{"id":1600,"date":"2014-12-04T09:30:27","date_gmt":"2014-12-04T08:30:27","guid":{"rendered":"http:\/\/vm.piszki.pl\/?p=1600"},"modified":"2014-12-04T10:16:21","modified_gmt":"2014-12-04T09:16:21","slug":"oporny-upgrade-vcenter-5-1-do-wersji-5-1u2a","status":"publish","type":"post","link":"https:\/\/vm.piszki.pl\/?p=1600","title":{"rendered":"Oporny upgrade vCenter 5.1 do wersji 5.1U2a."},"content":{"rendered":"

Niedawno na produkcji pojawi\u0142o si\u0119 okienko serwisowe. Zupe\u0142nie niespodziewanie. Wystarczaj\u0105co szerokie aby wykorzysta\u0107 je do wykonania dawno odk\u0142adanego upgrade vCenter 5.1 do ostatniej wersji. Przeskok z 5.1U1 do wersji 5.1U2a wydaje si\u0119 ma\u0142ym kroczkiem, h\u0119? Nic bardziej mylnego! Dwudniowy horror jaki sobie zafundowali\u015bmy b\u0119d\u0119 wspomina\u0142 d\u0142ugo! Do tej pory w rozmowach z przedstawicielami VMware zawsze chwali\u0142em si\u0119 \u017ce nie wiem o co im chodzi gdy m\u00f3wi\u0105 o problemach z SSO w 5.1. A\u017c do teraz. B\u0119d\u0119 pisa\u0142 grzecznie i poprawnie, mimo targaj\u0105cych mn\u0105 emocji :-)<\/p>\n

\"vm4\"<\/a><\/p>\n

<\/p>\n

Akt pierwszy, upgrade SSO. Czy mo\u017ce by\u0107 co\u015b prostszego? Wk\u0142adamy p\u0142ytk\u0119, next, next, next, finish. Us\u0142uga nie wstaje. Symptomy zosta\u0142y opisane w tym KB<\/a> (Server daemon died!), niestety opisana solucja nie pomog\u0142a. SSO na javie wykopiowanej z pliku jre.zip startowa\u0142o bez problemu, ale nie dzia\u0142a\u0142o poprawnie, w logu vCenter (vpxd.log), pojawi\u0142 si\u0119 natychmiast wpis:<\/p>\n

[01608 info '[SSO][SsoFactory_CreateFacade]’] Solution user set to: vCenterServer_2012.11.26_102929
\n[01608 info '[SSO][SsoFactory_CreateFacade]’] VC’s ServiceId in LookupService: {D3E3C386-3CCE-420E-AF3E-A72393D1A146}:9
\n[01608 info '[SSO][SsoFactory_CreateFacade]’] STS URI set to: https:\/\/PTSSO1.ptcloud.local:7444\/ims\/STSService
\n[01608 info '[SSO][SsoFactory_CreateFacade]’] Admin URI set to: https:\/\/PTSSO1.ptcloud.local:7444\/sso-adminserver\/sdk
\n[01608 info '[SSO][SsoFactory_CreateFacade]’] Groupcheck URI set to: https:\/\/PTSSO1.ptcloud.local:7444\/sso-adminserver\/sdk
\n[01608 info '[SSO][SsoFactory_CreateFacade]’] VC SSL certificate location: C:\\ProgramData\\VMware\\VMware VirtualCenter\\ssl\\rui.crt
\n[01608 info '[SSO][CreateSsoFacade]’] [CreateUserDirectory] STS URI set to: https:\/\/PTSSO1.ptcloud.local:7444\/ims\/STSService
\n[01608 info '[SSO][CreateSsoFacade]’] [CreateUserDirectory] Admin URI set to: https:\/\/PTSSO1.ptcloud.local:7444\/sso-adminserver\/sdk
\n[01608 info '[SSO][CreateSsoFacade]’] [CreateUserDirectory] Groupcheck URI set to: https:\/\/PTSSO1.ptcloud.local:7444\/sso-adminserver\/sdk
\n[01608 error 'Default’] Found dangling SSL error: [0] error:00000001:lib(0):func(0):reason(1)
\n[01608 error 'Default’] Found dangling SSL error: [1] error:00000001:lib(0):func(0):reason(1)
\n[01608 error '[SSO][SsoFactory_CreateFacade]’] Unable to create SSO facade: vmodl.fault.SystemError.
\n[01608 error 'vpxdvpxdMain’] [Vpxd::ServerApp::Init] Init failed: Vpx::Common::Sso::SsoFactory_CreateFacade(sslContext, ssoFacadeConstPtr)
\n–> Backtrace:
\n–> backtrace[00] rip 000000018018b86a
\n–> backtrace[01] rip 0000000180102ac8
\n–> backtrace[02] rip 0000000180103f9e
\n–> backtrace[03] rip 000000018008d22b
\n–> backtrace[04] rip 00000000003e5bdc
\n–> backtrace[05] rip 0000000000406652
\n–> backtrace[06] rip 00000001405cf001
\n–> backtrace[07] rip 00000001405c8e1c
\n–> backtrace[08] rip 00000001407ed8db
\n–> backtrace[09] rip 000007fefed7a82d
\n–> backtrace[10] rip 00000000776d59ed
\n–> backtrace[11] rip 000000007790c541
\n–>
\n[01608 warning 'VpxProfiler’] ServerApp::Init [TotalTime] took 7784 ms
\n[01608 error 'Default’] Failed to intialize VMware VirtualCenter. Shutting down…
\n[01608 info 'vpxdvpxdSupportManager’] Wrote uptime information<\/span><\/p>\n

Oczywi\u015bcie VMware ma na wszystko KB<\/a>, jednak i tym razem opisana solucja nie zadzia\u0142a\u0142a. Na szcz\u0119\u015bcie mia\u0142em do dyspozycji stary katalog jre z przed upgrade. Podmieni\u0142em i o dziwo SSO wystartowa\u0142o poprawnie. Tak\u017ce vCenter po\u0142\u0105czy\u0142o si\u0119 poprawnie do SSO.<\/p>\n

Akt drugi, upgrade Inventory Service. Instalator podmienia katalog jre na wersj\u0119 nie dzia\u0142aj\u0105c\u0105, us\u0142uga nie wstaje. Zastosowa\u0142em procedur\u0119 podmiany jre na starsz\u0105 wersj\u0119 i wszystko si\u0119 uruchomi\u0142o. Niestety, w logach Inventory Service pojawi\u0142o si\u0119 co\u015b takiego:<\/p>\n

wrapper.log:<\/p>\n

INFO\u00a0\u00a0 | jvm 1\u00a0\u00a0\u00a0 | 2014\/10\/29 08:09:35 | 2014-10-29 08:09:35 org.apache.tomcat.util.net.NioEndpoint$SocketProcessor run
\nINFO\u00a0\u00a0 | jvm 1\u00a0\u00a0\u00a0 | 2014\/10\/29 08:09:35 | SEVERE:
\nINFO\u00a0\u00a0 | jvm 1\u00a0\u00a0\u00a0 | 2014\/10\/29 08:09:35 | java.lang.NoClassDefFoundError: sun\/security\/util\/KeyUtil
\nINFO\u00a0\u00a0 | jvm 1\u00a0\u00a0\u00a0 | 2014\/10\/29 08:09:35 |\u00a0\u00a0\u00a0\u00a0 at com.sun.crypto.provider.DHKeyAgreement.engineDoPhase(DashoA13*..)
\nINFO\u00a0\u00a0 | jvm 1\u00a0\u00a0\u00a0 | 2014\/10\/29 08:09:35 |\u00a0\u00a0\u00a0\u00a0 at javax.crypto.KeyAgreement.doPhase(DashoA13*..)
\nINFO\u00a0\u00a0 | jvm 1\u00a0\u00a0\u00a0 | 2014\/10\/29 08:09:35 |\u00a0\u00a0\u00a0\u00a0 at com.sun.net.ssl.internal.ssl.DHCrypt.getAgreedSecret(Unknown Source)
\nINFO\u00a0\u00a0 | jvm 1\u00a0\u00a0\u00a0 | 2014\/10\/29 08:09:35 |\u00a0\u00a0\u00a0\u00a0 at com.sun.net.ssl.internal.ssl.ServerHandshaker.clientKeyExchange(Unknown Source)
\nINFO\u00a0\u00a0 | jvm 1\u00a0\u00a0\u00a0 | 2014\/10\/29 08:09:35 |\u00a0\u00a0\u00a0\u00a0 at com.sun.net.ssl.internal.ssl.ServerHandshaker.processMessage(Unknown Source)
\nINFO\u00a0\u00a0 | jvm 1\u00a0\u00a0\u00a0 | 2014\/10\/29 08:09:35 |\u00a0\u00a0\u00a0\u00a0 at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Unknown Source)
\nINFO\u00a0\u00a0 | jvm 1\u00a0\u00a0\u00a0 | 2014\/10\/29 08:09:35 |\u00a0\u00a0\u00a0\u00a0 at com.sun.net.ssl.internal.ssl.Handshaker$1.run(Unknown Source)
\nINFO\u00a0\u00a0 | jvm 1\u00a0\u00a0\u00a0 | 2014\/10\/29 08:09:35 |\u00a0\u00a0\u00a0\u00a0 at java.security.AccessController.doPrivileged(Native Method)
\nINFO\u00a0\u00a0 | jvm 1\u00a0\u00a0\u00a0 | 2014\/10\/29 08:09:35 |\u00a0\u00a0\u00a0\u00a0 at com.sun.net.ssl.internal.ssl.Handshaker$DelegatedTask.run(Unknown Source)
\nINFO\u00a0\u00a0 | jvm 1\u00a0\u00a0\u00a0 | 2014\/10\/29 08:09:35 |\u00a0\u00a0\u00a0\u00a0 at org.apache.tomcat.util.net.SecureNioChannel.tasks(SecureNioChannel.java:285)
\nINFO\u00a0\u00a0 | jvm 1\u00a0\u00a0\u00a0 | 2014\/10\/29 08:09:35 |\u00a0\u00a0\u00a0\u00a0 at org.apache.tomcat.util.net.SecureNioChannel.handshakeUnwrap(SecureNioChannel.java:343)
\nINFO\u00a0\u00a0 | jvm 1\u00a0\u00a0\u00a0 | 2014\/10\/29 08:09:35 |\u00a0\u00a0\u00a0\u00a0 at org.apache.tomcat.util.net.SecureNioChannel.handshake(SecureNioChannel.java:193)
\nINFO\u00a0\u00a0 | jvm 1\u00a0\u00a0\u00a0 | 2014\/10\/29 08:09:35 |\u00a0\u00a0\u00a0\u00a0 at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:1642)
\nINFO\u00a0\u00a0 | jvm 1\u00a0\u00a0\u00a0 | 2014\/10\/29 08:09:35 |\u00a0\u00a0\u00a0\u00a0 at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(Unknown Source)
\nINFO\u00a0\u00a0 | jvm 1\u00a0\u00a0\u00a0 | 2014\/10\/29 08:09:35 |\u00a0\u00a0\u00a0\u00a0 at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
\nINFO\u00a0\u00a0 | jvm 1\u00a0\u00a0\u00a0 | 2014\/10\/29 08:09:35 |\u00a0\u00a0\u00a0\u00a0 at java.lang.Thread.run(Unknown Source)<\/span><\/p>\n

I tak restart za restartem. Wy\u0142\u0105czamy SSO, podmieniamy Jav\u0119 na wersj\u0119 z pliku jre.zip, uruchamiamy Inventory Service. Dzia\u0142a! Czyli SSO dzia\u0142a na starszej wersji Javy a Inventory Service na nowej (a katalog jest wsp\u00f3lny). Ten problem te\u017c da\u0142o si\u0119 rozwi\u0105za\u0107. JRE zosta\u0142o przywr\u00f3cone stare, SSO wystartowa\u0142o. Obok zosta\u0142 wgramy JRE_NEW z pliku jre.zip a w pliku wrapper.conf w katalogu Program Files\\VMware\\Infrastructure\\Inventory Service\\conf zosta\u0142a zmodyfikowana linia: wrapper.java.command=D:\/Program Files\/VMware\/Infrastructure\/jre_new\/bin\/java. Po takiej modyfikacji mamy dwie us\u0142ugi dzia\u0142aj\u0105ce na r\u00f3\u017cnych wersjach Javy (to jeszcze ten typ instalacji gdzie SSO i Inventory Service s\u0105 na osobnym ho\u015bcie). Bardzo podobna procedura mia\u0142a miejsce na vCenter, instalator za ka\u017cdym razem uszkadza\u0142 katalog jre i trzeba by\u0142o r\u0119cznie podmienia\u0107 jego zawarto\u015b\u0107. W tym wypadku wszystkie us\u0142ugi dzia\u0142aj\u0105ce na Javie zainstalowane razem z vCenter dzia\u0142aj\u0105 poprawnie i na nowej i na starej wersji Javy.<\/p>\n

<\/div>","protected":false},"excerpt":{"rendered":"

Niedawno na produkcji pojawi\u0142o si\u0119 okienko serwisowe. Zupe\u0142nie niespodziewanie. Wystarczaj\u0105co szerokie aby wykorzysta\u0107 je do wykonania dawno odk\u0142adanego upgrade vCenter 5.1 do ostatniej wersji. Przeskok z 5.1U1 do wersji 5.1U2a wydaje si\u0119 ma\u0142ym kroczkiem, h\u0119? Nic bardziej mylnego! Dwudniowy horror … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":1599,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"yasr_overall_rating":0,"yasr_post_is_review":"","yasr_auto_insert_disabled":"","yasr_review_type":"Other","footnotes":""},"categories":[36],"tags":[57],"class_list":["post-1600","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-analiza","tag-vcenter"],"yasr_visitor_votes":{"stars_attributes":{"read_only":false,"span_bottom":false},"number_of_votes":0,"sum_votes":0},"_links":{"self":[{"href":"https:\/\/vm.piszki.pl\/index.php?rest_route=\/wp\/v2\/posts\/1600"}],"collection":[{"href":"https:\/\/vm.piszki.pl\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vm.piszki.pl\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vm.piszki.pl\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/vm.piszki.pl\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1600"}],"version-history":[{"count":3,"href":"https:\/\/vm.piszki.pl\/index.php?rest_route=\/wp\/v2\/posts\/1600\/revisions"}],"predecessor-version":[{"id":1831,"href":"https:\/\/vm.piszki.pl\/index.php?rest_route=\/wp\/v2\/posts\/1600\/revisions\/1831"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vm.piszki.pl\/index.php?rest_route=\/wp\/v2\/media\/1599"}],"wp:attachment":[{"href":"https:\/\/vm.piszki.pl\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1600"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vm.piszki.pl\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1600"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vm.piszki.pl\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1600"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}