Net 装机维护 RemoteSupportAgentConfigurationGuidefor.docx

《Net 装机维护 RemoteSupportAgentConfigurationGuidefor.docx》由会员分享，可在线阅读，更多相关《Net 装机维护 RemoteSupportAgentConfigurationGuidefor.docx（39页珍藏版）》请在三一文库上搜索。

1、NetAppxDataONTAP8.2RemoteSupportAgentConfigurationGuidefor7-ModeForUsewithDataONTAPNetApp, Inc.495 East JaVa Drive Sunnyvale, CA 94089 U.S.Part number: 215-08023_A0May 2013Telephone:+1(408)822-60Fax:+1(408)822-4501Supporttelephone:+1(888)463-8277Web:Feedback:doccommentsTableofContents3ContentsWhatRe

2、moteSupportAgentis5Remotesupportarchitecture5WhatRemoteSupportAgentdoes6HowRemoteSupportAgentusesAutoSupport7HowRemoteSupportAgentusesHTTPorHTTPS8HowRemoteSupportAgentprovidesdataandnetworksecurity8HowtheSP/RLMprovidesdataandnetworksecurity9WheretofindmoreinformationaboutRemoteSupportAgent10Configur

3、ingRemoteSupportAgent11Predeploymentchecklist11UpgradingtheSP/RLMfirmware11Configuringyour7-Modestoragesystem12ConfiguringRemoteSupportAgentsoftwareon7-Modcsystems13ManagingandmonitoringRemoteSupportAgent17DisablingandenablingRemoteSupportAgent17CommandsformanagingRemoteSupportAgent18rsahelp18rsaset

4、up19rsashow22rsastatus24rsatest25AccessingtheRemoteSupportEnterpriseUI27RemoteSupportEnterpriseservicepagedescriptions29Troubleshooting30Remotesupporterrormessages30Cannotconnecttohost30Cannotresolvehostname30OnCommandSystemManagerhostnamedoesnotmatchconfiguration.31HTTPerror403-accessdenied31HTTPer

5、ror-invalidusernameorpassword31HTTPhealthcheckinterfacebusy3132HTTPoperationtimeoutHTTPversionnotsupportedbyhost32RemoteSupportPolicyisdisabled32RSEhealthcheckinterfacebusy32RSEorproxyconfigurationisnotvalid33U33Unknownhost33WaitingforRLMtimetobeset33Remotesupportproblems34Incorrectfieldinformationi

6、nNetAppControllerSummary34IncorrectinformationinRemoteSupportAgentConfigurationSummary.34Incorrectstoragecontrollerinformation34U34Copyrightinformation35Trademarkinformation36Howtosendyourcomments37Index38WhatRemOteSUPPOrtAgentisRemoteSupportAgent(RSA)isaremotediagnosticsdatacollectorthatisembeddedd

7、irectlyintothestoragecontrollersremotemanagementdevicefirmware.RemoteSupportAgentenablesaNetAppsupportengineertoremotelyrequestanautomateduploadoflogfiles,corefiles,andotherdiagnosticinformationstoredinthestoragecontrollerandtoremotelytriggeranon-demandAutoSupportcollection.TheRemoteSupportAgentispr

8、ovidedinthelatestfirmwareforstoragesystemsthatsupportanonboardServiceProcessor(SP)ortheRemoteLANModule(RLM)add-oncard.RemoteSupportAgentcanonlybeinstalledonsystemswiththeonboardServiceProcessorortheRemoteLANModule.FAS20xxsystemsthathavethebuilt-inBaseboardManagementController(BMC)arcnotsupported.Not

9、e:YoucanaccessandusethebasicSPandRLMfeaturesindependentlyofRemoteSupportAgent.RemotesupportarchitectureRemoteSupportAgentisapartoftheNetAppRemoteSupportDiagnosticsTool,whichhelpsNetAppSupportsolveyourstoragesystemissueswithouttheneedftrstaffintervention.TheNetRemoteSupportDiagnosticsToolconsistsofth

10、efollowingcomponents:AremotemanagementdeviceTheremotemanagementdevicecanbetheSerViCeProcessor(SP)ortheRemoteLANModule(RLM),dependingonthestoragesystemmodel.TheSP/RLMstaysoperationalregardlessoftheoperatingstateofthesystem.Itprovidesremoteplatformmanagementcapabilities,includingremoteaccess,monitorin

11、g,troubleshooting,logging,andalertingfeatures.FormoreinformationabouttheSP/RLM,seetheDataONTAPSystemAdministrationGuidefor7-Mode.RemoteSupportAgent(RSA)RemoteSupportAgentispartoftheSP/RLMfirmware.RemoteSupportEnterprise(RSE)RemoteSupportEnterpriseistheapplicationandsen,eratNetAppthatlistensforthecus

12、tomersRemoteSupportAgentconnectionandprovidestheGUIthataNetAppTechnicalSupportEngineerusestorequestdiagnosticdata.RSAcommunicateswithRSEtoreceivesupportactionrequestsandsenddiagnosticdata.ThefollowingdiagramillustratesthearchitectureoftheNetAppRemoteSupportDiagnosticsToolin7-modcsystems:NetAppSuppor

13、tSupport ServerRemote Support Customer Data RepositoryRelatedinformationNetAppRemoteSupportDiagnosticsToolpage-WhatRemoteSupportAgentdoesRemoteSupportAgentremotelycollectsdata,intelligentlyhandlescorefiles,andsendsnotificationofdownstoragecontrollers.RemotedatacollectionRemoteSupportAgentenablesNetA

14、ppSupporttorequesttheuploadoffilesfromtheetclogandetccrashdirectoriesandtheirsubdirectories.ThesetwodirectoriescontainonlyNetAppstoragecontrollerenvironmentalanddebugginginformationanddonotcontainanycustomersensitivedata.Multiplefilescanberequestedfromthesedirectories,asrequired,duringcasetriage.Rem

15、oteSupportAgentalsoenablesNetAppSupporttoremotelytriggeranAutoSupportmessageonyourstoragecontrollerandhaveacompleteAutoSupportlogreturnedbyusingtheDataONTAPAutoSupportmechanism.IntelligentcorefilehandlingWhenasystempanics,RemoteSupportAgentautomaticallyuploadsthecorefiletoNetAppSupportwithoutyourint

16、ervention.RemoteSupportAgentuploadsacorefileonlyifitisnotcorruptedandthepanicsignaturedoesnotmatchanyknownpanicmessageintheNetApppanicmessagedatabase.Insuchacondition,thecaseisupdatedwiththelatestinformation.RemoteSupportAgenthandlescorefileuploadfailureasfollows:FailureonthestoragecontrollerIfthere

17、isafailureonthestoragecontrollerduringcorefilecollection,RemoteSupportAgentretriesthecorefilecollection.Ifunsuccessful,RemoteSupportAgentterminatestheretryandsendsafailurealarmtoRemoteSupportEnterprise.WhenRemoteSupportEnterprisereceivesthealarm,itnotifiesNetAppSupportthatanautomaticcoreuploadfailed

18、NetAppSupportthenreachesouttocustomercontactstorequestamanualcoreupload.RemoteSupportEnterprisefaultornetworkoutageIntheeventofanetworkfaultoroutageduringafiletransmission,RemoteSupportAgentretriesthefileuploadseveraltimes.NotificationofdownstoragecontrollerWhentheSP/RLMdetectsthatastoragecontrolle

19、risdown,forexample,duetoanabnormalreboot,theSP/RLMautomaticallytriggersanAutoSupportmessagetoNetAppSupport.Aproblemcaseiscreatedandthelistedhardwarecontactisnotified.AutoSupportmustbeenabledforthisfeaturetoworkcorrectly.HowRemoteSupportAgentusesAutoSupportRemoteSupportAgentenablesaNetAppSupportengin

20、eertoremotelytriggeranAutoSupportrequestonthestoragecontrollerandhavetheAutoSupportdatasentbacktoNetAppsupport.WhenAutoSupportisconfiguredandenabledontheNetAppstoragesystem,RemoteSupportAgentenablesNctAppSupporttobeginproblemdiagnosticsimmediatelywithoutwaitingforyoutosendanupdatedAutoSupportmessage

21、ItalsoenablesNetAppSupporttoeffectivelytroubleshootcasesthatoccurduringoffhourswhenyouarcnotavailabletosendanAutoSupportmessage.WhenRemoteSupportAgentsendsacommandtoDataONTAPtotriggeranAutoSupportmessage,themessageisuniquelyidentifiedbythesubjectlinenRemotcSupportAgenttriggeredASUP.*RemoteSupportAg

22、entrequiresthefollowingAutoSupportsettingsconfiguredonthestoragecontroller:optionautosupport.toe-mail_addressesoptionautosupport.mailhost(nameIP_address_of_outbound_SMTPForexample,ifyousubscribetoAutoSupportnotifications,youalsoreceiveAutoSupportmessagesthatarctriggeredbyRemoteSupportAgent.Forinform

23、ationaboutconfiguringandenablingAutoSupport,seetheDataONTAPSystemAdministrationGuidefor7-Modc.HowRemoteSupportAgentusesHTTPorHTTPSRemoteSupportAgentusesHTTPorHTTPStocommunicatewiththestoragecontrollertoinitiatecommandsandtocollectfiles.ItusesHTTPStosendsystemlogsandcorefilesfromtheDataONTAProotvolum

24、etoRemoteSupportEnterpriseontheNetAppSupportside.Duringacasetriage,theSupportteamoftenrequiresthesystemlogsandcorefiles.BecauseRemoteSupportAgentdoesnothavedirecthardwareaccesstothesefiles,itusesHTTPorHTTPStorequestthesefilesfromthestoragecontroller,tomanuallytriggeranAutoSupportmessagefromthestorag

25、esystem,andtomonitortheprogressofcorefileoperations.ItusesHTTPStocommunicatewithRemoteSupportEnterpriseontheNetAppSupportsideandtosendsystemlogsandcorefilesthatarelocatedontheDataONTAProotvolume.RemotedatacollectionbytheNetAppSupportteamislimitedtofileswithintheetccrashandetclogdirectoriesandtheirsu

26、bdirectories.UsingHTTPenablesRemoteSupportAgentsfasteraccesstothediagnosticsdataontheNetAppcontroller.UsingHTTPSenablesenhancedsecurityonthedataflowbetweenRemoteSupportAgentandtheNetAppcontrollerwithinyourintranet.Youshouldselectthebesttransportoptionbasedonperformanceandsecurityconsiderations.HowRe

27、moteSupportAgentprovidesdataandnetworksecurityToensuredataandnetworksecurity,RemoteSupportAgentenablesyoutohavefullcontrolandvisibilityoverallremoteeventsandactivities.RemoteSupportAgentusesthefollowingsecuritymeasures:Connectionsareoutboundonly.ConnectionbetweenRemoteSupportAgentandRemoteSupportEnt

28、erpriseisalwaysinitiatedbyRemoteSupportAgent.Thisensuresthatthereisonlyanoutboundconnectionfromyoursitetotechnicalsupport.RemoteSupportAgentdoesnotallowdial-inaccessfromNetApptoyoursystem.RemoteSupportAgentperiodicallyconnectstoRemoteSupportEnterprise,downloadsanyactionrequests,anduploadsthesystemst

29、atusorresultstosatisfypreviousrequeststoRemoteSupportEnterprise.ThenonalhealthcheckconnectionintervaliseveryfiveminutesforstoragecontrollersthatarenotbeingactivelyassistedbyaNetAppSupportengineerincasetriage.Theconnectioninten,alchangestoevery10secondsifaNetAppSupportengineerrequestsremotedatacollec

30、tionfromthestoragesystem.Thecollectionintervalreturnstothenormalinten,alwithinashorttimeaftercasetriagerequestshavestopped.Allcommunicationsareauthenticated.CommunicationbetweenRemoteSupportAgentandRemoteSupportEnterpriseisencryptedusing128-bitVeriSignsignedSecureSocketLayer(SSL)certificates.RemoteS

31、upportAgentretainsacopyoftheRemoteSupportEnterprisepubliccertificatetoensurethatcommunicationoccursonlywithNetAppSupport.Iftheauthenticationfails,theconnectionisbrokenandnodataissent.Accesstodiagnosticdataiscontrolled.RemoteSupportAgentconnectstotheNetAppSupportserverperiodically,totransferinformati

32、onandrespondtoservicerequests.Afterdataexchange,ifnosession(suchasafiletransfer)isactive,theconnectionisclosed.RemoteSupportAgentdoesnothaveaccesstoyouruserdata.Theonlydirectorytreesthatareaccessiblefromtherootvolumeofthestoragesystemareetccrashandetclogandtheirsubdirectories.Diagnosticdataisstoreds

33、ecurely.DatathatisuploadedfromRemoteSupportAgentisstoredinahighlysecureOracledatabasebehindtheNetAppcorporatefirewall.AccesstothisdataisrestrictedtoauthorizedNetAppSupportpersonnel.AllactionstakenbyNetAppSupportusingRemoteSupportEnterprisearerecordedandcanbeauditedbyaccessingtheRemoteSupportEnterpri

34、seinterfaceatyourNetAppSupportsitelogin.Securityassessmentsareconductedperiodically.SecurityassessmentshelptoensurethatRemoteSupportAgentconformstoindustrybestpracticesforprotectingyourdata.Formoreinformation,seetheThird-PartySecurityAssessmentlinkundertheAdditionalInformationheadingtoexaminetheRemo

35、teLANModuleSecurityAssessmentwhitepaperbySSecuritypoliciesarecheckedatstartup.WhenRemoteSupportAgentstarts,itchecksthesecuritypoliciesthatareconfiguredinthestoragecontroller.RemoteSupportAgentisnotifiedwheneveryouchangethesecuritypolicies.IfthesecuritypolicydoesnotallowcommunicationtotheRemoteSuppor

36、tEnterpriseserver,thenRemoteSupportAgentdoesnotconnecttoRemoteSupportEnterprise.RemoteSupportAgentfeatures,includingremotedatacollection,coreupload,andAutoSupportmessagegeneration,aredisabled.Ifthesecuritypolicyischangedfromallowingcommunicationtonotallowingcommunication,thenRemoteSupportAgentreport

37、sthenewpolicytoRemoteSupportEnterpriseandstopsanysubsequentcontactwithRemoteSupportEnterprise.YoucandisabletheconnectiontoNetAppSupportandallRemoteSupportAgentfeaturesbyusingthersasetupcommandwiththepolicy-enableoptionsettoNo.HowtheSP/RLMprovidesdataandnetworksecurityTheSP/RLMonyourstoragecontroller

38、usessingleoutbound-onlyCthernctconnection,locallysecuredusernameandpasswords,andasingleportfordataandnetworksecuritysupport.AsingleethemetconnectionistheonlyexternalinterfaceontheSP/RLM.TheSP/RLMfirewallpreventsincomingconnectionsfromoutsideyournetwork.Itallowsonlyconnectionsfromwithinyournetworkbyt

39、heDataONTAPadministrationaccounts(inboundSSHonly).ConnectionstoNetAppareoutgoingonly.OnlyanoutgoingconnectiontoNetApponport443isallowed.Datacollectionisonlyfromtheetccrashandetclogandtheirsubdirectories.AdministratoruserIDandpasswordisrequired.TheadministratoruserIDandpasswordthatisconfiguredinDataO

40、NTAPissuppliedtotheconfigurationoftheRemoteSupportAgentsothatitcancommunicatewithDataONTAP.TheSP/RLMcontrolsaccesstothestoragesystem.Thereisnorequirementforaspecialaccount;youcanuseanyaccountaslongasitisintheDataONTAPAdministratorsgroup.Ifmultipleadministratorsaresharingtheaccount,thenarecommendedbe

41、stpracticeistocreateaspecialaccountforRemoteSupportAgentusage.Onlyoneportacceptsconnections.TheonlySP/RLMportthatacceptsconnectionrequestsisSSH(port22).TheonlyoutboundportsallowedareSMTP(port25),SNMP(trapport162),andSSL(port443).WheretofindmoreinformationaboutRemoteSupportAgentYoucanfindadditionalin

42、formationaboutRemoteSupportAgent,SP,RLM,andRemoteSupportEnterpriseindocumentsontheNetAppSupportSite.TheNetAppRemoteSupportDiagnosticsToolsectionoftheNetAppSupportScontainsusefulbackgroundinformation,anFAQsection,andasecurityassessment.TheDataONTAPSystemAdministrationGuidefor7-Modecontainsinfbnationa

43、boutSPandRLM,AutoSupport,andRemoteSupportEnterprise.TheDataONTAPUpgradeandRevert/DowngradeGuidefor7-ModecontainsinformationaboutupdatingtheSPandRLMfirmware.COnfigUringRemOteSUPPOrtAgentConfiguringRemoteSupportAgentconsistsofupgradingtheSPRLM,configuringyourstoragesystem,andthenconfiguringRemoteSuppo

44、rtAgent.PredeploymentchecklistBeforeyoubegintoconfigureRemoteSupportAgent,youshouldbesurethatitsatisfiesyoursecuritypoliciesforInternetaccessandmeetstheserequirements.Ensurethatallofthefollowingaretrue.FormoreinformationaboutDataONTAPcommands,seetheDataONTAPSystemAdministrationGuidefor7-Modeandtheap

45、propriatemanpages.RemoteSupportAgentisprovidedasafirmwareupgradetotheRemoteLANModule(RLM)card.Firmware3.0orlaterisrequired;release4.0orlaterisrecommended.RemoteSupportAgentisincludedintheSen,iceProcessor(SP)firmwareonFASZV2200,3200,and6200systems.FAS20xxsystemsthathavethebuilt-inBaseboardManagementC

46、ontroller(BMC)arenotsupported.Youmusthavea128-bit,encrypted,outboundHTTPSconnectiontotheInternetoverport443.Youmusthavea10/100megabitspersecondfull-duplexEthernetportwithautonegotiationenabled.YoumusthavetheabilitytoaccessthetargetURLAutoSupportmustbeenabledonthestoragesystem.TheSP/RLMmustbeconfigur

47、ed.ThespsetupandrimsetupcommandsdisplaytheSP/RLMconfiguration.SP/RLMmustbeabletosendatestAutoSupportmessage.Theoptionsautosupport.to,optionsautosupport.mailhost,andrimtestautosupportorsptestautosupportcommandsenableyoutoverifywhethertheSP/RLMisabletosendatestmessage.UpgradingtheSP/RLMfirmwareBeforeyouconfigureRemoteSupportAgent,youshouldcheckwhethertheSP/RLMneedsafirmwareupgrade.Steps1. DownloadthelatestSP/RLMfirmware.UsetheDataONTAPconsoleort