Querying vRO Workflows with the REST API and Multiple Conditions

A colleague has made this fantastically useful post on how to query workflows using REST, using multiple conditions - seems the function is poorly documented, but he worked out how and explains all at the link below;

 Querying vRO Workflows with the REST API and Multiple Conditions

VCP Cloud thoughts

Following on from my last blog post, I have looked into the VCPC550 Exam a bit more, and having read the blueprint instead of just glancing at it, there are a few problems with doing this exam;

1 I *will* have to brush up on vSphere ESXi and vCenter facts including upgrades etc - so why would I want to do this at the vSphere 5.5 level when its on its way out.
2  Similarly, the vCAC and vCO versions covered in the VCPC550 are presumably not the latest versions
3 VCPC550 includes vCloud Director which isn't really current technology any more!

OK, so what would happen if I went for the VCPC610 current exam instead?

1 ESX/vCenter studying would be worth it as it would be at version 6.x
2 vCAC/vCO would be at vRA/vRO levels i.e. 6.x
3 There is no need to learn vCD which is not in the blueprint

(VCPC610 Blueprint is here https://mylearn.vmware.com/mgrReg/plan.cfm?plan=54066&ui=www_cert)

So what are the bad points?

One big one unfortunately;

The VCPC610 exam is being retired in only 5 weeks!!

It is being replaced with the VCP6 CMA exam (Cloud Management and Automation) - https://mylearn.vmware.com/mgrReg/plan.cfm?plan=64298&ui=www_cert - which seems to have a bigger remit, therefore more to learn, quite possibly some of it outside of my useful knowledge area (as in some of the knowledge I would be forced to learn might never be useful to me).

Decisions Decisions! I shall probably go for the CMA, as one of two projects is ramping up next\this week so I'll no doubt be super busy again, and therefore unlikely to be able to do the VCPC6 exam in the next month :s

VCP DCV 5 Expiry thoughts

I thought I'd share my VCP DCV  5 Expiry thoughts.

For those who don't know, VMware introduced a policy a few years ago to ensure VMware certification holders keep up to date - the rule is that the highest exam passed needs to (within two years) be ;

A Re-newed (i.e. VCP5 DCV to VCP 6 DCV)
OR
B  Another exam of the same level is passed (i.e. VCP5 DCV to VCP Cloud 5 or 6)
OR
C A higher exam (i.e. VCA is lower than VCP which is lower than a VCAP) is passed (i.e. VCP <anything> surpassed by a VCAP <anything>

The date on the newest certificate is what counts, not the date the exam was taken.

Firstly I was lucky in that I passed my exam in Nov 2013, but didn't do something (can't remember what) that 'completed' the certification until March 2014, so instead of having a matter of weeks before my VCP expires, I actually have 4 months :D

Secondly, I am lucky at present as there appears to be an 'easy' upgrade for me - I am not a massive fan of exams that need multiple weeks studying, as my complicated life (special needs daughter\volunteering and playing in bands taking up evenings etc) means that I find it very hard to retain the large amounts of pedantic knowledge required (i.e. needing to know exact numbers for maximum configs!) - this 'easy' upgrade appears to be the relatively light VCPC550 i.e. VCP Cloud
The reason I say it is relatively easy for me, is that I've pretty much been working with all the tech, and reading about and implementing all the topics of the VCP Cloud blueprint, during my roles for the last two years.

Colleagues who have taken the exam with similar skills and experience as me have all said that it should be relatively simple :D

This, therefore, is my planned exam to get another 2 years on the VMware exam countdown-to-expiry clock ;)

To see the exam blueprint, study guide & practice exam, instruction videos and more, click on the below link :D

http://mylearn.vmware.com/mgrReg/plan.cfm?ui=www_cert&plan=32558

Using OVFTool to upload an ISO to vCloud Director

Today I had to get a set of files into a vCloud Director vApp with no internet-facing network.
I found the easiest thing to do was to use ISO Creator (the Windows 7 version ran fine on 8.1) to create an iso file (changing the default BR type to CD) from the folder creating the files, then upload to the vCD Catalog and attach to the VM.

I got ISO Creator from here;
http://isorecorder.alexfeinman.com/W7.htm

I hit problems trying to use the (at time of writing) latest versions of Chrome and IE on Windows 8.1 64 bit, and instead used OVFTool to do it. Here is the syntax I used;

"c:\Program Files\VMware\VMware OVF Tool\ovftool.exe" --sourceType="ISO" --vCloudTemplate="false" "D:\downloads\files.iso" "vcloud://jgriffiths:MyPassword@myVCDportal.mydomain.com?vdc=Org_vDC&org=MyAwesomeORG&media=MyFiles&catalog=MyCatalog"

Replace the things in bold as appropriate.

Quick Tip: Just created a Resource Pool in vSphere and can't see it in vRA/vCAC Reservation form?

Have you just created a Resource Pool in vSphere, so that you can assign it to a vRA/vCAC Reservation, but can't see it in vRA/vCAC's Resource Pool list?

This is because vRA's vSphere Data Collection doesn't run continually;
For Inventory look ups, it runs daily.
For State look ups, it runs every 15 minutes.
For Performance look ups, it runs daily.

To force it to run so that it can see your newly create vSphere Resource Pool;
Log in as a Fabric Administrator, then go to the Infrastructure tab.
Navigate to Compute Resources, and click Compute Resources once more.
Hover over your Computer Resource so the actions menu appears, then click Data Collection.
In the Inventory section, click Request Now.
Wait a few minutes.

You should now be able to go back and create your Reservation, this time you will see your newly created vSphere Resource Pool in the Resource Pool list.

Error "HTTP/1.1 401 Unauthorized" with workflow "Add an IAAS host"

Today I have been setting up extensibility for a customers vRealize Automation vRA 6.2.1 Proof Of Concept Lab with an external vRO vRealize Orchestrator 6.0.1 server.

They require the ability to run custom workflows during machine provision (via vRA blueprints, not 'ASD' workflows), so I have therefore installed the vRA plugin (auto-installed on the in-built version of vRO that comes in the vRA appliace).

I was following the guide on Page 11 of VMware's Machine Extensibility doc (here), (which seems to be slightly different to the last time I did this on vRO 5.5 and vCAC 6.1), and got the below error in the vRO log;

com.vmware.o11n.plugin.dynamicops.ServiceException: HTTP/1.1 401 Unauthorized : <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>401 - Unauthorized: Access is denied due to invalid credentials.</title><style type="text/css"><!--body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1>Server Error</h1></div><div id="content"> <div class="content-container"><fieldset>  <h2>401 - Unauthorized: Access is denied due to invalid credentials.</h2>  <h3>You do not have permission to view this directory or page using the credentials that you supplied.</h3> </fieldset></div></div></body></html> (Workflow:Add an IaaS host / Add a VCAC host (item0)#54020)

This was very strange, as I had already gone to https://<IAAS Server Hostname> and correctly authenticated when prompted (using the username administrator@domain.local and the corresponding password).

The solution?

In the vRO workflow presentation form - do NOT type the "Authentication User Name" on Page 2a as <user>@<domain> like I did - leave out the domain name;

i.e.
"administrator@domain.local" = BAD
"domain\administrator" = BAD
"administrator" = GOOD

The "Domain for NTLM authentication" field on Page 2B would be the correct place to type the user accounts domain - i.e. in this case "domain.local".

Although I worked this out in much less time than it has taken to write this post, I thought that it would be helpful to others, as it is not very well documented in the VMware Machine Extensibility PDF or the workflow form (surely the use of REGEX filtering would have cleared this up?).

SQL Error 18456 when adding SQL DB to vCO/vRO vRealize Orchestrator inventory

Are you having trouble adding an MS SQL DB to the vCO/vRO vRealize Orchestrator inventory?
Are you getting Event 18456 in the Application log of the SQL server?
It might look like this;
Login failed for user 'administrator'. Reason: An attempt to login using SQL authentication failed. Server is configured for Windows authentication only. [CLIENT: 192.168.157.1]

This will most likely be because you need to add ";domain=<AD domain name, or SQL server hostname if using a local account>" to the of your JDBC connection URL

i.e.

Connection URL:             jdbc:jtds:sqlserver://sql01:1433/Database01;domain=sql01

For more info, see 

http://itsgettingcloudy.blogspot.co.uk/2015/05/adding-sql-2012-r2-database-to-vrealize.html

Adding a SQL 2012 R2 Database to the vRealize Orchestrator Inventory with the SQL Plug In

Recently I needed to add a Microsoft SQL 2012 R2 database to my vRealize Orchestrator (v6.0.1) SQL Plugin (v1.1.4) inventory.

This was so I could start writing workflows to pull reporting data from various sources (API\REST\SQL\XML\CSV) and upload into a central reporting DB.

I had a few problems finding the correct documentation and methods, so I made this post to help me in the future!

NB There are lots of possible config issues, so I have made the below assume that;

The server is called SQL01

The vRO server can resolve SQL01 to the correct IP

SQL TCPIP communication is enabled and on port 1433 (SQL Express will not enable it by default, and a named instance probably won't use port 1433)

The server has the one default instance

The database is called Reporting

The SQL server uses windows authentication (this may work with mixed mode too)

The account to use is a local account called svc_reporting and has the correct DB access permissions

1 Log in to the Orchestrator client

2 Click on the Workflows icon in the top left

3 Expand Library, SQL, and Configuration

4 Right click on Add a Database and choose Start Workflow

5 Enter the following data;

                Name                                    ReportingDB

                Database Type                  MS SQL

                Connection URL                jdbc:jtds:sqlserver://sql01:1433/Reporting;domain=epc35sql01

                Session mode                    Shared session

                User name                          svc_reporting

                Password                            <enter the correct password>

6 Click Submit

7 Assuming the workflow completes successfully, click the Inventory icon in the top left, and expand SQL Plug-in, then Reporting DB to see the contents (there will be two trace maps even with a blank DB)

As I said there are lots of things that can stop this working, but the assumption cover most of them. The biggest stumbling block I had was the correct syntax for the URL - namley adding ";domain=" to prevent the connect attempt using SQL authentication (event viewer errors alerted me to that).

libbuild.xml error installing IAAS for vRA 6.2 - also Java 1.7 64bit link

Today I got the below error when trying to install the IAAS components for vRA 6.2.1
"Exited with code -1 (2101591)".

Looking into the log, the first error I could see was;
Done Building Project "C:\Program Files (x86)\VMware\vCAC\Server\Database\Liquibase.xml" (RunLiquibase target(s)) -- FAILED.

Turns out, I should have had Java 1.7 installed - not 1.8 :*)
This was documented in this KB article;
http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2101591

After this, I found it quite hard to find the correct download, so I thought I'd post the below links;

Main Page: https://www.java.com/en/download/manual_java7.jsp
Actual 1.7 Update 79 64bit download: http://javadl.sun.com/webapps/download/AutoDL?BundleId=106369

Edit: Don't forget to update your JAVA_HOME environment variable as necessary!

vRealize Automation (vRA) error when configuring SSO - "Trying to access remote SSO on host and port 7444, but the returned host is and port 7444."

Today I was getting the vRA error "Trying to access remote SSO on host <FQDN> and port 7444, but the returned host is <old hostname IP> and port 7444." after re-ipping the vCSA\SSO server.

More history;

When I first deployed the vcs 5.5 appliance I told the VM to use DHCP and then ran through the default config vCenter setup.

After this I realised that the VM was on the wrong network so had picked up an IP in the wrong subnet.

At this point I re-ipped the box correctly, and confirmed that forward and reverse DNS was correct, as was the self-signed SSL certificate.

Despite this, when I tried to change a vRA 6.2 server to the SSO service on the vCSA, I got “Trying to access remote SSO on host <the correct FQDN> and port 7444, but the returned host is <the old IP!!> and port 7444.”.

Fix information;

After triple checking everything (and yes, rebooting the appliance ‘for luck’!), I eventually had to resort to google, and found this article from Dec 2014;

http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2096619

In it, VMware explain that a certain SSO server config file retains the old IP address\hostname after the system is renamed.

Unfortunately, the KB article refers to vCenter SSO running on Windows, and I was using the Linux-based appliance. I therefore wrote the below Linux fix instructions.

Linux Fix;

Go to the vCSA’s console in the vSphere client.

Press Enter to Login, use the username ‘root’ and the password you set when deploying the vCSA’s OVF template (if you left this blank, the default is probably ‘vmware’).

Enter this line, replacing <correct FQDN> with the actual FQDN I.e. vcs55.domain.local;

                echo <correct FQDN> > /etc/vmware-identity/hostname.txt

Once the above has been run, type the below and ensure the output shows the correct hostname;

cat /etc/vmware-identity/hostname.txt

This should all look something like this;

Once this is done, I found that no restart of either the SSO service, or the entire vCSA, was required – I did have the vCenter service down when I performed the above however.

VDP 6 error (and possibly early versions) “VDP: Failed to attach disk” after changing SSO\vSphere password

I recently set up VDP6 in my home lab, and during the setup, chose to register with vSphere using the in-built root@vsphere.local account.

I made an incorrect assumption that this credential was only used to create a VDP system account in the SSO domain - turns out I was wrong!

This was all working fine until I SSH’d into the vCenter Appliance and was prompted to change my password, which I did.

That night, all of my backups failed with the VDP error “VDP: Failed to attach disk” (seen in the Task Failures section of the Reports tab in the VDP GUI of the vSphere web client).

I tried rebooting the VDP appliance, but after that I could no longer connect to the VDP admin page in the vSphere Web Client.

Going into the VDP config page on port 8543 showed further issues – no proxies were listed, and the Storage tab could not display Capacity Utilization.

The fix was to go into the VDP Configuration page (https://<VDP IP OR HOSTNAME>:8543/vdp-configure), then click on the settings icon to the right of VDP Appliance (on the Configration tab), and choose “vCenter registration”.

Going through the wizard and entering the new root password fixed everything with no reboots.

Despite the error about losing jobs etc, as I did not change the vCenter hostname, the jobs survived, and I was able to run them successfully after waiting for the vCenter “Reconfiguring VDP” Tasks completed.

If you regularly need to change the root password, I suppose the correct fix would be to create a vSphere\SSO account just for use by the VDP service, and re-register using this account.

I made vExpert 2015 :D

I am very honoured to have been accepted as a vExpert for 2015, my second year in a row :)

VDP 5.5 Resetting the root password

Today I had to reset the root password on a VMware Data Protection (VDP) 5.5 server.

I followed the procedure in the below article - many thanks to Vladan Seget for writing it!

It's a very simple 5 minute job once the VDP server is shut down (this method DOES need shutting down - if you don't have OS rights you can do an OS shutdown via the vCenter\vCD tools).

If writing a CRQ for this, bear in mind that the server will take a while to boot up and start its services as usual, and don't forget to test!

http://www.vladan.fr/how-to-reset-root-password-in-vdp/

First day with a Hipstreet W7

Picked up a Hipstreet W7 tablet today with Windows 8.1 (full x86 Windows, not RT) and intend on installing Windows 10 Technical Preview.

For those of you who don't know these, they have great pros and great cons!

Pros (for me)

• PRICE!! Only £49 at time if writing from Carphone Warehouse in the UK with no contracts or anything involving further payment. You can even use the stock checker on their website to see if your local branch has one in stock
• Portability - fits in every coat and jacket I have, my suit trouser pockets, and just about my jeans front pocket! Its not really that much bigger than my wife's iPhone 6 plus
• "Full" Windows so can run all of the VMware Management apps\browser plug-ins, as well as VMware University\My Learn Flash courses
• Relatively decent Atom processor - a Quad Core Intel Atom Z3735G
• Bluetooth on-board so you can add a keyboard and mouse wirelessly
• HDMI out (think its mini rather than micro) so you can plug in a monitor
• USB-to-go cable IN THE BOX :) This is so you can plug in USB devices (NOTE as far as I know you cannot use USB devices and charge it at the same time, as the only usb slot is also the charging socket. Maybe a special\hacked cable would allow this?)
• Micro SD card slot to expand storage (I have heard a max of 32GB is supported)
• Office 365 personal 1 year subscription (worth more than the £49 purchase price, especially as I have heard that Office 365 subscription will soon be eligible for unlimited Onedrive storage - and this will apparently not be down graded or cancelled when the 1 year Office Subscription expires)
• Screen protector applied "out of the box"

Cons (for me)

• Only 1GB RAM - a pretty big deal for your average user, but as a seasoned professional used to tuning the RAM of VMs for Enterprises, I think I can work within this limitation
• Only 16GB internal storage - this is another fairly large issue, especially as the C: drive is only 9GB with about 5GB free (the missing 7GB is used by the recovery partition, which can me moved onto a cheap USB drive)
• Screen - Size - I have excellent eyesight and of course a bigger screen would mean less portability, so I can tolerate this. The real world issue is that it is hard to touch the right point on the screen 100% of the time, especially in Desktop mode, but you could of course make things bigger (i.e. raising the DPI) and the Modern UI Apps are much less of a problem due to them being designed for touch screen devices.
• Screen - Quality - I have saved the worst until last! This is probably the biggest thing I have struggled with. The graphics are not pin sharp at all and are actually slightly fuzzy. I have taken the first layer off the screen protector (the one labelled "Step 2, peel off this layer"), and am considering peeling off layer 1 somehow but the graphics aberrations actually look like a different issue that I am going to investigate and report back on

STOP PRESS

I have discovered the issue with the W7 screen being blurry\fuzzy and will report the fix in the next blog post!

Summary - flawed but worth the money if you can live with the cons.