CA Tuesday Tip: APM 9.6 TIM: Unofficial New Rules

[Hallett German]

CA Tuesday Tip: APM 9.6 TIM Unofficial New Rules

 

Introduction

Normally, I do not do a second Tuesday Tip in one month. But there has been some confusion about the TIM since APM 9.6 came out. I hope this Tip can clarify some things.

This is what is in the documentation:
TIM installation is now available as software. Because the TIM is no longer a "software appliance", it is easier for you to maintain and upgrade the software. The TIM System Health page and Machine Settings options are not available with the TIM installation Note: CA Technologies is researching support for 3G Napatech Drivers that would be made available in a future release.

 

And later in the documentation, the hardware/operating system requirements are provided.

 

 

But like parents to a newborn, you find quickly there is no owner's manual for the "new TIM". So here is my best guess what I believe the "new rules" are:

 

What you are responsible for:

- Providing and installing the operating system (Redhat, CentOS). An upgrade from prior releases is not supported.
- Making sure the correct software packages are installed. (They should be part of the operating system release. So nothing extra should be needed.)
- Installing TIM through the command line (No longer done through the browser.)

- Providing your own network driver card that is not from Napatech. As said above, this will be rectified in a future release.

- Time synchronization. TESS will no longer to synch with the TIM. And the documentation talks about why time synchronization is so important to APM successful operations.

- Adding as-needed security updates.

- Maintaining port (iptables) and firewall (SElinux) settings. These must also not conflict with TIM operations.

- Making sure that operating system and third-party software does not conflict or cause issues with TIM. This may be a harder task to do at times and may require opening support cases to clarify.

- A python script TIM-assist is provided to help the WebUI to perform tasks that may require root privileges. There is a helper file with details on using it.

 

 

Notes:
- 9.6 requires a fresh install. However you can move over custom components such as HTTP Plugins, Evidence collection, configuration file settings, etc. to the 9.6 TIM.

- NCipher is listed in the 9.6 Security Guide. But it is my understanding this is also a new customer responsibility. An update of my findings will be provided,

 

- Update: nCipher is included in APM 9.6. However, it will no longer be updated to later versions of the nCipher software.

Questions:
1. How are finding having OS control of the TIM? Just right or more responsibility than desired?
2. Are there other 9.6 TIM gotchas and guidelines that should be listed here?

[Jörg Mertin]

To this:

Providing and installing the operating system (Redhat, CentOS). An upgrade from prior releases is not supported

Keep in mind the following. If you want (as a customer) continue to use RedHat, you need to own/buy a License/subscription at RedHat to be entitled to use it.

The old RedHat installation on the Soft-Appliance cannot be used. A TIM installation on this old OS release will not work as it requires a clean pre-installed OS.

 

The alternative is to use CentOS - which is a "very" similar clone to RedHat. From experience, whatever software ran on RedHat, did run on CentOS (There are exceptions).

The TIM soft-only version is running under CentOS.

[Hallett German]

Joerg:

  Thanks for this update. Yes customers are now responsible for licensing the software so that is a new rule to deal with...

[Lynn Williams]

A couple of others :

If SElinux is subsequently enabled post TIM install then the TIM will need to be reinstalled.

The 9.6 TIM for Multi-Port Monitor (MTP) version is still installed via Browser UI.

[Anon Anon]

- Providing your own network driver card that is not from Napatech. As said above, this will be rectified in a future release.

What are the requirements for the network card for the new v9.6 TIM?

[Hallett German]

Dear Jeff1786:

>What are the requirements for the network card for the new v9.6 TIM?

I see nothing in the compatibility guide and this is listed in the installation and Upgrade

 

Copper Network adapters
¡ Two onboard copper 10/100/1000 network adapters

Fiber Network Adapters:
(optional) Two Intel Pro 1000 MF (1 GB) onboard network adapters for fiber networks

 

Thanks

Hal German

CA Technologies Support

[Jörg Mertin]

Please avoid boards that host multiport chips, like quadport chips or even dual-port chips to handle 4 or 2 network ports. These chips tend to share the physical receive/send buffers (in our case, only the receive buffers are of importance), increasing the strain on the PCI-X bus and CPU to recover the data. The more ports, the smaller the buffer size attributed to the each port.
Fine tuning can be done by sizing the physical card buffers on a per port base, experience however has shown that these chips tend to drop packets if the throughput gets too high. On the normal internet this would not be a problem, as the TCP/IP protocol would make sure the missing packets are resend. On a SPAN/TAP port however, as these are unidirection data streams and no communication exists, the dropped packets will simply be lost.

[Billy Cole]

Questions:

1. How are finding having OS control of the TIM? Just right or more responsibility than desired?

 

Having OS control would be great, but trying to get RHEL into our SLES shop is not only a tough sell but almost an impossible task.  When the TIM included the OS, it took a bit to get all the approvals and paper work down to get TIM with RHEL installed, scanned and functional. 

 

2. Are there other 9.6 TIM gotchas and guidelines that should be listed here?

 

We are in the process of upgrading to 9.6 and since we didn't have a budget line for RHEL license and support we upgraded our 9.1.1.1 TIM to 9.5.3 (last to include the OS).  Hopefully this will afford us enough time to get a line item in the budget, fight with the various departments to try to get a RHEL instance and get administration and security support for the non-standard OS. 

[Hallett German]

Dear BwCole:

 

>Having OS control would be great, but trying to get RHEL into our SLES shop is not only a tough sell but almost an impossible task.  When the TIM included the OS, it took a bit to get all the approvals and paper work >down to get TIM with RHEL installed, scanned and functional.

 

Thanks for the update. Also note that CentOS is also supported in 9.6 as well for TIM Software versions. This may be another path to explore.

 

Sincerely,

Hallett German

CA Technologies Support

 

[Billy Cole]

Thanks Hal.

 

When I mentioned RHEL, I got the "We are a Suse shop".  When I mentioned CentOS, I got silence.  Poking the badger a little I asked which one would be easier to get a budget line for.  Either, but then I would need to develop the full spectrum of support documentation or try to get the effort on the administration task list (looks like the naughty/nice list for Santa) and maybe, if I am a good boy for the next....decade or so, it might make it high enough on the list to be mentioned.

 

Then something about snowball's chance but the rest of the statement was hard to make out, due to the laughter.

 

Billy

[Anon Anon]

Ok so correct me if I'm wrong.... but now I cannot upgrade everything to 9.6 easily? Since:

 

• TIM needs to be at the same version level as the MOM
• CentOS or RedHat needs to be licensed and installed by me (my company) which is an additional cost.

 

I will go back and re-read these things, so correct me if I am wrong.

Also we have an MTP appliance with CentOS installed which is hosting our current TIM software.

 

Thanks,

Mike

[Haruhiko Davis]

Solis,

MTP is a different issue since the OS is still managed by CA. The only time you will need to rebuild the MTP is when there's a new version of the MTP software. The TIM software for MTP still located with the ADA software and not under APM.

[Lynn Williams]

Mike,

There is a Tuesday Tip 9.6 TIM for MTP document located here:

https://communities.ca.com/message/241699402

 

Re: your other questions

• TIM needs to be at the same version level as the MOM

        Yes all EMs and the TIM need to be at the same version

• CentOS or RedHat needs to be licensed and installed by me (my company) which is an additional cost.

        Correct. However I understand the license cost of the 9.6 TIM has been reduced accordingly.

Hope this helps

[Anon Anon]

Thanks all. I am hearing a few different things about the TIM Software. I will update this post after I perform the upgrade myself and state my experiences.

 

Thanks again.