This article is all about installing IBM Endpoint Manager v9.0.586.0 onto your RHEL v6.3 64-bit server. I’m assuming you’ve already followed my DB2 Enterprise Server installation guide here: http://danielheth.com/2013/04/29/installing-db2-enterprise-v10-1/

I’m being very specific on the versions and properties because of how important those are. If you are running on RHEL v6.3 32-bit, you skip the “installing 32-bit libraries” section since it applies only to 64-bit RHEL v6.x boxes.

Always remember documentation can be helpful sometimes, so here are the two which you might find useful:

DB2: http://pic.dhe.ibm.com/infocenter/db2luw/v10r1/index.jsp?topic=%2Fcom.ibm.db2.luw.licensing.doc%2Fdoc%2Fc0059812.html

IEM: http://pic.dhe.ibm.com/infocenter/tivihelp/v26r1/topic/com.ibm.tem.doc_9.0/Platform/Adm/c_getting_authorized_linux.html

First you’ll need to acquire the installer file.. http://support.bigfix.com/bes/install/downloadbes.html

Configure host and masthead url

# echo “10.0.0.11 rhellab” >> /etc/hosts
# echo “10.0.0.11 rhellab.bigfix.me” >> /etc/hosts

Extract Installer

# tar –zxvf ServerInstaller_9.0.586.0-rhel.tgz

oh… the rabbit holes we must go down in order to do almost anything on *nix…

Update:  “We decided, by design, to always allow the installation to proceed instead of aborting.
If you decide to proceed without prerequisites depending on the specific missing prerequisite you may have an installation failure or a server not working properly.
It is strongly suggest to satisfy the prerequisites, and you can refer to the installation log or the documentation to identify the missing one.”

Turns out my installation doesn’t have ksh… back to my RPM repository…

This led me to several other rabbit holes… here’s the summary after ksh:

Install 32-bit libraries

1. glibc-2.12-1.80.el6.i686.rpm AND nss-softokn-freebl-3.12.9-11.el6.i686.rpm (note install these at the same time to avoid the circular dependancies)
2. audit-libs-2.2-2.el6.i686.rpm
3. libselinux-2.0.94-5.3.el6.i686.rpm
4. db4-4.7.25-17.el6.i686.rpm
5. cracklib-2.8.9-3.3.i386.rpm
6. libaio-0.3.107-10.el6.i686.rpm
7. pam-1.1.1-8.el6.i686.rpm
8. cyrus-sasl-lib-2.1.23-8.el6.i686.rpm
9. libstdc++-4.4.6-4.el6.i686.rpm
10. compat-libstdc++-33-3.2.3-69.el6.i686.rpm

Yeah… the installer has proceeded to the next step!

License Agreement – type 1 and hit enter to accept

Installation Type – I’m using an authorization file… so I’ll specify Production.

####################
Select Install Type
[1] Evaluation: Request a free evaluation license from IBM Corp. This license allows you to install a fully functional copy of the IBM Endpoint Manager on up to 30 clients, for a period of 30 days.
[2] Production: Install using a production license or an authorization for a production license
Choose one of the options above or press <Enter> to accept the default: [1]

Feature Selection – I’ll be installing all of it.. Server, Client and WebReports

####################
Select the IBM Endpoint Manager Features you want to install:
[1] All Components (Server, Client, and WebReports)
[2] Server and Client Only
[3] WebReports Only
Choose one of the options above or press <Enter> to accept the default: [1]

Database Replication – This will be a single instance…with no DSA.

####################
Select Database Replication:
[1] Single or Master Database
[2] Replicated Database
Choose one of the options above or press <Enter> to accept the default: [1]

Database – Since I went through the trouble of installing DB2 locally… choose local.

####################
Select Database:
[1] Use Local Database
[2] Use Remote Database
Choose one of the options above or press <Enter> to accept the default: [1]

DB2 Local Administrative User

####################
DB2 Local Administrative User:
Specify the Username for the local DB2 Administrative user or press <Enter> to accept the default: db2inst1

Connection to the database failed. So let’s go back and work on some user accounts… In a separate putty instance… I did the following:

# groupadd –g 999 db2iadm1
# groupadd –g 998 db2fsdm1
# groupadd –g 997 dasadm1
# useradd –u 1004 –g db2iadm1 –m –d /home/db2inst1 db2inst1
# useradd –u 1003 –g db2fsdm1 –m –d /home/db2fenc1 db2fenc1
# useradd –u 1002 –g dasadm1 –m –d /home/dasusr1 dasusr1
# passwd db2inst1
# passwd db2fenc1
# passwd dasusr1

Create a DB2 Administration Server (DAS)

# /opt/ibm/db2/V10.1/instance/dascrt –u dasusr1

To get the next command… I had to add a static record on my windows DNS server since my RHEL box wasn’t registering. The hostname I was using has to be resolvable in order to…

Create an instance using db2icrt

# /opt/ibm/db2/V10.1/instance/db2icrt -a server –u db2fenc1 DB2INST1

Configure TCP/IP *Learned after much research the “DB2 Connection” section below.

Start the DB2 instance

# su – db2inst1
# db2start

DB2 Local Administrative User Password

####################
DB2 Local Administrative User Password:
Specify the Password of the local DB2 Administrative user:

Enter again the Password for verification:

WebReports Configuration:

####################
Choose the Web Server's Root Folder:
Specify the location for the Web Server's Root Folder or press <Enter> to accept the default: /var/opt/BESServer

####################
Choose the WebReports Server's Root Folder:
Specify the location for the WebReports Server's Root Folder or press <Enter> to accept the default: /var/opt/BEebReportsServer

####################
Choose the WebReports Server's Port:
Specify the Port Number or press <Enter> to accept the default: 80

IEM Administrative Login

####################
Create the initial administrative user:
Specify the Username for the new user or press <Enter> to accept the default: IEMAdmin

####################
Create the initial administrative user:
Specify the Password for the new user:

Enter again the Password for verification:

License Fork in the Road

This fork in the road depends on you have for licensing. If you have an authorization file…then you have a license that yet-to-be-activated. If you already have the masthead and license cert and private key then you’re license is already activated and you just want to link this deployment with that license.

####################
Choose the setup type that best suits your needs:
[1] I want to install with a BES license authorization file
[2] I want to install with a Production license that I already have
[3] I want to install with an existing masthead
Choose one of the options above or press <Enter> to accept the default: [1]

License Authorization Location

Move the license file over to the default place…

# cp /root/LicenseAuthorization.BESLicenseAuthorization /root/ServerInstaller_9.0.586.0-rhel/license/

Server DNS Name

Site Admin Private Key Password

Key Size Level

Choose License Folder

Request License

Proxy Usage

Advanced Masthead Parameters

Unfortunately I don’t have any information to share here at this time.

Site Admin Private Key

####################
Site Admin Private Key:
Specify the site Level Signing Key file (license.pvk) for the database you want to administer or press <Enter> taccept the default: ./license/license.pvk

Site Admin Private Key Password:

####################
Site Admin Private Key Password:
Specify the related Site Admin Private Key Password:

Enter again the Password for verification:

Deployment Masthead

####################
Deployment Masthead
Specify the Masthead file (masthead.afxm or actionsite.afxm) for your deployment or press <Enter> to accept the fault: ./license/masthead.afxm

DB2 Connection

Grrrr it failed! (if you’re installation did not fail.. skip down to the bottom “Back to the Installation”)

Let’s explore this new rabbit hole… It seemed to fail when it started to look

Ok… after an hour of research and talking to several people (thanks guys!) the solution was discovered and documented in the Configure TCP/IP section under Rabbit Hole #2

And the installation continues…

Grrr… another rabbit hole! This time it appears with all of the back and forth… I used the wrong password on the admin private key… kind of messed up the creation of the Server’s signing key… Let’s remove and start again

http://pic.dhe.ibm.com/infocenter/tivihelp/v26r1/topic/com.ibm.tem.doc_9.0/Platform/Adm/c_uninstalling_the_primary_server_onlinux.html

AH… something that worked exactly as desired… first time through!

Side Note: I had to uninstall/clean up the system multiple times… I made things easy by creating a script to do it for me.

#!/bin/sh
rpm -e BESRootServer-9.0.586.0-rhel.i686
rpm -e BESAgent-9.0.586.0-rhe5.x86_64
rpm -e BESWebReportsServer-9.0.586.0-rhel.i686
rm -fr /var/opt/BESClient
rm -fr /etc/opt/BESClient
rm -fr /var/opt/BESServer
rm -fr /etc/opt/BESServer
rm -fr /var/opt/BESWebReportsServer

#su - db2inst1
#db2 drop db BFENT
#db2 drop db BESREPOR
#exit

I had to comment out the database part and never dug into how to get that part to work from a script… I was doing that last part manually. Just in case anybody was interested… here’s the uninstall.sh script I built.

Starting Fresh with IEM Install

cd back to the ServerInstaller… directory and launch ./install.sh

then run through all of the options again… but this time specify the correct password for my admin private key.

ANNNNNDDDDD… it fails… turns out the password I was using before was correct. After another uninstall… time to try again.

Let’s dive head first into this rabbit hole… after doing a full installation on a fresh Windows server.. the problem turned out to be a licensing issue.

In the RHEL installation logs we see the following error message:

Info: Configuring the Database for Server Component, please wait ...
/opt/BESServer/bin/BESAdmin -install -dbUsername:"db2inst1" -dbPassword:"********" -dbname:"BFENT" -mastheadLocati
on:"/etc/opt/BESServer/actionsite.afxm" -sitePvkLocation="./license/license.pvk" -sitePvkPassword:"********" -dbPo
rt:"50000" -databaseDNS:"rhellab.bigfix.me" -username:"BigFixAdmin" -password:"********"
key values mismatch (33CertificateDoesNotMatchPrivateKey)
Error: An error occurred while running the command 'runBesAdmin -install'

After installing onto the Windows box with the same masthead, and license files… we end up with the following dialog:

It seems during the RHEL installation where I specified the License authorization file… the resulting License.crt and License.pvk … DO NOT MATCH! oh come on!

The step it is failing on in both the RHEL and Windows situations is the generation of the server’s signing key. If that is not generated.. nothing will work.

Ok… next step… contact licensing (tem@dk.ibm.com) to find the root cause since this one is out of my hands.

Update:  After talking to a few more knowledgeable people, I discovered the true issue of this certificate mis-match problem came from the multiple installation attempts.  The authorization file was used in more than one which would result in an incomplete license generation resulting in the experience I had here.

Solution… get a new authorization file.

Starting Fresh Again…

Now that I have a new authorization file we can attempt the fresh install again. Running the uninstall procedure to clean up this system… I ran through the installer once more with great success!

SCORE!!!! Console up and functional!

Final Assessment

The installation was a bear… but if you push through it… it will work. To be honest, I’m don’t really see this as an IEM failure as much as it is a Linux failure, but that thought is from a Windows guy… so take it with a grain of salt.

I’d like to see included with the IEM installation a PreReqCheck script similar to the one included with DB2. This would allow you to run a simple precheck on various libraries, DB connectivity, ports, etc… Something to eliminate the start-stop-start-stop-start again procedure of this installation.

Update:  During this installation I was reaching out to many of my contacts for assistance.  Many were helpful and helped push this installation forward.  As a post mortem, one of those contacts were helpful in providing additional information on the PreReqs… “in (the) next release or one of (the) next fixpacks we are going to improve prerequisite handling, allowing an automatically prerequisite installation”