Manual de Referencia SUMA
Manual de Referencia SUMA
Manual de Referencia SUMA
Reference Manual
SUSE LLC
10 Canal Park Drive
Suite 200
Cambridge MA 02141
USA
https://www.suse.com/documentation
Contents
1 Available Documentation 1
2 Feedback 2
3 Documentation Conventions 3
6 Navigation 6
6.1 Categories and Pages 9
6.3 Search 16
6.5 Lists 17
7 Systems 31
7.1 Overview Conventions 31
iv Reference Manual
7.7 Visualization 111
Virtualization Hierarchy 117 • Proxy Hierarchy 117 • Systems
Grouping 118
8 Autoinstallation 126
8.1 Introduction to AutoYaST 128
AutoYaST Explained 128 • AutoYaST Prerequisites 129 • Building Bootable
AutoYaST ISOs 130 • Integrating AutoYaST with PXE 130
v Reference Manual
8.9 Virtual Host Managers 153
VMware-Based 154 • File-Based 154 • Configuring Virtual Host Managers
via XMLRPC API 156
9 Salt 158
9.1 Keys 158
10 Images 160
10.1 Images 160
Image Details 161
11 Patches 164
11.1 Relevant 165
12 Software 175
12.1 Channels 175
All 176 • SUSE 177 • Popular 177 • My
Channels 177 • Shared 178 • Retired 178 • Channel Details 178
vi Reference Manual
12.2 Package Search 182
13 Audit 188
13.1 CVE Audit 188
Normal Usage 188 • API Usage 190 • Maintaining CVE Data 190 • Tips
and Background Information 190
15 Configuration 211
15.1 Configuration Management for Salt 211
16 Schedule 223
16.1 Pending Actions 223
17 Users 230
17.1 User List 230
Main Menu Users User List Active 230 • Main Menu Users User
List Deactivated 231 • Main Menu Users User List All 231 • User
Details 232
19 Help 266
19.1 SUSE Manager{mgrgetstart} 266
ix Reference Manual
About This Guide
SUSE Manager enables you to efficiently manage a set of Linux systems and keep them up-to-
date. It provides automated and cost-effective software management, asset management, system
provisioning, and monitoring capabilities. SUSE Manager is compatible with Red Hat Satellite
Server and offers seamless management of both SUSE Linux Enterprise and Red Hat Linux En-
terprise client systems.
This manual explains the features of the Web interface and is intended for SUSE Manager ad-
ministrators and administrators with restricted roles for specific tasks. On certain topics we also
provide background information, while some chapters contain links to additional documenta-
tion resources. The latter include additional documentation available on the installed system as
well as documentation on the Internet.
For an overview of the documentation available for your product and the latest documenta-
tion updates, refer to Available Documentation (http://www.suse.com/documentation/suse-man-
ager-3/) or to the following section.
HTML versions of the manuals are also available from the Help menu of the SUSE Manager
Web interface.
x
1 Available Documentation
The following manuals are available on this product:
Reference Manual
Reference documentation that covers the Web interface to SUSE Manager (WebUI).
HTML versions of the product manuals can be found in the installed system under /usr/
share/doc/manual . Find the latest documentation updates at Latest Docmentation (http://
www.suse.com/documentation/suse-manager/) where you can download PDF or HTML ver-
sions of the manuals for your product.
1
2 Feedback
Several feedback channels are available:
User Comments
We want to hear your comments about and suggestions for this manual and the other
documentation included with this product. Use the User Comments feature at the bottom of
each page in the online documentation or go to http://www.suse.com/doc/feedback.html
and enter your comments there.
Mail
For feedback on the documentation of this product, you can also send a mail to doc-
team@suse.de . Make sure to include the document title, the product version and the pub-
lication date of the documentation. To report errors or suggest enhancements, provide a
concise description of the problem and refer to the respective section number and page
(or URL).
2
3 Documentation Conventions
The following typographical conventions are used in this manual:
Alt , Alt – F1 : a key to press or a key combination; keys are shown in uppercase as
on a keyboard
This paragraph is only relevant for the x86_64 architecture. The arrows mark the beginning
and the end of the text block.
This paragraph is only relevant for the architectures z Systems and POWER . The arrows
mark the beginning and the end of the text block.
Dancing Penguins (Chapter Penguins, {uarr} Another Manual): This is a reference to a chap-
ter in another manual.
3
4 Special SUSE Manager Documentation Conventions
Additionally, the following typographical conventions are used in this manual:
[system_type]: This tag is used in chapter or section titles and indicates that this feature is
only available for registered client of that system type. For example, these system types
could appear in this context: [Management] (= clients registered via the traditional boot-
strap method), [Salt] (= Salt minions), [Proxy], etc.
4
5 Overview and Navigation
5.1 Overview
This topic introduces you to the SUSE Manager WebUI. This section covers the
Home menu.
Entering the SUSE Manager URL in a browser leads you to the Sign In screen.
Before logging in, select Header About, to browse and search for available documentation top-
ics. You may reset your username and password from the About Lookup Login/Password page.
For more information, see: Section 6.7, “User Account”
5 Overview
6 Navigation
The top bar provides access to commonly used tools and user settings.
The right part of the top bar contains functionalities such as a bell icon with a counter bubble of
unread notification messages, optionally, an eye icon with a context legend to the current page,
quick search, links to background information, user preferences, and sign o. On the left is the
so-called breadcrumb. The breadcrumb tells you how far you are from the root of the menu and
it brings you back to any previous step.
The left navigation bar is the main menu to the SUSE Manager WebUI from where you load the
WebUI pages. If you click a the label of a menu entry you either open that page, or, if it is just a
container of sub-entries, it expands this part of the menu tree without actually loading a page.
To collaps all open parts of the menu system, click the Clear Menus button at the top of menu,
right to the Search page eld. If you click the small circle icon on the right of a menu label,
6
the rst available page of that menu entry will get loaded and displayed automatically. Enter
a search string in the Search page eld to nd an entry of the menu tree. Available menu
entries depend on the roles of the user.
Only SUSE Manager Administrators see the following navigation items:
7
8
Some pages have tabs and subtabs. These tabs offer an additional layer of granularity in per-
forming tasks for systems or users. The following example displays the tabs and subtabs avail-
able under System Details . Green bars underline active tabs.
Overview. Obtain a quick overview of your account. This page notifies you if your systems
need attention, provides a quick link directly to these systems, displays the most recent
patch alerts for your account, and recently registered systems.
Your Account. Update your personal profile, addresses, email, and credentials. Deactivate
your account.
Your Preferences. Indicate if you wish to receive email notifications about available patches
for your systems. Set how many items are displayed in system and group lists. Set contents
of the overview start page. Select your preferred CSV separator.
Main Menu Systems. Manage all your systems (including virtual guests) here.
Overview. View a summary of your systems or system groups showing how many available
patches each system has and which systems are entitled.
Systems. Select and view subsets of your systems by specific criteria, such as Virtual Sys-
tems, Unprovisioned Systems, Recently Registered, Proxy, and Inactive.
System Set Manager. Perform various actions on sets of systems, including scheduling patch
updates, package management, listing and creating new groups, managing channel enti-
tlements, deploying configuration les, schedule audits, apply system states, and check
status. The availability of these actions depend on the system type.
Bootstrapping. Bootstrap minion machines using SSH. Input SSH credentials and the acti-
vation key the selected system will use for its software sources. SUSE Manager will install
Advanced Search. Quickly search all your systems by specific criteria, such as name, hard-
ware, devices, system info, networking, packages, and location.
Activation Keys. Generate an activation key for a SUSE Manager-entitled system. This acti-
vation key can be used to grant a specific level of entitlement or group membership to a
newly registered system using the rhnreg_ks command.
Custom System Info. Create and edit system information keys with completely customizable
values assigned while provisioning systems.
Virtual Host Managers. Display and modify virtual host managers, le-based or VMware-
based.
Salt. View all minions. Manage on-boarding, remote commands, and states catalogs.
Remote Commands. Execute remote commands on targeted systems. Select the preview
button to ensure selected targets are available and click Run to execute.
State Catalog. Create, store, and manage states for your Salt minions from the State Catalog.
Main Menu Patches. View and manage patch (errata) alerts here.
Patches. Lists patch alerts and downloads associated RPMs relevant to your systems.
Advanced Search. Search patch alerts based on specific criteria, such as synopsis, advisory
type, and package name.
Clone Patches. Clone patches for an organization for ease of replication and distribution
across an organization.
Software. View and manage the available SUSE Manager channels and the les they contain.
Main Menu Channels. View a list of all software channels and those applicable to your
systems.
Package Search. Search packages using all or some portion of the package name, descrip-
tion, or summary, with support for limiting searches to supported platforms.
Manage Software Channels. Create and edit channels used to deploy configuration les.
Distribution Channel Mapping. Define default base channels for servers according to their
operating system or architecture when registering.
Main Menu Audit. View and search CVE audits, system subscriptions, and OpenSCAP scans.
OpenSCAP. View and search OpenSCAP (Security Content Automation Protocol) scans.
Main Menu Configuration. Keep track of and manage configuration channels, actions, individual
configuration les, and systems with SUSE Manager-managed configuration les.
Configuration Channels. List and create configuration channels from which any subscribed
system can receive configuration les.
Configuration Files. List and create les from which systems receive configuration input.
Systems. List the systems that have SUSE Manager-managed configuration les.
Pending Actions. List scheduled actions that have not been completed.
Completed Actions. List scheduled actions that have been completed. Completed actions
can be archived at any time.
Archived Actions. List completed actions that have been selected to archive.
Main Menu Admin. Use the Setup Wizard to configure SUSE Manager. List, create, and manage
one or more SUSE Manager organizations. The SUSE Manager administrator can assign channel
entitlements, create and assign administrators for each organization, and other tasks.
Users. List all users known by SUSE Manager, across all organizations. Click individual
user names to change administrative privileges of the user.
Note
Users created for organization administration can only be configured by the orga-
nization administrator, not the SUSE Manager administrator.
Manager Configuration. Make General configuration changes to the SUSE Manager server,
including Proxy settings, Certificate configuration, Bootstrap Script configuration, Organi-
zation changes, and Restart the SUSE Manager server.
ISS Configuration. Configure master and slave servers for inter-server synchronization.
Task Engine Status. View the status of the various tasks of the SUSE Manager task engine.
Show Tomcat Logs. Display the log entries of the Tomcat server, on which the SUSE Manager
server is running.
Main Menu Help. List references to available help resources such as the product documentation,
release notes, and a general search for all of this.
Main Menu External Links. List external links to the knowledge base and the online documen-
tation.
On the Main Menu Home Overview page, in the Relevant Security Patches section click
the patch advisory to view details about the patch or click the number of affected systems to
see which systems are affected by the patch alert. Both links take you to tabs of the Patch
Details page. If all patches are installed, there is just a View All Patches link to open the
Main Menu Patches page. Refer to Section 11.2.2, “Patch Details” for more information.
6.3 Search
In the top bar, SUSE Manager offers a search functionality for Packages, Patches (Errata), Doc-
umentation, and Systems. To use the search, click the magnifier, then select the search item
(choose from Systems , Packages , Documentation , and Patches ) and type a string to look
for a name match. Click the Search button. Your results appear at the bottom of the page.
If you misspell a word during your search query, the SUSE Manager search engine performs
approximate string (or fuzzy string) matching, returning results that may be similar in spelling
to your misspelled queries.
For example, if you want to search for a certain development system called test-1.ex-
ample.com that is registered with SUSE Manager, but you misspell your query tset , the
test-1.example.com system still appears in the search results.
For advanced Patch or Errata searches, refer to Section 11.3, “Advanced Search”.
6.5 Lists
The information within most categories is presented in the form of lists. These lists have some
common features for navigation. For instance, you can set the number of items per page and
navigate through virtually all lists by clicking the back and next arrows above and below the
right side of the table. Some lists also offer the option to retrieve items alphabetically by clicking
numbers or letters from the Alphabetical Index above the table.
17 Systems Selected
Note: Performing Large List Operations
Performing operations on large lists{mdash}such as removing RPM packages from the
database with the SUSE Manager Web interface{mdash}may take some time and the
system may become unresponsive or signal “Internal Server Error 500”. Nevertheless, the
command will succeed in the background if you wait long enough.
Login to the SUSE Manager WebUI to view the Home Overview page. The Overview page con-
tains summary panes that provide important information about your systems.
Home Overview is split into functional sections, with the most critical sections displayed rst.
Users can control which of the following sections are displayed by making selections on the
Home Your Preferences page. Refer to Section 6.8, “Your Preferences” for more information.
18 Lists
The Overview Tasks pane lists the most common tasks an administrator performs via the
Web interface. Click any link to reach the page within SUSE Manager that allows you to
accomplish that task.
19 Lists
The Overview Inactive Systems list provides a list of all systems that have stopped checking
into SUSE Manager.
The Overview Most Critical Systems pane lists the most critical systems within your orga-
nization. It provides a link to quickly view those systems and displays a summary of the
patch updates that have yet to be applied to those systems. Click the name of a system to
see its System System Details page and apply the patch updates. Below the list is a link to
Overview View All Critical Systems on one page.
The Overview Recently Scheduled Actions pane lists all actions less than thirty days old and
their status: failed, completed, or pending. Click the label of any given action to view its
details page. Below the list is a link to Overview View All Scheduled Actions on one page,
which lists all actions that have not yet been carried out on your client systems.
20 Lists
The Overview Relevant Security Patches pane lists all available security patches that have
yet to be applied to some or all of your client systems. It is critical that you apply these
security patches to keep your systems secure. Below this list nd links to all available
patches Overview View All Patches. You may also view patches that only apply to your
systems Overview View All Relevant Patches.
The Overview System Group Name pane lists groups you may have created and indicates
whether the systems in those groups are fully updated. Click the link below this section to
get to the System System Groups page, where you can choose System Groups Group Name
to use with the System Set Manager.
The Overview Recently Registered Systems pane lists all systems added to SUSE Manager
in the past 30 days. Select a system’s name to see its System System Details page. At the
bottom of the Overview Recently Registered Systems pane select the Overview View All
Recently Registered Systems link to view all recently registered systems on one page.
21 Lists
To return to this page, select Home Overview on the left bar that is also known as The Menu .
22 Notification Messages
6.6.2 Notification Messages Buttons
The following buttons are available for working with notification messages:
Delete Selected Messages — Check any messages you would like removed and then mass
delete them via this button.
Notification Messages Severity : The following severity levels are available and for every
failure a customized button (in line with the message) is available to react to that failure:
— Info
— Warning
— Error
Onboarding failed(Error)
Action Read|Delete :
You can sort the messages by clicking a column label of the list header line.
If you change your SUSE Manager password, for security reasons you will not see the new
password while you enter it. Replace the asterisks in the Personal Info Password and Personal
Info Confirm Password text elds with the new password.
24 User Account
Note
If you forget your password or username, proceed to the sign in screen and select the
Header About link, then select the About Lookup Login/Password page. Here you can
either specify your login and email address or only your email address if you are not sure
about the username. Then click Send Password or Send Login respectively.
6.7.2 Addresses
On the Home User Account Addresses page you can manage your mailing, billing and shipping
addresses, and associated phone numbers.
Click Addresses Fill in this address or Addresses Edit this address below the address to be modi-
fied or added, make your changes, and click Update.
25 Addresses
6.7.3 Change Email
Set the email SUSE Manager sends notifications to on the Home User Account Change Email
page. If you would like to receive email notifications about patch alerts or daily summaries for
your systems, check the Receive email notifications checkbox located on the Home Your Prefer-
ences page.
To change your preferred email address, click Home User Account Change Email in the left
navigation bar. Enter your new email address and click the Update button. Invalid email ad-
dresses like those ending in @localhost are filtered and rejected.
The Home User Account Account Deactivation page provides a means to cancel your SUSE Man-
ager service. To do so, click the Home User Account Deactivate Account button. The Web in-
terface returns you to the login screen. If you attempt to log back in, an error message advises
you to contact the SUSE Manager administrator for your organization.
26 Change Email
6.8 Your Preferences
The Home YourPreferences page allows you to configure SUSE Manager options.
Email Notifications — Determine whether you want to receive email every time a patch
alert is applicable to one or more systems in your account.
Important
This setting enables Management and Provisioning customers to receive a daily sum-
mary of system events. These include actions affecting packages, such as scheduled
patches, system reboots, or failures to check in. In addition to selecting this check
box, you must identify each system to be included in this summary email. By default,
all Management and Provisioning systems are included in the summary. Add more
systems either individually on the System System Details page or for multiple sys-
27 Your Preferences
tems at once in the Systems System Set Manager interface. Note that SUSE Manager
sends these summaries only to verified email addresses. To disable all messages,
simply deselect this check box.
Your Preferences SUSE Manager List Page Size — Maximum number of items that appear in
a list on a single page. If more items are in the list, clicking the Next button displays the next
group of items. This preference applies to system lists, patch lists, package lists, and so on.
Your Preferences "Overview" Start Page — Select the information panes that are displayed
on the Home Overview page. Check the box to the left of each information pane that which
be included.
Your Preferences Time Zone - Set the SUSE Manager interface to your local time by select-
ing the appropriate Your Preferences Time Zone from the drop-down box. Click the Save
Preferences button to apply the selection.
Your Preferences CSV Files — Select the separator character to be used in downloadable
CSV les. Comma is the default; as an alternative use Semicolon , which provides better
compatibility with Microsoft Excel.
After making changes to any of these options, click the Save Preferences button.
28 Your Organization
6.9.1 Configuration
On the Home Your Organization Configuration page modify your personal information, such as
name, password, and title. To modify any of this information, make the changes in the appro-
priate text elds and click the Update button at the bottom.
You can filter the list of trusts by keyword using the Filter by Organization text box and clicking
Go .
29 Configuration
6.9.3 Configuration Channels
The Configuration Channels page displays the channels which have been created and added using
Configuration Configuration Channels .
From Home Your Organization Configuration Channels you can select which configuration
channels should be applied across your organization. If there is more than one configuration
channel selected you can specify the order of the channels.
1. Create a channel using Configuration Configuration Channels or via the command line.
4. Select the check box for the channel to be applied and click the Save Changes button. The
save button will save the change to the database but will not apply the channel.
5. Apply the channel by clicking the Apply button. The channel will be scheduled and applied
to any systems included within the organization.
30 Configuration Channels
7 Systems
If you select Main Menu Systems Overview, an overview of all Systems appears. From this page
you can select systems to perform actions on and may create system profiles.
Select box
Systems without a system type cannot be selected. To select systems, mark the appropriate
check boxes. Selected systems are added to the System Set Manager, where actions can be
carried out simultaneously on all systems in the set. For more information, see: Section 7.5,
“System Set Manager”.
System
The name of the system specified during registration. The default name is the host name
of the system. Clicking the name of a system displays its System Details page. For more
information, see: Section 7.3, “System Details”
— Virtual Host.
— Virtual Guest.
— Non-Virtual System.
— Unprovisioned System.
Updates
Shows which type of update action is applicable to the system or confirms that the system
is up-to-date. Some icons are linked to related tasks. For example, the standard Updates
icon is linked to the Upgrade subtab of the packages list, while the Critical Updates icon
links directly to the Software Patches page.
31 Overview Conventions
— System is up-to-date.
Patches
Total number of patch alerts applicable to the system.
Packages
Total number of package updates for the system, including packages related to patch alerts
and newer versions of packages not related to patch alerts. For example, if a client system
that has an earlier version of a package installed gets subscribed to the appropriate base
channel (such as SUSE Linux Enterprise 12 SP2), that channel may have an updated version
of the package. If so, the package appears in the list of available package updates.
32 Overview Conventions
the up2date configuration le. To resolve the conflict, either schedule a package
list update or remove the packages from the package exceptions list. For more in-
formation, see: Section 7.3, “System Details”
Configs
Total number of configuration les applicable to the system.
Base Channel
The primary channel for the system based on its operating system. For more information,
see: Section 12.1, “Channels”
System Type
Shows whether the system is managed and at what service level.
Links in the navigation bar below Systems enable you to select and view predefined sets of your
systems. All of the options described above can be applied within these pages.
33 Overview Conventions
7.2 Systems > Overview
The Main Menu Systems Overview page provides a summary of your systems, including their
status, number of associated patches (errata) and packages, and their so-called system type.
Clicking the name of a system takes you to its Selected Systems System Details page. For more
information, see: Section 7.3, “System Details”
Clicking the View System Groups button at the top of the page takes you to a summary of your
system groups. It identifies group status and displays the number of systems contained. Clicking
the number of systems in a group takes you to the Main Menu Systems Systems Groups Systems
tab. Selecting a group name takes you to the Main Menu Systems System Groups Group Details
tab for that system group. For more information, see: Section 7.4.3, “System Group Details”
You can also click Use in SSM from the Systems Overview View System Groups page to go directly
to the Systems System Set Manager. For more information, see: Section 7.5, “System Set Manager”
System
This column displays the name of each guest system.
Updates
This column shows whether there are patches (errata updates) available for the guest sys-
tems that have not yet been applied.
Base Channel
This column displays the base channel to which the guest is currently subscribed.
Only guests registered with SUSE Manager are displayed with blue text. Clicking the host name
of such a guest system displays its System Details page.
Salt
Management
Foreign Host
Checking in means that Zypper on SUSE Linux Enterprise or Red Hat Update Agent on Red
Hat Linux Enterprise client systems connects to SUSE Manager to see if there are any updates
available or if any actions have been scheduled. If you see a message telling you that check-ins
are not taking place, the client system is not successfully connecting to SUSE Manager.
The system is not entitled to any SUSE Manager service. System profiles that remain un-
entitled for 180 days (6 months) are removed.
The system is entitled, but the SUSE Manager daemon ( rhnsd ) has been disabled on the
system. Refer to Book “Best Practices”, Chapter 8 “Contact Methods”, Section 8.2 “Default (the SUSE
Manager Daemon rhnsd)” for instructions on restarting and troubleshooting.
The system is behind a firewall that does not allow connections over https (port 443).
The system is behind an HTTP proxy server that has not been properly configured.
The system is connected to a SUSE Manager Proxy Server or SUSE Manager that has not
been properly configured.
The system itself has not been properly configured, perhaps pointing at the wrong SUSE
Manager Server.
Some other barrier exists between the system and the SUSE Manager Server.
Active entitlements are in gray, while inactive entitlements are highlighted in yellow and their
check boxes checked by default for you to delete them as needed by clicking the Delete Selected
button. Entitlements are inactive if the system has not checked in with SUSE Manager in a time
specified via the drop-down box A system profile is inactive if its system has not checked in for:.
You can filter duplicate entitlements by clicking the respective tab.:
You may filter further by inactive time or typing the system’s host name, IP address, IPv6 ad-
dress, or MAC address in the corresponding Top menu Filter by text box.
To compare up to three duplicate entitlements at one time, click the Compare Systems link in the
Duplicate Systems Last Checked In column. Inactive components of the systems are highlighted
in yellow.
You can determine which systems are inactive or duplicate and delete them by clicking the
Delete System Profile button.
Click the Confirm Deletion button to confirm your choice.
42 System Details
Note
The Delete System link in the upper right of this screen refers to the system profile only.
Deleting a host system profile will not destroy or remove the registration of guest systems.
Deleting a guest system profile does not remove it from the list of guests for its host, nor
does it stop or pause the guest. It does, however, remove your ability to manage it via
SUSE Manager.
If you mistakenly deleted a system profile from SUSE Manager, you may re-register the
system using the bootstrap script or rhnreg_ks manually.
The Details page has numerous subtabs that provide specific system information and other iden-
tifiers unique to the system. The following sections discuss these tabs and their subtabs in detail.
This system summary page displays the system status message and the following key information
about the system:
System Status
This message indicates the current state of your system in relation to SUSE Manager.
Note
If updates are available for any entitled system, the message System Details Soft-
ware Updates Available appears, displaying the number of critical and non-critical
updates and the sum of affected packages. To apply these updates, click System De-
tails Packages then select some or all packages to update, then click Upgrade Pack-
ages.
System Info
Hostname
The host name as defined by the client system. A machine can have one and only
one hostname.
FQDN
The FQDN(Names) listed here represents the host.domain that the machine answers
to. A machine can have any number of FQDNs. Keep in mind that FQDN is not equal
to hostname.
IP Address
The IP address of the client.
IPv6 Address
The IPv6 address of the client.
Virtualization
If the client is a virtual machine, the type of virtualization is listed.
UUID
Displays the universally unique identifier.
Kernel
Note
The system ID can be used to eliminate duplicate profiles from SUSE Manag-
er. Compare the system ID listed on this page with the information stored on
the client system in the /etc/sysconfig/rhn/systemid le. In that le, the
system’s current ID is listed under system_id . The value starts after the char-
acters ID- . If the value stored in the le does not match the value listed in
the profile, the profile is not the most recent one and may be removed.
Activation Key
Displays the activation key used to register the system.
Installed Products
Lists the products installed on the system.
Lock Status
Indicates whether a system has been locked.
Actions cannot be scheduled for locked systems on the Web interface until the lock
is removed manually. This does not include preventing automated patch updates
scheduled via the Web interface. To prevent the application of automated patch up-
dates, deselect System Details Properties Auto Patch Update. For more information,
refer to Section 7.3.1.2, “System Details > Details > Properties”.
Locking a system can prevent you from accidentally changing a system. For exam-
ple, the system may be a production system that should not receive updates or new
packages until you decide to unlock it.
Important
Locking a system in the Web interface will not prevent any actions that origi-
nate from the client system. For example, if a user logs in to the client directly
and runs YaST Online Update (on {slea}) or pup (on {rhela}), the update tool
will install available patches even if the system is locked in the Web interface.
Important
It is also possible to lock multiple systems via the System Set Manager. Refer
to Section 7.5.10.4, “System Set Manager > Misc > Lock/Unlock” for instructions.
Subscribed Channels
List of subscribed channels. Clicking a channel name takes you to the Basic Channel Details
page. To change subscriptions, click the menu:(Alter Channel Subscriptions)[] link right
beside the title to assign available base and child channels to this system. When finished
making selections, click the Change Subscriptions button to change subscriptions and the
base software channel. For more information, see: Section 7.3.2.3, “System Details > Software
> Software Channels”.
Base Channel
The rst line indicates the base channel to which this system is subscribed. The base
channel should match the operating system of the client.
Child Channels
The subsequent lines of text, which depend on the base channel, list child channels.
An example is the SUSE Manager Tools channel.
System Events
Checked In
The date and time at which the system last checked in with SUSE Manager.
Registered
The date and time at which the system registered with SUSE Manager and created
this profile.
Last Booted
The date and time at which the system was last started or restarted.
2. Provide the earliest date and time at which the reboot may take place.
When the client checks in after the scheduled start time, SUSE Manager will
instruct the system to restart itself.
System Properties
System Types
Lists system types and add-on types currently applied to the system.
Notifications
Indicates the notification options for this system. You can activate whether you want
to receive e-mail notifying you of available updates for this system. In addition, you
may activate to include systems in the daily summary e-mail.
Contact Method
Available methods: Default (Pull), Push via SSH, and Push via SSH tunnel.
The so-called OSA status is also displayed for client systems registered with SUSE
Manager that have the OSA dispatcher (osad) configured.
Push enables SUSE Manager customers to immediately initiate tasks rather than wait
for those systems to check in with SUSE Manager. Scheduling actions through push
is identical to the process of scheduling any other action, except that the task can
immediately be carried out instead of waiting the set interval for the system to check
in.
In addition to the configuration of SUSE Manager, to receive pushed actions each
client system must have the osad package installed and its service started.
System Name
Description
This information is automatically generated at registration. You can edit the descrip-
tion to include any information you want.
Location
This eld displays the physical address of the system if specified.
Clicking the Edit These Properties link beside the System Details Overview System Properties title
opens the System Details Properties subtab. From this page you can edit any text elds you
choose, then click the Update Properties button to confirm.
This subtab allows you to alter basic properties of the selected system.
System Name
By default, this is the host name of the system. You can however alter the profile
name to anything that allows you to distinguish this system from others.
Notifications
Contact Method
Select one of the following contact methods:
Description
By default, this text box records the operating system, release, and architecture of the
system when it rst registers. Edit this information to include anything you like.
The remaining elds record the physical address at which the system is stored. To confirm any
changes to these elds, click the Update Properties button.
This subtab allows you to run remote commands on the selected system. Before doing so, you
must rst configure the system to accept such commands.
On {rhela} clients, subscribe the system to the Tools child channel. Then use up2date
or yum to install the rhncfg , rhncfg-client , and rhncfg-actions packages, if not
already installed:
2. Log in to the system as root and add the following le to the local SUSE Manager config-
uration directory: allowed-actions/scripts/run .
mkdir -p /etc/sysconfig/rhn/allowed-actions/script
Create an empty run le in that directory to act as a ag to SUSE Manager , signaling
permission to allow remote commands:
touch /etc/sysconfig/rhn/allowed-actions/script/run
When the setup is complete, refresh the page to view the text boxes for remote commands.
Identify a specific user, group, and timeout period, and the script to run. Select a date and time
to execute the command, then click Schedule or add the remote command to an action chain.
For further information on action chains, see: Section 16.5, “Action Chains”.
Reactivation keys include this system’s ID, history, groups, and channels. This key can then be
used only once with the rhnreg_ks command line utility to re-register this system and regain all
SUSE Manager settings. Unlike typical activation keys, which are not associated with a specific
system ID, keys created here do not show up within the Main Menu Systems Activation Keys
page.
rhnreg_ks --server=`server-url`\
--activationkey=`reactivation-key`,`activationkey`--force
Warning
When autoinstalling a system with its existing SUSE Manager profile, the profile uses the
system-specific activation key created here to re-register the system and return its other
SUSE Manager settings. For this reason, you should not regenerate, delete, or use this
key (with rhnreg_ks ) while a profile-based autoinstallation is in progress. If you do, the
autoinstallation will fail.
This subtab provides information about the system, such as networking, BIOS, memory, and
other devices. This only works if you included the hardware profile during registration. If the
hardware profile looks incomplete or outdated, click the Schedule Hardware Refresh button. The
next time the SUSE Manager Daemon ( rhnsd ) connects to SUSE Manager, it will update your
system profile with the latest hardware information.
This subtab provides the option to migrate systems between organizations. Select an organiza-
tion form the dropdown Migrate System Between Organizations Organization Name and click Mi-
grate System to initiate the migration.
Create Note
To add a new note, click the Create Note link, type a subject and write your note, then
click the Create button.
Modify Note
To modify a note, click its subject in the list of notes, make your changes, and click the
Update button.
Remove Note
To remove a note, click its subject in the list of notes then click the Delete Note link.
This subtab provides completely customizable information about the system. Unlike System De-
tails Notes, System Details Custom Info is structured, formalized, and can be searched. Before
adding custom information about a system, you must have Custom System Information Custom
Information Keys. To create such keys, click Custom System Info in the left bar. For more infor-
mation, see: Section 7.11, “Custom System Info”.
Once you have created one or more keys, you may assign values for this system by selecting the
Create Value link. Click the name of the key in the resulting list and enter a value for it in the
Edit Custom Value Value eld, then click the Update Key button.
This tab is only available for SUSE Manager Proxy systems. The tab lists all clients registered
with the selected SUSE Manager Proxy server.
This subtab contains a list of patch (errata) alerts applicable to the system. Refer to Section 6.2,
“Patch Alert Icons” for meanings of the icons on this tab.
None
Pending
Picked Up
Completed
Failed
This column displays only the latest action related to a patch. For example, if an action fails and
you reschedule it, this column shows the status of the patch as Pending with no mention of the
previous failure. Clicking a status other than None takes you to the Pending Action Details page.
Manage the software packages on the system. Most of the following actions can also be per-
formed via action chains. For further information on action chains, see: Section 16.5, “Action
Chains”.
Warning
When new packages or updates are installed on the client via SUSE Manager, any licenses
(EULAs) requiring agreement before installation are automatically accepted.
Packages
The default display of the System Details Packages tab describes the options available and
provides the means to update your package list. To update or complete a potentially out-
dated list, possibly because of the manual installation of packages, click the Update Package
List button in the bottom right-hand corner of this page. The next time the SUSE Manager
daemon ( rhnsd ) connects to SUSE Manager, it updates your system profile with the latest
list of installed packages.
List / Remove
Lists installed packages and enables you to remove them. View and sort packages by name
or the date they were installed on the system. Search for the desired packages by typing
a name in the Removeable Packages Filter by Package Name search eld. You may also
select the letter or number corresponding to the rst character of the package name from
the drop down selection menu. Click a package name to view its Package name Package
Details page. To delete packages from the system, select their check boxes and click the
Remove Packages button on the bottom right-hand corner of the page. A confirmation page
appears with the packages listed. Click the Confirm button to remove the packages.
Install
Install new packages on the system from the available channels. Click the package name
to view its Package Name Package Details page. To install packages, select them and click
the Install Selected Packages button. EULAs are automatically accepted.
Verify
Validates the packages installed on the system against its RPM database. This is the equiv-
alent of running rpm -V . The metadata of the system’s packages are compared with in-
formation from the database, such as le checksum, le size, permissions, owner, group
and type. To verify a package or packages, select them, click the Verify Selected Packages
button, and confirm. When the check is finished, select this action in the History subtab
under Events to see the results.
Lock
Locking a package prevents modifications like removal or update of the package. Since
locking and unlocking happens via scheduling requests, locking might take effect with
some delay. If an update happens before then, the lock will have no effect. Select the
packages you want to lock. If locking should happen later, select the date and time above
the Request Lock button, then click it. A small lock icon marks locked packages. To unlock,
select the package and click Request Unlock, optionally specifying the date and time for
unlocking to take effect.
Note
This feature only works if Zypper is used as the package manager. On the target
machine the zypp-plugin-spacewalk package must be installed (version 0.9.x or
higher).
Profiles
Compare installed packages with the package lists in stored profiles and other systems.
To create a stored profile based on the existing system, click the Create System Profile
button, enter any additional information, and click the Create Profile button. These
profiles are kept within the Main menu Systems Stored Profiles page.
When installed packages have been compared with a profile, customers have the
option to synchronize the selected system with the profile. All changes apply to the
system not the profile. Packages might get deleted and additional packages installed
on the system. To install only specific packages, click the respective check boxes in
the profile. To remove specific packages installed on the system, select the check
boxes of these packages showing a difference of This System Only.
To completely synchronize the system’s packages with the compared profile, select
the master check box at the top of the column. Then click the Sync Packages to button.
On the confirmation screen, review the changes, select a time frame for the action,
and click the Schedule Sync button.
You can use a stored profile as a template for the les to be installed on an autoin-
stalled system.
Non Compliant
Lists packages that are installed on this system and are not present in any of its channels.
Software channels provide a well-defined method to determine which packages should be avail-
able to a system for installation or upgrade based on its operating systems, installed packages,
and functionality.
For more information about channel management, see: Section 12.1, “Channels”.
Service Pack Migration (SP Migration) allows you to upgrade a system from one service pack
to another.
Warning
During migration SUSE Manager automatically accepts any required licenses (EULAs)
before installation.
Beginning with SLE 12 SUSE supports service pack skipping, it is now possible to migrate from
for example, SLE 12 to SLE 12 SP2. Note that SLE 11 may only be migrated step by step and in-
dividual service packs should not be skipped. Supported migrations include any of the following:
SLE 11 > SLE 11 SP1 > SLE 11 SP2 > SLE 11 SP3 > SLE 11 SP4
4. From the System Details Software SP Migration Service Pack Migration - Channels view
select the correct base channel, including Mandatory Child Channels and any additional
Optional Child Channels . Select Schedule Migration when your channels have been
configured properly.
Note
To manage the configuration of a system, it must have the latest rhncfg* packages in-
stalled. Refer to Section 15.2, “Preparing Systems for Configuration Management [Management]”
for instructions on enabling and disabling scheduled actions for a system.
This section is available to normal users with access to systems that have configuration man-
agement enabled. Like software channels, configuration channels store les to be installed on
systems. While software updates are provided by SCC, configuration les are managed solely
by you. Also unlike with software packages, various versions of configuration les may prove
useful to a system at any time. Only the latest version can be deployed.
Configuration Overview
This subtab lists all configuration les currently associated with the system. These are sorted via
subtabs in centrally and locally managed les and a local sandbox for les under development.
Using the appropriate buttons on a subtab, you can copy from one to the other subtabs.
Centrally-Managed Files
Centrally-managed configuration les are provided by global configuration channels. De-
termine which channel provides which le by examining the Configuration View/Modify
Files Centrally-Managed Files Provided By column below. Some of these centrally-man-
aged les may be overridden by locally-managed les. Check the Configuration View/
Modify Files Centrally-Managed Files Overridden By column to nd out if any les are
overridden, or click Override this le to provide such an overriding le.
Local Sandbox
In the sandbox you can store configuration les under development. You can promote
les from the sandbox to a centrally-managed configuration channel using Configuration
Overview Local Sandbox Copy Latest to Central Channel. After les in this sandbox have
been promoted to a centrally-managed configuration channel, you can deploy them to
other systems.
Use Configuration Overview Copy Latest to System Channel to install a configuration on the local
system only. When done, the le will end up on the Configuration Overview Locally-Managed
Files subtab.
Upload File
To upload a configuration le from your local machine, browse for the upload le, specify
whether it is a text or binary le, enter Filename/Path and user and group ownership.
Specific le permissions can be set. When done, click Upload Configuration File.
In the text box under Import New Files enter the full path of any les you want import into SUSE
Manager or select deployable configuration les from the Import Existing Files list. When done,
click Import Configuration Files.
Create File
Under Deploy Files you nd all les that can be deployed on the selected system.
Select the les to be compared, click the Compare Files button, select a time to perform the di,
and click the Schedule Compare button to confirm.
To watch progress, see Section 7.3.10, “System Details > Events”. After the di has been performed,
go to Recent Events in Section 7.3.3.1, “System Details > Configuration > Overview” to see the results.
AutoYaST is a SUSE Linux Enterprise and Kickstart is a Red Hat utility - both allow you to
automate the reinstallation of a system. Snapshot rollbacks provide the ability to revert certain
changes on the system. You can roll back a set of RPM packages, but rolling back across multiple
update levels is not supported. Both features are described in the sections that follow.
The Schedule subtab allows you to configure and schedule an autoinstallation for this system.
For background information about autoinstallation, see Chapter 8, Autoinstallation.
Note
You must rst create a profile before it appears on this subtab. If you have not created
any profiles, refer to Section 8.3.1, “Create a Kickstart Profile” before scheduling an autoin-
stallation for a system.
To alter autoinstallation settings, click the Advanced Configuration button. Configure the network
connection and post-installation networking information. You can aggregate multiple network
interfaces into a single logical "bonded" interface. In Kernel Options specify kernel options to be
used during autoinstallation. Post Kernel Options are used after the installation is complete and
the system is booting for the rst time. Configure package profile synchronization.
Select a time for the autoinstallation to begin and click Schedule Autoinstall and Finish for all
changes to take effect and to schedule the autoinstallation.
Alternatively, click Create PXE Installation Configuration to create a Cobbler system record. The
selected autoinstallation profile will be used to automatically install the configured distribution
next time that particular system boots from PXE. In this case SUSE Manager and its network
must be properly configured to allow boot using PXE.
The Variables subtab can be used to create Kickstart variables, which substitute values in Kick-
start les. To define a variable, create a name-value pair ( name/value ) in the text box.
For example, to Kickstart a system that joins the network of a specific organization (for example
the Engineering department) you can create a profile variable to set the IP address and the
gateway server address to a variable that any system using that profile will use. Add the following
line to the Variables text box:
IPADDR=192.168.0.28
GATEWAY=192.168.0.1
To use the system variable, use the name of the variable in the profile instead of the value. For
example, the network portion of a Kickstart le could look like the following:
Note
There is a hierarchy when creating and using variables in Kickstart les. System Kick-
start variables take precedence over profile variables, which in turn take precedence over
distribution variables. Understanding this hierarchy can alleviate confusion when using
variables in Kickstart.
Using variables are one part of the larger Cobbler infrastructure for creating templates that
can be shared between multiple profiles and systems. For more information about Cobbler and
Kickstart templates, refer to Book “Advanced Topics”, Chapter 10 “Cobbler”.
1. Add the respective systems to the system set manager as described in Section 7.5, “System
Set Manager”.
2. Click Manage (in the upper right corner), then menu: Provisioning[Power Management
Configuration] to change one or more configuration parameters for all systems in the set.
Note that any eld left blank will not alter the configuration parameter in selected systems.
3. When all configuration parameters are set correctly, click Manage , then Provisioning Pow-
er Management Operations to power on, o or reboot systems from the set.
To check that a power operation was executed correctly, click System Set Manager Status on the
left-hand menu, then click the proper line in the list. This will display a new list with systems
to which the operation was applied. If errors prevent correct execution, a brief message with an
explanation will be displayed in the Note column.
This feature uses Cobbler power management, thus a Cobbler system record is automatically
created at rst use if it does not exist already. In that case, the automatically created system
record will not be bootable from the network and will reference a dummy image. This is needed
because Cobbler does not currently support system records without profiles or images. The
current implementation of Cobbler power management uses the fence-agent tools to support
multiple protocols besides IPMI. Those are not supported by SUSE Manager but can be used by
adding the fence agent names as a comma-separated list to the java.power_management.types
configuration parameter.
Snapshots enable you to roll back the system’s package profile, configuration les, and SUSE
Manager settings.
To revert to a previous configuration, click the Reason for the snapshot and review the potential
changes on the provided subtabs, starting with Rollback .
group memberships,
channel subscriptions,
installed packages,
configuration les,
snapshot tags.
When satisfied with the reversion, return to the Rollback subtab and click the Rollback to Snapshot
button. To see the list again, click Return to snapshot list .
Snapshot tags provide a means to add meaningful descriptions to your most recent system snap-
shot. This can be used to indicate milestones, such as a known working configuration or a suc-
cessful upgrade.
To tag the most recent snapshot, click Create System Tag , enter a descriptive term in the Tag
name eld, and click the Tag Current Snapshot button. You may then revert using this tag directly
by clicking its name in the Snapshot Tags list. To delete tags, select their check boxes, click
Remove Tags , and confirm the action.
Only System Group Administrators and SUSE Manager Administrators can remove systems from
groups. Non-admins see a Review this system’s group membership page. To remove the system
from one or more groups, select the respective check boxes of these groups and click the Leave
Selected Groups button. To see the System Group Details page, click the group’s name. Refer to
Section 7.4.3, “System Group Details” for more information.
Only System Group Administrators and SUSE Manager Administrators can add a system to
groups. Non-admins see a Review this system’s group membership page. To add the system to
groups, select the groups' check boxes and click the Join Selected Groups button.
The Virtualization tab has three subtabs, Details, Provisioning, and Deployment . These tabs appear
the same for both virtual hosts and guests, but the functionality only makes sense for virtual
hosts. It is not possible to create a guest system that runs on another guest system.
Details is the default tab. For host systems, it presents a table of the host system’s virtual guests.
For each guest system, the following information is provided:
Status
This eld indicates whether the virtual system is running, paused, stopped, or has crashed.
Updates
This eld indicates whether patches (errata) applicable to the guest have yet to be applied.
Note
If a guest system has not registered with SUSE Manager , this information appears as
plain text in the table.
If you have System Group Administrator responsibilities assigned for your guest systems, a user
might see the message You do not have permission to access this system in the table. This is because
it is possible to assign virtual guests on a single host to multiple System Group Administrators.
Only users that have System Group Administrator privileges on the host system may create new
virtual guests.
Note
The following subtabs are only available for Salt minions.
Search for the custom state you want to apply to the system then select the Assign check box.
Click Save to save the change to the database finally select Apply to apply the changes. States
applied at the system level will only be applied to the selected system.
— Package Event,
— Patch Event,
tem Event.
To view details of an event, click its summary in the System History list. To go back to the table
again, click Return to history list at the bottom of the page.
The System Groups page allows SUSE Manager users to view the System Groups list.
Only System Group Administrators and SUSE Manager Administrators may perform the follow-
ing additional tasks:
2. Add systems to system groups. (Refer to Section 7.4.2, “Adding and Removing Systems in
Groups”.)
86 System Groups
3. Remove systems from system groups. (Refer to Section 7.3, “System Details”.)
The System Groups list displays all system groups. The list contains several columns for each
group:
Select — Via the check boxes add all systems in the selected groups to the System Set Man-
ager by clicking the Update button. All systems in the selected groups are added to the
System Set Manager . You can then use the System Set Manager to perform actions on them
simultaneously. It is possible to select only those systems that are members of all of the
selected groups, excluding those systems that belong only to one or some of the selected
groups. To do so, select the relevant groups and click the Work with Intersection button. To
add all systems of all selected groups, click the Work with Union button. Each system will
show up once, regardless of the number of groups to which it belongs. Refer to Section 7.5,
“System Set Manager” for details.
Updates — Shows which type of patch alerts are applicable to the group or confirms that
all systems are up-to-date. Clicking a group’s status icon takes you to the Patch tab of its
System Group Details page. Refer to Section 7.4.3, “System Group Details” for more information.
The status icons call for differing degrees of attention: — All systems in the group
Group Name — The name of the group as configured during its creation. The name should
be explicit enough to distinguish from other groups. Clicking the name of a group takes
you to the Details tab of its System Group Details page. Refer to Section 7.4.3, “System Group
Details” for more information.
87 System Groups
Systems — Total number of systems in the group. Clicking the number takes you to the
Systems tab of the System Group Details page for the group. Refer to Section 7.4.3, “System
Group Details” for more information.
Use in SSM — Clicking the Use in SSM link in this column loads all and only the systems in
the selected group and launches the System Set Manager immediately. Refer to Section 7.5,
“System Set Manager” for more information.
Type a name and description and click the Create Group button. Make sure you use a name that
clearly sets this group apart from others. The new group will appear in the System Groups list.
Systems can be added and removed from system groups. Clicking the group name takes you to
the Details page. The Systems tab shows all systems in the group and allows you to select some
or all systems for deletion. Click Remove Systems to remove the selected systems from the group.
The Target Systems page shows you all systems that can be added to the group. Select the systems
and click the Add Systems button.
88 Creating Groups
7.4.3 System Group Details
At the top of each System Group Details page are two links: Delete Group and Work With Group .
Clicking Delete Group deletes the System Group and should be used with caution. Clicking Work
With Group loads the group’s systems and launches the System Set Manager immediately like
the Use Group button from the System Groups list. Refer to Section 7.5, “System Set Manager” for
more information.
The System Group Details page is split into the following tabs:
Provides the group name and group description. To change this information, click Edit These
Properties , make your changes in the appropriate elds, and click the Update Group button.
List of all organization users that have permission to manage the system group. SUSE Manager
Administrators are clearly identified. System Group Administrators are marked with an asterisk
(*). To change the system group’s users, select and deselect the appropriate check boxes and
click the Update button.
The States tab displays states which have been created and added using the Salt > State Catalog
. From this page you can select which states should be applied across a group of systems. A state
applied from this page will be applied to all minions within a group.
Note
States are applied according to the following order of hierarchy within SUSE Manager :
1. Create a state using the Salt State Catalog or via the command line.
2. Browse to Systems System Groups . Select the group that a new state should be applied to.
From a specific group page select the States tab.
3. Use the search feature to located a state by name or click the Search button to list all
available states.
4. Select the check box for the state to be applied and click the Save button. The Save button
will save the change to the database but will not apply the state.
5. Apply the state by clicking the Apply button. The state will be scheduled and applied to
any systems included within a group.
Before performing actions on multiple systems, select the systems to work with. To select sys-
tems, click Systems in the left bar, check the boxes to the left of the systems you want to work
with, and click the Manage button in the top bar.
Additionally, you can access the System Set Manager in three different ways:
3. Click the Work with Group link on the System Group Details page.
A list of all the packages installed on the selected systems that might be removed.
Multiple versions appear if systems in the System Set Manager have more than one version
installed. Select the packages to be deleted, then click the Remove Packages button.
A list of all the packages installed on the selected systems that might be upgraded.
A list of all installed packages whose contents, le checksum, and other details may be verified.
At the next check in, the verify event issues the command rpm --verify for the specified
package. If there are any discrepancies, they are displayed in the System Details page for each
system.
Select the check box next to all packages to be verified, then click the Verify Packages button.
On the next page, select a date and time for the verification, then click the Schedule Verifications
button.
Change the child channel subscription on this page. Then click Next in the lower left corner.
Use this subtab to distribute configuration les from your central repository on SUSE Manager
to each of the selected systems.
The table lists the configuration les associated with any of the selected systems. Clicking its
system count displays the systems already subscribed to the le.
To subscribe the selected systems to the available configuration les, select the check box for
each wanted le. When done, click Deploy Configuration and schedule the action. Note that the
latest versions of the les, at the time of scheduling, are deployed. Newer versions created after
scheduling are disregarded.
Use this subtab to validate configuration les on the selected systems against copies in your
central repository on SUSE Manager .
Subscribe systems to configuration channels, and in a second step rank these channels accord-
ing to the order of preference. This tab is available only to SUSE Manager Administrators and
Configuration Administrators.
1. Select channels for subscription by activating the check box. When done, confirm with
Continue .
2. In the second step, rank the channels with the arrow-up or arrow-down symbols.
Channels are accessed in the order of their rank. Your local configuration channel always over-
rides all other channels.
7.5.7.4 System Set Manager > Configuration > Unsubscribe from Channels
Administrators may unsubscribe systems from configuration channels by clicking the check box
next to the channel name and clicking the Unsubscribe Systems button.
Note
If a system set contains bare-metal systems and installed clients, only features working
for systems without an operating system installed will be available. Full features will be
enabled again when all bare-metal systems are removed from the set.
If any of the systems connect to SUSE Manager via a proxy server, choose either the Preserve
Existing Configuration radio button or the Use Proxy radio button. If you choose to autoinstall
through a proxy server, select from the available proxies listed in the drop-down box beside the
Use this subtab to add meaningful descriptions to the most recent snapshots of your selected
systems.
To tag the most recent system snapshots, enter a descriptive term in the Tag name eld and click
the Tag Current Snapshots button.
Use this subtab to rollback selected systems to previous snapshots marked with a tag.
Click the tag name, verify the systems to be reverted, and click the Rollback Systems button.
First create a run le on the client systems to allow this function to operate. Refer to Sec-
tion 7.3.1.3, “System Details > Details > Remote Command” for instructions. Then identify a specific
user, group, timeout period, and the script to run. Select a date and time to execute the com-
mand and click Schedule .
7.5.8.6 System Set Manager > Provisioning > Power Management Operation
Enter the command and command line arguments, and the path to the XCCDF document. Then
schedule the scan. All target systems are listed below with a ag whether they support OpenSCAP
scans. For more details on OpenSCAP and audits, refer to Chapter 13, Audit.
Click the Hardware subtab to schedule a hardware profile refresh. Click Confirm Refresh .
Click the Software subtab, then the Confirm Refresh button to schedule a package profile update
of the selected systems.
Select the Lock/Unlock subtab to select systems to be excluded from package updates.
BOOTSTRAPPING PARAMETERS
Host
Place the FQDN of the minion to be bootstrapped within this eld.
SSH Port
Place the SSH port that will be used to connect and bootstrap a machine. The default is 22 .
User
Input the minions user login. The default is {rootuser} .
Password
Input the minions login password.
Activation Key
Select the activation key (associated with a software source channel) that the minion
should use to bootstrap with.
Once your minion’s connection details have been lled in click the Bootstrap button. When
the minion has completed the bootstrap process, nd your new minion listed on the Sys-
tems Overview page.
7.7 Visualization
You can visualize your virtualized, proxy, and systems group topologies. Listed under Sys-
tems Visualization you will nd the Virtualization Hierarchy , Proxy Hierarchy , and Systems
Grouping subpages. This features allows you to search, filter, and partition systems by name,
base channel, check-in date, group, etc.
To visualize your systems select Systems Visualization from the left navigation menu.
Click the Show Filters button in the upper right corner to open the filters panel. On the Filtering
tab, systems are filterable by name, base channel, installed products, or with special properties
such as security, bug x, and product enhancement advisories. etc.
111 Visualization
112 Visualization
On the Partitioning tab, systems may also be partitioned by check-in time. Select the check-in date
and time and click the Apply button. The Clear button will revert current partition configuration.
113 Visualization
114 Visualization
All elements of the network tree are selectable. Clicking any element in the tree opens a box
containing information about the selected systems and will be displayed in the top-right of the
visualization area.
115 Visualization
116 Visualization
Systems shown in the visualization view may be added to System Set Manager (SSM) for futher
management. This can be performed in two ways:
Select single systems and click the Add system to SSM button in the top-right detail box.
Add all visible child elements of any parent node in the view (visible means when filters
have been applied) by clicking the Add Children to SSM button at the bottom of the selection
details panel.
Note
System-specific activation keys created through the Reactivation subtab of the System De-
tails page are not part of this list because they are not reusable across systems.
For more information about Activation Keys, see Book “Best Practices”, Chapter 7 “Activation Key
Management”.
4. Key — Either choose automatic generation by leaving this eld blank or enter the key
you want to generate in the Key eld. This string of characters can then be used with
rhnreg_ks to register client systems with SUSE Manager . Refer to Section 7.9.2, “Using
Multiple Activation Keys at Once” for details.
Do not insert commas or double quotes in the key. All other characters are allowed, but <> ()
{} (this includes the space) will get removed automatically. If the string is empty, a random
one is generated.
Commas are problematic because they are used as separator when two or more activation keys
are used at once.
+
2. Base Channels — The primary channel for the key. This can be either the SUSE Manager
Default channel, a SUSE provided channel, or a custom base channel.
Selecting SUSE Manager Default allows client systems to register with the SUSE -provid-
ed default channel that corresponds with their installed version of SUSE Linux Enterprise .
You can also associate the key with a custom base channel. If a system using this key is
not compatible with the selected channel, it will fall back to the SUSE Manager default
channel.
3. Add-on System Types — The supplemental system types for the key, e. g. Virtualization
Host. All systems will receive these system types with the key.
4. Contact Method - Select how clients communicate with SUSE Manager . Default (Pull) waits
for the client to check in. With Push via SSH and Push via SSH tunnel the server contacts
the client via SSH (with or without tunnel) and pushes updates and actions, etc.
For more information about contact methods, see Book “Best Practices”, Chapter 8 “Contact
Methods”.
5. Universal Default — Select whether this key should be considered the primary activation
key for your organization.
Any (client tools) package installation requires that the Client Tools channel is available and
the Provisioning check box is selected. The Client Tools channel should be selected in the Child
Channels tab.
After creating the activation key, you can see in the Details tab a check box named Configuration
File Deployment . If you select it, all needed packages are automatically added to the Packages
list. By default, the following packages are added: rhncfg , rhncfg-client , and rhncfg-
actions .
Adding the osad package makes sense to execute scheduled actions immediately after the sched-
ule time. When the activation key is created, you can add packages with selecting the key (Soft-
ware Activation Keys ), then on the activation key details tab, go for the Packages subtab and
add osad .
To disable system activations with a key, uncheck the corresponding box in the Enabled column
in the key list. The key can be re-enabled by selecting the check box. Click the Update Activation
Keys button on the bottom right-hand corner of the page to apply your changes.
Do not use system-specific activation keys along with other activation keys; registration fails
in this event.
You are now ready to use multiple activation keys at once.
Unlike with notes, the information here is more formal and can be searched. for example, you
may decide to specify an asset tag for each system. To do so, select Custom System Info from the
left navigation bar and create an asset key.
Click Create Key in the upper-right corner of the page. Enter a suitable label and description,
such as Asset and Precise location of each system , then click Create Key . The key will
show up in the custom info keys list.
When the key exists, you may assign a value to it through the Custom Info tab of the System
Details page. Refer to Section 7.3.1.8, “System Details > Details > Custom Info” for instructions.
AutoYaST and Kickstart configuration les allow administrators to create an environment for
automating otherwise time-consuming system installations, such as multiple servers or work-
stations. AutoYaST les have to be uploaded to be managed with SUSE Manager. Kickstart les
can be created, modified, and managed within the SUSE Manager Web interface.
SUSE Manager also features the Cobbler installation server. For more information on Cobbler,
see Book “Advanced Topics”, Chapter 10 “Cobbler”.
SUSE Manager provides an interface for developing Kickstart and AutoYaST profiles that can be
used to install Red Hat Enterprise Linux or SUSE Linux Enterprise on either new or already-reg-
istered systems automatically according to certain specifications.
126
FIGURE 8.1: AUTOINSTALLATION OVERVIEW
127
This overview page displays the status of automated installations (Kickstart and AutoYaST) on
your client systems: the types and number of profiles you have created and the progress of
systems that are scheduled to be installed using Kickstart or AutoYaST. In the upper right area
is the Autoinstallation Actions section, which contains a series of links to management actions
for your Kickstart or AutoYaST profiles. Before explaining the various automated installation
options on this page, the next two sections provide an introduction to AutoYaST (Section 8.1,
“Introduction to AutoYaST”) and Kickstart (Section 8.2, “Introduction to Kickstart”).
1. After being connected to the network and turned on, the machine’s PXE logic broadcasts
its MAC address and requests to be discovered.
2. If no static IP address is used, the DHCP server recognizes the discovery request and offers
network information needed for the new machine to boot. This includes an IP address,
the default gateway to be used, the netmask of the network, the IP address of the TFTP
or HTTP server holding the bootloader program, and the full path and le name to that
program (relative to the server’s root).
3. The machine applies the networking information and initiates a session with the server to
request the bootloader program.
port 0
prompt 0
timeout 1
default autoyast
label autoyast
kernel vmlinuz
append autoyast=http://`my_susemanager_server`/`path`\
install=http://`my_susemanager_server`/`repo_tree`
5. The machine accepts and uncompresses the initrd and kernel, boots the kernel, fetches
the instsys from the install server and initiates the AutoYaST installation with the options
supplied in the bootloader configuration le, including the server containing the AutoYaST
configuration le.
6. The new machine is installed based on the parameters established within the AutoYaST
configuration le.
A DHCP server is not required for AutoYaST, but it can make things easier. If you are using
static IP addresses, you should select static IP while developing your AutoYaST profile.
Host the AutoYaST distribution trees via HTTP, properly provided by SUSE Manager.
Configure DHCP to assign the required networking parameters and the bootloader
program location.
In the bootloader configuration le, specify the kernel and appropriate kernel options
to be used.
1. After being connected to the network and turned on, the machine’s PXE logic broadcasts
its MAC address and requests to be discovered.
2. If no static IP address is used, the DHCP server recognizes the discovery request and offers
network information needed for the new machine to boot. This information includes an
IP address, the default gateway to be used, the netmask of the network, the IP address of
the TFTP or HTTP server holding the bootloader program, and the full path and le name
of that program (relative to the server’s root).
3. The machine applies the networking information and initiates a session with the server to
request the bootloader program.
4. The bootloader searches for its configuration le on the server from which it was loaded.
This le dictates which kernel and kernel options, such as the initial RAM disk (initrd)
image, should be executed on the booting machine. Assuming the bootloader program is
SYSLINUX, this le is located in the pxelinux.cfg directory on the server and named
the hexadecimal equivalent of the new machine’s IP address. For example, a bootloader
configuration le for Red Hat Enterprise Linux AS 2.1 should contain:
port 0
prompt 0
timeout 1
default My_Label
label My_Label
kernel vmlinuz
append ks=http://`my_susemanager_server`/`path`\
initrd=initrd.img network apic
6. This Kickstart configuration le in turn directs the machine to the location of the instal-
lation les.
7. The new machine is built based on the parameters established within the Kickstart con-
figuration le.
A DHCP server is not required for kickstarting, but it can make things easier. If you are
using static IP addresses, select static IP while developing your Kickstart profile.
An FTP server can be used instead of hosting the Kickstart distribution trees via HTTP.
If conducting a bare metal Kickstart, you should configure DHCP to assign required net-
working parameters and the bootloader program location. Also, specify within the boot-
loader configuration le the kernel to be used and appropriate kernel options.
label ks
kernel vmlinuz
http://`my.manager.server`/kickstart/ks/mode/ip_range
The Kickstart distribution defined via the IP range should match the distribution from which
you are building, or errors will occur. ksdevice is optional, but looks like:
ksdevice=eth0
It is possible to change the distribution for a Kickstart profile within a family, such as Red Hat
Enterprise Linux AS 4 to Red Hat Enterprise Linux ES 4, by specifying the new distribution label.
Note that you cannot move between versions (4 to 5) or between updates (U1 to U2).
Next, customize isolinux.cfg further for your needs by adding multiple Kickstart options,
different boot messages, shorter timeout periods, etc.
Next, create the ISO as described in the Making an Installation Boot CD-ROM section of the Red
Hat Enterprise Linux Installation Guide. Alternatively, issue the command:
Note that isolinux/ is the relative path to the directory containing the modified isolinux les
copied from the distribution CD, while file.iso is the output ISO le, which is placed into
the current directory.
Burn the ISO to CD-ROM and insert the disc. Boot the system and type "ks" at the prompt (as-
suming you left the label for the Kickstart boot as 'ks'). When you press Enter , Kickstart starts
running.
Note
Running the Network Booting Tool, as described in the Red Hat Enterprise Linux 4: System
Administration Guide, select "HTTP" as the protocol and include the domain name of the
SUSE Manager in the Server eld if you intend to use it to distribute the installation les.
The following sections describe the autoinstallation options available from the Systems Autoin-
stallation page.
1. On the rst line, enter a Kickstart profile label. This label cannot contain spaces, so use
dashes ( - ) or underscores ( \_ ) as separators.
2. Select a Base Channel for this profile, which consists of packages based on a specific archi-
tecture and Red Hat Enterprise Linux release.
3. Select an Kickstartable Tree for this profile. The Kickstartable Tree drop-down menu is only
populated if one or more distributions have been created for the selected base channel (see
Section 8.6, “Autoinstallation > Distributions”).
4. Instead of selecting a specific tree, you can also check the box Always use the newest Tree
for this base channel. This setting lets SUSE Manager automatically pick the latest tree that
is associated with the specified base channels. If you add new trees later, SUSE Manager
will always keep the most recently created or modified.
Note
If you do not intend to use the Kickstart profile to create virtual guest systems, you
can leave the drop-down at the default None choice.
6. On the second page, select (or enter) the location of the Kickstart tree.
Depending on your base channel, your newly created Kickstart profile might be subscribed to a
channel that is missing required packages. For Kickstart to work properly, the following pack-
ages should be present in its base channel: pyOpenSSL , rhnlib , libxml2-python , and space-
walk-koan and associated packages.
Make sure that the Tools software channel for the Kickstart profile’s base channel is avail-
able to your organization. If it is not, you must request entitlements for the Tools software
channel from the SUSE Manager administrator.
Make sure that the Tools software channel for this Kickstart profile’s base channel is avail-
able to your SUSE Manager as a child channel.
Make sure that rhn-kickstart and associated packages corresponding to this Kickstart
are available in the Tools child channel.
The final stage of the wizard presents the Autoinstallation Details Details tab. On this tab and
the other subtabs, nearly every option for the new Kickstart profile can be customized.
Once created, you can access the Kickstart profile by downloading it from the Autoinstallation
Details page by clicking the Autoinstallation File subtab and clicking the Download Autoinstallation
File link.
If the Kickstart le is not managed by SUSE Manager, you can access it via the following URL:
http://`my.manager.server`/ks/dist/ks-rhel-`ARCH`-`VARIANT`-`VERSION`
In the above example, ARCH is the architecture of the Kickstart le, VARIANT is either client
or server , and VERSION is the release of Red Hat Enterprise Linux associated with the Kickstart
le.
The following sections describe the options available on each subtab.
On the Autoinstallation Details Details page, you have the following options:
Note
Changing the Virtualization Type may require changes to the Kickstart profile boot-
loader and partition options, potentially overwriting user customizations. Consult
the Partitioning tab to verify any new or changed settings.
Change the amount of Virtual Memory (in Megabytes of RAM) allocated to virtual guests
autoinstalled with this profile.
Change the amount of Virtual Disk Space (in GB) allotted to each virtual guest.
Deactivate the profile so that it cannot be used to schedule a Kickstart by removing the
Active check mark.
Check whether to enable logging for custom %post scripts to the /root/ks-post.log
le.
Decide whether to enable logging for custom %pre scripts to the /root/ks-pre.log le.
Choose whether to preserve the ks.cfg le and all %include fragments to the /root/
directory of all systems autoinstalled with this profile.
Select whether this profile is the default for all of your organization’s Kickstarts by checking
or unchecking the box.
Enter comments that are useful to you in distinguishing this profile from others.
On this page, you can make the following changes to the operating system that the Kickstart
profile installs:
Child Channels
Subscribe to available child channels of the base channel, such as the Tools channel.
Available Trees
Use the drop-down menu to choose from available trees associated with the base channel.
IPADDR=192.168.0.28
GATEWAY=192.168.0.1
Now you can use the name of the variable in the profile instead of a specific value. For example,
the network part of a Kickstart le looks like the following:
Note
There is a hierarchy when creating and using variables in Kickstart les. System Kick-
start variables take precedence over Profile variables, which in turn take precedence over
Distribution variables. Understanding this hierarchy can alleviate confusion when using
variables in Kickstarts.
Using variables are just one part of the larger Cobbler infrastructure for creating templates that
can be shared between multiple profiles and systems. For more information about Cobbler and
templates, refer to Book “Advanced Topics”, Chapter 10 “Cobbler”.
From this page, you can toggle several installation options on and o by checking and uncheck-
ing the boxes to the left of the option. For most installations, the default options are correct.
Refer to Red Hat Enterprise Linux documentation for details.
You can specify an Organization Default Profile by clicking Autoinstallation Profiles profile
name Details, then checking the Organization Default Profile box and finally clicking Update.
This subtab provides the information necessary to Kickstart systems that are not currently regis-
tered with SUSE Manager. Using the on-screen instructions, you may either autoinstall systems
using boot media (CD-ROM) or by IP address.
Displays subtabs that are available from the System Details tab.
On the System Details Details page, you have the following options:
From this subtab, select the GPG keys and/or SSL certificates to be exported to the kickstarted
system during the %post section of the Kickstart. For SUSE Manager customers, this list includes
the SSL Certificate used during the installation of SUSE Manager.
Note
Any GPG key you wish to export to the kickstarted system must be in ASCII rather than
binary format.
From this subtab, change information that may help with troubleshooting hardware problems:
Bootloader
For some headless systems, it is better to select the non-graphic LILO bootloader.
Kernel Parameters
Enter kernel parameters here that may help to narrow down the source of hardware issues.
The image above shows subtabs that are available from the Software tab.
Enter the package groups, such as @office or @admin-tools you would like to install on the
kickstarted system in the large text box. If you would like to know what package groups are
available, and what packages they contain, refer to the RedHat/base/ le of your Kickstart tree.
If you have previously created a Package Profile from one of your registered systems, you can
use that profile as a template for the les to be installed on a kickstarted system. Refer to
Section 7.3.2.2, “System Details > Software > Packages” for more information about package profiles.
The Activation Keys tab allows you to select Activation Keys to include as part of the Kickstart
profile. These keys, which must be created before the Kickstart profile, will be used when re-
registering kickstarted systems.
8.3.1.17 Scripts
The Scripts tab is where %pre and %post scripts are created. This page lists any scripts that
have already been created for this Kickstart profile. To create a Kickstart script, perform the
following procedure:
1. Click the add new kickstart script link in the upper right corner.
2. Enter the path to the scripting language used to create the script, such as /usr/bin/perl .
4. Indicate whether this script is to be executed in the %pre or %post section of the Kickstart
process.
5. Indicate whether this script is to run outside of the chroot environment. Refer to the Post-
installation Script section of the Red Hat Enterprise Linux System Administration Guide for
further explanation of the nochroot option.
Note
SUSE Manager supports the inclusion of separate les within the Partition Details section
of the Kickstart profile. For instance, you may dynamically generate a partition le based
on the machine type and number of disks at Kickstart time. This le can be created via
%pre script and placed on the system, such as /tmp/part-include . Then you can call
for that le by entering the following line in the Partition Details eld of the System
Details Partitioning tab:
%include /tmp/part-include
The Autoinstallation File tab allows you to view or download the profile that has been generated
from the options chosen in the previous tabs.
1. In the rst line, enter a profile Label for the automated installation. This label cannot
contain spaces, so use dashes (-) or underscores (_) as separators.
2. Select an Autoinstallable Tree for this profile. The Autoinstallable Tree drop-down menu is
only populated if one or more distributions have been created for the selected base channel
(see Section 8.6, “Autoinstallation > Distributions”).
3. Instead of selecting a specific tree, you can also check the box menu:Always use the newest
Tree for this base channel. This setting lets SUSE Manager automatically pick the latest
tree that is associated with the specified base channels. If you add new trees later, SUSE
Manager will always keep the most recently created or modified.
4. Select the Virtualization Type from the drop-down menu. For more information about vir-
tualization, refer to Book “Advanced Topics”, Chapter 11 “Virtualization”.
Note
If you do not intend to use the autoinstall profile to create virtual guest systems,
you can leave the drop-down set to the default choice KVM Virtualized Guest.
5. Finally, either provide the le contents with cut-and-paste or update the le from the local
storage medium:
enter the le name in the File to Upload eld and click Upload File.
Details
Bare Metal
Variables
Autoinstallable File
Important
The GPG key you upload to SUSE Manager must be in ASCII format. Using a GPG key in
binary format causes anaconda, and therefore the Kickstart process, to fail.
Note
The Distributions page does not display distributions already provided. They can be found
within the Distribution drop-down menu of the Autoinstallation Details page.
Enter a label (without spaces) in the Distribution Label eld, such as my-orgs-
sles-12-sp2 or my-orgs-rhel-as-7 .
In the Tree Path eld, paste the path to the base of the installation tree.
Select the matching distribution from the Base Channel and Installer Generation drop-
down menus, such as SUSE Linux for SUSE Linux Enterprise, or Red Hat Enter-
prise Linux 7 for Red Hat Enterprise Linux 7 client systems.
IPADDR=192.168.0.28
GATEWAY=192.168.0.1
To use the distribution variable, use the name of the variable in the profile to substitute the
value. For example, the network part of a Kickstart le looks like the following:
Note
There is a hierarchy when creating and using variables in Kickstart les. System Kick-
start variables take precedence over Profile variables, which in turn take precedence over
Distribution variables. Understanding this hierarchy can alleviate confusion when using
variables in Kickstarts.
Important
Although le preservation is useful, it does have limitations. Each list is limited to a total
size of 1 MB. Special devices like /dev/hda1 and /dev/sda1 are not supported. Only
le and directory names may be entered. No regular expression wildcards can be used.
When finished, you may include the le preservation list in the Kickstart profile to be used on
systems containing those les. Refer to Section 8.3.1, “Create a Kickstart Profile” for precise steps.
<init-scripts config:type="list">
$SNIPPET('spacewalk/sles_register_script')
</init-scripts>
When you create a snippet with the Create Snippet link, all profiles including that snippet will
be updated accordingly.
8.9.1 VMware-Based
After selecting Create VMware-based enter the location of your VMware-based virtual host. En-
ter a Label , Hostname , Port , Username and Password . Finally click the Add Virtual Host Manager
button. For detailed information on working with a VMware-based Virtual Host Manager, see
Book “Advanced Topics”, Chapter 12 “Inventorying vCenter/vSphere ESXi Hosts with ”.
8.9.2 File-Based
In a VMWare environment where direct connection to the SUSE Manager Server is not possible, a
JSON le can be exported from the ESXi or vSphere host and later imported into SUSE Manager
via this option.
After selecting Create File-Based enter a label and URL leading to the location of this le.
154 VMware-Based
Note: VMWare vCenter Installations without Direct
Access
The le-based is not meant to be used with manually crafted les. It only meant to be
used with the output of virtual-host-gatherer against some other module. File-based
is suitable for VMWare vCenter installations for which no direct API access is possible
from the SUSE Manager Server.
The solution is to run virtual-host-gatherer from somewhere else in the network
and save the produced JSON data for further processing.
The following JSON data is an example of the exported information in the le:
{
"examplevhost": {
"10.11.12.13": {
"cpuArch": "x86_64",
"cpuDescription": "AMD Opteron(tm) Processor 4386",
"cpuMhz": 3092.212727,
"cpuVendor": "amd",
"hostIdentifier": "'vim.HostSystem:host-182'",
"name": "11.11.12.13",
"os": "VMware ESXi",
"osVersion": "5.5.0",
"ramMb": 65512,
"totalCpuCores": 16,
"totalCpuSockets": 2,
"totalCpuThreads": 16,
"type": "vmware",
"vms": {
"vCenter": "564d6d90-459c-2256-8f39-3cb2bd24b7b0"
}
},
"10.11.12.14": {
"cpuArch": "x86_64",
155 File-Based
"cpuDescription": "AMD Opteron(tm) Processor 4386",
"cpuMhz": 3092.212639,
"cpuVendor": "amd",
"hostIdentifier": "'vim.HostSystem:host-183'",
"name": "10.11.12.14",
"os": "VMware ESXi",
"osVersion": "5.5.0",
"ramMb": 65512,
"totalCpuCores": 16,
"totalCpuSockets": 2,
"totalCpuThreads": 16,
"type": "vmware",
"vms": {
"49737e0a-c9e6-4ceb-aef8-6a9452f67cb5": "4230c60f-3f98-2a65-
f7c3-600b26b79c22",
"5a2e4e63-a957-426b-bfa8-4169302e4fdb":
"42307b15-1618-0595-01f2-427ffcddd88e",
"NSX-gateway": "4230d43e-aafe-38ba-5a9e-3cb67c03a16a",
"NSX-l3gateway": "4230b00f-0b21-0e9d-dfde-6c7b06909d5f",
"NSX-service": "4230e924-b714-198b-348b-25de01482fd9"
}
}
}
}
For more information, see the man page on your SUSE Manager server for virtual-host-
gatherer :
{prompt.user}man virtual-host-gatherer
The README le coming with the package provides background information about the type
of a hypervisor, etc.:
/usr/share/doc/packages/virtual-host-gatherer/README.md
virtualhostmanager.listAvailableVirtualHostGathererModules(session)
The following APIs allow you to create and delete VHMs. The module parameter map must
match the map returned by virtualhostmanager.getModuleParameters to work correctly:
virtualhostmanager.delete(session, label)
virtualhostmanager.listVirtualHostManagers(session)
virtualhostmanager.getDetail(session, label)
Open Main Menu Salt from the left navigation sidebar. Main Menu Salt Keys provides an
overview of your Salt minions (clients). Use Remote Commands to execute remote commands
on your Salt minions. You can also define a State Catalog for creating a collection of salt
system states.
9.1 Keys
The Keys page provides a summary of your minions, including their names, fingerprints, state,
and actions you may perform on them.
Once you have pointed a minion to the SUSE Manager server as its master within /etc/salt/
minion , you can choose to accept or reject a minion from this page. Toggle the check mark or
cross in the actions column.
For more information about key handling and onboarding, see Book “Getting Started”, Chapter 5
“Registering Clients”, Section 5.5 “Registering Salt Clients”.
158 Keys
FIGURE 9.2: REMOTE COMMANDS
On the Salt Remote Commands page you will see two text boxes. The rst box is for entering
commands. The second box is for targeting minions by name, group, or by using wildcards.
Input a command you want to execute, add a target minion, group, or wildcard you want to ex-
ecute the command on. Select the Find Targets button to verify which machines will be targeted.
Select the Run Command button to execute a command on selected systems.
10.1 Images
SUSE Manager enables system administrators to build system images, virtual images, containers
and similar with the help of profiles and create image stores.
For background information, see Book “Advanced Topics”, Chapter 8 “Image Building and Manage-
ment”.
If you click menu::Main Menu[Images > Images] on the left navigation menu, an overview
listing of your images appears. Several columns provide information about each image:
Select box: To select images, mark the appropriate check boxes. Selected images can be
deleted simultaneously via the Delete button that appears in the upper right corner while
selecting images.
Name :
Updates : Shows which type of update action is applicable to the image or confirms that
the image is up-to-date. For more information about these icons, see Chapter 7, Systems.
Build :
Actions : Details and Delete button. Details opens a the Image Details page.
160 Images
In the upper right corner offers several action buttons: The Delete button appears when one
or more images are selected. Import and Refresh are default buttons. Import allows to import
pre-built images; for more information, see Book “Advanced Topics”, Chapter 8 “Image Building and
Management”, Section 8.2 “Container Images”, Section 8.2.7 “Importing an Image”.
10.2 Build
If you click menu::Main Menu[Images > Build] on the left navigation menu, the dialog for
building images appears:
Version : The version string that you would like to see in the Images listing, applicable
only to containers.
Build Profile : Select an Image Profile created with the Images Profiles page.
Confirm with Build to start image building. When the image is done, nd it listed in the Images
overview described in Section 10.1, “Images”.
Select box: To select image profiles, mark the appropriate check boxes. Selected profiles
can be deleted simultaneously via the Delete button that appears in the upper right corner
while selecting profiles.
Actions : Build , Edit and Delete button. Build creates the image according to this profile.
Edit opens a the Profile Details page for editing.
Refresh and Create are default buttons in the upper right corner. Create opens the Create Image
Profile dialog:
162 Profiles
10.4 Stores
If you click Images Stores on the left navigation menu, a listing of your Image Stores appears.
Several columns provide information about each store:
Select box: To select image stores, mark the appropriate check boxes. Selected stores can be
deleted simultaneously via the Delete button that appears in the upper right corner while
selecting stores.
Actions : Edit and Delete button. Edit opens a the Store Details page for editing.
In the upper right corner offers several action buttons: The Delete button appears when one or
more stores are selected. Refresh and Create are default buttons. Create opens the Create Image
Store dialog:
163 Stores
11 Patches
The Main Menu Patches menu from the left bar helps tracking the availability and application
of patches to your managed systems.
The Main Menu Patches Patches page displays all or relevant patches for at least one of your
managed systems that have not been applied yet.
SUSE distinguishes three types of patches: security updates, bug x updates, and enhancement
updates. Each patch consists of a summary of the problem and solution, including the RPM
packages fixing the problem.
Icons are used to identify the three types:
A summary of each patch is provided in list form displaying its type, advisory ID, synopsis
(with the severity as a textual prefix in case of security updates, such as “critical”, “important”,
“moderate”, or “low”), number of affected systems in your network, and date updated.
In addition, you may view patches by product line at the following location: http://
download.suse.com/patch/psdb/ . For more information on security updates, see https://
www.suse.com/support/security/ .
164
11.1 Relevant
The Relevant patches page displays a customized list of patches applying to your registered
systems.
Clicking an Advisory ID of a patch takes you to the Details page of the Patch Details
page. Clicking the number of associated systems takes you to the Affected Systems page of
the Patch Details page. Refer to Section 11.2.2, “Patch Details” for more information.
11.2 All
The All patches page displays a list of all patches released by SUSE, irrelevant of whether they
apply to your registered systems or not.
Like in the Relevant Patches page, clicking either Advisory or the number of systems af-
fected takes you to related tabs of the Patch Details page. Refer to Section 11.2.2, “Patch Details”
for more information.
165 Relevant
Apply all applicable patches to a system by clicking Main Menu Systems Systems. Click the
name of an entitled system. Then open the System Details Software Patches subtab. When the
relevant patch list appears, click Select All then Apply Patches. Only patches not scheduled, sched-
uled but failed, or canceled patches are listed. Pending updates are excluded.
In addition, users with appropriate roles can apply patches using two other methods:
To apply a specific patch to one or more systems, locate it in the patch list and click the
number of systems affected, which takes you to the Affected Systems page of the Patch
Details page. Select the individual systems to be updated and click the Apply Patches
button. Double-check the systems to be updated on the confirmation page, then click the
Confirm button.
To apply more than one patch to one or more systems, select the systems from the
Main Menu Systems Systems list. Click the Main Menu Systems System Set Manag-
er Overview, then click the Systems tab. After ensuring the appropriate systems are se-
lected, click the Patches tab, select the patches to apply, and click the Apply Patches but-
ton. Schedule a date and time for the patch to be applied. Default is the current date. Click
the Confirm button. You can follow the progress of the patch application via the Pending
Actions list. Refer to Chapter 16, Schedule for more details.
Important
If you use scheduled package installation, the packages or patches are installed via the
SUSE Manager daemon ( rhnsd ). You must enable the SUSE Manager daemon on your
systems. For more information about the SUSE Manager daemon, see Book “Best Practices”,
Chapter 8 “Contact Methods”, Section 8.2 “Default (the SUSE Manager Daemon rhnsd)”.
Each package is a member of one or more channels. If a selected system is not subscribed
to a channel containing the package, the update will not be installed on that system.
If a newer version of the package is already installed on the system, the update will not
be installed.
If you click the advisory of a patch in the Relevant or All pages, its Patch Details page
appears. This page is further divided into the following tabs:
This subtab displays the patch report issued by SUSE. It provides a synopsis of the patch rst
(with the severity as a textual prefix in case of security updates, such as “critical”, “important”,
“moderate”, or “low”), issue date, and any update dates. This is followed by a description of the
patch and the steps required to resolve the issue.
Below the Affected Channels label, all channels that contain the affected package are listed.
Clicking a channel name displays the Packages subtab of the Channel Details page for that
channel. Refer to Section 12.1.7, “Channel Details” for more information.
Security updates list the specific vulnerability as tracked by http://cve.mitre.org . This informa-
tion is listed below the CVEs label.
OVAL is an open vulnerability and assessment language promoted by Mitre, http://
oval.mitre.org . Clicking the link below the Oval label downloads this information to your sys-
tem. More useful are the SUSE Update Advisories at https://www.suse.com/support/update/ .
This page provides links to each of the updated RPMs by channel. Clicking the name of a package
displays its Package Details page.
This page lists systems affected by the patches. You can apply updates here. (See Section 11.2.1,
“Applying Patches”.) Clicking the name of a system takes you to its System Details page. Refer
to Section 7.3, “System Details” for more information.
To determine whether an update has been scheduled, refer to the Status column in the affect-
ed systems table. Possible values are: N/A, Pending, Picked Up, Completed, and Failed. This
column identifies only the last action related to a patch. For example, if an action fails and
kernel
Results will be grouped by advisory. For example, searching for 'kernel' returns all package
names containing the string kernel , grouped by advisory.
CVE — The name assigned to the security advisory by the Common Vulnerabilities and
Exposures (CVE) project at http://cve.mitre.org . For example:
CVE-2006-4535
Bug Fix Advisory — Patches that x issues reported by users or discovered during devel-
opment or testing.
Security Advisory — Patches fixing a security issue found during development, testing, or
reported by users or a software security clearing house. A security advisory usually has
one or more CVE names associated with each vulnerability found in each package.
Warning
If the organization is using both SUSE Manager and SUSE Manager Proxy server, then
manage patches only on the SUSE Manager server since the proxy servers receive updates
directly from it. Managing patches on a proxy in this combined configuration risks putting
your servers out of synchronization.
1. Click Main Menu Patches Manage Patches Published. Then on the Patches Management
page, click Create Patch .
2. Complete all remaining required elds, then click the Create Patch button. View standard
SUSE Alerts for examples of properly completed elds.
Published : this page displays the patch alerts the organization has created and dissem-
inated. To edit an existing published patch, follow the steps described in Section 11.4.1,
“Creating and Editing Patches”. To distribute the patch, click Send Notification in the Send
Patch Mail section on the top of the Patch Details page. The patch alert is sent to the
administrators of all affected systems.
Unublished : this page displays the patch alerts your organization has created but not
yet distributed. To edit an existing unpublished patch, follow the steps described in Sec-
tion 11.4.1, “Creating and Editing Patches”. To publish the patch, click Publish Patch on the top-
right corner of the Patch Details page. Confirm the channels associated with the patch
and click the Publish Patch button, now in the lower-right corner. The patch alert is moved
to the Published page awaiting distribution.
SUSE Manager administrators can also create patches by cloning an existing one. Cloning pre-
serves package associations and simplifies issuing patches. See Section 11.5, “Cloning Patches” for
instructions.
To edit an existing patch alert’s details, click its advisory on the Patches Management page,
make the changes in the appropriate elds of the Details tab, and click the Update Patch
button. Click the Channels tab to alter the patch’s channel association. Click the Packages
tab to view and modify its packages.
To delete patches, select their check boxes on the Patches Management page, click the Delete
Patches button, and confirm the action. Deleting published patches might take a few minutes.
1. Select a patch, click the Packages tab, then the Add subtab.
2. To associate packages with the patch being edited, select the channel from the View drop-
down box that contains the packages and click View. Packages already associated with
the patch being edited are not displayed. Selecting All managed packages presents all
available packages.
3. After clicking View, the package list for the selected option appears. Note that the page
header still lists the patch being edited.
4. In the list, select the check boxes of the packages to be assigned to the edited patch and
click Add Packages.
5. A confirmation page appears with the packages listed. Click Confirm to associate the pack-
ages with the patch. The List/Remove subtab of the Managed Patch Details page ap-
pears with the new packages listed.
When packages are assigned to a patch, the patch cache is updated to reflect the changes. This
update is delayed briey so that users may finish editing a patch before all the changes are
made available. To initiate the changes to the cache manually, follow the directions to commit
the changes immediately at the top of the page.
1. On the top navigation bar, click Main Menu Patches Manage Patches Unpublished to see
all the unpublished patches listed.
2. Click the patch Advisory name to open the patch details pages.
3. On the patch details page, click Publish Patch. A confirmation page appears that will ask
you to select which channels you want to make the patch available in. Choose the relevant
channels.
4. At the bottom of the page, click Publish Patch. The patch published will now appear on the
Published page of Manage Patches .
To delete patches, select them rst and then click Delete Patches.
11.4.5 Unpublished
Here all published patches are listed. It is possible to perform the same actions as with published
patches. For more information, see Section 11.4.4, “Published”. Additionally, on a patch details
page, you can click Publish Patch for publishing.
Only patches potentially applicable to one of your channels can be cloned. Patches can be ap-
plicable to a channel if that channel was cloned from a channel to which the patch applies. To
access this functionality, click Main Menu Patches Clone Patches.
On the Clone Patches page, select the channel containing the patch from the View drop-
down box and click View. When the patch list appears, select the check box of the patch to be
cloned and click Clone Patch. A confirmation page appears with the patch listed. Click Confirm
to finish cloning.
173 Published
The cloned patch appears in the Unpublished patch list. Verify the patch text and the packages
associated with that patch, then publish the patch so it is available to users in your organization.
The pages in the Main Menu Software category enable you to view and manage software chan-
nels and packages associated with your systems.
12.1 Channels
The Main Menu Software Channels page is the rst to appear. A software channel provides
packages grouped by products or applications to simplify the selection of packages to be installed
on a system.
There are two types of software channels: base channels and child channels.
Base Channels
A base channel consists of packages built for a specific architecture and release. For exam-
ple, all of the packages in SUSE Linux Enterprise Server 12 for the x86_64 architecture
make up a base channel. The list of packages in SUSE Linux Enterprise Server 12 for the
s390x architecture make up a different base channel.
A system must be subscribed to only one base channel assigned automatically during reg-
istration based on the SUSE Linux Enterprise release and system architecture. For paid
base channels, an associated subscription must exist.
Child Channels
A child channel is associated with a base channel and provides extra packages. For ex-
ample, an organization can create a child channel associated with SUSE Linux Enterprise
Server on x86_64 architecture that contains extra packages for a custom application.
Especially important are the SUSE Manager Tools channels that are available for every
base channel. These tools channels provide the tools needed to connect the clients with
the SUSE Manager server.
A system can be subscribed to multiple child channels of its base channel. Only packages
provided by a subscribed channel can be installed or updated. SUSE Manager Administra-
tors and Channel Administrators have channel management authority. This authority gives
them the ability to create and manage their own custom channels.
175 Channels
Note
Do not create child channels containing packages that are not compatible with the
client system.
Note
Channels can be further distinguished by relevance: All , SUSE , Channels , My
Channels , Shared , and Retired .
12.1.1 All
Under Main Menu Software Channels select All . All channels available to your organization
are listed.
Links within this list go to different tabs of the Software Channel Details page. Clicking
a channel name takes you to the Details tab. Clicking the number of packages takes you to
the Packages tab. Clicking the number of systems takes you to the Subscribed Systems tab.
Refer to Section 12.1.7, “Channel Details” for details.
176 All
12.1.2 SUSE
The SUSE page displays all SUSE channels and any available child channels.
12.1.3 Popular
The Popular page displays the software channels most subscribed by systems registered to your
organization.
You can refine the search by using the drop-down box to list only the channels with at least a
certain number of systems subscribed.
12.1.4 My Channels
The My Channels page displays all software channels that belong to your organization, includ-
ing both SUSE and custom channels. Use the text box to filter by channel name.
177 SUSE
12.1.5 Shared
The Shared page displays the channels shared with others in the organizational trust.
12.1.6 Retired
The Retired page displays available channels that have reached their end-of-life dates and do
not receive updates.
178 Shared
179 Channel Details
In addition, Per-User Subscription Restrictions can be set globally by SUSE Manager
administrators and channel administrators. By default, any user can subscribe channels to a
system. To manage user permissions, select Only selected users within your organization
may subscribe to this channel and click Update. The Subscribers tab appears. Click it
to grant specific users subscription permissions to a channel. SUSE Manager administrators and
channel administrators can always subscribe any channels to a system.
Only customers with custom base channels can change their systems' base channel assignments
via the SUSE Manager Web interface in two ways:
Note
The assigned base channel must match the installed system. For example, a system run-
ning SUSE Linux Enterprise 11 for x86_64 cannot be registered to a SUSE Linux Enter-
prise 12 for s390x base channel. Use the les /etc/os-release or /etc/SuSE-re-
lease to check your product, architecture (try uname -a ), version, and patch level.
On the Managers page, you can check which users are authorized to manage the selected chan-
nel.
The list displays advisory types, names, summaries, and issue dates. Clicking an advisory name
takes you to its Patch Details page. for more information, see:
Section 11.2.2, “Patch Details”
This page displays a set of tabs with information about the package, including architectures
on which it runs, the package size, build date, package dependencies, change log, list of les
in the package, newer versions, and which systems have the package installed. Download the
packages as RPMs.
The list displays system names and their system type. Clicking a system name takes you to its
System Details page. For more information, see:
List of systems eligible for subscription to the channel. This tab appears only for child channels.
Use the check boxes to select the systems, then click the Confirm and Subscribe button on the
bottom right-hand corner. You will receive a success message or be notified of any errors. This
can also be accomplished through the Channels tab of the System Details page. For more
information, see:
Section 7.3, “System Details”
Free Form — a general keyword search useful when the details of a particular package
and its contents are unknown.
Name and Summary — Search for a package or program which might not show up in the
respective package name but in its one-line summary.
The Free Form eld additionally allows you to search using eld names that you prepend to
search queries and filter results by that eld keyword.
For example, if you wanted to search all of the SUSE Linux Enterprise packages for the word
java in the description and summary, type the following in the Free Form eld:
arch : search the packages by their architecture (such as x86_64 , ppc64le , or s390 ).
You can also limit searches to Channels relevant to your systems by clicking the check
box. Additionally, you can restrict your search by platform ( Specific channel you have
access to ) or architecture ( Packages of a specific architecture ).
To create a new channel, click the Create Channel link. Select the appropriate options for
the new channel, including base architecture and GPG options, then click Create Channel. Note
that a channel created in this manner is blank, containing no packages. You must either upload
software packages or add packages from other repositories. You may also choose to include
patches in your custom channel.
it is a cloned patch,
it does not contain a package that the original patch has, or it has at least one package with
a different version with regard to the corresponding one in the original patch, or both.
Clicking the Sync Patches button opens a confirmation page in which a subset of those
patches can be selected for synchronization.
Clicking the Confirm button in the confirmation page results in such patches being copied
over from the original channel to the cloned channel, thus updating corresponding pack-
ages.
On the Repositories page, assign software repositories to the channel and synchronize repos-
itory content:
Add/Remove lists configured repositories, which can be added and removed by selecting
the check box next to the repository name and clicking Update Repositories.
Sync lists configured repositories. The synchronization schedule can be set using the drop-
down boxes, or an immediate synchronization can be performed by clicking Sync Now.
The Manage Repositories tab to the left shows all assigned repositories. Click a name to see
details and possibly delete a repository.
1. Make sure that the CVE data is up-to-date. For more information, see Section 13.1.3, “Main-
taining CVE Data”.
2. Click Main Menu Audit CVE Audit to open the CVE Audit page.
3. Input a 13-char CVE identifier in the CVE Number eld. The year setting will be automat-
ically adjusted. Alternatively, set the year manually and add the last four digits.
4. Optionally, uncheck the patch statuses you are not interested in.
Red - Affected, patches are available in channels that are not assigned
The system is affected by the vulnerability and SUSE Manager has one or more patches for
it, but at this moment, the channels offering the patches are not assigned to the system.
Green - Patched
A patch has already been installed.
The Orange - state is displayed when SUSE Manager has at least one patch in an
assigned channel. This might mean that, after installing such a patch, others might be
needed—users should double check the CVE Audit page after applying a patch to be sure
that their systems are not affected anymore.
For a more precise definitions of these states, see Section 13.1.4, “Tips and Background Information”.
For each system, the Next Action column contains suggestions on the steps to take to address
the vulnerabilities. Under these circumstances it is either sensible to install a certain patch or
assign a new channel. If applicable, a list of “candidate” channels or patches is displayed for
your convenience.
5. After some minutes, refresh the page and check that the scheduled run status is FINISHED .
A direct link is also available on the Main Main Audit CVE Audit page ( extra CVE data
update ).
Relevant patch
A patch known by SUSE Manager in a relevant channel.
Relevant channel
A channel managed by SUSE Manager, which is either assigned to the system, the original
of a cloned channel which is assigned to the system, a channel linked to a product which
is installed on the system or a past or future service pack channel for the system.
A notable consequence of the above definitions is that results can be incorrect in cases of un-
managed channels, unmanaged packages, or non-compliant systems.
It gathers information about systems, subscriptions and pinned matches (xed customer defined
subscriptions to systems mapping) as input and returns the best possible match according to the
SUSE Terms and Conditions. The Subscription Matcher ( subscription-matcher ) is also able
to write CSV Reports.
The Unmatched Products Report provides information on products and their systems
when a match to a subscription cannot be found
The Error Report provides a list of errors raised during the matching process
Selecting Main Menu Audit Subscription Matching from the left navigation menu will provide
you with an overview of all results generated by the Subscription Matcher.
Description
Name of a particular product
Policy
Kind of the subscription of this product
Matched/Total
Fully Matched. If the total amounts of a subscription are fully matched, the quantity
Susbscritions about to Expire. When a subscription will expire within less than
3 months, the record is highlighted.
Start Date
Start date of the subscription
End Date
End date of the subscription
The pins table displays a list of all pins. Items in the list contain the status of pins, which can
be satisfied , not satisfied and pending next run .
A pin is satisfied if its system and subscription was matched in the last matcher run.
A pin is not satisfied if its system and subscription was not matched in the last matcher
run. This can happen, for example, if the pin violates terms and conditions for subscrip-
tions.
A pin is in the pending next run state when it needs a new matcher run to be taken into
account. After the new run, the pin will become either satisfied or not satisfied .
Within the Subscriptions Available for Selected System window click the Save Pin button to raise
priority for subscription use on the selected system.
Physical Guest
Physical system is reported as virtual guest, check hardware data
13.3 OpenSCAP
If you click Main Menu Audit OpenSCAP All Scans, an overview of the {openscap} Scans
appears. SCAP (Security Content Automation Protocol) is a framework to maintain the security
of enterprise systems. It mainly performs the following tasks:
For a description of the WebUI dialogs, see Section 14.5, “OpenSCAP SUSE Manager Web Interface”.
For instructions and tips on how to best use OpenSCAP with SUSE Manager, refer to Chapter 14,
System Security via OpenSCAP. To learn more about OpenSCAP, see the project home page at http://
open-scap.org .
197 OpenSCAP
14 System Security via OpenSCAP
SCAP content
SCAP content les defining the test rules can be created from scratch if you understand
at least XCCDF or OVAL. XCCDF content is also frequently published online under open
source licenses and this content can be customized to suit your needs.
The openscap-content package provides default content guidance for systems via a tem-
plate.
Note
SUSE supports the use of templates to evaluate your systems. However, you are creating
custom content at your own risk.
Package Requirements
As Server: SUSE Manager 1.7 or later.
For the Client: spacewalk-oscap package (available from the SUSE Manager Tools Child
Channel).
Other Requirements
Client: Distribution of the XCCDF content to all client machines.
You can distribute XCCDF content to client machines using any of the following methods:
RPMs
Custom RPMs are the recommended way to distribute SCAP content to other machines. RPM
packages can be signed and verified to ensure their integrity. Installation, removal, and verifi-
cation of RPM packages can be managed from the user interface.
4. Fill in the Schedule New XCCDF Scan form. See Section 14.5.2.3, “Schedule Page” for more
information about the elds on this page.
Warning
The XCCDF content is validated before it is run on the remote system. Specifying
invalid arguments can make spacewalk-oscap fail to validate or run. Due to security
concerns the oscap xccdf eval command only accepts a limited set of parameters.
Run the mgr_check command to ensure the action is being picked up by the client system.
mgr_check -vv
Note
If the SUSE Manager daemon ( rhnsd ) or osad are running on the client system,
the action will be picked up by these services. To check if they are running, use:
+
To view the results of the scan, refer to Section 14.4, “Viewing SCAP Results”.
1. To perform an audit scan via API, choose an existing script or create a script for scheduling
a system scan through system.scap.scheduleXccdfScan , the front end API, for example:
#!/usr/bin/python
2. Run the script on the command-line interface of any system. The system needs the appro-
priate Python and XML-RPC libraries installed.
3. Run the mgr_check command to ensure that the action is being picked up by the client
system.
mgr_check -vv
If the SUSE Manager daemon ( rhnsd ) or osad are running on the client system, the action
will be picked up by these services. To check if they are running, use:
or
Via the Web interface. Once the scan has finished, the results should show up on the Audit
tab of a specific system. This page is discussed in Section 14.5, “OpenSCAP SUSE Manager Web
Interface”.
spacewalk-report system-history-scap
spacewalk-report scap-scan
spacewalk-report scap-scan-results
All Scans is the default page that appears on the Audit OpenSCAP page. Here you see all the
completed OpenSCAP scans you have permission to view. Permissions for scans are derived from
system permissions.
For each scan, the following information is displayed:
System
the scanned system.
XCCDF Profile
Completed
time of completion.
Satisfied
number of rules satisfied. A rule is considered to be satisfied if the result of the evaluation
is either Pass or Fixed.
Dissatisfied
number of rules that were not satisfied. A rule is considered Dissatisfied if the result of
the evaluation is a Fail.
Unknown
number of rules which failed to evaluate. A rule is considered to be Unknown if the result
of the evaluation is an Error, Unknown or Not Checked.
The evaluation of XCCDF rules may also return status results like Informational , Not Ap-
plicable , or not Selected . In such cases, the given rule is not included in the statistics on
this page. See System Details Audit for information on these types of results.
XCCDF Di is an application that visualizes the comparison of two XCCDF scans. It shows meta-
data for two scans as well as the lists of results.
Click the appropriate icon on the Scans page to access the di output of similar scans. Alterna-
tively, specify the ID of scans you want to compare.
Items that show up in only one of the compared scans are considered to be "varying". Varying
items are always highlighted in beige. There are three possible comparison modes:
Full Comparison
all the scanned items.
Only Invariant
unchanged or similar items.
Use the Advanced Search page to search through your scans according to specified criteria
including:
rule results,
targeted machine,
Completed
The exact time the scan finished.
Compliance
The unweighted pass/fail ratio of compliance based on the Standard used.
P
Number of checks that passed.
F
Number of checks that failed.
E
Number of errors that occurred during the scan.
U
Unknown.
N
Not applicable to the machine.
S
Not Selected.
I
Informational.
X
Fixed.
Total
Total number of checks.
Each entry starts with an icon indicating the results of a comparison to a previous similar scan.
The icons indicate the following:
"RHN List Alert" Icon — arbitrary differences between the compared scans.
"RHN List Error" Icon — major differences between the compared scans. Either there are
more failures than the previous scan or less passes
"RHN List Check In" Icon — no comparable scan was found, therefore, no comparison was
made.
To nd out what has changed between two scans in more detail, select the ones you are interested
in and click Compare Selected Scans . To delete scans that are no longer relevant, select those
and click on Remove Selected Scans . Scan results can also be downloaded in CSV format.
The Scan Details page contains the results of a single scan. The page is divided into two sections:
File System Path: the path to the XCCDF le used for the scan.
Profile Title: the title of the profile used for the scan.
Command-line Arguments
Optional arguments to the oscap command, either:
If not specified, the default profile is used. Some early versions of OpenSCAP in re-
quire that you use the --profile option or the scan will fail.
--skip-valid : Do not validate input and output les. You can use this option to
bypass the le validation process if you do not have well-formed XCCDF content.
For information about how to schedule scans using the WebUI , refer to Procedure: Scans via the
Web Interface.
Only Configuration Administrators or SUSE Manager Administrators see the Main Menu Con-
figuration pages.
On this configuration pages, manage systems with configuration les, channels offering config-
uration les, and configartion les themselves. Centrally-managed les are available to multiple
systems; locally-managed les are available to individual systems only.
rhncfg — the base libraries and functions needed by all rhncfg-* packages,
rhncfg-actions — the RPM package required to run configuration actions scheduled via
SUSE Manager,
rhncfg-client — the RPM package with a command line interface to the client features
of the Configuration Management system,
rhncfg-management — the RPM package with a command line interface used to manage
SUSE Manager configuration.
Installation of these packages can also be accomplished during bootstrapping if you enable Con-
figuration File Deployment on the Details page of the activation key after creating that
activation key. For more information about activation keys, see Section 7.9.1, “Managing Activation
Keys”.
This list includes les that are managed centrally in configuration channels and les that are
managed locally via individual system profiles.
Configuration Summary
The panel provides quick information about your configuration les. Click the blue text to
the right to display relevant systems, channel details, or configuration les.
Configuration Actions
Configuration Actions offers direct access to the most common configuration manage-
ment tasks. Deploy, compare, or create les on your systems.
213 Overview
File types that can appear here: * — Centrally-managed configuration le provided
1. Click the Create Config Channel link in the upper right corner of this screen.
3. Enter a label for the channel. This eld must contain only alphanumeric characters, "-",
"_", and ".".
4. Enter a mandatory description for the channel that allows you to distinguish it from other
channels. No character restrictions apply.
5. Click the Create Config Channel button to create the new channel.
6. The following page is a subset of the Channel Details page and has three tabs: Overview
, Add Files , and Systems . The Channel Details page is discussed in Section 15.4.1,
“Main Menu Configuration Configuration Channels Configuration Channel Details”.
1. Click the Create State Channel link in the upper right corner of this screen.
3. Enter a label for the channel. This eld must contain only alphanumeric characters, "-",
"_", and ".".
4. Enter a mandatory description for the channel that allows you to distinguish it from other
channels. No character restrictions apply.
7. The following page is a subset of the Channel Details page and has four tabs: Overview ,
List/Remove Files , Add Files , and Systems . The Channel Details page is discussed
in Section 15.4.1, “Main Menu Configuration Configuration Channels Configuration Channel
Details”.
Overview
The Overview page of the Configuration Channel Details page is divided into several
panels.
Channel Information
The panel provides status information for the contents of the channel.
Configuration Actions
The panel provides access to the most common configuration tasks. For Salt minions,
there is a link to edit the init.sls le.
List/Remove Files
This page only appears if there are les in the configuration channel. You can remove les
or copy the latest versions into a set of local overrides or into other central configuration
channels. Check the box next to les you want to manipulate and click the respective
action button.
Add Files
The Add Files page has three subtabs of its own, which allow you to Upload , Import ,
or Create configuration les to be included in the channel.
Upload File
To upload a le into the configuration channel, browse for the le on your local
system, populate all elds, and click the Upload Configuration File button. The File-
name/Path eld is the absolute path where the le will be deployed.
Import Files
To import les from other configuration channels, including any locally-managed
channels, check the box to the left of any le you want to import. Then click the
Import Configuration File(s) button.
Note
Create File
Create a configuration le, directory, or symbolic link from scratch to be included
in the configuration channel.
PROCEDURE: CREATING A CONFIGURATION FILE, DIRECTORY, OR SYMBOLIC LINK FROM SCRATCH
i. Choose whether you want to create a text le, directory, or symbolic link in the File
Type section.
ii. In the Filename/Path text box, set the absolute path to where the le should be
deployed.
iii. If you are creating a symbolic link, indicate the target le and path in the Symbolic
Link Target Filename/Path text box.
iv. Enter the User name and Group name for the le in the Ownership section, and
the File Permissions Mode .
v. If the client has SELinux enabled, you can configure SELinux contexts to enable
the required le attributes (such as user, role, and le type).
vii. Then enter the configuration le content in the File Contents eld, using the script
drop-down box to choose the appropriate scripting language.
viii. Click the Create Configuration File button to create the new le.
Deploy Files
This page only appears when there are les in the channel and a system is subscribed to
the channel. Deploy all les by clicking the Deploy All Files button or check selected les
and click the Deploy Selected Files button. Select to which systems the le(s) should be
applied. All systems subscribed to this channel are listed. If you want to apply the le to
a different system, subscribe it to the channel rst. To deploy the les, click Confirm &
Deploy to Selected Systems.
Systems
Manage systems subscribed to the configuration channel via two subtabs:
Subscribed Systems
All systems subscribed to the current channel are displayed. Click the name of a
system to see the System Details page.
Target Systems
This subtab displays a list of systems enabled for configuration management but not
yet subscribed to the channel. To add a system to the configuration channel, check
the box to the left of the system’s name and click the Subscribe System button.
# /usr/share/rhn/config-defaults/rhn_web.conf
web.maximum_config_file_size = 262144
# /usr/share/rhn/config-defaults/rhn_server.conf
maximum_config_file_size = 262144
# /etc/rhn/rhn.conf
web.maximum_config_file_size=262144
server.maximum_config_file_size=262144
# spacewalk-service restart
This page lists all les currently stored in your central configuration channel. Click the Path of a
le to see its Details tab. Click the name of the Configuration Channel to see the channel’s
Overview tab. Clicking Systems Subscribed shows you all systems currently subscribed to
the channel containing that le. Click Systems Overriding to see all systems that have a local
(or override) version of the configuration le. The centrally-managed le will not be deployed
to those systems.
rhn.system.sid
rhn.system.profile_name
rhn.system.description
rhn.system.hostname
rhn.system.ip_address
rhn.system.custom_info(key_name)
rhn.system.net_interface.ip_address(eth_device)
rhn.system.net_interface.netmask(eth_device)
rhn.system.net_interface.broadcast(eth_device)
rhn.system.net_interface.hardware_address(eth_device)
rhn.system.net_interface.driver_module(eth_device)
To use this powerful feature, either upload or create a configuration le via the Configuration
Channel Details page. Then open its Configuration File Details page and include the
supported macros of your choice. Ensure that the delimiters used to offset your variables match
hostname={| rhn.system.hostname |}
ip_address={| rhn.system.net_interface.ip_address(eth0) |}
Upon delivery of the le to individual systems, whether through a scheduled action in the SUSE
Manager Web interface or at the command line with the SUSE Manager Configuration Client
( mgrcfg-client ), the variables will be replaced with the host name and IP address of the
system as recorded in SUSE Manager’s system profile. In the above example configuration le
the deployed version resembles the following:
hostname=test.example.domain.com
ip_address=177.18.54.7
To capture custom system information, insert the key label into the custom information macro
( rhn.system.custom_info ). For example, if you developed a key labeled “ asset ” you can
add it to the custom information macro in a configuration le to have the value substituted on
any system containing it. The macro would look like this:
asset={@ rhn.system.custom_info(asset) @}
When the le is deployed to a system containing a value for that key, the macro gets translated,
resulting in a string similar to the following:
asset=Example#456
To include a default value, for example, if one is required to prevent errors, you can append it
to the custom information macro, like this:
Note
You will need to perform some manual tasks to enable configuration le deployment.
Follow the on-screen instructions provided to assist with each step.
222 Systems
16 Schedule
Schedule helps with managing actions and combining actions to action chains.
Schedule is located on the left navigation menu and features pages that enable you to manage
the actions carried out on your systems. An action is a scheduled task to be performed on one or
more client systems. For example, an action can be scheduled to apply all patches to a system.
Actions can also be grouped into action chains to schedule them at the same time in a particular
order, for example to reboot a system after deploying patches.
SUSE Manager keeps track of the following action types:
system reboots,
patch application,
remote commands.
The following list of actions may be added to an action chain. These actions are supported
on both traditional clients and Salt minions. Schedulable actions are located under a systems,
System Details page on the following subtabs.
Images Build
In the Action Chain List you can click the label to view or edit an Action Chain . In the top right
corner is the delete action chain link. To add actions to an existing chain, pick up a “chainable”
action (such as running a remote command) from a system details page (see Section 7.3, “System
Details”. Then check Add to Action Chain and select an action chain from the drop-down box.
Confirm with Schedule .
To create a new action chain, configure the rst action, then select Add to Action Chain instead
of Schedule no sooner than . Click the drop-down box, enter a name, and click Schedule to save
the chain. Then proceed to the next action and add it to the new chain.
Action chains can be edited via the Schedule Action Chains page. Click a chain name to see the
actions in the order they will be performed. The following tasks can be carried out here:
Change the order of actions by dragging the respective action to the right position and
dropping it.
Delete actions from the chain by clicking the delete action link.
Delete a single system from an action chain by clicking the delete system link.
Delete the complete action chain with the delete action chain link in the top-left corner.
Schedule an action chain for execution on a certain date by clicking the Save and Schedule
button.
Currently you cannot add an action to an action chain from the Edit section of the action chain
details page. When a Chain is scheduled, the actions it contains will be displayed under Schedule
on the appropriate pages: Pending Actions , Failed Actions or Completed Actions , depending on
the status. If one action fails on a system no other actions from the same chain will be executed
on that systems. Because of technical limitations it is not possible to reuse Action Chains.
Filter by Action — Enter a term to filter the listed actions or use the check boxes in this
column to select actions. Then either add them to your selection list or archive them by
clicking Archive Actions . If you archive a pending action, it is not canceled, but the action
item moves from the Pending Actions list to the Archived Actions list.
Action — Type of action to perform such as Patches or Package Install. Clicking an action
name shows its Action Details page. Refer to Section 16.7, “Action Details” for more informa-
tion.
Scheduled Time — The earliest day and time the action will be performed.
Failed — Number of systems on which this action has been tried and failed.
Total — Total number of systems on which this action has been scheduled.
Refer to Section 17.1.4, “User Details” for detailed descriptions of each tab.
Username — The login name of the user. Clicking a user name displays the User Details
page for the user. Refer to Section 17.1.4, “User Details” for more information.
Real Name — The full name of the user (last name, rst name).
Last Sign In — Shows when the user last logged in to SUSE Manager.
Click the check box to the left of their name and click the Reactivate button then the Confirm
button. Reactivated users retain the permissions and system group associations they had when
they were deactivated. Clicking a user name shows the User Details page.
Here SUSE Manager administrators manage the permissions and activity of all the users. Here
you can also delete or deactivate users.
Users can be deactivated directly in the SUSE Manager Web interface. SUSE Manager admin-
istrators can deactivate or delete users of their organization. Users can deactivate their own
accounts.
Deactivated users cannot log in to the SUSE Manager WebUI or schedule any actions. Actions
scheduled by a user prior to their deactivation remain in the action queue. Deactivated users
can be reactivated by SUSE Manager administrators.
To deactivate a user:
2. Verify that the user is not a SUSE Manager administrator. If they are, uncheck the box to
the left of that role and click the Submit button.
3. Click the Deactivate User link in the upper right corner of the dialog.
To delete a user:
2. Verify that the user is not a SUSE Manager administrator. Uncheck the box to remove the
role if necessary.
3. Click the Delete User link in the upper right corner of the dialog.
For instructions to deactivate your own account, refer to Section 6.7.4, “Account Deactivation”.
The Details tab, displays the user name, rst name, last name, e-mail address, roles of a user,
and other details about the user. The Details tab, displays the user name, rst name, last name,
e-mail address, roles of a user, and other details about the user.
[guimenu]``User (normal user) — Also known as a System Group User, this is the standard
role associated with any newly created user. This person may be granted access to manage
system groups and software channels, if the SUSE Manager administrator sets the roles
accordingly. The systems must be in system groups for which the user has permissions to
manage them. However, all globally subscribable channels may be used by anyone.
SUSE Manager Administrator — This role allows a user to perform any function avail-
able in SUSE Manager .
This tab displays a list of system groups the user may administer; for more information about
system groups, see Section 7.4, “System Groups”.
SUSE Manager administrators can set this user’s access permissions to each system group. Check
or uncheck the box to the left of the system group and click the Update Permissions button to
save the changes.
SUSE Manager administrators may select one or more default system groups for a user. When
the user registers a system, it gets assigned to the selected group or groups. This allows the user
to access the newly-registered system immediately. System groups to which this user has access
are preceded by an (*).
This tab lists all systems a user can access according to the system groups assigned to the user.
Identifies channels the user may manage. To change these, select or deselect the appropriate
check boxes and click the Update Permissions button. The permission to manage channels does not
enable the user to create new channels. Note that channels automatically manageable through
the user’s admin status cannot be altered. These channels are identified with a check icon. Re-
member, SUSE Manager administrators and channel administrators can subscribe to or manage
any channel.
SUSE Manager List Page Size : Maximum number of items that appear in a list on a
single page. If the list contains more items than can be displayed on one page, click the
Next button to see the next page. This preference applies to the user’s view of system lists,
patch lists, package lists, and so on.
CSV Files : Select whether to use the default comma or a semicolon as separator in
downloadable CSV les.
Change these options to t your needs, then click the Save Preferences button.
This tab lists mailing addresses associated with the user’s account.
If there is no address specified yet, click Fill in this address and ll out the form. When finished,
click Update. To modify this information, click the Edit this address button, change the relevant
information, and click the Update button.
For more information, see Section 17.1.4.2, “User Details System Groups”.
The Main Menu Admin pages allows SUSE Manager customers to manage the basic configura-
tion, including creating and managing multiple organizations. Only the SUSE Manager admin-
istrator can access the Main Menu Admin pages.
HTTP Proxy:
If needed configure a proxy server that SUSE Manager will use to access SCC (SUSE Cus-
tomer Center) and other remote servers here. Use hostname:port syntax in the HTTP
Proxy HTTP Proxy Hostname: eld if the proxy port is not 8080. Clearing the elds dis-
ables proxy.
Organization Credentials:
After saving, a new credential card will be displayed. Buttons below the credential card
allow you to:
Check credential validation status (green tick or red cross icon). To re-check the
credential with SCC, click the icon.
Set the primary credentials for inter-server synchronization (yellow star icon).
Search by the product description. The filter limits the search to base products.
Filter by architecture. Click in the search eld (or press Enter ) and then select
from drop-down menu. You can repeat this as often as necessary. To remove an
architecture either click the “x” symbol (or press Backspace ).
Once you have made your selection(s), click Add products in the upper right area.
This is equivalent to running mgr-sync add products or mgr-sync without any
arguments.
View the synchronization progress in the status bar eld to the right.
/var/log/rhn/reposync
Important
Alternatively, you can add listed channels immediately by clicking the Add this
product button in the status column. A progress bar will be displayed. The main
product will expand, and then you may select add-on products belonging to
the product that is currently added. To overview required channels, select the
list icon in the SUSE Products Channels column. Once a product has finished
downloading, the status bar state will change from a lled percentage value
to SUSE Products Finished.
If you click the name of an organization, the Organization Details page appears.
Organization Details Organization Name : String (between 3 and 128 characters). This is
the only value that you can change here. When done, confirm with clicking the Update
Organization button.
Organization Details Active Users : Number. Clicking this number will open the Organization
Details Users tab.
Such a trust allows sharing contents and migrate systems between these two organizations. You
may add a trust by checking the box next to an organization (or remove a trust by unchecking
it) and clicking the Modify Trusts button.
Organization Configuration
When settings are done, confirm with clicking the Update Organization button.
stagingContent=1
stagingContentWindow=24
salt_content_staging_advance: 8 hours
salt_content_staging_window: 8 hours
Note
These parameters will only have an effect when Content Staging is enabled for the tar-
geted Organization.
Default To SSL
For secure communication, use SSL.
Enable SSL
Click the Restart button to restart SUSE Manager and incorporate all of the configuration options
added on the previous screens. It will take between four and ve minutes for a restart to finish.
Note
New systems will be added to the organization of the administrator who enabled this
feature. To change the organization, disable the feature, log in as an administrator of a
different organization and enable it again.
Provisioning can be initiated by clicking the Provisioning tab. In case of bare-metal systems,
though, provisioning cannot be scheduled, it will happen automatically when it is completely
configured and the system is powered on.
It is possible to use Main Menu Systems System Set Manager with bare-metal systems, although
in that case some features will not be available as those systems do not have an operating system
installed. This limitation also applies to mixed sets with regular and bare-metal systems: full
features will be enabled again when all bare-metal systems are removed from the set.
Click Admin ISS Configuration Master Setup. In the top right-hand corner of this page, click
Add New Slave:
Allow Slave to Sync? Selecting this checkbox will allow the slave SUSE Manager to access
this master SUSE Manager. Otherwise, contact with this slave will be denied.
Sync All Orgs to Slave? Checking this eld will synchronize all organizations to the slave
SUSE Manager.
Click Create. Optionally, click any local organization to be exported to the slave SUSE Manager
then click Allow Orgs.
For synchronization timeout settings, see: Book “Best Practices”, Chapter 19 “Troubleshooting”, Sec-
tion 19.4 “RPC Connection Timeout Settings”.
To securely transfer content to the slave servers, the ORG-SSL certificate from the master server
is needed. Click Admin ISS Configuration Slave Setup. In the top right-hand corner, click Add
New Master.
Filename of this Master’s CA Certificate: use the full path to the CA Certificate. For example:
/etc/pki/trust/anchors
Default Master?
Click Add New Master. Once the master and slave servers are configured, start the synchroniza-
tion on the Master server by executing mgr-inter-sync :
mgr-inter-sync -c`YOUR-CHANNEL`
mgr-inter-sync -c`YOUR-CHANNEL`
Click a SUSE Manager Schedules Schedule name to open its Schedule Name Basic Schedule Details
where you can disable it or change the frequency. Click Edit Schedule to update the schedule
with your settings. To delete a schedule, click delete schedule in the upper right-hand corner.
If you click a bunch name, a list of runs of that bunch type and their status will be displayed.
Clicking the start time links takes you back to the Schedule Name Basic Schedule Details.
For example, the following predefined task bunches are scheduled by default and can be con-
figured:
channel-repodata-default:
(Re)generates repository metadata les.
cleanup-data-default:
Cleans up stale package change log and monitoring time series data from the database.
clear-taskologs-default:
Clears task engine (taskomatic) history data older than a specified number of days, de-
pending on the job type, from the database.
cobbler-sync-default:
Synchronizes distribution and profile data from SUSE Manager to Cobbler. For more in-
formation on Cobbler, see Book “Advanced Topics”, Chapter 10 “Cobbler”.
compare-configs-default:
Compares configuration les as stored in configuration channels with the les stored on all
configuration-enabled servers. To review comparisons, click the Main Menu Systems tab
and click the system of interest. Go to Configuration Compare Files. For more information,
refer to: Section 7.3.3.5, “System Details > Configuration > Compare Files”.
cve-server-channels-default:
Updates internal pre-computed CVE data that is used to display results on the Main
Menu Audit CVE Audit page. Search results in the Main Menu Audit CVE Audit page are
updated to the last run of this schedule). For more information, see: Section 13.1, “CVE Audit”.
daily-status-default:
Sends daily report e-mails to relevant addresses. To learn more about how to configure
notifications for specific users, see: Section 17.1.4.5, “User Details Preferences”
errata-cache-default:
errata-queue-default:
Queues automatic updates (patches) for servers that are configured to receive them.
kickstart-cleanup-default:
Cleans up stale kickstart session data.
kickstartfile-sync-default:
Generates Cobbler les corresponding to Kickstart profiles created by the configuration
wizard.
mgr-register-default:
Calls the mgr-register command, which synchronizes client registration data with NCC
(new, changed or deleted clients' data are forwarded).
mgr-sync-refresh-default:
the default time at which the start of synchronization with SUSE Customer Center (SCC)
takes place ( mgr-sync-refresh ).
package-cleanup-default:
deletes stale package les from the le system.
reboot-action-cleanup-default:
any reboot actions pending for more than six hours are marked as failed and associated
data is cleaned up in the database. For more information on scheduling reboot actions,
see: Section 7.3.4.2, “System Details > Provisioning > Power Management”.
sandbox-cleanup-default:
cleans up sandbox configuration les and channels that are older than the sandbox_lifetime
configuration parameter (3 days by default). Sandbox les are those imported from sys-
tems or les under development. For more information, see: Section 7.3.3.3, “System Details
> Configuration > Add Files”
session-cleanup-default:
cleans up stale Web interface sessions, typically data that is temporarily stored when a
user logs in and then closes the browser before logging out.
ssh-push-default:
token-cleanup-default:
deletes expired repository tokens that are used by Salt minions to download packages and
metadata.
Next to the task name you nd the date and time of the last execution and the status.
19.7 Search
The Documentation Search page features a robust search engine that indexes and searches SUSE
Manager documentation.
Users can search the available online documentation and filter them according to the following
choices in the What to Search drop-down box:
Content & Title — Search both the title heading or body content of all available documents.
Free Form — Search documents for any keyword matches, which broadens search results.
Content — Search only the body content of documentation for more specific matches.
Title — Search only the title headings of the documentation for targeted, specific search
results.
The Free Form eld additionally allows you to search using eld names that you prepend to
search queries and filter results in that eld.
267 API
For example, if you wanted to search all of the SUSE Manager manuals for the word Virtual-
ization in the title and install in the content, type the following in the Free Form eld:
If there are several pages of search results, you can limit the amount of visible results shown on
one page by clicking the Display quantity items per page drop-down box, which offers between
10 and 500 results per page.
To move between pages, click the right or left angle brackets (> to go forward or < to go
backward).
268 Search