IBM Spectrum Scale GUI Beta Installation

This guide provides detailed instructions for the IBM Spectrum Scale GUI installation process.

Current Version Number: 4.2

Date: 02/03/2016

Contact:
gpfs@de.ibm.com

1 Product Introduction.................................................................................................................................. 4
2 Functional Scope of the Beta.................................................................................................................... 5
3 Known GA Product Limitations................................................................................................................. 7
4 Known Issues & Work Arounds with the Beta delivery..............................................................................8
5 Installation Overview............................................................................................................................... 10
6 Installation Prerequisites......................................................................................................................... 10
Operating System requirements.............................................................................................................10
IBM Spectrum Scale Installation and configuration................................................................................10
YUM Repository Setup............................................................................................................................11
NTP Setup...............................................................................................................................................11
7 Packaging Overview and Extraction....................................................................................................... 12
8 GUI Login................................................................................................................................................ 20
9 Using the GUI......................................................................................................................................... 21
IBM Spectrum Scale GUI -Overview Mode ........................................................................................21
10 Using the Performance monitoring and the GUI...................................................................................23
11 Additional Notes.................................................................................................................................... 24
12 Active Directory setup for the GUI......................................................................................................... 25
Modifying the GUI servers server.xml.................................................................................................25
Disabling the internal user repository.................................................................................................25
Adding the LDAP/AD feature to WebSphere Liberty..........................................................................25
Configuring the LDAP/AD repository using the <ldapRegistry> element...........................................25
Specifying the LDAP group to GUI role mapping...............................................................................27
Viewing and modifying existing group to role mappings....................................................................27
Creating a group to role mapping for initial access............................................................................27
13 Configuring further group to role mappings using the Spectrum Scale GUI.........................................28
Troubleshooting................................................................................................................................ .31
Configure tracing.............................................................................................................................. .31
14 Generating a trusted SSL certificate for secure browsing .................................................................32
15 Appendix: Protocol (CES) node installation .........................................................................................34
16 Browser Support Statement.................................................................................................................. 35
17 Glossary................................................................................................................................................ 36

1 Product Introduction
IBM Spectrum Scale GUI Beta and Open Beta version 4.2.1-beta* ( * the actual version number starting with 2)
delivery includes the Beta version of the IBM General Parallel File System (IBM Spectrum Scale) GUI version
which is an alternative management tool instead of using IBM Spectrum Scale CLI commands of the Advanced
edition of the IBM Spectrum Scale product.
The purpose for this beta is to get early feedback from you:
-

Whether the GUI helps you to achieve management and monitoring tasks.

Whether the features and functions of the GUI are easy and intuitive to use.

What missing or additional features of the GUI you see.

Whether you encountered any issues during your tests.

If you are interested in testing the beta version of the GUI, the GUI node has to run RHEL7.x or SLES12 as the
operating system on Power ppc64 (Big or Little Endian) or Intel X86_64. Although the other nodes in the IBM
Spectrum Scale cluster could be on other platforms and operating systems.
Note that like IBM Spectrum Scale, the GUI serving functionality is also delivered (only) as software. The intent of
the functionality is to provide access to data managed by IBM Spectrum Scale via additional access methods.
The management of IBM Spectrum Scale serving functions in the Beta release is using the CLI installed with a base
IBM Spectrum Scale installation. The use of most of these CLI commands will require root/administrative access
but in the GUI we have role based access for use of the GUI. To some extend the CLI support
Delivery model
Customer provides a Spectrum Scale cluster with minimum release level>=4.1.0
This cluster might be a production or an evaluation cluster
Customer provides a dedicated node to install and run the GUI
This node needs to run Spectrum Scale 4.1.0-8 or 4.1.1-1 or 4.2.-beta or 4.2.0.0 on RHEL 7.x or
SLES12. Best is the latest GA version 4.2.0-1
Customer is responsible to obtain licenses for all Spectrum Scale nodes
No additional license is required for the GUI itself
Performance Tool as monitoring tool is part of the GUI rpm and will be installed by the this rpm with the rpm install
commands but the Performance Tool Sensors and Collectors are separated rpm files which needs to be installed.
Earlier Beta program customers just need to update the GUI rpm and the Performance Tool Collector rpm files, the
sensors collecting the performance data do not need to be updated.
Customers who have a Base IBM Spectrum Scale 4.2.0.0 installed may stay on this version but will face some issues
not fixed with this release.
We seek feedback from Beta customers on the functions described in the following section and also would like to
learn which aspects of your workload work as expected in this delivery and what enhancements you would like to
see in the future.

2 Functional Scope of the Beta

The following versions of IBM Spectrum Scale GUI software packages are included in the IBM Spectrum Scale
GUI 4.2.1-beta package. It is a rpm file with WLP and Java included.

Websphere Liberty Profile v8.5.5.6 ( WLP )

Performance Tool Sensor and Collector rpm files (separate rpm files)

GUI web service installed in the WLP GUI directory: /opt/ibm/wlp/usr/servers/gpfsgui

Management of IBM Spectrum Scale objects:

View of file system and pools and configuration and capacity

View and manage file sets, snapshots and quotas

Modify NFSV4 ACLS

Management of ILM policies

Management of NFS and CIFS protocols

Management of object accounts, containers, users and roles ( with a later code patch )

Monitoring

Collect performance data via pmsensors/ pmcollector agents

Display performance data and store performance queries

Arrange performance and health data in a configurable dashboard

Monitor capacity of file systems, file sets, user and group quotas

Display system health events

Display the protocol states for NFS and CIFS and Object

Directed Maintenance Procedures to recover from certain health events

Configuration of email notifications

Other

Role based access control for GUI users

Integrated contextual help for all menu items and link to the IBM Spectrum Scale Knowledge Center for
advanced help

Downloading dump files for defect analysis

AD / LDAP GUI user configuration ( new )

Changing the SSL certificate (new)

Specific areas of interest:

Dashboard:
Which additional type of information are you missing in the dashboard?
How would be a standard dashboard view that you configure for your system look like?
Performance:
Which performance metrics are you missing?
Would you require a different type of aggregation?
Which granularity are you expecting?
Health Events and DMPs:
Did you run into any health issues where you would have expected the Gui would have informed you?
Which directed maintenance procedures are missing?
Capacity monitoring:
Is the available capacity monitoring suitable for your need?
If not, which additional capacity reports would you expect?
Object , NFS and CIFS protocol:
Are the information and feature as expected ?
Is the usability of the panels satisfy your needs?
Scalability:
for up to 1K nodes (1k =1024 nodes).
Is the usability of the panels with many nodes still OK ?
Are there panels or functions you feel they are to slow or even times out ?

3 Known GA Product Limitations

Limitation

Description

Comments

Filesystem (FS) creation

The Beta version does not support FS creation with the

GUI

Today use the CLI to

create a file system
( mounting the FS works
in the GUI) also changing
file system options.

1024 node limitation

The current testing was done only on for 1024 (1K) node
systems within IBM and so the test statement is we can
only support a cluster with 1024 nodes and provide no
warranty if you use the GUI with more nodes.

In the previous Beta

program support was for
limited to 128 nodes .

Snapshot deletion period is Actually the snapshot deletion happens once a day at 02:30 Under discussion if more
1 in 24 hours only.
in the night to prevent the bad impact on the performance often snapshots should be
of the cluster. Due to this limitation it is possible that there deleted.
is discrepancy between number of snapshots present on the
system and the number that should remain according to
the snapshot retention rules.

Mixed ESS (RAID)

/Spectrum Scale setup

Do not setup a CES node on a ESS

This does not work ,

please read the related
Knowledge-center for
more details.

4 Known Issues & Work Arounds with the Beta delivery

During the beta testing we found some issues we decided they should not gating the beta update. With the next
update, most likely beginning of March , we will fix those issues. The Inspector the issues are mainly related ( 2-4)
is prototype code we are looking for early feedback if the design is OK or if you have proposals for changes.
Most important is one issue we found when a user initially log in to the GUI. With the new feature of user specific
dashboard(s) configuration a user must specify a name for the dashboard , otherwise you can not continue to show
the GUI dashboard. The issue is that no information or help is shown that the name is required but if not added the
'OK' button keeps being disabled and the 'Cancel' button is not shown so you can't proceed and just cancel the
session. You can add any name of your choice but we suggest a meaningful name as you can store multiple ones.
Should not look like Picture 1:

Should look like , Picture 2:

The Cancel button is only displayed once you have at least one dashboard defined. On initial
display you are required to define a new dashboard.
A summary of the changes:
- multiple dashboards can be created, all of them will be visible to all users

the dashboard creation dialog now requires a name

- the same dialog cannot be cancelled if accessing the GUI for the first time
- the menu (...) has two new options: Create dashboard and Delete dashboard, should be selfexplanatory
- if more than one dashboard is available/defined, an arrow appears on the right side of the title;
clicking the title will open a dropdown menu which allows you to switch between dashboards
2)
The Inspector panels does not show the IBM Spectrum Scale state correctly if no CES
node was configured. The shown status 'starting' but should be started.
Mtigation: Use the CLI command to show the status or configure a CES node and restart the GUI.
3)
If make a change in the Inspectore node panel a change of the IBM Spectrum Scale state or
CES state is not shown immediatly. No mitgation for this issue available.
4)
The Inspector panels the amount of shown client nodes can be incorrect. The root cause is
investgated.

5 Installation Overview
The steps of the installation are listed here to provide an overview how to setup the GUI and some related
components so the system works well.
Make sure the cluster is healthy and all prerequisites are installed. You can use a platform specific installer or direct
rpm installation.
The GUI uses the IBM Java version 8 and IBM Websphere Liberty 8.5.5.7 but both are included in the GUI rpm.

6 Installation Prerequisites
This section describes the installation prerequisites that must be met to use the installation toolkit.
We depend on the postgre server pre-installed. We use the postgresql-server-9.4.1201 version we access with a
jdbc driver. If you use the YUM installation commands the dependency is automatically resolved by YUM. If you
use the rpm based installation you must take care by yourself if it is installed.
The Performance Collector must be installed on the GUI node as the GUI accesses it using the localhost
configuration by default.
IBM Spectrum Scale 4.2 must be installed to use the full range of capabilities.
The IBM Spectrum Scale Installation takes care for the Spectrum Scale and Performance Tool installation but maybe
not for the Postgres database installation.

Operating System requirements

The Red Hat 7 or any other described operating operating system must be loaded on all nodes that will be designated
as GUI nodes.
On any other cluster node all operating systems are discovered and displayed by the GUI which are supported by
IBM Spectrum Scale.

IBM Spectrum Scale Installation and configuration

General Parallel File System (IBM Spectrum Scale/GPFS before) must be installed on every IBM
Spectrum Scale GUI node you want to run a GUI service in your system.
More information about the 4.2.0.0 version you find in the IBM knowledge center.
IBM Knowledgecenter for IBM Spectrum Scale 4.2
A IBM Spectrum Scale cluster is a prerequisite. If this infrastructure does not already exist, you must
install the IBM Spectrum Scale software, create a IBM Spectrum Scale cluster and create a file system.
NO FS creation wizard is implemented so far in the GUI.
The IBM Spectrum Scale file system (FS) must be created and mounted on the IBM Spectrum Scale GUI node to
run mm-commands this is needed by the GUI. The GUI starts without a FS created or mounted but then many

functions does not work. To use the GUI with all features use the cli to create a FS if not done before and mount it or
mount it later after logged in to the GUI on the FS view.

YUM Repository Setup

You can use a repository like yum to manually install the GUI rpm files.
Further Yum Repository information is available within Red Hat documentation for example:
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System_Administrators_Guide/secConfiguring_Yum_and_Yum_Repositories.html

This is the preferred way of installation as YUM checks the dependencies and automatically installs missing
platform dependencies like the postgres module we do not ship but require.
How to setup the GUI with YUM you see in chapter 7.

NTP Setup
It is recommended that Network Time Protocol (NTP) be configured on all nodes in your system to ensure that all of
the nodes clocks are synchronized. Clocks that are not synchronized will cause debugging issues and authentication
problems with the protocols. Here is an example of enabling NTP on a node. We suggest to setup a Linux NTP
server as described here. Another OS was not tested if that works.

10

1)

# yum install -y ntp

2)

# ntpdate <NTP server IP>

3)

Update the ntp.conf on any server before the NTP daemon is enabled.Refer to the man
page for details about the configuration. You find it usually at /etc/ntp.conf.

4)

# systemctl enable ntpd

5)

# systemctl start ntpd

6)

# timedatectl list-timezones

7)

# timedatectl set-timezone

8)

# systemctl enable ntpd

7 Packaging Overview and Extraction

The Spectrum Scale GUI package consists of the following components:

IIBM Spectrum Scale GUI rpm including IBM Websphere Liberty Profile and IBM Java 8 JRE.

The GUI rpm is necessary to begin the GUI installation.

Performance monitoring tool rpm files are necessary to enable the performance monitoring tool in the GUI.

The Performance Tool Collector rpm ( only on collector nodes / gui nodes)

The Performance Tool Sensor rpm ( on all nodes to be monitored)

Downloading and unpacking the software

Obtain from your IBM customer advocate the IBM Spectrum Scale GUI and Performance Tool package
or download it by yourself.

RHEL 7.x x86

gpfs.gui-4.2.1_beta-2.l7.x86_64.rpm (X is the counter

for the latest version starting with 1)

RHEL 7.x ppc64 (big endian)

gpfs.gui-4.2.1_beta-2.el7.ppc64.rpm (X is the counter

for the latest version starting with 1)

RHEL 7.x ppc64le (little endian)

gpfs.gui-4.2.0_beta-2.el7.ppc64le.rpm (X is the counter

for the latest version starting with 1)

SLES12 x86

gpfs.gui-4.2.0_beta-2.sles12.x86_64.rpm (X is the
counter for the latest version starting with 1)

SLES12 ppc64le (little endian)

gpfs.gui-4.2.0_beta-2.sles12.ppc64le.rpm (X is the
counter for the latest version starting with 1)

RHEL 7.x X86

gpfs.gss.pmcollector-4.2.0-1.el7.x86_64.rpm
gpfs.gss.pmsensors-4.2.0-1 .el7.x86_64.rpm

RHEL 7.x ppc64

gpfs.gss.pmcollector-4.2.0-1 .el7.ppc64.rpm
gpfs.gss.pmsensors-4.2.0-1 .el7.ppc64.rpm

RHEL 7.x ppc64 LE

11

gpfs.gss.pmcollector-4.2.0-1 .el7.ppc64le.rpm

gpfs.gss.pmsensors-4.2.0-1 .el7.ppc64le.rpm
SLES12 X86

gpfs.gss.pmcollector-4.2.0-1 .SLES12.x86_64.rpm
gpfs.gss.pmsensors-4.2.0-1 .SLES12.X86_64.rpm

SLES12 ppc64

gpfs.gss.pmcollector-4.2.0-1 .SLES12.ppc64.rpm
gpfs.gss.pmsensors-4.2.0-1 .SLES12.ppc64.rpm

SLES12 ppc64 LE

gpfs.gss.pmcollector-4.2.0-1 .SLES12.ppc64le.rpm
gpfs.gss.pmsensors-4.2.0-1 .SLES12.ppc64le.rpm

SLES11 ppc64 (sensor only)

gpfs.gss.pmsensors-4.2.0-1 .SLES11.ppc64.rpm

Debian sensor packages

gpfs.gss.pmsensors_4.2.0-1 .U14.04_amd64.deb
gpfs.gss.pmsensors_4.2.0-1 .U12.04_amd64.deb
gpfs.gss.pmsensors_4.2.0-1 .D7.6_amd64.deb
gpfs.gss.pmsensors_4.2.0-1 .D6.0.10_amd64.deb

RHEL6 ppc64 /x86 ( was not packaged in the gpfs.gss.pmsensors-4.2.0-1.el6.ppc64

GA version of 4.2.0) sensor files. In case you
have RHEL 6 nodes in your cluster you want gpfs.gss.pmsensors-4.2.0-1.el6.x86_64
monitor.

The rpm files should be placed on the node that will run the installation. Only the ones for the specific
platform are needed.

Completion criteria for the installation:

The completion criteria is that after extracting all GUI code to the installation node the packages are
extracted to: /usr/lpp/mmfs/4.2.1_beta-2/ and the GUI service was started successfully and you are able to
access the GUI after the installation completed with the web browser.

12

Using the GUI rpm to install the GUI

1. Ensure that the prerequisites defined in Installation Prerequisites section are satisfied.
2. Obtain the rpm files and place it in a node that will be used for the installation. The node can be part

of your IBM Spectrum Scale cluster or IBM Spectrum Scale client node of the cluster.
3. Make sure the Performance Tool Collector runs on the same node as the GUI.

4. Installation
The preferred way to install the performance tool changed with the GA version of Spectrum Scale 4.2.0. The big
advantage is especially on larger systems that the installer takes care about the distribution to all nodes on RHEL7.
On RHEL 6 and SLES you can use the mmperfmon command to install and configure the the performance tool as
well. But there is a packaging issue on the GA version of Spectrum Scale 4.2.0 so you need to manually install the
RHEL 6 libraries for the pmsensors file.
You can also manually install the rpm files but must run the commands on all nodes you want to monitor or to be a
collector node. The GUI can run on up to 3 nodes must have a performance collector installed locally. The following
commands will install the pmsensors on each node in your cluster. The sensor configuration file will get stored in
the Spectrum Scale back-end.

a) /usr/lpp/mmfs/bin/mmperfmon config generate --collectors <collector_node_name>

b) /usr/lpp/mmfs/bin/mmchnode --perfmon -N <sensor_node_list>

Yum Install commands

RHEL
yum install gpfs.gss.pmsensors-4.2.0-1.el7.<arch>.rpm ?
yum install -ivh gpfs.gss.pmcollector-4.2.0-1.el7.<arch>.rpm
yum -ivh gpfs.gui-4.2.1_beta-2.el7.<arch>.rpm
SLES
zypper install gpfs.gss.pmsensors-4.2.0-1.SLES12.<arch>.rpm
zypper install gpfs.gss.pmcollector-4.2.0-1.SLES12.<arch>.rpm

13

zypper install gpfs.gui-4.2.1_beta-2.el7.<arch>.rpm

RPM based installation

RHEL
rpm -ivh gpfs.gss.pmsensors-4.2.0-1.el7.<arch>.rpm
rpm -ivh gpfs.gss.pmcollector-4.21.1-2.el7.<arch>.rpm
rpm -ivh gpfs.gui-4.2-0.el7.<arch>.rpm
SLES
zypper -ivh gpfs.gss.pmsensors-4.2.0-1.SLES12.<arch>.rpm
zypper -ivh gpfs.gss.pmcollector-4.2.0-1.SLES12.<arch>.rpm
zypper -ivh gpfs.gui-4.2.1_beta-2.el7.<arch>.rpm

The sensor rpm must be installed on any additional node you want to monitor. All senors must point to the
Collector node.

5. Installation adjustments
The Performance Tool is installed into /opt/IBM/zimon.
If you upgrade-only but you want to clean up the old collector data you must stop the collector service
and remove the /data directory under opt/IBM/zimon and start the pmcollector service again.
If you upgrade-only but you want to clean up the old collector data you must stop the collector service and run
following commands.
The Zimon configuration can be removed from the system. You have to remove the rpm files and cleanup the
configuration.

call
call

'rpm -e --nodeps gpfs.gss.pmsensors-4.2.0-1.el7.x86_64'

'rpm -e --nodeps gpfs.gss.pmcollectors-4.2.0-1.el7.x86_64'

Delete the configuration by entering the following commands.

14

call 'mmchnode --noperfmon -N all'

call 'mmperfmon config delete all'
The sensor configuration file "ZIMonSensors.cfg" controls which sensors are activated and also sets the reporting
interval of each sensor. By setting the reporting interval to -1, a sensor is disabled. A positive number defines the
reporting period in seconds. The smallest possible period is once per second.
An update of the sensor values ( period ) in the configuration file is needed using the mmperfmon command so the
update is propagated to all nodes. If you just change the configuration manually in the configuration file it can be
overwritten by the Cluster Configuration Repository ( CCR).

mmperfmon config update <sensorname>.period=<value>

Example:
/usr/lpp/mmfs/bin/mmperfmon config update GPFSFilesetQuota.period=86400
The collector configuration file "ZIMonCollector.cfg" defines the number of aggregation levels and the maximum
amount of memory that is used. By default, 3 domains are created: A raw domain that stores the metrics
uncompressed, a first aggregation domain that aggregates data to 1 minute averages and a second aggregation
domain that stores data in 15-minute averages. Each domain can be configured with the amount of memory used by
the in-memory database of the Performance Monitoring and also the maximum file size and number of files used to
store the data on disk.
By default, the sensor unit reports to a collector running on "localhost". If this is not the case change the sensor
configuration to point to the collector IP address.
After this changes the pmsensor service must be started again.

systemctl restart pmsensors

6. Initialization
The following command starts the Performance Tool if it is already correctly configured (must be done first):
systemctl start pmcollector ( only on the collector node or nodes)
systemctl start pmsensors ( on all sensor nodes)
f you have not configured the performance tool on your cluster so far you might encounter the message that the
service was not found.
To resolve this problem, first configure the GPFS cluster for the performance tool using the mmperfmon GPFS
command is described before. This step requires that the set of collector nodes is provided (insert their hostname or
IP address instead of [COLLECTOR_NODE_NAMES]):
mmperfmon config generate --collectors [COLLECTOR_NODE_NAMES]
Then enable the sensors on the cluster using the "mmchmode command. This will configure and start the
Performance Tool sensors on the given nodes (make sure pmsensors is already installed on all sensor nodes!):

15

mmchnode --perfmon -N [SENSOR_NODE_LIST]

[SENSOR_NODE_LIST] is a comma separated list of the sensor nodes hostnames or IP addresses without any
spaces between them.

In case this does not work, you can manually configure the performance tools sensor nodes by editing the file :
/opt/IBM/zimon/ZIMonSensors.cfg on all sensor nodes. Add the host name or IP address of the node running the
collector in this section:
collectors = {
host = "[HOSTNAME or IP ADDRESS]"
port = "4739"
}
This specifies the collector to which the sensor is reporting. Then try starting the sensor on every sensor node again
with:

systemctl start pmsensors

After configuring the performance tool you can start the IBM Spectrum Scale GUI .The following command starts
the IBM Spectrum Scale GUI:
systemctl start gpfsgui

To make sure the GUI and Performance Tool gets started on boot, run this command to enable it:
systemctl enable gpfsgui.service
systemctl enable pmsensor.service
systemctl enable pmcollector.service

7. Check the GUI and Performance Tool status

On the command line of the node the GUI was installed you can check the GUI service is up and running.
A typical output looks like this:
systemctl status gpfsgui.service
gpfsgui.service - IBM_GPFS_GUI Administration GUI
Loaded: loaded (/usr/lib/systemd/system/gpfsgui.service; disabled)
Active: active (running) since Fri 2015-04-17 09:50:03 CEST; 2h 37min ago
Process: 28141 ExecStopPost=/usr/lpp/mmfs/gui/bin/cfgmantraclient unregister (code=exited, status=0/SUCCESS)
Process: 29120 ExecStartPre=/usr/lpp/mmfs/gui/bin/check4pgsql (code=exited, status=0/SUCCESS)

16

Main PID: 29148 (java)

Status: "GSS/GPFS GUI started"
CGroup: /system.slice/gpfsgui.service
29148 /opt/ibm/wlp/java/jre/bin/java -XX:MaxPermSize=256m -Dcom.ibm.gpfs.platform=GPFS
-Dcom.ibm.gpfs.vendor=IBM -Djava.library.path=/opt/ibm/wlp/usr/servers/gpfsgui/lib/
-javaagent:/opt/ibm/wlp/bin/tools/ws-javaagent.jar -jar /opt/ibm/wlp/bin/tools/ws-server.jar gpfsgui --clean
Apr 17 09:50:03 server-21.localnet.com java[29148]: Available memory in the JVM: 484MB
Apr 17 09:50:03 server.localnet.com java[29148]: Max memory that the JVM will attempt to use: 512MB
Apr 17 09:50:03 server.localnet.com java[29148]: Number of processors available to JVM: 2
Apr 17 09:50:03 server.localnet.com java[29148]: Backend started.
Apr 17 09:50:03 server.localnet.com java[29148]: CLI started.
Apr 17 09:50:03 server.localnet.com java[29148]: Context initialized.
Apr 17 09:50:03 server.localnet.com systemd[1]: Started IBM_GPFS_GUI Administration GUI.
Apr 17 09:50:04 server.localnet.com java[29148]: [AUDIT ] CWWKZ0001I: Application / started in 6.459
seconds.
Apr 17 09:50:04 server.localnet.com java[29148]: [AUDIT ] CWWKF0012I: The server installed the following
features: [jdbc-4.0, ssl-1.0, localConnector-1.0, appSecurity-2.0, jsp-2.2, servlet-3.0, jndi-1.0, usr:FsccUserRepo,
distributedMap-1.0].
Apr 17 09:50:04 server-21.localnet.com java[29148]: [AUDIT ] CWWKF0011I: ==> When you see the service
was started anything should be OK !

Performance Tool status:

systemctl status pmcollector
systemctl status pmsensors

You can also check if the Performance Tool backend can receive data by using the GUI or alternative by
using a Performance Tool command line tool called zc located in /opt/IBM/zimon
Usage:
echo "get metrics mem_active, cpu_idle, gpfs_ns_read_ops last 10 bucket_size 1" | ./zc 127.0.0.1
Result example:
1:
server-21.localnet.com|Memory|mem_active
2:
server-22.localnet.com|Memory|mem_active
3:
server-23.localnet.com|Memory|mem_active
4:
server-21.localnet.com|CPU|cpu_idle
5:
server-22.localnet.com|CPU|cpu_idle
6:
server-23.localnet.com|CPU|cpu_idle
7:
server-21.localnet.com|GPFSNode|gpfs_ns_read_ops
8:
server-22.localnet.com|GPFSNode|gpfs_ns_read_ops
9:
server-23.localnet.com|GPFSNode|gpfs_ns_read_ops
Row Timestamp
mem_active
mem_active mem_active
cpu_idle
cpu_idle
cpu_idle
gpfs_ns_read_ops
gpfs_ns_read_ops gpfs_ns_read_ops
1
2015-05-20 18:16:33 756424 686420 382672 99.000000
100.000000 95.980000
0
0
2
2015-05-20 18:16:34 756424 686420 382672 100.000000 100.000000 99.500000
0
0
3
2015-05-20 18:16:35 756424 686420 382672 100.000000 99.500000
100.000000
0
6
4
2015-05-20 18:16:36 756424 686420 382672 99.500000
100.000000 100.000000
0
0

17

0
0
0
0

5
0
6
0
7
0
8
0
9
0
10
0

18

2015-05-20 18:16:37
0
2015-05-20 18:16:38
0
2015-05-20 18:16:39
0
2015-05-20 18:16:40
0
2015-05-20 18:16:41
0
2015-05-20 18:16:42
0

756424 686520 382672 100.000000

98.510000

100.000000

774456 686448 384684 73.000000

100.000000

96.520000

784092 686420 382888 86.360000

100.000000

52.760000

786004 697712 382688 46.000000

52.760000

100.000000

756632 686560 382688 57.580000

69.000000

100.000000

756460 686436 382688 99.500000

100.000000

100.000000

8 GUI Login
To access the GUI, open your web-browser and enter "https://<server-url>". You should get the login page below.
The default account is "admin/admin001". You should change it after you logged in when you run in production or
more users share the access. Before you log-in we will show a message that the GUI is initialized. At the first time
this takes some time.

19

9 Using the GUI

After you logging in successfully you see the GUI Dashboard as welcome screen (example).

IBM Spectrum Scale GUI -Overview Mode

The new implemented dashboard replaces the previous system view as overview after the log-in to the GUI. At start
up the user is asked which layout he/she wants to use. The user can change this later very flexible to his/her personal
preferences.
New widgets can be added from a list of predefined ones and also metrics can be added or changed which are
predefined. The changes are stored in the browser so that after log in again they are kept.
This causes the GUI to look different in case of different browser windows are used.

From here you can move to the menu and select an alternate sub menu ore menu item.

20

Each menu item typically contains a link to the contextual help which provides you some additional help
information for the selected operation. This can be a link in some of the widgets or the round button in the upper
right corner of the menu bar (see the next screen-shot).
Picture which shows the mentioned button:

21

10 Using the Performance monitoring and the GUI

The performance tool used has been extended and is now showing also protocol CIFS and NFS metrics.

A help menu for the performance monitoring you can find in the contextual help of the GUI or in the IBM
Knowledge Center.
https://www01.ibm.com/support/knowledgecenter/STXKQY_4.2.0/com.ibm.spectrum.scale.v4r2.ins.doc/bl1ins_introtogui.htm?
lang=en
The GUI integrates different metrics to monitor the performance of file systems and block storage.
The performance tool charting area allows panning (click and drag the chart or the time-line control at the bottom)
and zooming (mouse wheel or resizing the time-line control). Two charts can be displayed side by side, in order to
compare different objects/metrics or different time periods of the same chart. More details you find in the contextual
help for this topic.

A list of available sensors you find only in the IBM Knowledge Center:
https://www01.ibm.com/support/knowledgecenter/STXKQY_4.2.0/com.ibm.spectrum.scale.v4r2.adv.doc/bl1adv_listofmetricsP
MT.htm?lang=en .

More information about the monitoring tool you find in the IBM Knowledge Center:
https://www01.ibm.com/support/knowledgecenter/STXKQY_4.2.0/com.ibm.spectrum.scale.v4r2.adv.doc/bl1adv_PMToverview.
htm?lang=en

22

11 Additional Notes
To enforce discovery of cluster components manually:
Call: '/usr/lpp/mmfs/gui/cli/lscluster'
Cluster id
Name
Primary server Secondary server Profile Mode
8393575977173099624 GSS.cluster.com gss01.cluster.com gss02.cluster.com unknown normal
EFSSG1000I The command completed successfully.
To clean up the database after an incompatible update:
The GUI must be stopped for the cleanup and restarted afterward.
Call: 'psql postgres postgres -c "drop schema fscc cascade"'
Whenever the cluster was recreated on a IBM Spectrum Scale level (and thus the clusterid changed) the database
MUST be cleaned up otherwise the GUI will display outdated data from the internal database of the old cluster id
and ignore the new data with the new cluster id ! You also must not change the Zimon configuration files directly as
they get overwritten when the node is synchronized with the central data store. Use the mm-commands instead.
To cleanly remove the GUI :
Call following sequence of commands:
1. systemctl stop gpfsgui
2. psql postgres postgres -c "drop schema fscc cascade"
3. systemctl stop pmcollector
4. yum remove gpfs.gss.gui gpfs.pmsensors*
5 .yum remove gpfs.gss.gui gpfs.collector*

and on ALL nodes:

systemctl stop pmsensors
yum remove gpfs.gss.pmsensors*

Cleanup the configuration by entering the following commands.

mmchnode --noperfmon -N all

mmperfmon config delete --all

After the cleanup you run the installation process again as described above in the install chapter.

23

12 Active Directory setup for the GUI

Modifying the GUI servers server.xml
By default, Spectrum Scale uses an internal authentication repository. In order to use an external AD or LDAP
server, the internal user repository needs to be disabled and the LDAP/AD repository has to be enabled.

Disabling the internal user repository

Access the server that is running the GUI and open /opt/ibm/wlp/usr/servers/gpfsgui/server.xml using a text editor
Comment out the two elements referring to the FsccUserRepo/Registry as seen in bold below:
<server description="GSS GUI">
<featureManager>
<feature>jsp-2.2</feature>
<feature>localConnector-1.0</feature>
<feature>jdbc-4.0</feature>
<feature>ssl-1.0</feature>
<feature>servlet-3.0</feature>
<feature>appSecurity-2.0</feature>
<!-- <feature>usr:FsccUserRepo</feature> -->
<feature>jndi-1.0</feature>
</featureManager>
<!-- <fsccUserRegistry prefFile="${server.config.dir}/preferences.xml"/> -->
[...]

Adding the LDAP/AD feature to WebSphere Liberty

To enable LDAP/AD support in WebSphere Liberty the feature ldapRegistry-3.0 has to be added to the
server.xml:
Access the server that is running the GUI and open /opt/ibm/wlp/usr/servers/gpfsgui/server.xml using a text editor
Add the ldapRegistry-3.0 feature to the server.xml, see in bold below:
<server description="GSS GUI">
<featureManager>
<feature>jsp-2.2</feature>
<feature>localConnector-1.0</feature>
<feature>jdbc-4.0</feature>
<feature>ssl-1.0</feature>
<feature>servlet-3.0</feature>
<feature>appSecurity-2.0</feature>
<!-- <feature>usr:FsccUserRepo</feature> -->
<feature>jndi-1.0</feature>
<feature>ldapRegistry-3.0</feature>
</featureManager>
[]

Configuring the LDAP/AD repository using the <ldapRegistry> element

The LDAP/AD repository can be configured using the <ldapRegistry> element. Depending on the type of the
external server, the configuration element can have different attribute values. Sample configurations for Active

24

Directory and IBM Directory Server can be seen below:

Active Directory:
<ldapRegistry id="ldap"
host="ldapserver.mycity.mycompany.com" port="389" ignoreCase="true"
baseDN="cn=users,dc=adtest,dc=mycity,dc=mycompany,dc=com"
bindDN="cn=testuser,cn=users,dc=adtest,dc=mycity,dc=mycompany,dc=com"
bindPassword="testuserpwd"
ldapType="Microsoft Active Directory"
sslEnabled="false">
<activedFilters
userFilter="(&amp;(sAMAccountName=%v)(objectcategory=person))"
groupFilter="(&amp;(cn=%v)(objectcategory=group))"
userIdMap="user:sAMAccountName"
groupIdMap="*:cn"
groupMemberIdMap="memberOf:member">
</activedFilters>
</ldapRegistry>

For advanced configuration options or for enabling SSL refer to the IBM WebSphere Liberty knowledge center at
https://www01.ibm.com/support/knowledgecenter/was_beta_liberty/com.ibm.websphere.wlp.nd.multiplatform.doc/ae/twlp_sec_
ldap.html

After saving the changes, the management GUI service needs to be restarted:
Call: service gpfsgui start

25

Specifying the LDAP group to GUI role mapping

After the GUI server was restarted, you have to review the groups to roles mapping and add/remove group to role
mappings as necessary.

Viewing and modifying existing group to role mappings

You can view the existing groups by using the lsusergrp command; adding and removing groups can be
accomplished by using mkusergrp and rmusergrp respectively.

Creating a group to role mapping for initial access

For initial GUI access you should map one existing LDAP/AD group to the securityadmin GUI role. The group
name needs to match the CN attribute of the corresponding group in the external (LDAP/AD) repository.
Log on to the server which is hosting the GUI and execute the below command which will map the specified LDAP
group to the GUI role securityadmin. A LDAP user which needs to access the GUI needs to be a member of this
AD group:
Call: mkusergrp mySecurityAdminLDAPGroup --role securityadmin
!!! Attention: The group name is case sensitive !!!
To verify the configuration access the management GUI from a web browser and log in using the credentials of a
user that is member of the group you have previously mapped to the securityadmin role.

26

13 Configuring further group to role mappings using the Spectrum Scale GUI
After the initial setup you can manage the group to role mappings directly from the Spectrum Scale GUI using the
Access -> GUI Access section (1/3):

27

Adding a new mapping is accomplished by clicking the Create Group Mapping button (2/3):

28

If the group you are trying to map does not exist (i.e. has not yet been created) in the external repository
you will get a warning; you will still be able to save the role assignment (3/3):

29

Troubleshooting
The Spectrum Scale GUI relies on WebSphere to connect to the specified LDAP repository and to execute the
necessary authentication steps. Therefore any LDAP connection, authentication or configuration failure should
appear in the WebSphere log wlp-messages.log found under : /var/log/cnlog/mgtsrv

Configure tracing
In most cases it helps to enable tracing on detail or finer level to troubleshoot a specific issue. This can be done
by modifying the property com.ibm.ws.logging.trace.specification in the bootstrap.properties found under
/opt/ibm/wlp/usr/servers/gpfsgui. The following setting would enable tracing for all classes (*) on the level
finer: com.ibm.ws.logging.trace.specification="*=finer"
By default the trace messages are written to the wlp-trace-log file under /var/log/cnlog/mgtsrv.
More information on trace logging options can be found here:
https://www01.ibm.com/support/knowledgecenter/was_beta_liberty/com.ibm.websphere.wlp.nd.multiplatform.doc/ae/rwlp_logg
ing.html

To further debug LDAP/AD authentication issues you can enable tracing on level "finer" for the
"com.ibm.ws.security.wim.*" classes:
1.) Open /opt/ibm/wlp/usr/servers/gpfsgui/bootstrap.properties
2.) Replace the line:
com.ibm.ws.logging.trace.specification="*=audit"
with:
com.ibm.ws.logging.trace.specification="*=audit:com.ibm.ws.security.wim.*=finer"
3.) Restart the GUI: systemctl restart gpfsgui
You will now get some more detailed messages in the WebSphere Liberty trace log found here:
/var/log/cnlog/mgtsrv/wlp-trace-log. For example the groups retrieved from the LDAP/AD server are shown:
> cat wlp-trace-log | grep -A5 getGroupsForUser
...
[1/26/16 15:50:08:872 CET] 00000034 id=16de9e23 com.ibm.ws.security.wim.registry.util.MembershipBridge
< getGroupsForUser Exit
[CN=test_group,cn=users,DC=W2K8DOM02,DC=local]

30

14 Generating a trusted SSL certificate for secure browsing

In order to start the procedure it is necessary to have openssl installed on the machine, where Websphere Liberty
Profile is stored. Perform all the steps to receive a new certificate for secure browsing.

1) Generate private key file.

openssl genrsa -out <NameOfYourKey>.key 2048

2) Generate certificate request file.

openssl req -new -key <NameOfYourKey>.key -out <NameOfYourRequest>.csr

You will be prompted to fill it out with information about your company:
Country Name (2 letter code) [XX]:
State or Province Name (full name) []:
Locality Name (eg, city) [Default City]:
Organization Name (eg, company) [Default Company Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:
Email Address []:
Please enter the following 'extra' attributes to be sent with your certificate request
A challenge password []:
An optional company name []:

3) Send the certificate request file to a trusted Certificate Authority in order to get a certificate file.
4) Generate PKCS12 file.
openssl pkcs12 -export -in <YourCertificateFile> -inkey <NameOfYourKey>.key >
<NameOfYourPKCS12File>.p12

You will be prompted to set the export password.

Enter Export Password: <YourPassword>
Verifying - Enter Export Password: <YourPassword>

5) Generate Java Keystore file .jks with keytool. It is typically stored in the directory
/opt/ibm/wlp/java/jre/bin/ - make sure you locate it correctly on your system.
<PathToKeytool>keytool -importkeystore -srckeystore <NameOfYourPKCS12File>.p12 -destkeystore
<NameOfYourJKSFile>.jks -srcstoretype pkcs12

You will be prompted to set the destination keystore password use here the same password as in
the step 4. The source keystore password is the export password from the step 4.
Enter destination keystore password: <YourPassword>
Re-enter new password: <YourPassword>
Enter source keystore password: <YourPassword>

6) Copy your new Java Keystore file to the directory 'security' of the gpfsgui server. It can be
typically found under /opt/ibm/wlp/usr/servers/gpfsgui/resources/security. It is a default place
where keystore files are stored.
cp <NameOfYourJKSFile>.jks <PathToSecurityDir>

7) An entry to your new Java Keystore file and its password must be defined in the server.xml file
of the gpfsgui server. You may want to encode your password if you don't want to have it there in

31

plain text. For that, use the security utility - it is typically stored in the directory /opt/ibm/wlp/bin.
The supported encodings are XOR and AES.
<PathToSecurityUtility>securityUtility encode --encoding=<xor or aes> <YourPassword>

You will receive in the output your encrypted password.

8) Edit keystore entry of the server.xml file for the gpfsgui server in order to enable your new key.
The file can be found under '/opt/ibm/wlp/usr/servers/gpfsgui'.
<keyStore id="defaultKeyStore" password="<YourPassword> or <YourEncodedPassword>"
location="<NameOfYourJKSFile>.jks" />

9) Restart the GPFS GUI.

call: systemctl restart gpfsgui

32

15 Appendix: Protocol (CES) node installation

Setting up a CES protocol support for Spectrum Scale
If no protocol node was setup previously which is usually done when you use the IBM Spectrum Scale installer
here some recognized issues and workarounds we found during testing.
The Spectrum scale installer can be used on the virtual cluster to create a cluster with CES protocol support but is
only available on RHEL7 today.
Detailed information you find in the IBM Knowledge Center.
https://www-01.ibm.com/support/knowledgecenter/STXKQY_4.2.0/ibmspectrumscale42_welcome.html

Just in case no protocol node was configured make sure to setup one before the GUI is installed if you
want to use protocols.
The installer does only support RHEL 7 so a manual installation of a protocol (CES) node must be made.
Refer to the manual installation procedure described Knowledge Center: https://www01.ibm.com/support/knowledgecenter/STXKQY_4.2.0/com.ibm.spectrum.scale.v4r2.ins.doc/bl1in_InstallingIBMSp
ectrumScale.htm
If you also have a Spectrum Scale Raid System integrated into your cluster make sure you do not install the CES
node on an ESS node as this does not work without problems.

33

16 Browser Support Statement

Browser support is limited to the versions listed that are tested and certified by the
product team:
Mozilla Firefox 41
Mozilla Firefox Extended Support Release (ESR) 38
Google Chrome 45
Internet Explorer 10 and Internet Explorer 11
Note: IBM supports higher versions of the browsers as long as the vendors do not
remove or disable functionality that the product relies upon. For browser levels higher
than the versions that are certified with the product, customer support shall accept usage related
and defect-related service requests. As with operating system and virtualization
environments, if IBM support cannot re-create the issue in our lab, we may ask the client
to re-create the problem on a certified browser version in order to determine if whether a
product defect exists. Defects are not accepted for cosmetic differences between
browsers or browser versions that do not affect the functional behavior of the product. If a
problem is identified in the product, defects are accepted. If a problem is identified with
the browser, IBM may investigate potential solutions or work-arounds that the client may
implement until a permanent solution becomes available.

34

17 Glossary
IBM Spectrum Scale node

A node with active IBM Spectrum Scale daemon,

primarily the management node

management GUI

The web-based user interface for administration of

IBM Spectrum Scale

back-end

The back-end for the GUI that encapsulates the

business logic

database

A configuration and state database used by the

management GUI. We use a PostgreSQL database
to store offline data.

IMM

Integrated Management Module of the x3650

server.

SNMP

Simple Network Management Protocol. We use the

so-called SNAP traps to receive asynchronous
events from the IMM.

IPMI

Intelligent Platform Management Interface.

Industry standard for communication with
management modules.

mm-commands

The IBM Spectrum Scale command line

commands.

Performance Monitor

Performance Monitor component ( not listed in the

diagram above) sometimes also called Performance
Tool which is an IBM internal name.

HMC

Hardware Management Console for IBM Power

systems

GUI node

A node which is part of the IBM Spectrum Scale

cluster. It can be a server or client node.

Nsd node or NSD servers

NSD node is a node that serves a IBM Spectrum

Scale NSD. This node typically has storage
attached physically to it so it can serve these
NSDs to other nodes in the IBM Spectrum Scale
cluster.

DMP Directive Maintenance Procedure

A wizard of the GUI to assist the user to run a

maintenance procedure.

CCR -Cluster Configuration Repository

The central configuration repository also used by

the GUI and Zimon to distribute configurations
over the cluster.

35