Net 装机维护 RemoteSupportAgentConfigurationGuideForUse.docx

《Net 装机维护 RemoteSupportAgentConfigurationGuideForUse.docx》由会员分享，可在线阅读，更多相关《Net 装机维护 RemoteSupportAgentConfigurationGuideForUse.docx（49页珍藏版）》请在三一文库上搜索。

1、NetAppxClusteredDataONTAP8.2RemoteSupportAgentConfigurationGuideForUsewithClusteredDataONTAPNetApp, Inc.495 East JaVa Drive Sunnyvale, CA 94089 U.S.Part number: 215-08022_A0May 2013Telephone:+1(408)822-60Fax:+1(408)822-4501Supporttelephone:+1(888)463-8277Web:Feedback:doccommentsTableofContents3Conte

2、ntsWhatRemoteSupportAgentis5Remotesupportarchitecture5WhatRemoteSupportAgentdoes6HowRemoteSupportAgentusesAutoSupport7HowRemoteSupportAgentusesHTTPorHTTPS8HowRemoteSupportAgentprovidesdataandnetworksecurity8HowtheSP/RLMprovidesdataandnetworksecurity9WheretofindmoreinformationaboutRemoteSupportAgent1

3、0ConfiguringRemoteSupportAgent11Pre-deloymentconsiderationsforCluster-Mode11UpgradingtheSP/RLMfirmware12UpgradinganddowngradingDataONTAPtouseSPIwebservicecluster-wide.12Configuringyourstoragesysteminaclusterenvironment13ConfiguringtheRemoteSupportAgentsoftwareforCluster-Mode22ManagingandmonitoringRe

4、moteSupportAgent26DisablingandenablingRemoteSupportAgent26CommandsformanagingRemoteSupportAgent27rsahelp27rsasetup28rsashow31rsastatus33rsatest34AccessingtheRemoteSupportEnterpriseUI36RemoteSupportEnterpriseservicepagedescriptions38Troubleshooting39Remotesupporterrormessages39Cannotconnecttohost39Ca

5、nnotresolvehostname39OnCommandSystemManagerhostnamedoesnotmatchconfiguration.40HTTP503-resourceunavailable40HTTPerror403-accessdenied4041HTTPerror-invalidusernameorpassword,HTTPhealthcheckinterfacebusy41HTTPoperationtimeout41HTTPversionnotsupportedbyhost41optionhttpd.admin.enablenotsettoon42optionht

6、tpd.autoindex.enablc42RemoteSupportPolicyisdisabled42RSEhealthcheckinterfacebusy42RSEorproxyconfigurationisnotvalid42Unknownhost43WaitingforRLMtimetobeset43Remotesupportproblems43IncorrectfieldinformationinNetAppControllerSummary43IncorrectinformationinRemoteSupportAgentConfigurationSummary.43Incorr

7、ectstoragecontrollerinformation44U44Copyrightinformation45Trademarkinformation46Howtosendyourcomments47Index48WhatRemOteSUPPOrtAgentisRemoteSupportAgent(RSA)isaremotediagnosticsdatacollectorthatisembeddeddirectlyintothestoragecontrollersremotemanagementdevicefirmware.RemoteSupportAgentenablesaNetApp

8、supportengineertoremotelyrequestanautomateduploadoflogfiles,corefiles,andotherdiagnosticinformationstoredinthestoragecontrollerandtoremotelytriggeranon-demandAutoSupportcollection.TheRemoteSupportAgentisprovidedinthelatestfirmwareforstoragesystemsthatsupportanonboardServiceProcessor(SP)ortheRemoteLA

9、NModule(RLM)add-oncard.RemoteSupportAgentcanonlybeinstalledonsystemswiththeonboardServiceProcessorortheRemoteLANModule.FAS20xxsystemsthathavethebuilt-inBaseboardManagementController(BMC)arcnotsupported.Note:YoucanaccessandusethebasicSPandRLMfeaturesindependentlyofRemoteSupportAgent.Remotesupportarch

10、itectureRemoteSupportAgentisapartoftheNetAppRemoteSupportDiagnosticsTool,whichhelpsNetAppSupportsolveyourstoragesystemissueswithouttheneedftrstaffintervention.TheNetRemoteSupportDiagnosticsToolconsistsofthefollowingcomponents:AremotemanagementdeviceTheremotemanagementdevicecanbetheSer,iceProcessor(S

11、P)ortheRemoteLANModule(RLM),dependingonthestoragesystemmodel.TheSP/RLMstaysoperationalregardlessoftheoperatingstateofthesystem.Itprovidesremoteplatformmanagementcapabilities,includingremoteaccess,monitoring,troubleshooting,logging,andalertingfeatures.Forcluster-modesystems,theSP/RLMmusthaveaccesstot

12、heClusterManagementLIF.FormoreinformationabouttheSP/RLM,seetheClusteredDataONTAPSystemAdministrationGuideforClusterAdministrators.RemoteSupportAgent(RSA)RemoteSupportAgentispartoftheSP/RLMfirmware.RemoteSupportEnterprise(RSE)RemoteSupportEnterpriseistheapplicationandsen,eratNetAppthatlistensforthecu

13、stomersRemoteSupportAgentconnectionandprovidestheGUIthataNetAppTechnicalSupportEngineerusestorequestdiagnosticdata.RSAcommunicateswithRSEtoreceivesupportactionrequestsandsenddiagnosticdata.ThefollowingdiagramillustratesthearchitectureoftheNetAppRemoteSupportDiagnosticsToolincluster-modesystems:Relat

14、edinformationNetAppRemoteSupportDiagnosticsToolpage-WhatRemoteSupportAgentdoesRemoteSupportAgentremotelycollectsdata,intelligentlyhandlescorefiles,andsendsnotificationofdownstoragecontrollers.RemotedatacollectionRemoteSupportAgentenablesNetAppSupporttorequesttheuploadoffilesfromthe/mroot/etc/logandm

15、rootetccrashdirectoriesandtheirsubdirectoriesinanynodethatishostingtheClusterManagementLIF.ThesetwodirectoriescontainonlyNetAppstoragecontrollerenvironmentalanddebugginginformationanddonotcontainanycustomer-sensitivedata.Multiplefilescanbeuploadedfromthesedirectories,asrequired,duringcasetriage.Remo

16、teSupportAgentalsoenablesNetAppSupporttoremotelytriggeranAutoSupportmessageonyourstoragecontrollerandhaveacompleteAutoSupportlogreturnedbyusingtheDataONTPAutoSupportmechanism.IntelligentcorefilehandlingWhenasystempanics,RemoteSupportAgentautomaticallyuploadsthecorefiletoNetAppSupportwithoutyourinter

17、vention.RemoteSupportAgentuploadsacorefileonlyifitisnotcorruptedandthepanicsignaturedoesnotmatchanyknownpanicmessageintheNetApppanicmessagedatabase.Insuchacondition,thecaseisupdatedwiththelatestinformation.RemoteSupportAgenthandlescorefileuploadfailureasfollows:FailureonthestoragecontrollerIfthereis

18、afailureonthestoragecontrollerduringcorefilecollection,RemoteSupportAgentretriesthecorefilecollection.Ifunsuccessful,RemoteSupportAgentterminatestheretryandsendsafailurealarmtoRemoteSupportEnterprise.WhenRemoteSupportEnterprisereceivesthealarm,itnotifiesNetAppSupportthatanautomaticcoreuploadfailed.N

19、etAppSupportthenreachesouttocustomercontactstorequestamanualcoreupload.RemoteSupportEnterprisefaultornetworkoutageIntheeventofanetworkfaultoroutageduringafiletransmission,RemoteSupportAgentretriesthefileuploadseveraltimes.NotificationofdownstoragecontrollerWhentheSP/RLMdetectsthatastoragecontrolleri

20、sdown,forexample,duetoanabnormalreboot,theSP/RLMautomaticallytriggersanAutoSupportmessagetoNetAppSupport.Aproblemcaseiscreatedandthelistedhardwarecontactisnotified.AutoSupportmustbeenabledonallnodesintheclusterforthisfeaturetoworkcorrectly.HowRemoteSupportAgentusesAutoSupportRemoteSupportAgentenable

21、saNetAppSupportengineertoremotelytriggeranAutoSupportrequestonthestoragecontrollerandhavetheAutoSupportdatasentbacktoNetAppsupport.WhenAutoSupportisconfiguredandenabledontheNetAppstoragesystem,RemoteSupportAgentenablesNetAppSupporttobeginproblemdiagnosticsimmediatelywithoutwaitingforyoutosendanupdat

22、edAutoSupportmessage.ItalsoenablesNetAppSupporttoeffectivelytroubleshootcasesthatoccurduringoffhourswhenyouarenotavailabletosendanAutoSupportmessage.WhenRemoteSupportAgentsendsacommandtoDataONTAPtotriggeranAutoSupportmessage,themessageisuniquelyidentifiedbythesubjectlinenRemoteSupportAgenttriggeredA

23、SUP.nRemoteSupportAgentusesthesystemnodeautosupportcommandparametersthatareconfiguredonthenode.ForinformationaboutconfiguringandenablingAutoSupport,seetheClusteredDataONTAPSystemAdministrationGuideforClusterAdministrators.HowRemoteSupportAgentusesHTTPorHTTPSRemoteSupportAgentusesHTTPorHTTPStocommuni

24、catewiththestoragecontrollertoinitiatecommandsandtocollectfiles.ItusesHTTPStosendsystemlogsandcorefilesfromtheDataONTAProotvolumetoRemoteSupportEnterpriseontheNetAppSupportside.Duringacasetriage,theSupportteamoftenrequiresthesystemlogsandcorefiles.BecauseRemoteSupportAgentdoesnothavedirecthardwareac

25、cesstothesefiles,itusesHTTPorHTTPStorequestthesefilesfromthestoragecontroller,tomanuallytriggeranAutoSupportmessagefromthestoragesystem,andtomonitortheprogressofcorefileoperations.ItusesHTTPStocommunicatewithRemoteSupportEnterpriseontheNetAppSupportsideandtosendsystemlogsandcorefilesthatarelocatedon

26、theDataONTAProotvolume.RemotedatacollectionbytheNetAppSupportteamislimitedtofileswithinthemrootetccrashandmrootetclogdirectoriesandtheirsubdirectories.UsingHTTPenablesRemoteSupportAgentsfasteraccesstothediagnosticsdataontheNetAppcontroller.UsingHTTPSenablesenhancedsecurityonthedataflowbetweenRemoteS

27、upportAgentandtheNetAppcontrollerwithinyourintranet.Youshouldselectthebesttransportoptionbasedonperformanceandsecurityconsiderations.HowRemoteSupportAgentprovidesdataandnetworksecurityToensuredataandnetworksecurity,RemoteSupportAgentenablesyoutohavefullcontrolandvisibilityoverallremoteeventsandactiv

28、ities.RemoteSupportAgentusesthefollowingsecuritymeasures:Connectionsareoutboundonly.ConnectionbetweenRemoteSupportAgentandRemoteSupportEnterpriseisalwaysinitiatedbyRemoteSupportAgent.Thisensuresthatthereisonlyanoutboundconnectionfromyoursitetotechnicalsupport.RemoteSupportAgentdoesnotallowdial-inacc

29、essfromNetApptoyoursystem.RemoteSupportAgentperiodicallyconnectstoRemoteSupportEnterprise,downloadsanyactionrequests,anduploadsthesystemstatusorresultstosatisfypreviousrequeststoRemoteSupportEnterprise.Thenonalhealthcheckconnectionintervaliseveryfiveminutesforstoragecontrollersthatarenotbeingactivel

30、yassistedbyaNetAppSupportengineerincasetriage.Theconnectioninten,alchangestoevery10secondsifaNetAppSupportengineerrequestsremotedatacollectionfromthestoragesystem.Thecollectionintervalreturnstothenomialintervalwithinashorttimeaftercasetriagerequestshavestopped.Allcommunicationsareauthenticated.Commu

31、nicationbetweenRemoteSupportAgentandRemoteSupportEnterpriseisencryptedusing128-bitVeriSignsignedSecureSocketLayer(SSL)certificates.RemoteSupportAgentretainsacopyoftheRemoteSupportEnterprisepubliccertificatetoensurethatcommunicationoccursonlywithNetAppSupport.Iftheauthenticationfails,theconnectionisb

32、rokenandnodataissent. Accesstodiagnosticdataiscontrolled.RemoteSupportAgentconnectstotheNetAppSupportserverperiodically,totransferinformationandrespondtoservicerequests.Afterdataexchange,ifnosession(suchasafiletransfer)isactive,theconnectionisclosed.RemoteSupportAgentdoesnothaveaccesstoyouruserdata.

33、Theonlydirectorytreesthatareaccessiblefromtherootvolumeofthestoragesystemaremrootetccrashand/mroot/etc/logdirectoriesandtheirsubdirectories.Diagnosticdataisstoredsecurely.DatathatisuploadedfromRemoteSupportAgentisstoredinahighlysecureOracledatabasebehindtheNetAppcorporatefirewall.Accesstothisdataisr

34、estrictedtoauthorizedNetAppSupportpersonnel.AllactionstakenbyNetpSupportusingRemoteSupportEnterprisearerecordedandcanbeauditedbyaccessingtheRemoteSupportEnterpriseinterfaceatyourNetAppSupportsitelogin. Securityassessmentsareconductedperiodically.SecurityassessmentshelptoensurethatRemoteSupportAgentc

35、onformstoindustrybestpracticesforprotectingyourdata.Formoreinformation,seetheThird-PartySecurityAssessmentlinkundertheAdditionalInformationheadingtoexaminetheRemoteLANModuleSecurityAssessmentwhitepaperbySSecuritypoliciesarecheckedatstartup.WhenRemoteSupportAgentstarts,itchecksthesecuritypoliciesthat

36、areconfiguredinthestoragecontroller.RemoteSupportAgentisnotifiedwheneveryouchangethesecuritypolicies.IfthesecuritypolicydoesnotallowcommunicationtotheRemoteSupportEnterpriseserver,thenRemoteSupportAgentdoesnotconnecttoRemoteSupportEnterprise.RemoteSupportAgentfeatures,includingremotedatacollection,c

37、oreupload,andAutoSupportmessagegeneration,aredisabled.Ifthesecuritypolicyischangedfromallowingcommunicationtonotallowingcommunication,thenRemoteSupportAgentreportsthenewpolicytoRemoteSupportEnterpriseandstopsanysubsequentcontactwithRemoteSupportEnterprise.YoucandisabletheconnectiontoNetAppSupportand

38、allRemoteSupportAgentfeaturesbyusingthersasetupcommandwiththepolicy-enableoptionsettoNo.HowtheSP/RLMprovidesdataandnetworksecurityTheSP/RLMonyourstoragecontrollerusessingleoutbound-onlyethemetconnection,locallysecuredusernameandpasswords,andasingleportfordataandnetworksecuritysupport. Asingleethemet

39、connectionistheonlyexternalinterfaceontheSP/RLM.TheSP/RLMfirewallpreventsincomingconnectionsfromoutsideyournetwork.ItallowsonlyconnectionsfromwithinyournetworkbytheDataONTAPadministrationaccounts(inboundSSHonly). ConnectionstoNetAppareoutgoingonly.OnlyanoutgoingconnectiontoNetApponport443isallowed.D

40、atacollectionisonlyfromthe/mroot/etc/crashandmrootetclogdirectories,andtheirsubdirectories.AdministratoruserIDandpasswordisrequired.TheadministratoruserIDandpasswordthatisconfiguredinDataONTAPissuppliedtotheconfigurationoftheRemoteSupportAgentsothatitcancommunicatewithDataONTAP.TheSP/RLMcontrolsacce

41、sstothestoragesystem.Thereisnorequirementforaspecialaccount;youcanuseanyaccountaslongasitisintheDataONTAPAdministratorsgroup.Ifmultipleadministratorsaresharingtheaccount,thenarecommendedbestpracticeistocreateaspecialaccountforRemoteSupportAgentusage.Onlyoneportacceptsconnections.TheonlySP/RLMporttha

42、tacceptsconnectionrequestsisSSH(port22).TheonlyoutboundportsallowedareSMTP(port25),SNMP(trapport162),andSSL(port443).WheretofindmoreinformationaboutRemoteSupportAgentYoucanfindadditionalinformationaboutRemoteSupportAgent,SP,RLM,andRemoteSupportEnterpriseindocumentsontheNetAppSupportSite. TheNetAppRe

43、moteSupportDiagnosticsToolsectionoftheNetAppSupportScontainsusefulbackgroundinformation,anFAQsection,andasecurityassessment.TheClusteredDataONTAPSystemAdministrationGuideforClusterAdministratorscontainsinformationaboutSPandRLM,AutoSupport,andRemoteSupportEnterprise.TheDataONTAPUpgradeandRevertZDowng

44、radeGuideforCluster-ModecontainsinformationaboutupdatingtheSPandRLMfirmware.11ConfiguringRemoteSupportAgentConfiguringRemoteSupportAgentconsistsofupgradingtheSPRLM,configuringyourstoragesystem,andthenconfiguringRemoteSupportAgent.Pre-deploymentconsiderationsforCluster-ModeBeforeyoubegintoconfigureRe

45、moteSupportAgent,youmustensurethatitsatisfiesyoursecuritypoliciesforInternetaccess.BeforeyoudeployRemoteSupportAgentinyourclusterenvironment,allofthefollowingconditionsmustexistandrequirementsmustbemet.FormoreinformationaboutDataONTAPcommands,seetheClusteredDataONTAPSystemAdministrationGuideforClust

46、erAdministratorsandtheappropriatemanpages.RemoteSupportAgentrequirementsYoumusthavearemotemanagementdeviceonyourNetAppFASandV-Seriesstoragesystems:RemoteSupportAgentisprovidedasafirmwareupgradetotheRemoteLANModule(RLM)card.Firmware3.0orlaterisrequired;release4.0orlaterisrecommended.,RemoteSupportAge

47、ntisincludedintheSen,iceProcessor(SP)firmwareonFASandV-Series2200,3200,and6200systems. Youmusthavea128-bit,encrypted,outboundHTTPSconnectiontotheInternetoverport443.,Youmusthavea10/100Mbpsfull-duplexEthernetportwithautonegotiationenabled. YoumusthaveaccesstothetargetURL. AutoSupportmustbeenabledonthestoragesystem.StoragesystemrequirementsTheSer,iceProcessor(SP)orRemoteLANModule(RLM)mustbeconfigured.ThespsetupandrimsetupcommandsdisplaytheSPorRLMconfiguration.AutoSupportmustbeenabledonthestoragesystem.