HP Server Automation Virtual Appliance (aka SA Standard)...2. HP Server Automation Virtual Appliance (SAVA) aka HP Server Automation Standard is a single HP Server Automation (SA)

Table of contentsA solution for automated server configuration management ........................................................................................ 2

HP Server Automation Virtual Appliance (SAVA) feature overview ............................................................................... 2

Server Automation Virtual Appliance design and architecture overview ..................................................................... 3

Server automation client ....................................................................................................................................................... 4

OS provisioning and configuration ....................................................................................................................................... 4

Patch management ................................................................................................................................................................. 7

Software management .......................................................................................................................................................... 9

Audit and compliance management .................................................................................................................................... 9

Virtualization management ................................................................................................................................................ 10

Global Shell (OGFS) ................................................................................................................................................................ 11

HP Live Network ................................................................................................................................................................... 11

Appliance management and maintenance ....................................................................................................................... 12

Summary—A lightweight solution for server automation ........................................................................................... 12

Technical white paper

HP Server Automation Virtual Appliance (aka SA Standard)Secure, simplified, and lower-cost edition of HP Server Automation for small to medium size deployments

2

A solution for automated server configuration management

HP Server Automation software version 10.0 (HP SA) enables automated server configuration and system management. A key IT automation tool for server administrators, it is offered in two editions:

1. HP Server Automation Enterprise with the complete set of features, full set of managed platform support, and extreme scale known for the product

2. HP Server Automation Virtual Appliance (SAVA) aka HP Server Automation Standard is a single HP Server Automation (SA) core packaged as a virtual machine. This offering completely simplifies the setup required for HP Server Automation and reduces the setup time to under an hour. SAVA is targeted specifically for small to medium size deployments and with SAVA customers will be able to manage the entire lifecycle management of servers for up to 3000 servers. HP Server Automation Standard or SAVA supports a limited set of HP Server Automation Enterprise capabilities. For example, SAVA only supports Windows®- and Linux-based operating systems platforms. For more information on SAVA-supported platforms, see the SAVA support matrix.

This white paper presents a brief overview of the HP Server Automation Virtual Appliance (SAVA) architecture, and provides a very high level insight into specific features it offers as well as the security and maintenance of the overall virtual appliance itself.

HP Server Automation Virtual Appliance (SAVA) feature overview

System administrators use SAVA to provision and manage servers through their entire lifecycle. SAVA uses resources such as OS build plans and scripts to run deployment jobs. With SAVA, patch administrators can establish patch polices to install and maintain patches for supported operating systems running on managed servers. With SAVA, compliance managers have visibility across the managed servers to see which servers are out of compliance and can then remediate non-compliant servers to bring them back into compliance, based on policies created within SA.

SAVA helps you perform the following system management tasks:

• Scan your networks for unmanaged servers and deploy SA agents for management

• Install Windows, Linux, VMware ESXi, and Hyper-V™ on HP and non-HP servers

• Update drivers, utilities, and firmware on HP ProLiant servers using the HP Service Packs for ProLiant (SPPs)

• Configure HP ProLiant system hardware, Integrated Lights-Out (iLOs), BIOS, and HP Smart Array

• Deploy to target servers without using PXE (HP ProLiant Gen8 and later, HP servers only)

• Apply the required operating system patches for Windows and Linux servers

• Install and configure software applications using templates called software policies

• Use out-of-the-box application configuration templates to push configurations to all managed servers

• Define server configuration policies to help ensure SAVA-managed servers meet corporate defined standards as well as the compliance regulations from industry-standard bodies or government organizations

• Remediate non-compliant servers to bring them into compliance

• Get complete visibility of all physical and virtual machine environments (VMware ESXi and Hyper-V) from a single tool

• Create and manage VM templates for multiple virtualization vendor tools within SAVA

• Search for VMs based on their genealogy (creation record) and by other virtual characteristics

• Manage servers remotely for routine maintenance or troubleshooting issues from a single tool using SA Global Shell (OGFS) capability

Technical white paper | HP Server Automation Virtual Appliance

3

Server Automation Virtual Appliance design and architecture overview

HP Server Automation Virtual Appliance (SAVA) comes completely preinstalled and pre-configured on a virtual machine (VM) in a CentOS 6 platform and communicating with PostgreSQL 9.0 database in the backend. Figure 1 shows a high level view of the SAVA architecture.

Figure 1. SAVA architecture

As Figure 1 shows, SAVA requires two IP addresses:

• Appliance IP address: used to manage the appliance lifecycle and operations, such as patching/upgrading the appliance or embedded SA core, getting support logs

• Deployment IP address: used by SA users to connect the nGUI to the embedded SA core to perform deployment or other SA specific tasks

The target server represents a server managed by SAVA. Each managed server runs an SA agent, which is software used to make changes to the server. The SA agent is used for software installation and removal, software and hardware configuration, and server status reporting. The external media server is required for OS provisioning tasks and contains vendor-supplied OS media used during OS provisioning. It may also contain media for other purposes, such as firmware and driver updates, and is also where captured images are stored. The external media server is a separate server from the SAVA appliance and is not included as part of the appliance backup and restore actions. The media for other SA features such as software management, patching, and others is kept inside the appliance itself.

The model repository is a SA component that stores critical information about SA and its managed server environment including inventory of all servers under management, inventory of the hardware associated with these servers such as memory, CPUs, storage capacity, and so on, managed server configuration, inventory of the operating systems, system software, and applications installed on managed servers, inventory of OS provisioning operating system installation media (the media itself is stored in the external media server), inventory of software available for installation, and the software policies that control how the software is configured and installed as well as the authentication and security information. The Model Repository in SAVA is actually inside the PostgreSQL 9.0 optimized and embedded within the SAVA appliance itself.

Server automation client

Also known as SA nGUI, the SAVA SA client is a Java-based tool that is installed on a SA user desktop and connects to the SA core within SAVA via the deployment IP address. Figure 2 displays a snapshot of the SA client navigation pane showing the operational tabs for SAVA users to manage their servers, scripts, jobs, and so on.


Provision

DHCP serveroptional

Media serveroptional

Media server(OS prov)

Browser

SA client

Deployment interface

Patch

Software Audit

SA virtual appliance

SA agent

Target serverPostgreSQL

Model repository

NICAppliance IP address

Deployment IP address

4

Server automation client

Also known as SA nGUI, the SAVA SA client is a Java-based tool that is installed on a SA user desktop and connects to the SA core within SAVA via the deployment IP address. Figure 2 displays a snapshot of the SA client navigation pane showing the operational tabs for SAVA users to manage their servers, scripts, jobs, and so on.

Figure 2.

OS provisioning and configuration

SAVA OS provisioning provides the ability to provision operating system baselines onto bare metal and virtual servers quickly, consistently, and with minimal manual intervention. SAVA automates the entire process of provisioning a comprehensive server baseline, which typically consists of the following tasks:

• Creating OS build plans that define a server build policy, including software policies, patch policies, device groups, and remediation policies

• Installing a base operating system and default OS configuration using an OS build plan

• Applying the latest set of OS patches; the exact list depends on the applications running on the server

• Installing widely shared system software such as Java Virtual Machines

• Executing pre-installation or post-installation scripts that configure the system with values such as a root password

• SAVA OS provisioning also integrates with your operating system vendors’ native installation technologies, specifically:

• WinPE and Windows setup answer files: unattend.txt, unattend.xml.

• Red Hat/VMware Kickstart

• SuSE YaST (Yet another Setup Tool)


Virtualization tab–Shows all your virtualization services, virtual machines, VM templates, and other items, and lets you manage them.

Administration tab–Lets you set up and manage users and passwords, manage your SA cores, set preferences, and more.

Jobs and sessions tab–Shows a history of jobs that have run and scheduled jobs waiting to run.

Library tab–Shows everything needed to manage servers such as patches, patch policies, OS build plans, software policies, software packages, audit policies, and more.

Use the tabs to navigate to each major area of the SA client.

Devices tab–Shows all your servers and lets you manage them

5

OS build plansAn OS build plan is a sequence of steps that execute in a specific order to perform a task on a target server. OS build plan steps are autonomous operations, such as “run script,” “install package(s),”, “attach patch or software policies,” and “run remediation.” OS build plans are typically used for provisioning operating systems, but can be used for almost any automated task. OS build plans use the software on the media server to provision managed servers.

Creating and editing OS build plansSAVA provides a set of baseline OS build plans that you copy and use to base your build plans on. Each build plan is provided with detailed usage instructions. These baseline OS build plans have been tested for their specified platform and are known to work. You simply need to make a copy of a build plan for the appropriate platform and modify it for your specific environment (modifications include: location of the media server, required scripts, required reboots, etc.).

New OS build plans/OS build plan updatesOn occasion, HP releases new baseline OS build plans or updates to existing OS build plans. You will be required to download these build plans from the HP Live Network and install them by running an APX from SA client. Installation instructions and detailed descriptions for each baseline OS build plan are included with the download.

Types of OS build plansSAVA also provides a master list of OS build plans addressing these tasks:

• Wait in service OS—Reboot the server into the service OS

• Off-line firmware update—Boot the server into the service OS, update the firmware, and reboot the server

• Hardware for system ROM data configuration—Either capture and save the current BIOS configuration, or update it using a previously saved configuration

• Hardware for Smart Array data configuration—Either capture and save the current Smart Array configuration, or update it using a previously saved configuration

• Hardware for iLO data configuration—Either capture and save the current iLO configuration or deploy a setting update

• OS deployment via scripted install—Scripted OS install using OS answer file

– Windows Server 2008 SP2 x64 Standard edition—other Windows editions are supported as well

– Windows Server 2008 R2 SP1 x64 Standard edition—other Windows editions are supported as well

– Windows Server 2012 x64 Standard edition—other Windows editions are supported as well

– Red Hat 6.3 x64

– Red Hat 5.9 x64

– SLES 11 SP2 x64

– VMware ESXi 5.0 U1

– VMware ESXi 5.1

• Windows Server OS deployment through image install—You can either capture a golden OS image of a Windows install or deploy a previously captured image

– Windows Server 2008 SP2 x64 Standard edition

– Windows Server 2008 R2 SP1 x64 Standard edition

– Windows Server 2012 x64 Standard edition

• Install Windows SPP on production server—Online update of the SPP components on the production OS, including firmware, drivers, and agents

• Install Linux SPP on production server—Online update of the SPP components on the production OS, including firmware, drivers, and agents


6

Custom attributesA custom attribute is a simple name/value pair that is used as a form of variable substitution in scripts and other provisioning functions. When referenced, the custom attribute name is replaced by the value of that custom attribute. Custom attributes do not stand alone. They are always associated with an object in the management database, such as servers, facility, or OS build plans. Custom attributes can be inherited from a containing object. For example, a server will inherit the custom attributes inherited from the facility.

Custom attributes substitute specific values into scripts, configuration files, and package paths when an OS build plan is run. This is useful for configuring installation processes, including network and server configuration. Custom attributes are typically used for overriding default values.

Custom attributes may be defined for a specific build plan using the UI. Facility-level custom attributes may be viewed from the settings screen in the UI.

You can find more information about OS build plans and associated software components in SAVA online help.

ScriptsYou use scripts in SAVA to accomplish provisioning tasks. Run a script by inserting it as a step in an OS build plan. You can run multiple scripts as a series of steps within a build plan. SAVA supports a variety of script types:

• UNIX®—Bourne shell (sh), C shell (csh), and KornShell (ksh)

• Opsware Global File System (OGFS). OGFS scripts run on the appliance but can access files on the managed servers as well as run commands there.

• Windows .BAT—Windows batch file

• Windows VBScript—Visual Basic scripting

• Python—Python programming language

Configuration filesConfiguration files are the generic term for Windows and Linux data files used during provisioning tasks. These include the following file types:

• Hardware configuration files. These files are used during hardware provisioning for such tasks as BIOS configuration and Smart Array configuration.

• OS answer files. These files provide all the information required to install the OS.

• Configuration files operate without user intervention. Customers may create new configuration files for their own purposes. These can include:

– Additional configuration files for Windows 2008 editions besides Standard

– Additional configuration files for Windows 2008 R2 editions besides Standard

– Additional configuration files for Windows 2012 editions besides Standard

PackagesConfigured as a .zip file, packages are compressed bundles of files. You can use packages to place files on a target server during deployment. OS build plan steps are used to deploy packages to a target server. When the packages are placed on the target server by Insight Control server provisioning, they are decompressed (unzipped) at the location specified in the build plan step. You can also specify which scripts should run before decompression takes place, and which scripts should run afterward.


7

Patch management

In SAVA, patch management enables you to identify, install, and remove Microsoft® Windows and Linux (see support matrix for full list of platforms supported) patches, and maintain a high level of security across managed servers in your organization. SAVA automates the key aspects of patch management, while offering a fine degree of control over how and under what conditions patches are installed. By automating the patching process, patch management can reduce the amount of downtime required for patching. SAVA also allows you to schedule patch activity, so that patching occurs during off-peak hours.

SAVA automates patching by providing the following features and capabilities:

• A central repository where patches are stored and organized in their native formats

• A database that stores information about every patch that has been applied

• Customized scripts that can be run before and after a patch is installed

• Advanced search abilities that identify servers that require patching

• Auditing abilities for tracking the deployment of important patches

These features and capabilities enable you to browse patches by a certain operating system, schedule patch downloads and installations, set up email notifications, preview a patch installation, use policies and remediation to install patches, and export patch information to a reusable file format.


8

Importing patches into SAVAYou can import the Microsoft patches into SAVA by using the SA client as follows:

1. Navigate to the Administration -> Patch Settings.

2. Select Patch Products from the list of Windows Patch Download settings.

3. Click Edit to open the Edit Patch Products window. Available products are on the left and selected products are on the right.

Note: When you use SAVA for the first time, the initial set of selected products in the left panel might be empty and have to be populated from the Microsoft website, which can be done by clicking on Update action button ->Update Products from Vendor (Microsoft’s default URL for the patch database will be populated).

4. After the list is updated, modify the selected products list as needed for your environment and click Ok to save selection.

Warning: Patch sizes can be large and will take up valuable space on the appliance—only choose the products that need to be patched.

Figure 3.

To import Red Hat Package Managers (RPMs) from the Red Hat website directly, run the SAVA Web Utilities Launcher and select the “Import Red Hat” option. To verify that your patches were imported, select the Library tag in the SA client.

Scan and remediate serversAfter importing all the patches for all the desired Windows products, attach vendor recommended patch policies (VRPPs) to your Windows servers and scan the required Windows servers for patch compliance against the attached VRPP. Once the scan is complete, remediate the recommended patches on the non-compliant servers to bring them into compliance.


9

Software management

SAVA enables you to govern the full spectrum of your software management requirements. With SA policy-based software management you can automate software installation and application configuration, and verify that managed servers are compliant with software policies.

Figure 4. The software management process within SAVA.

Software policiesA software policy is an ordered list of packages, script, application configurations, and other items. A software policy is essentially a recipe for installing, uninstalling, and configuring one of more pieces of software on a single server. SAVA software policies enable automation of software installation and application configuration. If a policy is changed after it has been deployed, the managed servers can be scanned and remediated to verify that they maintain compliance with the policy.

Additionally in SAVA, software policies also serve as the mechanism to deliver RPMs or Linux patches for supported Linux platforms.

Software policy compliance scan and remediation To scan a set of managed server(s) for software policy compliance users should use the SA client and select the server/set of servers and go to Menu->Actions->Scan->Software compliance. The results of this scan show the servers that are in compliance and the servers that are out of compliance and specify the software policies that need to be synchronized. Users can then remediate non-compliant servers against the specified software policy to bring the servers back into compliance.

Audit and compliance management

In SAVA, the audit and compliance management feature allows you to identify which objects you want checked, where you want to check for them, and when you want to check them in your IT environment. Using the audit and remediation capabilities, SAVA helps you to ensure that servers in your facilities meet policy standards. When servers are found to be out of compliance—not configured the way you want them to be—you can remediate them to comply with your organization’s standards.


Step 1Set up the SA library: import software packages and patches into the SA library and create application configurations.

Step 2Create a software policy: specify software packages, patches, and application configurations in a software policy.

Step 3Attach the policy:

attach the softwarepolicy to managedservers or device groups.

Step 4Remediate the servers: remediate attachedservers againstthe software policyto install the software and apply the application configuration.

Step 5Run compliance scans: run compliance scans to ensure that managed servers maintain compliance.

10

AuditsAn audit defines a set of rules or configuration values that determine whether the configuration of a managed server or group of managed servers match your organization’s compliance standards. Audit rules can be configured in an ad hoc manner or, more effectively, reference a predefined audit policy that specifically defines the required configuration for a managed server in SAVA. Some audit rules also allow you to run scripts that capture more detailed configuration information.

Audit policiesAn audit policy is a collection of reusable rules that define the desired state of server configuration, based on industry standards and the compliance goals set by your organization. An audit policy can be linked to audits, snapshot specifications, and other audit policies. When changes are made to an audit policy, all references to that audit policy are also updated. An audit policy is typically created by a policy setter who understands the compliance standards that a company requires its servers to meet for a specific configuration domain and operating system. Administrators who manage servers can use predefined audit policies by linking them to their audits or snapshot specifications. This is very critical to organizational security as it helps in separation of roles/duties between policy setters and enforcers.

Using the SA client, you can audit server configuration values based on a live server or a server snapshot, based on your own custom values, or based on pre-configured audit policies. You can also take server configuration snapshots to capture the current state of a system, so that you can compare other servers against a known baseline.

BSA Essentials compliance subscription serviceWith BSA Essentials Subscription Service, you can be kept up to date on the latest industry compliance standard, based on the needs of your data center. BSA Essentials subscription services give you access to regularly updated security best practices and compliance content, such as the Center for Internet Security (CIS), Payment Card Industry (PCI), and so on. It also enables access to additional free non-subscription content such as Microsoft Patch Supplement for SAVA. BSA Essentials subscription services enable you to access the most current regulatory compliance policies, such as Federal Information Security Management Act (FISMA), Sarbanes-Oxley, and daily vulnerability alerts. SAVA uses HP Live Network connector to download the compliance content available on the BSA Essential Subscription service content stream. For information about subscribing to BSA Essentials Subscription Services, contact your HP Software sales representative.

Virtualization management

In SAVA, virtualization management feature provides:

Visibility into entire data center (P+V)SAVA provides full visibility into your hybrid, heterogeneous, distributed data centers providing you with:

• Genealogy of VMs—SA records how each VM was created and displays it in the virtualization view of the SA client. You can also perform searches on how VMs were created.

• Search for VMs by Virtual Characteristics—Advanced search allows you to locate VMs, VM templates, hypervisors, clusters, resource pools, and data centers by cluster properties, resource pool properties, number of processors, datastore, hypervisor, memory creation method, power state, and many other criteria.

• See All Virtual Assets—SA provides comprehensive details about all your virtual assets—data centers, resource pools, clusters, hypervisors, virtual machines, folders, datastores, and network elements. You can see and manage all your hypervisors and VMs.

Full end-to-end lifecycle and policy management for VMs and VM templatesSAVA provides you with the ability to create and manage VMs and VM templates. By setting up a well-defined process of deploying, managing, and deleting VMs and VM templates you can control VM sprawl and VM compliance drift. SAVA helps significantly in managing this process by bringing SA’s policy management capabilities to VM templates from any stage of its lifecycle, for example, if you already have VM templates, SA can attach ongoing patch policies to this template, so that any VMs created from this template automatically derives the SA policies that were set on the templates. For more information on SA’s Virtualization Management capabilities, refer to SA Virtualization white paper.


11

Global Shell (OGFS)

The Global Shell is a command-line interface to the Global File System (OGFS). The command-line interface is a UNIX shell such as bash that runs in a terminal window. The OGFS unifies the SA data model and the contents of managed servers, including files, into a single, virtual file system. SA users can open a Global Shell session from within the SA client.

The OGFS represents the SA data model as a hierarchical structure of file directories and text files. For example, in the OGFS, the /opsw/Customer directory contains details about SA customers and the /opsw/Server directory has information about managed servers. The /opsw/Server directory also contains subdirectories that reflect the contents (such as file systems and registries) of the managed servers. If you have the required permissions, in the Global Shell, you can view and even modify the file systems of managed servers. By accessing the global view of the OGFS, system administration scripts can run iteratively on groups of servers.

HP Live Network

In SAVA, most of the content for OS build plans, Microsoft patch supplements, managed platform updates, and BSA Essentials subscription service (this is for customers who purchase the BSA Essentials subscription service) will be downloaded to the appliance from HP Live Network using the HP Live Network connector. Figure 5 illustrates the content consumption model within SAVA.

Figure 5. HP Live Network connector can be configured by users using the SA client by launching the SAVA Web Utilities Launcher and selecting the “HP Live Network Connect execute” option.


Provision

DHCP serveroptional

Media serveroptional

Patch

Software Audit

SA virtual appliance

SAVA content—OSBP, Patch and BSA Essentials subscription service

HP live network

PostgreSQL

Model repository

Rate this documentShare with colleagues

Sign up for updates hp.com/go/getupdated

Appliance management and maintenance

SAVA provides a set of services to easily maintain and support the appliance. The appliance management interface is actually based on HTML 5 and can be accessed using supported browsers:

• Windows Internet Explorer® version 8 or later

• Mozilla Firefox latest version

Users can point their browsers to the appliance IP address and be able to perform the following actions.

Appliance updates and SA core patchesUsers should go to Settings->Actions->Update Appliance to update the appliance with patches or SAVA core patches. These patches are available on HP Software Support Online (SSO portal) at http://support.openview.hp.com.

Appliance supportYou will need VMware ESXi version 5.0, 5.0 UI, or 5.1 and your host computer must have the ability to run 64 bit guest VMs on the ESXi host. You must install VMware vSphere client with VMware tools. The VM hosting hardware requirements include:

• At least four cores to accommodate the VM

• At least 16 GB of memory allocated for the VM

• Around 500 GB of disk space allocated for the VM

• One network adapter (after you configure your appliance, the appliance network interface must be able to access the network the target servers are on)

• A separate media server

• Two IP addresses allocated to the appliance that must be on the same subnet and be static IP addresses

Note: If you host multiple appliances or other VMs on the same host, the requirements must scale appropriately.

Appliance security SAVA is delivered as a security-hardened virtual appliance. The number of open ports and protocols supported has been limited to the minimum necessary for operation.

Summary—A lightweight solution for server automation

HP Server Automation Virtual Appliance (SAVA) aka HP Server Automation Standard is a simplified and lighter version of the HP Server Automation product that simplifies the setup and reduces the time associated to manage the physical and virtual servers in your data center throughout their lifecycle.


© Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. The only warranties for HP products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. HP shall not be liable for technical or editorial errors or omissions contained herein.

Java is a registered trademark of Oracle Corporation and/or its affiliates. Microsoft, Windows, Internet Explorer, and Hyper-V are U.S. registered trademarks of Microsoft Corporation. UNIX is a registered trademark of The Open Group.

4AA4-6397ENW, May 2013

http://deploy.ztelligence.com/start/index.jsp?PIN=168M59L2W4H8Z&filename=4AA4-6397ENW

http://www.hp.com/go/getupdated

http://support.openview.hp.com

Documents

HP Server Automation Virtual Appliance (aka SA Standard)...2. HP Server Automation Virtual Appliance (SAVA) aka HP Server Automation Standard is a single HP Server Automation (SA)