IBM License Metric Tool (ILMT)

IBM License Metric Tool (ILMT)

Connect with Db2, Informix, Netezza, open source, and other data experts to gain value from your data, share insights, and solve problems.

 View Only
Expand all | Collapse all

Disconnected Scanner not accepting schedule values other than default

  • 1.  Disconnected Scanner not accepting schedule values other than default

    Posted Mon June 05, 2023 07:54 AM

    We are using disconnected scanners being deployed by Ansible. We have set the variables (see below) in an attempt to manage when the HW and SW scans are being performed on our remote nodes. Alas, no matter what we do, it seems that the lmt_scanner is installed using the default values. This is true for both our Windows and Linux servers. There is no issue with the schedule being created in either 'Windows Scheduler' or 'Linux Cron', the issue is with the values.

    We want to change the frequency of the SW scans to daily and cannot seem to achieve this via either the "lmt_install_or_upgrade_scanner.yml" or "lmt_reconfigure_scanner.yml" playbooks.

    As you can see, we'd like to run our SW scans 'DAILY' at 1PM local time. The entry that is place in the scheduler is to run 'weekly' (the default) at the time when the installation/update was made (again, the default).

    Obviously, we could go into each of the servers and modify the schedule manually, however, that effort seems wasted when those settings will be overwritten during the next updated deployment of the disconnected lmt_scanner...plus the LMT Collection seems to have accounted for the capability - we just need to figure out why it is not working.

    Our LMT Playbook variable settings:

      vars:
        lmt_local_file_storage_path: ./lmt_file_storage/scanner_installers
        lmt_scanner_path_windows: c:\program files\IBM\LMTScanner
        lmt_scanner_output_path_windows: c:\program files\IBM\LMTScanner\output
        lmt_scanner_path_unix: /var/opt/ibm/LMTScanner 
        lmt_scanner_output_path_unix: /var/opt/ibm/LMTScanner/output/
        lmt_server_path: /apps/ibm/LMT
        lmt_server_port: 9081
        lmt_server_token:
        lmt_server_datasource_path: /apps/ibm/LMT/datasource
        lmt_scanner_setup_timeout: 300
        # lmt_scanner_solaris_dsd_mode:
        lmt_scanner_software_scans_enabled: TRUE
        lmt_scanner_software_scans_frequency: DAILY
        # lmt_scanner_software_scan_day_of_week:
        # lmt_scanner_software_scan_local_time: "13:00"
        lmt_scanner_software_scan_cpu_threshold_percentage: 5
        lmt_scanner_daily_pack_results_enabled: false
        # lmt_scanner_public_cloud_type:
        lmt_scanner_virt_host_scan_enabled: false
        lmt_scanner_collect_host_hostname: false
        lmt_scanner_docker_scan_enabled: false

    Thanks for any assistance/suggestions you can provide.



    ------------------------------
    Gary Latter
    Solution Architect
    Peraton
    CA
    ------------------------------


  • 2.  RE: Disconnected Scanner not accepting schedule values other than default

    Posted Tue June 06, 2023 05:01 AM

    Hello Gary,

    To investigate further we would need to see the following items :

    1. command syntax which has been used to run the "lmt_reconfigure_scanner.yml" playbook,
    2. full content of lmt_inventory.yml
    3. full content of setup_config.ini collected from one of those servers.



    ------------------------------
    Thank you,
    Oktawian

    Oktawian Powązka, L3 Support
    IBM License Metric Tool
    ------------------------------



  • 3.  RE: Disconnected Scanner not accepting schedule values other than default

    Posted Tue June 06, 2023 05:38 AM

    Hi Oktawian,

    Let me try to understand how to respond to your request by providing more details of our installation.

    We use Ansible Automation Platform version 2.2 from Red Hat (not the free OpenSource version known as AWX), which has multiple manual and dynamic inventories derived from different sources. In working to adapt your Playbooks to our instance, we realized it appears the IBM-templated installation was one where both Ansible and LMT resided on the same server and that Ansible was used from a CLI...that is NOT our case, nor will it ever be as we have an enterprise instance of Ansible for our Client and is the primary reason we elected to use this method of deploying/maintaining the LMT disconnected scanners.

    We work extensively with Red Hat to deploy and maintain our AAP 2.x platform according to their recommended best practices and through past discussions with IBM understand that your LMT Collection is currently being re-packaged and updated to reflect current Ansible practices. That being said, there is nothing in your code that shouldn't work (with a bit of adaptation) within our existing AAP instance.

    So, for your first & second questions - we execute the Playbooks via Job Templates in the Controller GUI (previously referred to as Tower). The Playbooks reference an inventory (for us, we called the LMT-dedicated inventory "Z_GL_LMT_POC01" - not the approach of using a file as an inventory as the lmt_inventory.yml file suggests) which contains 2 sub-groups (Windows and Linux with 13 & 39 hosts respectively). I've included a screenshot of our Job Template to run the 'lmt_install_or_upgrade_scanner.yml' playbook. The "Variables" section details are exactly what I provided in my original post (ignore those in the screenshot).

    A screen shot of our job template to install & upgrade LMT disconnected scanners

    As it is currently 02:30 her in California, I will have to wait until later this morning to provide an answer to your 3rd question as being an 'architect', I have not been given direct access to the various managed nodes and will need the assistance of one of our Windows or Linux SAs. 

    Do you have a preference from which OS we obtain the 'setup_config.ini' file our would one from each (Windows & Linux) be preferable?

    Thanks for the prompt response, I'll provide further updates later today.



    ------------------------------
    Gary Latter
    Solution Architect
    Peraton
    CA
    ------------------------------



  • 4.  RE: Disconnected Scanner not accepting schedule values other than default

    Posted Tue June 06, 2023 05:41 AM

    One additional observation, in the original list of Variables I provided, I noticed that two of the entries had been commented-out.

    That is not accurate. Please ignore the hashtag character preceeding these two lines - those variables are indeed attempting to be set.

        # lmt_scanner_software_scan_day_of_week:
        # lmt_scanner_software_scan_local_time: "13:00"

    Thanks



    ------------------------------
    Gary Latter
    Solution Architect
    Peraton
    CA
    ------------------------------



  • 5.  RE: Disconnected Scanner not accepting schedule values other than default

    Posted Tue June 06, 2023 05:59 AM

    Are those listed variable settings from the first post exactly the same for both Playbooks (lmt_install_or_upgrade_scanner.yml / lmt_reconfigure_scanner.yml) ?

    Please obtain 'setup_config.ini' file from one of the Linux boxes....  



    ------------------------------
    Thank you,
    Oktawian

    Oktawian Powązka, L3 Support
    IBM License Metric Tool
    ------------------------------



  • 6.  RE: Disconnected Scanner not accepting schedule values other than default

    Posted Tue June 06, 2023 06:13 AM

    Yes, the config variables are actually set within the Ansible Inventory (Z_GL_LMT_POC01) so they remain constant for ALL LMT-related playbooks regardless of the function being performed by the Playbook. We did this to ensure consistency and avoid issues with human errors.

    Just as a point of reference, here are some screen shots of our dedicated LMT inventory screen, the groups and one each of a Windows server and a Linux server. 

    Main Page



    ------------------------------
    Gary Latter
    Solution Architect
    Peraton
    CA
    ------------------------------



  • 7.  RE: Disconnected Scanner not accepting schedule values other than default

    Posted Tue June 06, 2023 03:15 PM

    Here are the setup_config.ini files from two different Linux servers (first time I've seen them and wonder if the Windows servers have a similar file).

    In looking at these files, I clearly see...

    SW_SCAN_FREQUENCY=WEEKLY

    SW_SCAN_LOCAL_TIME=

    which again, reinforces the use of the default values. My assumption here is that the Playbooks should be picking up the variables and applying them to this 'setup_config.ini" file so the actual lmt_scanners use those values for execution.

    Hopefully you'll be able to shed some light on why our non-default values are not being applied.



    ------------------------------
    Gary Latter
    Solution Architect
    Peraton
    CA
    ------------------------------

    Attachment(s)

    ini
    0222_setup_config.ini   15 KB 1 version
    ini
    0333_setup_config.ini   15 KB 1 version


  • 8.  RE: Disconnected Scanner not accepting schedule values other than default

    Posted Wed June 07, 2023 03:52 AM

    Hello back,

    setup_config.ini files content looks OK...

    May I see some proof that the dedicated "lmt_reconfigure_scanner.yml" playbook has been successfully applied to one of those boxes.
    Could you please doublecheck a content of
    job processing output from Job's Output screen ?

    Would it be possible to run just for a quick test that "lmt_reconfigure_scanner.yml" playbook from command line ?
    That way we could unequivocally confirm that the problem is not Automation controller launcher related... 



    ------------------------------
    Thank you,
    Oktawian

    Oktawian Powązka, L3 Support
    IBM License Metric Tool
    ------------------------------



  • 9.  RE: Disconnected Scanner not accepting schedule values other than default

    Posted Wed June 07, 2023 04:40 AM

    Hi,

    I am including the output from a recent attempt to get the variables updated. We attempted to try to update Linux servers which appeared to run successfully, however, upon checking the Cron schedule on those two servers, the only thing that had changed was the day and time the HW and SW scans would run - and that change was NOT to our requested variables, but to the defaults. It simply refreshed the schedule to run at the time we ran the Playbook and weekly (for the SW scan, starting with the day we ran the reconfigure playbook)...again ignoring our request to run the SW scans daily at 13:00.

    Job_35351.txt is the output from that recent run of 'lmt_reconfigure_scanner.yml".

    I am also going to include the job results from our nightly collection of lmt_scanner results using the "lmt_collect_results.yml" playbook. We run this job nightly at 10PM to collect and transfer the files to the LMT server, which has an automated routine to ingest those results every day at 1AM.

    The attached file named "job_36328.txt" contains those results.

    Once our System Admins return in the morning, I will work with one to re-run the equivalent of Job #35351 via the CLI to verify the results are the same, and send you the output from that run as well.

    Thanks!



    ------------------------------
    Gary Latter
    Solution Architect
    Peraton
    CA
    ------------------------------

    Attachment(s)

    txt
    job_36328.txt   284 KB 1 version
    txt
    job_35351.txt   4 KB 1 version


  • 10.  RE: Disconnected Scanner not accepting schedule values other than default

    Posted Wed June 07, 2023 08:56 AM

    Hello,

    From job_35351.txt output we can clearly see a WEEKLY setup :
    TASK [ilmt_scanner : Set WEEKLY Software Scans on UNIX/Linux endpoints] 

    It basically means that 'lmt_reconfigure_scanner.yml' playbook has been run with lmt_scanner_software_scans_frequency setting set to 'WEEKLY'.

    So, it all comes to the question why those modified Playbook variable settings are not being picked up by the Automation controller launcher... 
    Unfortunately we can't help with this one as so far using Ansible solution has only been tested via CLI.
     



    ------------------------------
    Thank you,
    Oktawian

    Oktawian Powązka, L3 Support
    IBM License Metric Tool
    ------------------------------