Managing servers

About this task

XClarity Administrator can automatically discover rack and tower servers in your environment by probing for manageable devices that are on the same IP subnet as XClarity Administrator. To discover rack and tower servers that are in other subnets, specify an IP address or range of IP addresses, or import information from a spreadsheet.

After the servers are managed by XClarity Administrator, Lenovo XClarity Administrator polls each managed server periodically to collect information, such as inventory, vital product data, and status. You can view and monitor each managed server and perform management actions (such as configuring system settings, deploying operating-system images, and powering on and off).

A device can be managed by only one XClarity Administrator instance at a time. Management by multiple XClarity Administrator instances is not supported. If a device is managed by one XClarity Administrator, and you want to manage it with another XClarity Administrator, you must first unmanage the device on the initial XClarity Administrator, and then manage it with the new XClarity Administrator. If an error occurs during the unmanagement process, you can select the Force management option during management on the new XClarity Administrator.

Procedure

To manage your rack and tower servers using XClarity Administrator, complete one of the following procedures.

• Discover and manage a large number of tower and rack servers and other devices using a bulk-import file (see Managing devices).

• Discover and manage rack and tower servers that are on the same IP subnet as XClarity Administrator.

  1. From the XClarity Administrator menu bar, click Hardware > Discover and Manage New Devices. The Discover and Manage New Devices page is displayed.

     
     
     

     You can sort the table columns to make it easier to find the servers that you want to manage. In addition, you can enter text (such as a name or IP address) in the Filter field to further filter the servers that are displayed. You can change the columns that are displayed and the default sort order by clicking the Customize Columns icon ().

  2. Click the Refresh icon () to discover all manageable devices in the XClarity Administrator domain. Discovery might take several minutes.

  3. Click the Enable encapsulation on all future managed devices checkbox to change the firewall rules on all devices during the management process so that incoming requests are accepted from only XClarity Administrator.

     Encapsulation can be enabled or disabled on specific devices after they are managed.

     Note

     When the management network interface is configured to use the Dynamic Host Configuration Protocol (DHCP) and when encapsulation enabled, managing a rack server can take a long time.
     Attention

     If encapsulation is enabled and XClarity Administrator becomes unavailable before a device is unmanaged, necessary steps must be taken to disable encapsulation to establish communication with the device. For recovery procedures, see lenovoMgrAlert.mib file and Recovering management with a CMM after a management server failure.

  4. Select one or more servers that you want to manage.

  5. Click Manage Selected. The Manage dialog is displayed.

  6. Choose to use XClarity Administrator managed authentication or local authentication for this device. Managed authentication is selected by default. To use local authentication, clear Managed Authentication.

  7. Choose the type of credentials to use to authenticate to the device and specify the appropriate credentials:

     • Use manually entered credentials

       • Specify the user ID and password for authenticating to the server.

       • (Optional) Set a new password for the specified user name if the password is currently expired on the device.

       Note

       • For ThinkSystem V4 servers, external LDAP usernames are case sensitive.

       • To use manually entered credentials, you must select XClarity Administrator managed authentication.

     • Use stored credentials

       Select the stored credential to use for this managed device. You can create a new stored credential by clicking Create New.

     • Use identity-management system

       Select the identity management system that you want to use for this managed device. Then, fill in the remaining fields, including the IP address or host name of the managed server, user name, and optionally application ID, safe and folder.

       If you specify the application ID, you must also specify the safe and folder, if applicable.

       If you do not specify the application ID, XClarity Administrator uses the paths that were defined when you setup CyberArk to identify the onboarded accounts in CyberArk (see Setting up a CyberArk identity-management systemSetting up a CyberArk identity-management system in the XClarity Administrator online documentation).

       Note

       Only ThinkSystem or ThinkAgile servers are supported. The identity management system must be configured in XClarity Administrator, and the Lenovo XClarity Controller for the managed ThinkSystem or ThinkAgile servers must be integrated with CyberArk (see Setting up a CyberArk identity-management systemSetting up a CyberArk identity-management system in the XClarity Administrator online documentation).
     Tip

     It is recommended to use a supervisor or administrator account to manage the device. If an account with lower level authority is used, management might fail, or management might succeed but other XClarity Administrator operations on the device might fail (particularly if the device is managed without managed authentication).

     For more information about normal and stored credentials, see Managing user accounts and Managing stored credentials.

  8. Specify the recovery password if managed authentication is selected.

     When a password is specified, the recovery account (RECOVERY_ID) is created on the server, and all local user accounts are disabled. If there is a problem with XClarity Administrator, and it stops working for some reason, you cannot log in to the management controller using normal user accounts. However, you can log in using the recovery account.

     Note

     • The recovery password is optional if you choose to use managed authentication and is not allowed if you if you choose to use local authentication.

     • You can choose to use a local recovery account or stored recovery credentials. In either case, the user name is always RECOVERY_ID.

     • Ensure that the password follows the security and password policies for the device. Security and password policies might vary.

     • Ensure that you record the recovery password for future use.

     • The recovery account is not supported for ThinkServer and System x M4 servers.

     For more information about the recovery ID, see Managing the authentication server.

  9. Click Change to change the role groups that are to be assigned to the devices.

     Note

     • You can select from a list of role groups that are assigned to the current user.

     • If you do not change the role groups, the default role groups are used. For more information about the default role groups, see Changing the default permissions.

  10. Click Manage.

      A dialog is displayed that shows the progress of this management process. To ensure that the process completes successfully, monitor the progress.

  11. When the process is complete, click OK.

      The device is now managed by XClarity Administrator, which automatically polls the managed device on a regular schedule to collect updated information, such as inventory.

      If management was not successful due to one of the following error conditions, repeat this procedure using the Force management option.

      • If the managing XClarity Administrator failed and cannot be recovered.

        Note

        If the replacement XClarity Administrator instance uses the same IP address as the failed XClarity Administrator, you can manage the device again using the RECOVERY_ID account and password (if applicable) and the Force management option.

      • If the managing XClarity Administrator was taken down before the devices were unmanaged.

      • If the devices were not unmanaged successfully.

      Attention

      Devices can be managed by only one XClarity Administrator instance at a time. Management by multiple XClarity Administrator instances is not supported. If a device is managed by one XClarity Administrator, and you want to manage it with another XClarity Administrator, you must first unmanage the device from the original XClarity Administrator, and then manage it with the new XClarity Administrator.

• Discover and manage rack and tower servers that are not on the same IP subnet as XClarity Administrator by manually specifying IP addresses.

  1. From the XClarity Administrator menu bar, click Hardware > Discover and Manage New Devices. The Discover and Manage page is displayed.

  2. Click the Enable encapsulation on all future managed devices checkbox to change the firewall rules on all devices during the management process so that incoming requests are accepted from only XClarity Administrator.

     Encapsulation can be enabled or disabled on specific devices after they are managed.

     Note

     When the management network interface is configured to use the Dynamic Host Configuration Protocol (DHCP) and when encapsulation enabled, managing a rack server can take a long time.
     Attention

     If encapsulation is enabled and XClarity Administrator becomes unavailable before a device is unmanaged, necessary steps must be taken to disable encapsulation to establish communication with the device. For recovery procedures, see lenovoMgrAlert.mib file and Recovering management with a CMM after a management server failure.

  3. Select Manual Input.

  4. Specify the network addresses of the servers that you want to manage:

     • Click Single System, and enter a single IP address domain name, or fully-qualified domain name (FQDN).
       Network Access

       To specify an FQDN, ensure that a valid domain name is specified on page (see Configuring network access).
     • Click Multiple Systems, and enter a range of IP addresses. To add another range, click the Add icon (). To remove a range, click the Remove icon ().

  5. Click OK. The Manage dialog is displayed

  6. Choose to use XClarity Administrator managed authentication or local authentication for this device. Managed authentication is selected by default. To use local authentication, clear Managed Authentication.

  7. Choose the type of credentials to use to authenticate to the device and specify the appropriate credentials:

     • Use manually entered credentials

       • Specify the user ID and password for authenticating to the server.

       • (Optional) Set a new password for the specified user name if the password is currently expired on the device.

       Note

       • For ThinkSystem V4 servers, external LDAP usernames are case sensitive.

       • To use manually entered credentials, you must select XClarity Administrator managed authentication.

     • Use stored credentials

       Select the stored credential to use for this managed device. You can create a new stored credential by clicking Create New.

     • Use identity-management system

       Select the identity management system that you want to use for this managed device. Then, fill in the remaining fields, including the IP address or host name of the managed server, user name, and optionally application ID, safe and folder.

       If you specify the application ID, you must also specify the safe and folder, if applicable.

       If you do not specify the application ID, XClarity Administrator uses the paths that were defined when you setup CyberArk to identify the onboarded accounts in CyberArk (see Setting up a CyberArk identity-management systemSetting up a CyberArk identity-management system in the XClarity Administrator online documentation).

       Note

       Only ThinkSystem or ThinkAgile servers are supported. The identity management system must be configured in XClarity Administrator, and the Lenovo XClarity Controller for the managed ThinkSystem or ThinkAgile servers must be integrated with CyberArk (see Setting up a CyberArk identity-management systemSetting up a CyberArk identity-management system in the XClarity Administrator online documentation).
     Tip

     It is recommended to use a supervisor or administrator account to manage the device. If an account with lower level authority is used, management might fail, or management might succeed but other XClarity Administrator operations on the device might fail (particularly if the device is managed without managed authentication).

     For more information about normal and stored credentials, see Managing user accounts and Managing stored credentials.

  8. Specify the recovery password if managed authentication is selected.

     When a password is specified, the recovery account (RECOVERY_ID) is created on the server, and all local user accounts are disabled. If there is a problem with XClarity Administrator, and it stops working for some reason, you cannot log in to the management controller using normal user accounts. However, you can log in using the recovery account.

     Note

     • The recovery password is optional if you choose to use managed authentication and is not allowed if you if you choose to use local authentication.

     • You can choose to use a local recovery account or stored recovery credentials. In either case, the user name is always RECOVERY_ID.

     • Ensure that the password follows the security and password policies for the device. Security and password policies might vary.

     • Ensure that you record the recovery password for future use.

     • The recovery account is not supported for ThinkServer and System x M4 servers.

     For more information about the recovery ID, see Managing the authentication server.

  9. Click Change to change the role groups that are to be assigned to the devices.

     Note

     • You can select from a list of role groups that are assigned to the current user.

     • If you do not change the role groups, the default role groups are used. For more information about the default role groups, see Changing the default permissions.

  10. Click Manage.

      A dialog is displayed that shows the progress of this management process. To ensure that the process completes successfully, monitor the progress.

  11. When the process is complete, click OK.

      The device is now managed by XClarity Administrator, which automatically polls the managed device on a regular schedule to collect updated information, such as inventory.

      If management was not successful due to one of the following error conditions, repeat this procedure using the Force management option.

      • If the managing XClarity Administrator failed and cannot be recovered.

        Note

        If the replacement XClarity Administrator instance uses the same IP address as the failed XClarity Administrator, you can manage the device again using the RECOVERY_ID account and password (if applicable) and the Force management option.

      • If the managing XClarity Administrator was taken down before the devices were unmanaged.

      • If the devices were not unmanaged successfully.

      Attention

      Devices can be managed by only one XClarity Administrator instance at a time. Management by multiple XClarity Administrator instances is not supported. If a device is managed by one XClarity Administrator, and you want to manage it with another XClarity Administrator, you must first unmanage the device from the original XClarity Administrator, and then manage it with the new XClarity Administrator.