Install and Configure vRealize Operations Manager 8.2 Part 7 Configure Custom Certificate

In the previous six post’s we went through installing and configuring the vROps virtual appliance, connecting to vCenter server, configuring Window Active directory as an identity source, create custom alerts and notifications, creating dashboards and upgrading the appliance to the latest version.

In this post we will be going through requesting and applying a custom certificate. Configuring a custom cert is good practice from security standpoint and also will stop the security warning when access the vRealize web client.

Adding a certificate requires that there is a internal certificate authority that can be used to issue the certificate or we could use a public CA but there would be a cost to that, in this example we will be using a Windows Server CA.

I used the below VMware kb as reference when creating the cert.

Enabling TLS on Localhost Connections (vmware.com)

Configure a Custom Certificate (vmware.com)

First step is to connect to the vROps appliance using ssh connection and to generate the key file and cert request that will be used to generate the cert.

To enabled ssh go to the admin page and enable the ssh status.

If you have not updated the root password on the appliance already then this require to connect by ssh. To do this open a VM console for the appliance and go to login. The default root password is blank so just hit enter and it will prompt for a new password to be set.

Once the above has been completed, ssh to the vrops server I use putty but any ssh client will work.

After connecting I usually create a folder to keep the key file and cert request to they are simpler to find later if I need them again.

Next we need to generate a key file

openssl genrsa -out key_filename.key 2048

Next run the below command to create the certificate request

openssl req -new -key key_filename.key -out certificate_request.csr

Enter in the details for the cert. These can also be pre creating using a .config file but I just typed them in to the ssh console.

There should now be a key file and cert request in the folder.

Copy the .csr file as this will be used to generate the cert from the internal CA.

To generate the certificate logon on to the Microsoft CA web enrollment page.

Click submit and advanced certificate request.

Click submit a certificate request

Open the .csr file in a text editor and copy the content to certificate request box and select the certificate template to be used.

Click submit and the certificate should be generated. The cert needs to be downloaded as base 64.

Save the cert. The root CA cert also needs to be downloaded

Once all the cert files and key file are created, they now need to be combined to a .PEM format as that is the required format for vrops.

To combine the cert using Windows using the type command. The order the of the cert needs to be server cert, then key file, intermediate cert (if there are any in my case I only have the root cert) , root cert and then the PEM output.

type server_cert.cer key_filename.key cacerts.cer > vrops.pem

The .PEM file should now be created and is ready to be applied to vROps.

The last step is to apply the certificate, logon to the vROps admin page and go to the certificate icon in the top right.

Click Install new certificate.

Click browse and select the pem file we created. If there are no issue with verifying the pem file it should show as ready to install.

Click install to complete. The page should now reload and when we check the cert it should now be using the custom cert.

In the next post we will go through installing the Windows vROps agent and configuring the Windows management pack.

Install and Configure vRealize Operations Manager 8.2 Part 6 Upgrading vROps

In the previous five post’s we went through installing and configuring the vROps virtual appliance, connecting to vCenter server, configuring Window Active directory as an identity source, create custom alerts and notifications and creating dashboards.

Part 1: Install and Configure vRealize Operations Manager 8.2 Part 1 – TheSleepyAdmins

Part 2: Install and Configure vRealize Operations Manager 8.2 Part 2 Connect to vCenter – TheSleepyAdmins

Part 3: Install and Configure vRealize Operations Manager 8.2 Part 3 AD Authentication – TheSleepyAdmins

Part 4: Install and Configure vRealize Operations Manager 8.2 Part 4 Create Alerts and Notifications – TheSleepyAdmins

Part 5: Install and Configure vRealize Operations Manager 8.2 Part 5 Create a Dashboard – TheSleepyAdmins

In this post we will be going through upgrading the vROps appliance to the latest version 8.3. Keeping appliances up to date is good from a security standpoint and also allows for new features and fixes to be applied.

To confirm if the upgraded version of vROps is supported by the existing vCenter version use the VMware interoperability matrix site.

Product Interoperability Matrix (vmware.com)

Once this has been confirmed as supported we will need to download the .pak file that will be used to update the appliance.

To download go the following URL

https://my.vmware.com/en/group/vmware/downloads/info/slug/infrastructure_operations_management/vmware_vrealize_operations/8_3

Select the version and edition required in my case it Enterprise

Select upgrade type we will be upgrading from 8.2 so we will use 8.x, there is also a upgrade assessment tool that can be run to do a pre check.

Once the .pak files has been downloaded we are ready to start the upgrade. We will run the assessment first and view the report then process with the full upgrade.

To access the admin page use /admin at the end of the vROps URl. We can check the current version on the system status page.

https://vropsserver/admin

Go to software update and click install a software update.

Click browse and select the .pak file and click upload

Once the file is uploaded click next

Accept the end user agreement.

Next you can review the update info and the last screen is to install.

The installation should now start, it took about 10 minute to complete.

This image has an empty alt attribute; its file name is image-89.png

Once the assessment is completed, we need to go to the support tab and select support bundles. Click on the download icon to download the zip file.

To view the report click the download and extract the zip file go to \apuat-data\report and click on the index.html.

This image has an empty alt attribute; its file name is image-91.png

If there are no issue reported in the pre assessment we can go ahead with the upgrade.

It is recommend to take a backup of the appliance before upgrading in case there are any issue during the install.

First part of the upgrade is to take the cluster offline, go to the system status page

Once the cluster is offline we can uploaded and apply the .pak file similar to the assessment tool.

Go to software update > Install a software update, select the upgrade pak file and upload.

Follow the wizard to start the upgrade.

The upgrade took 30 minutes to complete and the cluster to come back online. Once fully back online we can confirm that the version is now upgraded to 8.3.

In the next post we will go thorough configuring a custom SSL cert to replace the self singed cert to give better security.

Manage Calendar Permissions in Office 365 PowerShell

I had been asked to update all users calendar permission to allow a certain application to be able to edit users calendar so it can automate adding days off and other calendar items.

Currently the only way this can be done that I know off is either using PowerShell or using MS Graph.

In this post we will be going through how to report calendar permission for all users and how to bulk update. We will be using the exchange online PowerShell module.

https://docs.microsoft.com/en-us/powershell/exchange/exchange-online-powershell-v2?view=exchange-ps#install-the-exo-v2-module

Install-Module -Name ExchangeOnlineManagement

To get the list of mailboxes and permissions we will use two command Get-Mailbox and Get-MailboxFolderPermission. Then we will be formatting the results for export out to a CSV.

To get calendar permission we will need to add :\Calendar to after the UserPrincipalName.

First step is that we need to connect to Exchange Online using PowerShell.

Connect-ExchangeOnline

To get a single user’s permission use

Get-MailboxFolderPermission -Identity user@domain.com:\calendar

To check for a specific users permission we can add the -user parameter.

To get all users permission we need to get a list of all users using Get-Mailbox and then loop through each user to get the permission.

## Get all users mailboxes
$Mailboxes = Get-Mailbox -ResultSize Unlimited | Select-Object UserPrincipalName

## Loop through each mailbox
foreach ($mailbox in $Mailboxes) {

## Get default user calendar permissions
Write-Warning "Checking Permission on $($mailbox.UserPrincipalName)"
Get-MailboxFolderPermission -Identity "$($mailbox.UserPrincipalName):\Calendar" | 
Select-Object @{Name="UserPrincipalName";E={$mailbox.UserPrincipalName}},FolderName,User,AccessRights |
Export-Csv C:\temp\Office_365_Export\Calendar_Report\CalenarPermissionReport.csv -NoTypeInformation -Append
}

The export should look like the below.

Once I had a report of the current users calendar permission, I needed to add the user account that the application would use to add the calendar items.

To add calendar permission we use the Add-MailboxFolderPermission,

The roles that are available, along with the permissions that they assign are below.

Author: CreateItems, DeleteOwnedItems, EditOwnedItems, FolderVisible, ReadItems
Contributor: CreateItems, FolderVisible
Editor: CreateItems, DeleteAllItems, DeleteOwnedItems, EditAllItems, EditOwnedItems, FolderVisible, ReadItems
None: FolderVisible
NonEditingAuthor: CreateItems, FolderVisible, ReadItems
Owner: CreateItems, CreateSubfolders, DeleteAllItems, DeleteOwnedItems, EditAllItems, EditOwnedItems, FolderContact, FolderOwner, FolderVisible, ReadItems
PublishingEditor: CreateItems, CreateSubfolders, DeleteAllItems, DeleteOwnedItems, EditAllItems, EditOwnedItems, FolderVisible, ReadItems
PublishingAuthor: CreateItems, CreateSubfolders, DeleteOwnedItems, EditOwnedItems, FolderVisible, ReadItems
Reviewer: FolderVisible, ReadItems

To add a single user use the command below.

Add-MailboxFolderPermission -Identity user@domain.com:\calendar -User "Account to be added" -AccessRights Editor

I also wanted to be able to run this script again and not have to modify users that already have the correct permission as this will return an error, so we will be using a if statement to only apply to users who don’t have the permission.

Below is the full script.

## Calendar Permission Variable
$Account = "Account to be added"
## Get all users mailboxes
$Mailboxes = Get-Mailbox -ResultSize Unlimited | Select-Object UserPrincipalName

## Loop through each mailbox
foreach ($mailbox in $Mailboxes) {

## Get default user calendar permissions
$permission = Get-MailboxFolderPermission -Identity "$($mailbox.UserPrincipalName):\Calendar"

## Report on Users without correct calendar permissions and set permissions
if ($permission.User.DisplayName  -notcontains $Account) {
Write-Warning "Calender permission not set on $($mailbox.UserPrincipalName) adding Permission"
Add-MailboxFolderPermission -Identity "$($mailbox.UserPrincipalName):\Calendar" -User $Account -AccessRights Editor | Out-Null
} 

## calendar permission are correct
else {Write-Host "Calender Permission are set on $($mailbox.UserPrincipalName)" -ForegroundColor Green}

}

Install and Configure vRealize Operations Manager 8.2 Part 5 Create a Dashboard

In the previous four post’s we went through installing and configuring the vROps virtual appliance, connecting to vCenter server, configuring Window Active directory as an identity source and create custom alerts and notifications.

Part 1: Install and Configure vRealize Operations Manager 8.2 Part 1 – TheSleepyAdmins

Part 2: Install and Configure vRealize Operations Manager 8.2 Part 2 Connect to vCenter – TheSleepyAdmins

Part 3: Install and Configure vRealize Operations Manager 8.2 Part 3 AD Authentication – TheSleepyAdmins

Part 4: Install and Configure vRealize Operations Manager 8.2 Part 4 Create Alerts and Notifications – TheSleepyAdmins

In this post we will be creating a custom dashboard. Dashboard can be used to visual your VMware infrastructure, view performance issue and capacity planning / right sizing. Dashboards are made up of views and widgets.

We can create custom dashboards or clone and existing dashboard and modify that to add addtional view or widgets.

To create a new dashboard logon to the vROps web client > Dashboards > Dashboards > Create Dashboard

Give the dashboard a name and we can toggle between view and widgets using the below button.

Start adding the required views / widgets for the dashboard in this dashboard we are looking for performance related.

First we will add a view list that we will use to create an relationship with the other widgets.

Give the view a name and select if the content should be refreshed or not. Since I want to specify the cluster I will be setting self provider to On. If this is not set to on input data object will be greyed out

Next we need to specify the object under the inventory tree. We will be using vSphere Host and Clusters and the object will be vSphere World.

Under output data we will use cluster utilization.

Click save and output should look like the below.

Once we have the view we can add the addtional widgets and start creating the interactions.

No data will be showing till the Interactions are in place.

After adding in the required widgets and click on show interactions.

Now we just connect the LAB_Cluster view to the other widgets we just added.

Now if we select the cluster view we will have alert volume, health data, scoreboard and object relationship information returned.

If we want to share the dashboard with other users we can select share icon

Click on groups and select the group to be included.

Now share icon should show beside the name of the dashboard.

If there are pre existing dashboard that we want to customize we can clone these by going to Dashboards >> Manage Dashboards, select the dashboard you want to clone, click on the three dots and select clone.

Give the dashboard a name and we can then start to modify.

In the next post we will go through scheduling reports and updating vROps appliance

Install and Configure vRealize Operations Manager 8.2 Part 4 Create Alerts and Notifications

In the previous three post we went through installing and configuring the vROPs virtual appliance, connecting to vCenter server and configuring Window Active directory as an identity source.

Part 1: Install and Configure vRealize Operations Manager 8.2 Part 1 – TheSleepyAdmins

Part 2: Install and Configure vRealize Operations Manager 8.2 Part 2 Connect to vCenter – TheSleepyAdmins

Part 3: Install and Configure vRealize Operations Manager 8.2 Part 3 AD Authentication – TheSleepyAdmins

In this post we will be going through the different alert types and configuring actions bases on certain alerts.

Alerts:

Below are the three types of alert in vROPs:
Health Alerts:
The health alert list is all the generated alerts that are configured to affect the health of your
environment and require immediate attention. You use the health alert list to evaluate,
prioritize, and immediately begin resolving the problems.

Risk Alerts:
The risk alerts list is all the generated alerts that are configured to indicate risk in your
environment. Address risk alerts in the near future, before the triggering symptoms that
generated the alert negatively affect the health of your environment.

Efficiency Alerts:
The efficiency alerts list is all the generated alerts that are configured to indicate problems
with the efficient use of your monitored objects in your environment. Address efficiency
alerts to reclaim wasted space or to improve the performance of objects in your environment.

Each alert type has four different severity types, info, warning, immediate and critical. The can all be configured

To create a custom alert logon to vROPs web client > alerts > Alert Definitions

Click Add, give the alert a name

We will be using virtual machine so we will

select base object type and select vCenter Adapter > virtual Machine

We want to alert on Capacity so click on advanced.

Impact = Health

Criticality = Symptom based

Alert Type & Subtype = Virtualization/Hypervisor : Capacity

Next we need to add the a symptom that will be used to trigger the alert. If there is no symptom that matches what we want to alert on we can create a new symptom. For snapshot there is only greater than 2 days so we will create a new symptom.

We will be using Virtual Machine: Disk space > Snapshot > Age (Days) and set the value to greater than 5 days.

We can set a recommendation that already exists to not keep snapshots over 72 hours or create a custom recommendation.

We can also apply a policy we will use the default policy.

Complete the wizard to create the new alert.

Next we will configure an email notification instance to allow alerts to be emailed.

Go to Administration > Outbound Settings > Add

Added in the email servers settings.

Click test to validate the mail flow is working.

Click save to to complete.

Once we have the outbound email instance configured, we can setup alerts to send emails notifications.

I created a new alert for Powered off VM so it would be easier to get a alert to trigger to test the email notification.

Go to Alerts > Notification

Next add in the details and select the email instance we setup earlier. I will be alerting for when LAB-Linux01 is powered off so will use object and specify the VM name and alert definition.

Click save to create the notification.

Now once the VM is powered off we will get an notification.

In the next post we will be going through creating a dashboard.