relates are the property of, and embody
trade secrets and confidential information proprietary to, VMware, Inc., and may not be
reproduced , copied, disclosed, transferred , adapted or modified without the express written
approval of VMware, Inc.

www.vmware.com/education
CONTENTS

Lab 1 Using the Command Line .. .. .... .. ..... . ................ . .. .. ..... . .... . . .... 1
Lab 2 Adding vSphere Management Assistant to Active Directory ........ .. .... .. ... . . . .... 7
Lab 3 Searching Log Files ....... . .... . . . .. .. . . .... . . .. ..... . . . . .. .. . . .. . . .. . . . .. .. 13
Lab 4 Searching Log Files . . ...... . ..... . ........... . ... ... ....... .. ... . .. .... . ... . 17
Lab 5 Troubleshooting Network Problems .. ..... . ....... . ........ . .. . ...... . .... . . ... 23
Lab 6 Troubleshooting Storage Problems ... . . .. . .. . . . .. . . . . .. . . .. .... . . . . . . .... . . . ... 27
Lab 7 Troubleshooting Cluster Problems . .. ..... . .. . .. . ..... . ....... . ...... . ..... . ... 31
Lab 8 Troubleshooting Virtual Machine Problems . . . . . .. ..... . .. . ..... .. .... . ...... . ... 35
Lab 9 Managing the PostgreSQL Database . . ..... . ..... . ..... . .... . ......... . ..... . ... 39
Lab 10 Troubleshooting vCenter Server and ESXi Host Problems ... . .. ... .... .. .. .... . ... . 4 7
Lab 11 (Optional) Working with Certificates .. .... .. . . .. . . .. . .. . . . . . . . . .... .... . . . . . .. 51
Answer Key . ........... . ..... . . . ..... . ................... . ... .. ...... . . ... ...... 67

iii
iv VMware vSphere: Troubleshooting Workshop
Lab 1 Using the Command Line

Objective: Use the command line to review the ESXi host


configuration
In this lab, you perform the following tasks:

1. Access Your Student Desktop System


2. Validate the vSphere Licenses
3. Directly Access the DCUI of the ESXi Host
4. Remotely Access the DCUI of the ESXi Host
5. Use ESXCLI Commands to Verify the Host Hardware Configuration
6. Use ESXCLI Commands to Verify the Storage Information
7. Use ESXCLI Commands to Verify the Virtual Switch Information

Task 1: Access Your Student Desktop System


You access and log in to your student desktop system.
Use the following information from the class configuration handout:
• Student desktop system name or IP address
• Student desktop system user name
• Student desktop system password
1. Ask your instructor how to use Remote Desktop Connection (RDC) to access the student
desktop system.
2. Log in to the student desktop system.

1
Task 2: Validate the vSphere Licenses
You log in to the VMware vCenter Server® system and determine whether the VMware vSphere®
licenses are valid. If the licenses have expired, you add valid licenses to the vCenter Server system
and VMware ESXi™ hosts.
1. Open the Internet Explorer web browser.
2. Select the vSphere Web Client favorite to connect to VMware vCenter® Server Appliance™
at https://sa-vcsa-01. vclass. local/vsphere-cl ient.
3. On the VMware vCenter Single Sign-on page, enter the vCenter Server user name
adrninistrator@vsphere. local and the user password VMwarel ! and click Login.

4. Point to the Home icon and select Administration.


5. In the Navigator pane, select Licenses.
6. Click Assets.
7. Verify that the required assets are licensed.
The following assets should be licensed:
• sa-vcsa-01.vclass.local under vCenter Server systems
• sa-esxi-01. vclass. local under Hosts
• sa-esxi-02.vclass.local under Hosts
An asset is licensed if the license expiration date is in the future and the status in the Is Licensed
column is Yes.
8. If the licenses are not expired, go to task 3.
9. If the licenses are expired, ask your instructor for help.

2 Lab 1 Using the Command Line


Task 3: Directly Access the DCUI of the ESXi Host
You directly access the ESXi host's Direct Console User Interface. Accessing the DCUI directly is
useful when troubleshooting vSphere problems.
Your instructor will provide the following information:
• VMware vCloud Director® URL
• vCloud Director user name
• vCloud Director password
• Classroom vApp name

IMPORTANT
The steps in this task are specific to the OneCloud lab environment. If you are using a OneCloud lab
environment, you can perform this task. If you are not using a OneCloud environment, you must
skip this task. Your instructor can tell you how to access the ESXi host's DCUI in your lab
environment.
1. From the first RDC session where you logged in to the virtual data center lab environment,
open the Internet Explorer web browser and enter the vCloud Director URL.
2. Use the vCloud Director user name and password to log in to vCloud Director.
3. On the Home page, find your classroom vApp and click the Open link.
4. In the center pane, click the Virtual Machines tab.
5. Right-click the SA-ESXi-01 host and select Popout Console.
6. If a window warns that a newer version of the Client Integration Plug-In is available, click
Cancel.
7. Click in the console window and press F2 to log in to the host with the ESXi host login name
(root) and the user password VMware 1! .
8. Use the up and down arrow keys to view the menu selections.
9. Navigate to the Troubleshooting Options menu and press Enter.
10. Select Enable ESXi Shell and press Enter to activate it.
11. Select Enable SSH and press Enter to activate it.
12. Press Esc until you are logged out of the DCUI.
13. Press Ctrl+Alt to release the insertion point from the ESXi console window.
14. Minimize or close the console window, and return to the first student desktop RDC session.
15. Right-click the SA-ESXi-02 host and select Popout Console.

Lab 1 Using the Command Line 3


16. If a window warns that a newer version of the Client Integration Plug-In is available, click
Cancel.
17. Click in the console window and press F2 to log in to the host with the ESXi host login name
(root) and the user password VMware 1!.
18. Use the up and down arrow keys to view the menu selections.
19. Navigate to the Troubleshooting Options menu and press Enter.
20. Select Enable ESXi Shell and press Enter to activate it.
21. Select Enable SSH and press Enter to activate it.
22. Press Esc until you are logged out of the DCUI.
23. Press Ctrl+Alt to release the insertion point from the ESXi console window.
24. Minimize or close the console window and return to your student desktop RDC session.

Task 4: Remotely Access the DCUI of the ESXi Host


You access the ESXi host's DCUI from an MTPuTTY session. Accessing the DCUI remotely is
useful when troubleshooting vSphere problems.
1. On your desktop system, double-click the MTPuTTY icon.
2. Double-click the entry for the SA-ESXI-01 host and click Yes.
The session automatically connects as root. If the connection does not automatically complete,
you must manually log in with the ESXi host login name (root) and the user password
VMwarel!.
3. At the command prompt, enter dcui.
4. Press F2 to display the login screen, and enter the ESXi host login name (root) and the user
password VMwarel ! .
5. View the default gateway of the host.
a. Using the down arrow key, select Configure Management Network and press Enter.
b. Select 1Pv4 Configuration and view the IP configuration in the right pane.
c. Press Esc to return to the main menu.
6. Use the up and down arrow keys to view the other menu selections.

IMPORTANT
You must not change any settings.
7. Close the SA-ESXi-01 tab.

4 Lab 1 Using the Command Line


Task 5: Use ESXCLI Commands to Verify the Host Hardware
Configuration
You use the command-line interface to verify the hardware configuration of the vSphere
environment.
1. Double-click the entry for the SA-ESXI-01 host.
2. Verify the hardware configuration, based on the lab topology guide provided by yo ur
instructor.
a. At the command prompt, enter esxcli hardware clock get to verify the time and
date on the host.
b. Enter esxcli hardware cpu list to verify the number of CPUs on the host.
c. Enter esxcli hardware memory get to verify the host memory.
d. Enter esxcli hardware pci list to verify the PCI address of vmnic5 .

Task 6: Use ESXCLI Commands to Verify the Storage Information


You use the command-line interface to verify the storage configuration of the vSphere environment.
1. Verify the lab configuration, based on the lab topology guide provided by your instructor.
a. At the command prompt, enter esxcli storage vmfs extent list to verify the
number of VMware vSphere® VMFS extents that are available to the host.
b. Enter esxcli storage core adapter list to verify the SCSI host bus adapters.
c. Enter esxcli storage core path stats get to verify the SCSI path statistics.
d. Enter esxcli storage filesystem list to verify the datastores available to each host.
e. Enter esxcli storage nfs list to verify the information about the NFS datastores
available to each host.

Lab 1 Using the Command Line 5


Task 7: Use ESXCLI Commands to Verify the Virtual Switch
Information
You use the command-line interface to verify the virtual switch configuration of your vSphere
environment.
1. Verify the lab configuration, based on the lab topology guide provided by your instructor.
a. At the command prompt, enter esxcli network ip dns server list to verify the IP
address of the DNS server.
b. Enter esxcli network nic list to verify the physical NICs on the default target host.
c. Enter esxcli network vswitch standard list to verify that a standard switch is
available to the host.
d. Enter esxcli network vswi tch dvs vmware list to verify the available distributed
switches.
e. Enter esxcli network vswitch standard portgroup list I less to verify the
standard switch port groups.
f. Enter esxcli network ip interface list I less to verify the VMkemel
interfaces on the host.
g. Enter esxcli network ip interface ipv4 get to verify the IP address and subnet
mask of the VMkernel interfaces on the host.
h. Enter esxcli network ip route ipv4 list to verify the default gateway address for
the VMkernel interfaces on the host.

6 Lab 1 Using the Command Line


Lab 2 Adding vSphere Management
Assistant to Active Directory

Objective: Configure vSphere Management Assistant to use


Active Directory
In this lab, you perform the following tasks:

1. Log In to vSphere Management Assistant


2. Add the vSphere Management Assistant Instance to an Active Directory Domain
3. Configure the Target Server
4. Use the more and less Commands
5. Use vicfg-* Commands to Verify the Virtual Switch Information
6. Use vmware-cmd Commands to Verify the Virtual Machine Information

7
Task 1: Log In to vSphere Management Assistant
You start an MTPuTTY session to log in to VMware vSphere® Management Assistant.
1. On your student desktop system, double-click the MTPuTTY icon.
2. In the Servers pane on the left, double-click SA-VMA-01.
3. If a PuTTY Security Alert dialog box appears, click Yes to accept and cache the server 's
host key.
You are automatically logged in as the vi-admin user.
The vSphere Management Assistant Command Prompt window opens.

Task 2: Add the vSphere Management Assistant Instance to an Active


Directory Domain
You join the vSphere Management Assistant instance to the class Active Directory (AD) domain.

IH•iii
All commands are case-sensitive.
1. Run the sudo domainj oin- c li join command to join the vSphere Management Assistant
instance to the vclass.local AD domain.
sudo domainjoin-cli join vc l ass. l ocal administrator

2. When prompted for the vSphere Management Assistant user password, enter VMwarel ! .
3. When prompted for the domain administrator password, enter VMwarel ! .
For help with the sudo command, you can enter sudo -h.

4. Verify that the command successfully completes.

IMPORTANT
If a warning appears recommending that you reboot the system, you must not reboot the system.

5. Verify that the vSphere Management Assistant instance is part of an AD domain.


sudo domainjoin-cli query

6. If prompted for the vSphere Management Assistant user's password, enter VMwarel ! .
7. Leave the vSphere Management Assistant window open for the next task.

8 Lab 2 Adding vSphere Management Assistant to Active Directory


Task 3: Configure the Target Server
You log in to the vSphere Management Assistant system and configure the target server.
1. Run the v ifp addserver command to add your vCenter Server Appliance instance as a target
server.
vifp addserver sa-vcsa-01.vclass.local --authpolicy fpauth -- username
administrator@vclass.local

2. Enter VMwarel ! .
3. When prompted with a security warning message, enter yes to continue.
4. Add your first ESXi host as a target server.
vifp addserver sa-esxi-01.vclass.local --authpolicy fpauth --username root

5. Enter VMwarel ! .
6. If you are prompted with a security warning message, enter yes to continue.
7. Add your second ESXi host as a target server.
vifp addserver sa-esxi-02.vclass.local --authpolicy fpauth --username root

8. Enter VMwarel ! .
9. If you are prompted with a security warning message, enter yes to continue.
10. Verify that all the target servers, which include your vCenter Server system and both of your
ESXi hosts, are added properly.
vifp lis tservers

11. Store the thumbprint of the first ES Xi host.


a. Enter esxcli --server sa-esxi-01 . vclass . local .
An error message indicates that the connection to the host failed. The error message also
displays the thumbprint of the ESXi host.
b. Select the thumbprint text and copy it to the clipboard.
c. Enter the command to store the thumbprint.
/ usr /l ib /vmware- vcli/apps/general/credstore_admin.pl add --server
sa-esxi-01.vclass.local --thumbprint thumbprint

For example:
/ usr /l i b/vmware - vcli/apps/general/c redstore_admin.pl add --server
sa-esxi-01.vclass.local --thumbprint
OE:D8:85 :D9 : 32 : 9B :O O:D8 : 94 :01:CC: 76:99 :B5:76:F9 : 9B : 19 :99 :4 3

d. Verify that the New entry added successfully message appears.

Lab 2 Adding vSphere Management Assistant to Active Directory 9


12. Store the thumbprint of the second ESXi host.
a En~resxcli --server sa-esxi-02.vclass.local.
b. Enter the user name root.
An error message indicates that the connection to the host failed. The error message also
displays the thumbprint of the ES Xi host.
c. Select the thumbprint text and copy it to the clipboard.
d. Enter the command to store the thumbprint.
/usr/lib/vmware - vcli/apps/general/credstore admin . p l add -- server
sa-esxi-02.vclass.local --thumbprint thumbprint

For example:
/usr/lib/vmware - vcli/apps/general/credstore admin.p l add --s erver
sa-esxi-02.vclass.local --thumbprint
OE:D8:85:D9:32:9B:OO:D8:94 : 01:CC : 76:99 : B5:76:F9 : 9B : 19 : 99:43

e. Verify that the New entry added successfull y message appears.


13. Set the target server.
vifptarget -s sa-esxi-01.vclass.local

14. After running the command, verify that the name of the ESXi host is displayed as part of the
command prompt.
For example:
vi -admin @vma : ~> vifptarget -s sa-esxi-01.vclass.local
vi -admin @vma : ~ [sa-es xi - 01.vclass.loca l] >

For help with vSphere Management Assistant commands, you can use the --help option:
• esxc li --help
• vifp --help
• vi f ptarget --help

10 Lab 2 Adding vSphere Management Assistant to Active Directory


Task 4: Use the more and less Commands
You use the mo re and le s s commands to page through the command output.
1. Display help information for the esxcli command.
esxcl i --he lp

The command does not pause after each screen of information.


2. Use the mo re command to display help information for the e s xcl i command.
es xc li --help I mo re

The mo re command only scrolls down.


a. Press Enter to advance one line at a time.
b. Press the spacebar to scroll one screen at a time.
3. Use the less command to display help information for the esxcl i command.
esxcl i --help I l ess

a. Press Ctrl+F to go forward in the output.


b. Press Ctrl+B to go backward in the output.
c. Use the up and down arrow keys to navigate backward and forward one line at a time.
d. Press Q to quit the les s command and return to the command line.
4. Display help information for the v ifp command.
v ifp --help

5. Display help information for the v ifp t arge t command.


v ifpt a r ge t --he l p

Task 5: Use vicfg-* Commands to Verify the Virtual Switch Information


You use the command-line interface to verify the virtual switch configuration of your vSphere
environment.
1. If your target is not set to sa-esxi-01.vclass.local, enter the vifptarget -s sa-esxi-
01. vclass. local command.

2. At the command prompt, enter vicfg-vmknic -1 to verify the IP address and subnet mask of
the VMkernel interfaces on the host.
3. Enter vicfg-route -1 to verify the default gateway address for the VMkernel interfaces on
the host.

Lab 2 Adding vSphere Management Assistant to Active Directory 11


Task 6: Use vmware-cmd Commands to Verify the Virtual Machine
Information
You use the command-line interface to verify the information about virtual machines in the vSphere
environment.
1. At the command prompt, enter vmware-cmd -1 to verify the number of virtual machines on
the host.
2. Enter vmware-cmd path_ to_ the_. vmx_fil.e hassnapshot to verify that the virtual
machine has a snapshot.
path_to_the_.vmx_file is the path information, which you can copy from the command output in
step 1.
For example, if the virtual machine name is linux-a-01 and it is located on the datastore named
54f7ftf9-757c9064-548b-005056011403, then you can use the following command:
vmwa re- cmd /vmfs /vo lume s/54 f7fff9- 7 57 c9064 - 548b- 005056011403/ li nux- a -
01/linux-a-01 . vmx hassnapshot

If the command returns has snapshot () = O, the virtual machine has no snapshots. If the
command returns has snapshot () = 1, the virtual machine has at least one snapshot.
3. Enter vmware-cmd pa th_ to_ the_. vmx_ fil.e gets ta te to view the state information
about the virtual machine.
For example, to view the state of the linux-a-01 virtual machine, you can use the following
command:
vmware- cmd /vmfs /vo lume s/54 f7fff 9- 757c9064 - 548b- 005056011403/ li nux- a -
01/linux - a - 01 . vmx ge tstat e

4. Enter vmware-cmd path_ to_ the_. vmx_fil.e getuptime to view the uptime for the
virtual machine.
5. Close the MTPuTTY session.

12 Lab 2 Adding vSphere Management Assistant to Active Directory


Lab 3 Searching Log Files

Objective: Search log files for events


In this lab, you perform the following tasks:

1. Modify the vSphere Environment


2. Extract Log Files from vCenter Server
3. Search Log Files for Event Information

Task 1: Modify the vSphere Environment


You log in to VMware vSphere® Web Client and make changes to the vSphere environment.
1. Open vSphere Web Client if it is not active.
a. Open the Internet Explorer web browser.
b. Select the vSphere Web Client favorite to connect to vCenter Server Appliance at https://
sa-vcsa-01. vclass. local/vsphere-client.
c. IfyouseetheThere is a problem with this website's security
ce r t ifi cate warning message, click the Continue to this website (not recommended)
link to proceed.
d. On the VMware vCenter Single Sign-on page, enter the vCenter Server user name
administrator@vsphere .1oca1 and the user password VMwarel ! and click Login.

2. On the vSphere Web Client Home page, point to the Home icon and select Hosts and Clusters.
3. In the Navigator pane on the left, select sa-vcsa-01.vclass.local.
4. In the middle pane, click the Configure tab.
5. Click General.
6. Click Edit.

13
7. In the Edit vCenter Server Settings dialog box, click Logging settings.
8. Select verbose from the Logging options drop-down menu.
9. Click OK to close the Edit vCenter Server Settings dialog box.
10. In the Navigator pane, expand the vCenter Server inventory.
11. Right-click sa-esxi-01.vclass.local and select Add Networking.
12. On the Select connection type page, click Virtual Machine Port Group for a Standard
Switch and click Next.
13. On the Select Target Device page, click New standard switch and click Next
14. On the Create a Standard Switch page, click Next.
15. If you see a warning that no physical network adapters for the switch exist, click OK.
16. On the Connection Settings page, enter your_name_yortgroup in the Network label text box
and click Next.
For example, if your name is Thomas, create a port group named Thomas_portgroup.
17. On the Ready to Complete page, click Finish.
18. Click the Networks tab.
19. Verify that the network that you created appears in the list.

Task 2: Extract Log Files from vCenter Server


You use vSphere Web Client to collect log files from your ESXi host and vCenter Server system,
and save them to your desktop.
1. In vSphere Web Client, point to the Home icon and select Hosts and Clusters.
2. Select sa-vcsa-01.vclass.local and click the Monitor tab.
3. Click System Logs and click Export System Logs.
4. On the Source page, select sa-esxi-01.vclass.local.
5. Select the Include vCenter Server and vSphere Web Client logs check box and click Next.
6. On the Ready to Complete page, click Finish.
7. Click Save to save the default file name to the desktop.
Generating the log bundle takes a few minutes to complete.

14 Lab 3 Searching Log Files


Task 3: Search Log Files for Event Information
You search the log files for the time that you performed the system changes in task 1.
1. On the desktop of your student desktop machine, right-click the ZIP file that you downloaded in
task 2 and select 7-Zip > Open archive.
2. In the window that opens, double-click the sa-vcsa-01.vclass.local-vcsupport timestamp.tgz
file.
3. Double-click the vc-sa-vcsa-01.vclass.local-timestamp.tgz file .
4. Double-click the vc-sa-vcsa-01. vclass.local-timestamp directory.
5. Navigate to the. /var/ l og/vmware/vpxd directory.
6. Right-click the vpxd-##.log file and select Edit.
##correlates with the current version of the vpxd. l og file. By default, the current log file is in
. log format. Older log files are compressed and have a . gz extension.

7. In the editor window, press Ctrl+F.


8. Use the Find function to locate text in the log file .
a. Use the Find function to discover errors (if any) in the file.
b. Use the Find function to discover the time that the your_name_portgroup creation process
was completed.
c. Use the Find function to discover whether the your_name_portgroup creation process
reported any errors.
If you cannot find any information relating to your_name_portgroup, you can extract and
open an older log file.
9. Close the editor window and the 7-Zip window, and return to vSphere Web Client.

Lab 3 Searching Log Files 15


16 Lab 3 Searching Log Files
Lab 4 Searching Log Files

Objective: Use vRealize Log Insight to monitor the health of


vSphere systems
In this lab, you perform the following tasks:

1. Log In to vRealize Log Insight


2. Search and Filter Log Events
3. Use Interactive Analytics Charts
4. Use Dynamic Field Extraction
5. Clean Up for the Next Lab

17
Task 1: Log In to vRealize Log Insight
You log in to VMware vRealize® Log Insight™ and make changes to the vSphere environment.
1. Open the Internet Explorer web browser.
2. Open a new tab if vSphere Web Client is running.
3. Select the vRealize Loglnsight favorite .
4. Click the Continue to this website (not recommended) link.
5. Enter the user name admin and the user password VMwarel ! and click Login.
6. Click the icon to the right of the admin user (three horizontal bars) in the upper right and select
Administration.
7. Click vSphere under Integration in the left pane.
The vRealize Log Insight appliance should be integrated with vCenter Server Appliance (sa-
vcsa-01. vclass.local ).
8. Click TEST CONNECTION.
9. If the Test successful message does not appear, ask your instructor for help.

Task 2: Search and Filter Log Events


You use vRealize Log Insight to search and filter log events.
1. Click Interactive Analytics.
2. From the time-interval drop-down menu, select Latest 6 hours of data.
3. Enter portgroup in the search box to the left of the time-interval drop-down menu.
You should see the creation of the port group with your name from lab 3. You might have to
scroll down to find the log entry. The text portgroup should be selected. The event should be
a HostChanged event that occurred on sa-esxi-01 .vclass.local.

2017- IB - 29Ti8 : 39':1 2. 0l 2.Z s a- a sxi - 01 . vclas s .loca l Ypxa1: verbose vpx.a [60A5870] [Or iginator@5875 su~-vpxa MvtHos t op
Hos t th<i ngOOll configtt;l nage!"_ nH..-orlkSy.s t eiii: neb>Ol"kI n fo. po!"tgtc:ru:p[ ".k ey- vim. host _PO!"t G!"oup- Danid z_pol"t gl"ou p• l
OOUJOO Cl\lent_typQ h~tname appneime lllTIW_QSXJ_seVl'!rlty vmw_ oplc:I

4. Point to the space to the left of the time stamp on the event that records the creation of your port
group.
A settings icon (gear) should appear.
5. Click the settings icon and select View Event in Context.
You should see the events that occurred before and after your event.
6. Close the window.

18 Lab 4 Searching Log Files


Task 3: Use Interactive Analytics Charts
You use interactive analytics charts to analyze data.
Your vRealize Log Insight appliance should be displaying interactive analytics with po r t g roup in
the search box. The event where you created a port group should be visible.
1. Click hostname in your event.

2017- 0 3- 29Tl8:39: 12.012Z sa - ~xi -01.vcla.ss.local Ypxa: venl>ose YJ)xa[60A5970] [Or'iginato


[•key- viIll. hos t _Vi r't u alSwi t ch.- vSwi t c.h 2 •] , rtet •'l'.)r'kI.n.fo. por'lgr-ou,p[ • key- virll. host . POr't Gr'ou,p-
vim _hos t . Yir-tu,alSi.,i tch- vSoJi tdt0"] .n:umPor-tsA.vailable, ne t wor-krnfo_ pmxySi.,i tch.["OvsPor'tse
rouroo ewnt_type ~ ~ appname vmw_esx1_s9vertty vmw_oplcl

2. Click View Chart.


You should see two bar graphs, one for each ESXi host, under your event.
2017 - 03 - 29TlB :39 :1 2.012Z sa- £.Sxi - 01.vclass.local Vpxa: venbose v pxa[ 60A.5970] [Or-igirtator@6B76
["ltey- vim. hos t . Virt •u alS.Wi tc.h-vS-~·i t c.h2"], 1net •..or-kinfo.por-tgr-oup["key- v i m. host. Port Grou,p- Oaniel
vim. hos t. Vi r'tu.a.lSwi t ch- vSwi t ch.0"] .numPortsAvaila ble , net ..'l'.)r'kir\fo.pr-oxySoJi t ch["OvsPor-t.set-0"] _
00\l'OO ewnt_type h~tname appname vmw_esx1_s9wrtty vmw_opld

hoomame
hostname: s~l-02.vciassJocal
100
72

3. Click the second bar graph (sa-esxi-02.vclass.local).


You see all events related to port groups on the sa-esxi-02.vclass.local host.
The second filter is set to hostname contains sa-esxi-02.vclass.local.

[ portgroup

x hostname v contains v sa-esxi-02.vclass:Jocal

+ADD F I LTER X CLEAR AL L FILTERS

4. Click the X to the right of sa-esxi-02.vclass.local to delete that filter.

Lab 4 Searching Log Files 19


5. Enter sa-esxi-01 in the hostname filter box.

[ portgroup

X hostname v contains
~~~~~~~-
v sa-es~ I
Sil-eSXl- 02
+ADD FILH R x; CLEA R A LL FILT ERS
sa-esxl-01
Events Field T11ble Event Types Event Trends

2017-03-10 Wl7 - 03 - 10129:91: 2S.. 992Z sca -~xi - 92 . vcfa s:s .loc.al Ho:std: i nf,
12:01:28.935 5-d:- 26 f 8 Ill W ld 9d 26 de: portgroup dlvportgroup- 36

6. Click the search icon to the right of the time-range drop-down menu.
The chart shows port group events related to sa-esxi-01 .
7. Select Line from the Chart Type drop-down menu.

The chart changes to a line graph.

20 Lab 4 Searching Log Files


Task 4: Use Dynamic Field Extraction
You use dynamic field extraction to get detailed log information related to a specific event.
Your vRealize Log Insight appliance should show interactive analytics with p o r tg r o u p in the
search box. hostname contains sa-esxi-01 should be the second filter.
1. Locate the event that shows the creation of the new port group, yourname_portgroup.
2. Select the text ["key-vim.host.PortGroup-yourname_portgroup"].
3. Point to the selected text and select Contains '["key-vim ... '.
This action adds to your filter any references to your port group on sa-esx-01.

vmw_user
Ad'cd Filter: x
l[B9709o&] [Orig inat or@68
Id 26 de portgroup dvpor Contains '["key-vim _~·--'
vmw_user
Does not contein '["~y-vim.lio___,
l[OS.M.876] [Orig i na,t or-@68
~d26· de portgroup dvpor
vmw_user Extract field

4. Return to vSphere Web Client.


5. Click Networks.
6. Right-click SA Datacenter and select New Folder> New Network Folder.
7. Enter Test-Network-Folder in the folder name text box and click OK.
8. Right-click your port group, select Move To> Test-Network-Folder, and click OK.
9. Return to vRealize Log Insight.
10. Change the time interval to Latest hour of data.

Lab 4 Searching Log Files 21


11. Click the search icon.
You should see both the event where the port group was created and the event where the port
group was moved to a folder.

portg roup

!: Mf!tc:h all y of the followtng filters:

X text v contains v [key-vim.hostportgroup-thomss_portgroup]

X hostname v contains v sa-esxi-01

+ADD FILTrn x CLEAR A LL FILHRS

Events Field Table Event Types Event Trends

20f7-03-29 2017-1'13- 29T20:29:4l.577Z sa- esxi - 0Lvclass.loca l Vpxa: verbose vpxa[A3AEB70] [0riginator@6876 sub---vpxarnvtHost
13:29".38.066 {3729) : HostCh,a nged lc:o nfigHa n.ager-. net workSyst em: networkinfo.por-tgroup["key- viaL hos t. F'or-tGroup- Tnoaias_por-tgr-oup'
source event_type h0&tname appname \llllW~everny vmw_opld

20f7-03-29 2017-1'13- 29T20:29: 42.. 576Z sa- esxi - l'!Lvclass.loca l Vpxa: verbose vpxa[A3AEB71'1] [0riginator@6876 sul:i=halservic:es <
13:29:38.066 pro;p0r-ties c:nangM [ net..-orkin,fo. vswi t e h["key- villL host. Vi rtualS...i t c:h- vSwi t c:hl •], net..'()r'lc!nfo. portgroup["key- villl .
villl . host. Vi rtualSwi tc:h-vS>..i t eh0" ]. nui:nf'ortsAva ila ble, net..-orkinfo.pro><y'.i>Nitc:h["Ovs:Po.-tse t - 0"] . numPortsAva ila ble:
sotice event_typl;l hos.mame appname \llllW_~everny vmw_opld

12. Log out of vRealize Log Insight.


13. Minimize or close your browser window.

Task 5: Clean Up for the Next Lab


You delete the virtual switch that you created in an earlier lab.
1. In vSphere Web Client, point to the Home icon and select Hosts and Clusters.
2. Select sa-esxi-01.vclass.localand and select Configure.
3. Expand Networking and select Virtual Switches.
4. Select vSwitchl and click the Remove selected standard switch icon (red X) to remove the
virtual switch, including the port group that you created.
5. Click Yes to confirm.
6. Minimize or close your browser window.

22 Lab 4 Searching Log Files


Lab 5 Troubleshooting Network
Problems

Objective: Identify, diagnose, and resolve virtual networking


problems
In this lab, you perform the following tasks:

1. Run a Break Script


2. Verify That the System Is Not Functioning Properly
3. Troubleshoot and Repair the Problem
4. Verify That the Problem Is Repaired
Several break scripts are provided to create network problems. Each script damages networking in
the lab environment in a different way. You can run the break scripts in any order. And you can
choose which problems to resolve.

Task 1: Run a Break Script


You use VMware PowerCLI™ to run a break script to damage networking in the lab environment.

IMPORTANT
After the break script completes, do not run another break script until you complete tasks 2 through
4 for each network problem. You must run the scripts one at a time.
1. Double-click the PowerCLI icon on the student desktop system to start a PowerCLI session.
2. In the PowerCLI window, enter cd \materials\scripts\mod4.

23
3. Enter the name of a break script.
For example, you enter . \break-5-1 . psl to run the first break script.
In the Difficulty column, I = least difficult and 3 = most difficult to resolve.

Break Script Difficulty


.\break- 5 - 1.psl

2 .\break- 5 - 2.psl 2

3 . \break- 5-3.psl 3

4 . \break- 5 - 4.psl 2

5 .\break- 5 - 5.psl 3

6 . \break- 5 - 6 .psl 3

7 . \break- 5 - 7.psl 3

4. Wait until the You are ready to start the lab message appears.
5. Leave the PowerCLI window open for the next problem and go to task 2.

24 Lab 5 Troubleshooting Network Problems


Task 2: Verify That the System Is Not Functioning Properly
You verify that networking is damaged in your lab environment.
1. Use the trouble ticket summary information to verify that you see the symptoms reported for
your break script and that your lab environment is not working.

•U·Hi
The first time you open a virtual machine console, you are prompted to click either Web
Console or VMware Remote Console. You must click Web Console.

Break Script Trouble Ticket


. \break- 5 - 1.psl The linux-a-01 virtual machine cannot ping its default gateway,
172.20.11.10.

2 . \break- 5 - 2 .psl The linux-a-04, linux-a-05, linux-a-09, and linux-a-10 virtual machines
are no longer accessible over the network. You cannot open a remote
console to them. The CONTENT-LIBRARY-STORAGE, NFSOl, and
Shared datastores are also marked as inactive or inaccessible.

3 . \break- 5 - 3 . psl The sa-esxi-01 host is not responding in the inventory.


It might take a few minutes for this problem to become apparent
after you run the break script.

4 . \break- 5 - 4 .psl Users on the linux-a-01 and linux-a-02 virtual machines can no longer
communicate with each other. The IP address for linux-a-01 is
172.20.11.200. The IP address for linux-a-02 is 172.20.11.201.

5 . \break-5-5 .psl Users on the following virtual machines have reported total network
communication failures: linux-a-01 , linux-a-02, linux-a-03, and linux-
a-04.

6 . \break- 5 - 6 .psl A vSphere administrator cannot move the linux-a-02 virtual machine
to the Production-A port group.

7 . \break- 5 - 7 .psl A vSphere administrator reports seeing the message The vSphere
distributed switch configuration on some hosts
differed from that in vCenter Server. The administrator
sees the message in the Networking> LabVDS >Summary pane
of vSphere Web Client.
After you fix the problem, the error message disappears within a few
minutes.

2. Go to task 3.

Lab 5 Troubleshooting Network Problems 25


Task 3: Troubleshoot and Repair the Problem
You use the techniques and tools presented in the lecture manual to troubleshoot and repair the
problem with the network.
1. Use the available techniques and tools to troubleshoot and repair the problem.
• The lab topology handout
This handout contains important information about the network, storage, host, and virtual
machine configurations.
• Lecture manual for this course
• Virtual machine, vCenter Server, and ESXi host log files
• vRealize Log Insight
• VMware knowledge base articles, available at http://kb.vmware.com
• The Internet
2. Go to task 4.

Task 4: Verify That the Problem Is Repaired


You verify that the virtual network is repaired.
1. Reread the trouble ticket summary information in task 2.
2. Use vSphere Web Client and remote consoles as needed to verify that the problem is resolved.
3. Leave vSphere Web Client open until you complete all network troubleshooting problems.
4. Return to task 1 and run the next break script.

26 Lab 5 Troubleshooting Network Problems


Lab 6 Troubleshooting Storage Problems

Objective: Identify, diagnose, and resolve virtual storage


problems
In this lab, you perform the following tasks:

1. Run a Break Script


2. Verify That the System Is Not Functioning Properly
3. Troubleshoot and Repair the Problem
4. Verify That the Problem Is Repaired
Several break scripts are provided to create storage problems. Each script damages storage in the lab
environment in a different way. You can run the break scripts in any order. And you can choose
which problems to resolve.

27
Task 1: Run a Break Script
You use PowerCLI to run a break script to damage storage in the lab environment.

IMPORTANT
After the break script completes, do not run another break script until you complete tasks 2 through
4 for each storage problem. You must run the scripts one at a time.

1. Double-click the PowerCLI icon on the student desktop system to start a PowerCLI session.
2. In the PowerCLI window, enter cd \materials\scripts\mod5 .
3. Enter the name of a break script.
For example, you enter . \break-6-1 . psl to run the first break script.
In the Difficulty column, 1 =least difficult and 3 =most difficult to resolve.

Break Script Difficulty


.\break- 6- 1.psl

2 .\break- 6- 2.ps l 2

3 .\break- 6- 3.ps l 3

4 .\break- 6- 4.psl 3

5 . \break- 6-5.psl 3

6 . \break- 6- 6 . psl 3

7 . \break- 6- 7 . ps l 2

8 . \break- 6- 8 . ps l 2

9 . \break- 6- 9 . ps l 2

10 .\break- 6- 10.psl 3

4. Wait until the You are ready to start the lab message appears.
5. Leave the PowerCLI window open for the next problem and go to task 2.

28 Lab 6 Troubleshooting Storage Problems


Task 2: Verify That the System Is Not Functioning Properly
You verify that storage is damaged in your lab environment.
1. Use the trouble ticket summary information to verify that you see the symptoms reported for
your break script and that your lab environment is not working.

Break Script Trouble Ticket


. \ bre ak- 6 -1.ps l A vSphere administrator cannot create any virtual machines on the
NFS datastore. The administrator also cannot migrate any existing
virtual machines to the NFS datastore.

2 . \ bre ak- 6 - 2 .psl A vSphere administrator cannot establish a console connection to


any virtual machine on the Shared datastore. In the inventory pane,
all virtual machines stored on the Shared datastore are marked as
inaccessible.

3 . \ break- 6 - 3 .ps l A vSphere administrator cannot establish a console connection to


any virtual machine hosted on sa-esxi-02.vclass.local, which is
stored on the Shared datastore.

4 . \ bre ak- 6 -4.ps l A vSphere administrator cannot establish a console connection to


several virtual machines. Many virtual machines are marked as
inaccessible in vSphere Web Client. The vSphere administrator did
not specify which ESXi host, virtual machines, or storage had the
problem.

5 . \ bre ak- 6 -5.psl A vSphere administrator cannot establish a console connection to


any virtual machine that is stored on the Shared datastore.

6 . \ break- 6 - 6 .ps l End users report extremely poor performance on several virtual
machines. All virtual machines that were reported are stored on
the Shared datastore.

7 . \ bre ak- 6 - 7 .ps l A vSphere administrator reports that storage performance is very
slow on the Shared datastore. The vSphere administrator did not
specify which ESXi host had the problem.

8 . \ break- 6 - 8 .ps l A vSphere administrator reports that storage performance is very


slow on the Shared datastore. The vSphere administrator did not
specify which ESXi host had the problem.

Lab 6 Troubleshooting Storage Problems 29


Break Script Trouble Ticket
9 . \b reak - 6 - 9 . psl A vSphere administrator cannot establish a console connection to
any virtual machine that is stored on the Shared datastore. The
Shared datastore is also marked as inactive.

10 . \ break- 6 -1 0 .psl A vSphere administrator reports that some virtual machines stored
on the Shared datastore are now marked inaccessible. The vSphere
administrator did not specify which ESXi host or virtual machines
had the problem.

2. Go to task 3.

Task 3: Troubleshoot and Repair the Problem


You use the techniques and tools presented in the lecture manual to troubleshoot and repair the
problem with storage.
1. Use the available techniques and tools to troubleshoot and repair the problem.
• The lab topology handout
This handout contains important information about the network, storage, host, and virtual
machine configurations.
• Lecture manual for this course
• Virtual machine, vCenter Server, and ESXi host log files
• vRealize Log Insight
• VMware knowledge base articles, available at http://kb.vmware.com
• The Internet
2. Go to task 4.

Task 4: Verify That the Problem Is Repaired


You verify that all storage systems are repaired.
1. Reread the trouble ticket summary information in task 2.
2. Use vSphere Web Client and remote consoles as needed to verify that the problem is resolved.
3. Leave vSphere Web Client open until you complete all storage troubleshooting problems.
4. Return to task 1 and run the next break script.

30 Lab 6 Troubleshooting Storage Problems


Lab 7 Troubleshooting Cluster Problems

Objective: Identify, diagnose, and resolve cluster problems


In this lab, you perform the following tasks:

1. Run a Break Script


2. Verify That the System Is Not Functioning Properly
3. Troubleshoot and Repair the Problem
4. Verify That the Problem Is Repaired
Several break scripts are provided to create cluster problems. Each script damages the cluster
configuration in the lab environment in a different way. You can run the break scripts in any order.
And you can choose which problems to resolve.

31
Task 1: Run a Break Script
You use PowerCLI to run a break script to damage storage in the lab environment.

IMPORTANT
After the break script completes, do not run another break script until you complete tasks 2 through
4 for each cluster problem. You must run the scripts one at a time.
1. Double-click the PowerCLI icon on the student desktop system to start a PowerCLI session.
2. In the PowerCLI window, enter cd \materials\scripts\mod6 .
3. Enter the name of a break script.
For example, you enter . \break-7-1 . psl to run the first break script.

IMPORTANT
You must start with the first break script, . \break - 7 -1 . ps 1. The first break script creates the
cluster that is used in all other break scripts. After you run the first break script and solve that
networking problem, you can run the remaining break scripts in any order.
In the Difficulty column, 1 = least difficult and 3 =most difficult to resolve.

Break Script Difficulty


. \break- 7 - 1 . psl 3

2 .\break- 7 - 2 . psl 2

3 .\break- 7 - 3 .psl 2

4 . \break- 7 -4 .psl 2

5 . \break- 7 - 5 . ps l 2

6 .\break- 7 - 6.psl 2

7 . \break- 7 - 7 . psl 2

8 . \break- 7 - 8 . ps l 2

9 .\break- 7 - 9.psl 2

10 . \break- 7 - 10.psl 2

4. Wait until the You are ready to start the lab message appears.
5. Leave the PowerCLI window open for the next problem and go to task 2.

32 Lab 7 Troubleshooting Cluster Problems


Task 2: Verify That the System Is Not Functioning Properly
You verify that the cluster configuration is damaged in your lab environment.
1. Use the trouble ticket summary information to verify that you see the symptoms reported for
your break script and that your lab environment is not working.

Break Script Trouble Ticket


. \break - 7 - 1. ps 1 A vSphere administrator brought a new ESXi host online (sa-esxi-
02.vclass.local) and tried to patch it. The ESXi host is stuck in
maintenance mode and cannot join the cluster.

2 . \break - 7- 2 .psl A vSphere administrator cannot power on any virtual machines in


the Test or Production resource pools. The error message
Insufficient resources to satisfy configured
failover level for vSphere HA appears .

3 . \break - 7 - 3.psl A vSphere administrator cannot migrate any virtual machines to a


new ESXi host.

4 .\break-7-4.psl A vSphere administrator reports that several issues related to


vSphere HA appear in the Issues pane of vSphere Web Client.

5 . \break - 7- 5 . psl End users report major performance problems with various virtual
machines in the vSphere cluster.

6 . \break - 7- 6.psl A vSphere administrator cannot power on any virtual machines in


the Test or Production resource pools.

7 . \break - 7 - 7.psl A vSphere administrator cannot migrate any virtual machines to a


new ESXi host. The administrator sees the message The vSphere
Motion migration failed because the destination
host did not receive data from the source host on
the vMotion network.

8 . \break - 7 - 8 .psl A vSphere administrator reports that CPU use is not balanced
across hosts in the cluster.

9 . \break - 7- 9 .psl A vSphere administrator cannot migrate any virtual machines to a


new ESXi host.

10 . \break - 7 -1 0 .psl A vSphere administrator reports that CPU use is not balanced
across hosts in the cluster.

2. Go to task 3.

Lab 7 Troubleshooting Cluster Problems 33


Task 3: Troubleshoot and Repair the Problem
You use the techniques and tools presented in the lecture manual to troubleshoot and repair the
problem with your configuration.
1. Use the available techniques and tools to troubleshoot and repair the problem.
• The lab topology handout
This handout contains important information about the network, storage, host, and virtual
machine configurations.
• Lecture manual for this course
• Virtual machine, vCenter Server, and ESXi host log files
• vRealize Log Insight
• VMware knowledge base articles, available at http://kb.vmware.com
• The Internet
2. Go to task 4.

Task 4: Verify That the Problem Is Repaired


You verify that the cluster is repaired.
1. Reread the trouble ticket summary information in task 2.
2. Use vSphere Web Client and remote consoles as needed to verify that the problem is resolved.
3. Leave vSphere Web Client open until you complete all cluster troubleshooting problems.
4. Return to task 1 and run the next break script.

34 Lab 7 Troubleshooting Cluster Problems


Lab B Troubleshooting Virtual Machine
Problems

Objective: Identify, diagnose, and resolve virtual machine


problems
In this lab, you perform the following tasks:

1. Run a Break Script


2. Verify That the System Is Not Functioning Properly
3. Troubleshoot and Repair the Problem
4. Verify That the Problem Is Repaired
Several break scripts are provided to create virtual machine problems. Each script damages virtual
machines in the lab environment in a different way. You can run the break scripts in any order. And
you can choose which problems to resolve.

35
Task 1: Run a Break Script
You use PowerCLI to run a break script to damage virtual machines in the lab environment.

IMPORTANT
After the break script completes, do not run another break script until you complete tasks 2 through
4 for each virtual machine problem. You must run the scripts one at a time.

1. Double-click the PowerCLI icon on the student desktop system to start a PowerCLI session.
2. In the PowerCLI window, enter cd \materials\scripts\mod7 .
3. Enter the name of a break script.
For example, you enter . \break-8-1.psl to run the first break script.
In the Difficulty column, 1 =least difficult and 3 =most difficult to resolve.

Break Script Difficulty


.\break- 8- 1.psl 2

2 .\break- 8-2.psl 2

4 .\break- 8-4.psl 3

6 . \ break-8-6.psl 2

7 . \ break- 8- 7 . psl 2

8 . \break- 8- 8 . psl 3

9 . \break- 8- 9 .psl 3

4. Wait until the You are ready to start the lab message appears.
5. Leave the PowerCLI window open for the next problem and go to task 2.

36 Lab 8 Troubleshooting Virtual Machine Problems


Task 2: Verify That the System Is Not Functioning Properly
You verify that virtual machines are damaged in your lab environment.
1. Use the trouble ticket summary information to verify that you see the symptoms reported for
your break script and that your lab environment is not working.

Break Script Trouble Ticket


. \break- 8 -1.psl An end user cannot power on the linux-a-06 virtual machine.

2 . \break- 8 - 2 .psl A vSphere administrator reports that the linux-a-02 virtual


machine is missing from inventory.

4 . \break-8-4 .psl An vSphere administrator reports that a virtual machine is


connected to an unknown network instead of to the Production
network. The administrator did not log which virtual machine had
the problem.

6 . \break-8- 6 .psl A vSphere administrator cannot install VMware Tools™ on the


linux-a-08 virtual machine.

7 . \break- 8 - 7 . psl An end user cannot power on a virtual machine. The user did not
report which virtual machine failed to power on.

8 . \break-8- 8 .psl A vSphere administrator cannot install VMware Tools into any
virtual machine.

9 . \break- 8 - 9 .psl An end user cannot power on the linux-a-03 virtual machine.

2. Go to task 3.

Lab 8 Troubleshooting Virtual Machine Problems 37


Task 3: Troubleshoot and Repair the Problem
You use the techniques and tools presented in the lecture manual to troubleshoot and repair the
problem with virtual machines.
1. Use the available techniques and tools to troubleshoot and repair the problem.
• The lab topology handout
This handout contains important information about the network, storage, host, and virtual
machine configurations.
• Lecture manual for this course
• Virtual machine, vCenter Server, and ESXi host log files
• vRealize Log Insight
• VMware knowledge base articles, available at http://kb.vmware.com
• The Internet
2. Go to task 4.

Task 4: Verify That the Problem Is Repaired


You verify that the virtual machine is repaired.
1. Reread the trouble ticket summary information in task 2.
2. Use vSphere Web Client and remote consoles as needed to verify that the problem is resolved.
3. Leave vSphere Web Client open until you complete all virtual machine troubleshooting
problems.
4. Return to task 1 and run the next break script.

38 Lab 8 Troubleshooting Virtual Machine Problems


Lab 9 Managing the PostgreSQL
Database

Objective: Manage the PostgreSQL database


In this lab, you perform the following tasks:

1. Verify That PostgreSQL Is Running


2. Modify the Logging Level in the PostgreSQL Configuration File
3. Reload the PostgreSQL Server Instance
4. Examine the PostgreSQL Log File
5. Use the vCenter Server Appliance Management Interface
6. Use vSphere Web Client to Examine the Health of the PostgreSQL Database

Task 1: Verify That PostgreSQL Is Running


You use commands in an SSH session to verify that PostgreSQL is running.
1. On your student desktop system, double-click the MTPuTTY icon.
2. In the Servers pane on the left, double-click SA-VCSA-01.
3. If a PuTTY Security Alert dialog box appears, click Yes to accept and cache the server's host key.
You are automatically logged in as the root user.
4. At the command prompt, enter shell.
This command grants shell access to root.
5. Enter ps aux I grep postgres.
This command might produce a large output.

39
6. Scroll back to the beginning of the output.
Your screen should look like the screenshot.
root@sa- vc:::sa - 01 [ - HI ps aux I g rep p mn.g ces
vposcgr+ 2 6a7 a .a a . 3 463576 2 492 a ? I'!a rOl 2 : 2 6 I opt / vmwa.r e/vpos tgres/ c urrenc/b i n/ postgres - D /st orage/ db / vpo s tgres
vp03tQ"c+ 2 610 a .a a .a 68280 3460 ? Ss I'!ar O l 0 : 02 postgres: l o g ge r process
v po:3 t gr+ 2 6 12 a .a 1. 6 4640 48 1343 24 ? Ss I'!ar01 0 : 56 p ostgres : c:h e c kpo i nt e r proce:39
vpo stqc+ 2 6 1 3 a .a a . 2 4 63 7 52 1 8 7 68 ? So I'Iar 0 1 0: 2 0 postgres: v r ite r proce ss
vpoBtqr+ 2 614 o.o a . 1 463752 1 5 348 ? So !'Iar Ol 2 : 0 3 postgre s : wal tn: iter proc e~s
vpo::i tgr + 2615 a . a a . a 464 2a4 6464 ? Ss I'l:ar01 1: 48 pCIBtgres : a u t ovacu"WTI leu ncher proce::i::i
vpostr;;rr+ 2 6 1 6 a . a a . a 7 1464 4888 ? So l!lar 0 1 9 : 33 p os'C-gres : stets collecto r p r oce~s
vpos t gr+ 2617 a . a a . 1 46q 7 2 0 9280 ? Ss !'IarOl a : 19 p ost.gres: bgt1orker : heelth stat u s 'tilarker
vpostgr+ 39a8 a . a 0 .1 46582 0 12788 ? Ss I'!a r0 1 0 : 5 4 p o:Jtgre s : vc V CDB 12 7 . o . o. 1 i 4 2 162 I i d l e
vposti;rr+ 39 11 a . a a .1 4 6 4 8a8 1 1692 So llac Ol O: 59 post-gre~ : vc VCDB 12 7 . 0. 0 . 1 142 16 6 ) id l ~
vpostgr+ 4 708 a . a a . 2 4 67876 2032 4 ? 93 1.la rO l O: OB post.gres : vc VCDB 127 . 0.0 .1( 42592) idl e
r o ot 5 11 4 a . 2 q. 2 204 3096 3 5 0220 ? Sl :!l'l:ar:O l ? 3 : qq I usr / java/ jre-vmvare/b i n/vmvar e - sps. l auncher - Xmx350m -XX : Comp r esse d
5 i z:e:• l 28m - X~32 56k - XX : P eral l e: lGC Thre: e.d~· 1 -Dxm l . c::o nf ig• .. I c::onf / ~p~- ~p r i ng-c::o n fi g . xml - Dpbm . conf ig• .. /conf / pbm- ~ pri ng-c onfi g . xml - D~m
. /conf/sms - spr ing- conf ig . xml - XX : +Forc:: : eTime HighRe so l ut ion - XX : +Pr int Tenur ingDistr i but ion - verbose : gc - Dcatal i na . home= /s t or a ge/ s p s/ t om
eapDumpOnOut ot Memor y Error - XX : He apDumpPath"' /var/ l o g /vmloia re/'Vl'llwar e - sps/ - XX : Erro r Fi le"' / var / l o g /vmloiare/ 'Vl'llwar e - sps/ j ava_ e r ro r %- p . log -XX :
t e. i l s - XX : +Pr i n t GCD e.te 5 t ernp9 - XX : +Pr intRe t:e r:enceGC - XX: +U3eGCLogr i l e Ro t at i on - XX : NumberOt:GC Logfi le3 "' 10 - XX: GCLog FileS i z:e= l 0 2 4K - Xlog g
/vmurar:e/vmt&Ta r:e - s ps/vmware-sps-qc:::: . l o q - D ; ava . s e c::::ur: i tv . p r:oper: t i e s = /etc::::/vmvare/ ; ava/vnn:rar:e-over:r ide -; ava . secur i t v - Di ava . ext . d i rs= / usr/ i

The screenshot indicates the following information:


PostgreSQL is running.
The executable directory is /opt/vmware/vpostgres/current/bin.
• The database directory is /storage/db/vpostgres.
If your database were clustered, you would also see a - p xxxx string with the port number for
TCP/IP communication between the cluster nodes at the end of the first line.
If PostgreSQL is not running, you should ask your instructor for help.
7. Examine the second line of your output.
You should see a logger process listed, which indicates that PostgreSQL logging is enabled
and running.
8. Examine the third, fourth, and fifth lines of your output.
The following default processes should be listed:
• checkpointer
• writer

• wal writer (write-ahead logging writer)

If you do not see these processes running, you should ask your instructor for help.

40 Lab 9 Managing the PostgreSQL Database


9. Examine the sixth and seventh lines of your output.
The following utility processes should be listed:
• a ut ovacuum launcher
• s t a t s co llector
If your database were configured for streaming replication, you would also see wal sender
process r ep l aaa . bbb. ccc . ddd (xxxxx ) streami ng z z zzzz z zz listed after the
stats collector process. This information is the direction (sender or receiver), the TCP/IP
address of the connected node, and the streaming segment ID.
If you do not see these processes running, you should ask your instructor for help.
10. Examine the output and look for the aut ovacuum worke r process.
The a utovacuum worke r process runs periodically. It is started by the a utova cuum
l auncher process.

Task 2: Modify the Logging Level in the PostgreSQL Configuration File


You modify the configuration file of the PostgreSQL database to change the logging level.
1. At the command prompt, enter cd /storage/db/vpostgres .
This command changes the directory to the /stor age/db/vpostgres directory.
2. Enter cp postgresql. conf postgresql .bak.
This command creates a backup copy of the configuration file .
3. Enter vi postgresql. conf.
This command starts the vi editor.
4. Enter /#log_dest.
The / #l og_des t command searches for the string #log_dest , which is in the log file
destination settings part of the configuration.
Your screen should look like the screenshot.
# - Where to Log -

m1og_destination 'stderr'
# stderr, csvlog, syslog, and eventlog,

5. Enter x to delete the single character #.


The x command deletes the# character in #log_ des t i nat i on. As a result, log messages are
now sent to the s t derr output, as well as to the log file.

Lab 9 Managing the PostgreSQL Database 41


6. Enter I = warning.

The I = warning command searches for the string= warning, which is in the log file
message settings part of the configuration.
Your screen should look like the screenshot.

#log_min_messages I warning # values in order of decreasing detail:


# debug5
# debug'!
U r3Phllrr1

7. Move the cursor to the right until it is over the w in warning.


8. Enter dw to delete the word warning.
9. Enter i to start insert mode.
The -- INSERT -- notice appears at the bottom of the screen.
10. Enter info, followed by one space character.
The change from warning level to info level increases the detail of log messages that are
recorded.
11. Press Esc.
The -- INSERT -- notice disappears from the bottom of the screen.
12. Enter :wq.
This command saves the file and quits vi.

Task 3: Reload the PostgreSQL Server Instance


You reload the PostgreSQL database server instance to change the logging level. First, you give
shell access to the PostgreSQL account.
1. In the sa-vcsa-01 SSH session, enter service-control --stop vmware-vpxd.
This command stops the vCenter Server service that is using the PostgreSQL database.
2. Wait for the vmware-vpxd service to stop.
3. Enter service-control --stop vmware-vpostgres .
This command stops the PostgreSQL database server.
4. Enter ps aux I grep postgres to verify that PostgreSQL has stopped.
5. Enter service-control --start vmware-vpostgres .
This command starts the PostgreSQL database server, using the new configuration.

42 Lab 9 Managing the PostgreSQL Database


6. Enter service control --start vmware-vpxd.
This command starts the vCenter Server service that is using the PostgreSQL database.
7. Enter ps aux I grep postgres to verify that PostgreSQL has restarted.

Task 4: Examine the PostgreSQL Log File


You examine the PostgreSQL log file.
1. In the sa-vcsa-01 SSH session, enter cd /storage/log/vmware/vpostgres.
This command changes the directory to the PostgreSQL log file.
2. Enter ls .
This command lists the files in the directory. The PostgreSQL log files are based on calendar
date. So if today is day 20 of the month, the log file for today is named p ostg r esql-2 0 . l og.
3. Enter tail postgresql-.X.X. log -n 200 I more.
XX is the current day of the month. For example:
tail p o stgre sql- 0 5.l o g -n 2 0 0 I more

4. Examine the end of the log file, and notice when vCenter Server and the PostgreSQL database
server stopped and started.
5. Enter exit to log out of the shell.
6. Close the MTPuTTY application.

Task 5: Use the vCenter Server Appliance Management Interface


You use the vCenter Server Appliance Management Interface to examine the health of the
PostgreSQL database.
1. If a vSphere Web Client tab is open, click administrator@vsphere.local (your user), click
Logout, and close the tab.
2. Open a new tab in the Internet Explorer browser.
3. Enter the URL https: //sa-vcsa-01. vclass . local: 5480 .
4. Click the Continue to this website (not recommended) link.
5. Use the account root and the password VMwarel ! to log in to the appliance console.
6. If the console does not open to the Summary page, click Summary in the navigation pane.
7. Verify that the health status of the database is listed as Good, with a green icon.
8. Click Database.

Lab 9 Managing the PostgreSQL Database 43


9. Verify that VC DB SEAT (Statistics, Events, Alarms, and Tasks) shows plenty of free space.
If the capacity is 5 GB, then at least 3 GB (about 50 percent) should be free . You should have at
least 25 percent free on a production system.
10. Verify that Transaction Log has plenty of free space.
You should have at least 25 percent free on a production system.
11. Verify that VC Inventory has plenty of free space.
You should have at least 25 percent free on a production system.
12. Verify that the Overall current space utilization trending graph shows lines for all four SEAT
components at below 60 percent.
13. From the Select duration drop-down menu on the right, select 1 week.
14. Verify that the SEAT, Transaction Log, and VC Inventory graph lines are below 60 percent.
15. Click Summary in the navigation pane.
16. Click Reboot.
17. Click Yes.
18. Click Cancel.
19. Close the VMware Appliance Management tab in Internet Explorer.
The vCenter Server Appliance virtual machine takes about five minutes to reboot.

Task 6: Use vSphere Web Client to Examine the Health of the


PostgreSQL Database
You use vSphere Web Client to examine the health of the PostgreSQL database.
1. Open Internet Explorer and select the vSphere Web Client favorite.
2. Log in as user administrator@vsphere.local, with the password VMware 1! .
3. Point to the Home icon and select Administration.
4. Click System Configuration under Deployment in the Navigator pane.
5. Click Nodes in the Navigator pane.
6. Select xx Services in the Services Health pane on the right.
These services have a status of Good.
7. Verify that the VMware Postgres service is reported as a service in good health.
8. Click the Objects tab.

44 Lab 9 Managing the PostgreSQL Database


9. Click Services.
10. Scroll down and locate VMware Postgres.
11. Verify that VMware Postgres is in good health and is in a Running state.
12. Click VMware Postgres and click Restart to restart the PostgreSQL database server.
13. Click No.

IMPORTANT
You must not restart the PostgreSQL database server.
14. Point to the Home icon and select Hosts and Clusters.

Lab 9 Managing the PostgreSQL Database 45


46 Lab 9 Managing the PostgreSQL Database
Lab 10 Troubleshooting vCenter Server
and ESXi Host Problems

Objective: Identify, diagnose, and resolve vCenter Server


and ESXi host problems
In this lab, you perform the following tasks:

1. Run a Break Script


2. Verify That the System Is Not Functioning Properly
3. Troubleshoot and Repair the Problem
4. Verify That the Problem Is Repaired
Several break scripts are provided to create vCenter Server configuration and ESXi host
configuration problems. Each script damages the configuration in the lab environment in a different
way. You can run the break scripts in any order. You can choose which problems to resolve.

47
Task 1: Run a Break Script
You use PowerCLI to run a break script to damage your vCenter Server configuration or ESXi host
configuration in the lab environment.

IMPORTANT
After the break script completes, do not run another break script until you complete tasks 2 through
4 for each problem. You must run the scripts one at a time.
1. Double-click the PowerCLI icon on the student desktop system to start a PowerCLI session.
2. In the PowerCLI window, enter cd \materials\scripts\mod8 .
3. Enter the name of a break script.
For example, you enter . \break-10-1 . psl to run the first break script.
In the Difficulty column, 1 = least difficult and 3 = most difficult to resolve.

Break Script Difficulty


. \break- 10- 1 . psl 3

2 . \break- 10- 2 . psl 2

3 . \break- 10- 3 .psl 2

4 .\break- 10- 4.psl 3

5 .\break- 10- 5.psl 2

6 .\break- 10- 6.psl 3

7 .\break- 10- 7.psl 3

8 .\break- 10- 8.psl 3

9 .\break- 10- 9.psl

10 .\break- 10-10.psl 2

11 .\break- 10- 11.psl

4. Wait until the You are ready to start the lab message appears.
5. Leave the PowerCLI window open for the next problem and go to task 2 .

48 Lab 10 Troubleshooting vCenter Server and ESXi Host Problems


Task 2: Verify That the System Is Not Functioning Properly
You verify that an ESXi host or vCenter Server configuration is damaged in your lab environment.
1. Use the trouble ticket summary information to verify that you see the symptoms reported for
your break script and that your lab environment is not working.

Break Script Trouble Ticket


. \break- 10- 1.psl A vSphere administrator reports that the inventory in vSphere
Web Client is empty.

2 . \break- 10- 2 .psl A vSphere administrator cannot use SSH or the DCUI to access
an ESXi host. The administrator did not report which host had
the problem.

3 . \break- 10- 3 .psl A vSphere administrator cannot use vSphere Web Client to log in
to vCenter Server.

4 . \break- 10- 4 .psl A vSphere administrator cannot join an ESXi host to the
vclass.local domain. The administrator received a task
notification indicating that the specified domain either does not
exist or could not be contacted by the host. The administrator did
not report which host had the problem.

5 . \break- 10- 5 .psl A vSphere administrator noticed that the size of the vCenter
Server log files is rapidly expanding. The administrator is
concerned that continued expansion at this rate will eventually
crash vCenter Server Appliance.

6 . \break- 10- 6 . psl A vSphere administrator reports that the inventory in vSphere
Web Client is empty.
Standard procedure requires that this system have an extra
backup of the vCenter Server database saved in /usr I loca l /
share/vcdb. save . If all else fails, you can use this backup to
help solve the problem.

7 .\break- 10- 7.psl A Sphere administrator logged out of vSphere Web Client before
going to lunch. When the administrator returned and logged back
in, the inventory was empty.

8 .\break- 10- 8.psl A vSphere administrator reports that an ESXi host is


disconnected from vCenter Server. None of the virtual machines
on the host are responding. The administrator did not report
which host had the problem.

Lab 10 Troubleshooting vCenter Server and ESXi Host Problems 49


Break Script Trouble Ticket
9 . \b re ak-1 0 - 9 .psl A vSphere administrator cannot connect an ESXi host to vCenter
Server. The ESXi host does not respond and is shown as
disconnected in the inventory. The administrator did not report
which host had the problem.

10 . \ brea k -1 0 -1 0 .ps l A vSphere administrator reports that an ESXi host is not


responding. The administrator tried to make a direct connection
to the ESXi host console and saw a purple crash screen.

11 . \b r e a k -11-11. ps 1 A vSphere administrator cannot log in to vSphere Web Client.

2. Go to task 3.

Task 3: Troubleshoot and Repair the Problem


You use the techniques and tools presented in the lecture manual to troubleshoot and repair the
problem with your configuration.
1. Use the available techniques and tools to troubleshoot and repair the problem.
• The lab topology handout
This handout contains important information about the network, storage, host, and virtual
machine configurations.
• Lecture manual for this course
• Virtual machine, vCenter Server, and ESXi host log files
• v Realize Log Insight
• VMware knowledge base articles, available at http://kb.vmware.com
• The Internet
2. Go to task 4.

Task 4: Verify That the Problem Is Repaired


You verify that the vCenter Server and ESXi host configurations are repaired.
1. Reread the trouble ticket summary information in task 2.
2. Use vSphere Web Client and remote consoles as needed to verify that the problem is resolved.
3. Leave vSphere Web Client open until you complete all vCenter Server and ESXi host
troubleshooting problems.
4. Return to task 1 and run the next break script.

50 Lab 10 Troubleshooting vCenter Server and ESXi Host Problems


Lab 11 (Optional) Working with
Certificates

Objective: Generate and replace vCenter Server certificates


In this lab, you perform the following tasks:

1. Examine vSphere Certificates


2. Create a Windows 2012 Certificate Authority Template for vSphere
3. Create a Certificate Signing Request
4. Download the CSR to the Student Desktop
5. Request a Signed Custom Certificate
6. Replace a Machine Certificate with the New Custom Certificate
7. Regenerate the VMware CA Root Certificate and Replace All Certificates
8. Use vSphere Web Client to Verify Certificate Replacement

Task 1: Examine vSphere Certificates


You examine the default certificates issued by VMware Certificate Authority in a nonproduction
vCenter Server system.
1. In the Internet Explorer window, click the vSpbere Web Client tab for sa-vcsa-01.vclass.local.
2. Point to the Home icon and select Administration.
3. In the left pane, click System Configuration.
4. In the left pane, click Nodes and select sa-vcsa-01.vclass.local.
5. In the center pane, click the Manage tab and click Certificate Authority.

51
6. In the Certificate Authority panel, click the Verify password link.
7. In the Password text box, enter the standard lab password and click OK.

Q1. How many active certificates are in the certificate store for this node?

Q2. How long are the certificates valid for?

Q3. On what date do the certificates expire?

8. Select the first C=US,CN=sa-vcsa-01.vclass.local certificate in the list.


9. Record the expiration date of the certificate. _ _ _ __
10. Click the Show Details for certificate icon.

~~~
Subject

C;;;US, CN" sa-vcsa-01 .vclass.local


C"US, CN=sa-vcsa-01 .vclass.local

Q4. Who issued the certificate?

11. Click OK.


12. Widen the Subject column in the center pane until you can see the CN= part of the subject
name for each certificate.
13. Select the first certificate in the list that has a Subject field that begins with OU=.
14. Click the Show Details for certificate icon.

Q5. Based on the Common name field under Subject, what is the type of this certificate?

15. Click OK.

52 Lab 11 (Optional) Working with Certificates


16. Click the Show Details for certificate icon to examine the other certificates with Subject fields
that begin with OU=.
These certificates are called vSphere solution user certificates.

Q6. How many solution user certificates do you see?

Q7. What are the names of the solution users that have certificates (from the Subject
field)?

17. In the center pane, click Root Certificates.


18. Select the root certificate in the list.
The certificate begins with OU=VMware Engineering.
19. Click the Show Details for certificate icon.

Q8. What is the organization in the Issuer section of this certificate?

20. Click OK

Task 2: Create a Windows 2012 Certificate Authority Template for


vSphere
You create a vSphere 6.5 certificate template on a Windows 2012 Server domain controller, which
you can use to create certificates that work with vSphere 6.5. The certificate template can be used to
create machine SSL or solution user certificates in VMware CA.
1. Open a console to dc.vclass.local.
a. Click the Remote Desktop Connection Manager icon in the Windows desktop tool bar.
The Remote Desktop Connection Manager window appears.
b. In the left pane, double-click DC (vclass.Iocal) .
The desktop for dc.vclass.local appears in the center pane.
You are automatically logged in as a domain administrator.
2. Open the certification authority console.
a. Click the Windows Start button on the dc.vclass.local desktop.
b. On the Apps page, click the up arrow icon.
Lab 11 (Optional) Working with Certificates 53
c. Click Administrative Tools.
d. In the Administrative Tools window, double-click Certification Authority.
The Certification Authority window appears.
3. Open the certificate templates console.
a. Expand vclass-DC-CA.
b. Right-click Certificate Templates and select Manage.
4. Configure a new certificate template.
a. Right-click the existing Web Server template and select Duplicate Template.
The Properties of New Template dialog box appears.
b. Click the General tab and enter vSphere65 in the Template display name text box.
c. Click the Extensions tab.
d. Select the Key Usage check box and click Edit.
e. In the Edit Key Usage Extension dialog box, select the Signature is proof of origin
(nonrepudiation) check box and the Allow encryption of user data check box.
f. Click OK
g. Select Application Policies and click Edit.
h. In the Edit Application Policies Extension dialog box, click Add and select Client
Authentication.
1. Click OK and click OK again.
J. Click the Request Handling tab and select the Allow private key to be exported check box.
k. Click OK to save the new certificate template.
I. Close the Certificate Templates Console window.
5. Enable the new certificate template.
a. In the Certification Authority console window, right-click Certificate Templates and
select New> Certificate Template to Issue.
The Enable Certificate Templates window appears.
b. Select the vSphere65 check box and click OK
c. Close all open windows.
d. In the left pane of the Remote Desktop Connection Manager, right-click DC (vclass.Iocal)
and select Disconnect server.
6. Close the Remote Desktop Connection Manager window.

54 Lab 11 (Optional) Working with Certificates


Task 3: Create a Certificate Signing Request
You use vSphere Certificate Manager to create a certificate signing request (CSR) that you use to
request a signed custom certificate from the domain controller certificate authority (CA) for the lab.
1. Start an SSH session with SA-VCSA-01.
a. Click the MTPuTTY icon in the Windows desktop toolbar.
The MTPuTTY window appears.
b. In the left pane, double-click SA-VCSA-01.
A new SA-VCSA-01 tab opens in the center pane.
c. Enter shell to start a Bash shell.
2. Create a CSR.
a. Enter /usr/lib/vmware-vmca/bin/certificate-manager and press Enter.
The vSphere Certificate Manager starts.
b. Enter 1 to select the Replace Machine SSL certificate with Custom Certificate option.
c. Press Enter to accept the default user name of Adminstrator@vsphere.local.
d. Enter the standard lab password.
e. Enter 1 to select the Generate Certificate Signing Request option.
f. For the output directory path, enter /var/tmp.
The /var / tmp directory on Linux and UNIX systems is a temporary directory. The
contents of the /var /tmp directory are not deleted during a reboot.
3. Configure the certificate properties.
a. For Country, press Enter to accept the default.
b. For Name, enter VMware.
C. For Organization, enter VMeduc.
d. For OrgUnit, enter vclass.
e. For State, press Enter.
f. For Locality, press Enter.
g. For IPAddress, press Enter.
h. For Email, enter certadmin@vclass. local.
I. For Hostname, enter sa-vcsa-01. vclass. local.
4. Enter 2 to exit the vSphere Certificate Manager.

Lab 11 (Optional) Working with Certificates 55


Task 4: Download the CSR to the Student Desktop
You download the CSR from the vCenter Server system to your student desktop.
1. Enter chsh -s /bin/bash to temporarily change the login shell of the root account to /b in /
bash.

This step is necessary for WinSCP to connect to the vCenter Server system so that you can
download the CSR to your student desktop.
2. Start the WinSCP application.
a. On the student desktop taskbar, click the WinSCP icon.

b. In the left pane, double-click SA-VCSA-01.


c. In the Warning dialog box, click Update to accept and remember the Certificate Lab vCenter
Server public key for SSH
d. Click Continue to close the Authentication Banner dialog box.
In the WinSCP window, you should see the c: \Ma teria ls \Down l oads folder on your
student desktop in the left pane and the I root directory on the vCenter Server Appliance
instance in the right pane.
3. Use the folder controls to navigate to the /va r /tmp directory in the right pane.
4. If the left pane is not c: \Materials \Downloads, then use the folder controls to navigate to
the C: \Mate rials \ Downloads folder.
5. Drag the vmca_issued_csr.csr and vmca_issued_key.key files from the /var/tmp directory in
the right pane to the C:\Materials\Downloads folder in the left pane.
This action copies the files from the vCenter Server system to the Downloads folder on your
student desktop.
6. Leave the WinSCP window open.

56 Lab 11 (Optional) Working with Certificates


Task 5: Request a Signed Custom Certificate
You request a signed custom certificate from the domain controller CA for the lab.
1. Copy the contents of the vmca_i ssued _cs r. c sr file to the clipboard.
a. On your student desktop, open Windows Explorer and navigate to the
C : \Ma t e rial s \ Downl oads folder.

b. Right-click the vmca_issued_csr.csr file and select Open with.


c. Open vmca _ i ssue d_c sr. cs r in WordPad.
d. Click Select all in the WordPad toolbar.
e. Press Ctrl+C to copy the selected text to the clipboard.
2. Go to the certificate services program on the domain controller and request a certificate.
a. On your student desktop, open a new Internet Explorer tab and go to
http://dc. vclass.local/certsrv.
b. Log in with user name administrator and the standard lab password.
c. On the Microsoft Active Directory Certificate Services page, click the Request a
certificate link.
d. Click the advanced certificate request link.
e. Click the Submit a certificate request by using a base-64-encoded CMC or PKCS #10
file, or submit a renewal request by using a base-64-encoded PKCS #7 file link.
f. Under Saved Request, press Ctrl+V to paste the CSR text into the Base-64-encoded
certificate request text box.
g. From the Certificate Template drop-down menu, select vSphere65.
h. Click Submit.
1. Click Base 64 encoded.
J. Click the Download certificate link.
k. Click Save As in the Internet Explorer dialog box and navigate to the
c: \Materials \ Downloads folder on your student desktop to save the certificate.
l. Save the file as ma c hi ne ss l. cer.

IH-111
The filename is case-sensitive and must exactly match the filename as written in order for
the script to use it.

Lab 11 (Optional) Working with Certificates 57


3. Download the certificate chain.
a. In the Internet Explorer window, click the Download certificate chain link.
Base 64 encoded should still be clicked.
b. Click Save as in the Internet Explorer dialog box and navigate to the
c: \ Materials \ Downloads folder on your student desktop to save the certificate.
c. Save the file as cachain.p7b.

IH-Hi
The filename is case-sensitive and must exactly match the filename as written in order for
the script to use it.
d. Close the Microsoft Active Directory Certificate Services page.
e. IfWordPad is open, close it.
4. Export the root certificate.
a. Switch to the Windows Explorer window and navigate to the c: \Ma t erials \ Downl o ad s
directory.
b. Right-click the cachain.p7b file and select Open.
The Certificate Manager Console opens.
c. In the left pane, expand the inventory tree until you see the Cert ificates folder.
d. Select the Certificates folder.
You should see two certificates: the root certificate for your domain controller and the
custom certificate for your vCenter Server Appliance instance.
The custom certificate appears as VMware. vSphere65 appears under the Certificate
Template column at the far right.
e. To export the root certificate, right-click the vclass-DC-CA root certificate and select All
Tasks > Export.
The Certificate Export wizard appears.
f. Click Next.
g. On the Export File Format page, click Base-64 encoded X.509 (.CER) and click Next.
h. On the File to Export page, click Browse.
1. Navigate to the c : \Materi a ls \ Downl oad s folder.

58 Lab 11 (Optional) Working with Certificates


J. Enter root-64. cer in the File name text box.

MU.Hi
The filename is case-sensitive and must exactly match the filename as written in order for
the script to use it.
k. Click Save.
I. On the File to Export page, click Next.
m. Click Finish.
n. Click OK.
o. Close the Certificate Manager console.

Task 6: Replace a Machine Certificate with the New Custom Certificate


You replace the machine SSL certificate for vCenter Server with the new custom certificate so that
VMware CA acts as a subordinate CA to the domain controller CA.
1. Copy the certificate files from the student desktop to the vCenter Server system.
a. Switch to the WinSCP window.
b. In the WinSCP window, drag the machine_ssl.cer and root-64.cer files from the
C:\Materials\Downloads folder to the /var/tmp folder in the right pane.
This action copies the certificate files from the student desktop to the vCenter Server system.
2. In the MTPuTTY session, change the login shell of the root account back to the vCenter Server
Appliance shell.
a. Switch to the MTPuTTY window.
b. If the SSH session to SA-VCSA-01 is not open, reconnect to SA-VCSA-01.
c. If you see the message timed out waiting for input : a uto -logou t, enter shell.
d. Enter chsh -s /bin/appliancesh to change the login shell of the root account back to
the vCenter Server Appliance shell.
This step returns the vCenter Server system to its more secure posture.
3. Replace the machine SSL certificate with the custom certificate.
a. Enter cd /var/tmp to change to the /var / tmp directory.
If you run the vSphere Certificate Manager from the /va r / tmp directory, you do not have
to enter the full path for each of the certificate and key files that you import.
b. Enter /usr I lib/vmware-vmca/bin/ certificate-manager to start the vSphere
Certificate Manager.

Lab 11 (Optional) Working with Certificates 59


c. Enter 1 to select Replace Machine SSL certificate with Custom Certificate.
d. Press Enter to use the default user name of Administrator@vsphere.local.
e. When prompted, enter the standard lab password.
f. Enter 2 to select Import custom certificate(s) and key(s).
g. Import the custom certificate.

Option Action
Please provide valid custom certificate for Machine Enter machine ssl. cer.
SSL

Please provide valid custom key for Machine SSL Enter vmca_issued_key. key.

Please provide the signing certificate of the Machine Enter root-64. cer.
SSL certificate

You are going to replace Machine SSL cert using Enter y.


custom cert. Continue operation: Option[Y/N]?:

You must wait for the process to complete. This process takes several minutes while the
services are restarted.
h. During this operation, notice the number of services that are updated.
1. Wait until the 100 % Complete [All tasks comp l eted successfully ] message
appears.
J. After the operation is 100 percent complete, press Ctrl+D.
4. Close and reopen Internet Explorer, and log back in to vSphere Web Client.
a. Close the Internet Explorer window.
b. Start Internet Explorer.
c. From the Favorites bar, select vSphere Web Clients> SA-VCSA-01.
The vSphere Web Client login page appears.
d. Log in to vSphere Web Client as administrator@vsphere.local with the standard lab
password.

Q1. What color is the background of the Internet Explorer location bar?

5. In Internet Explorer, click the Security report icon (padlock) to the right of the Location text box.

60 Lab 11 (Optional) Working with Certificates

Вам также может понравиться