Admins Handbook

Create this reg-key and load it on the veeam server:

—
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\PowerShellSnapIns\VeeamPSSnapIn]
“PowerShellVersion”=”2.0”
“Vendor”=”Veeam”
“Description”=”Include the Veeam’s cmdlet.”
“VendorIndirect”=”VeeamPSSnapIn, Veeam”
“DescriptionIndirect”=”VeeamPSSnapIn,This is a PowerShell snap-in that includes the Veeam’s cmdlet.”
“Version”=”8.0.0.0”
“ApplicationBase”=”C:\\Program Files\\Veeam\\Backup and Replication\\Backup”
“AssemblyName”=”Veeam.Backup.PowerShell, Version=8.0.0.0, Culture=neutral, PublicKeyToken=bfd684de2276783a”
“ModuleName”=”C:\\Program Files\\Veeam\\Backup and Replication\\Backup\\Veeam.Backup.PowerShell.dll”

—

Load:
asnp VeeamPSSnapin

Run this as an example:
Get-VBRJob

If running HP servers you need the customized HP VMware image to install ESX.

Show controller configuration:
/opt/hp/hpssacli/bin/hpssacli controller all show detail

Show disk info:
/opt/hp/hpssacli/bin/hpssacli controller slot=0 physicaldrive all show

Enable Drive Write Cache
/opt/hp/hpssacli/bin/hpssacli controller slot=0 modify dwc=enable forced

Array cache read and write ratio (read/write)
/opt/hp/hpssacli/bin/hpssacli controller slot=0 modify cacheratio=40/60 forced

Example:
esxcli software vib update -d /vmfs/volumes/ESX03\:storage1/ESXi500-201502001.ZIP

Use “update” insted of “install” if using cust. image

Enable SSH access on ESX host
Install vmware vSphere CLI

Go to:
C:\Program Files (x86)\VMware\VMware vSphere CLI\bin

See configuration with:
vicfg-snmp.pl –server 10.0.0.42 -s

Setup snmp:
vicfg-snmp.pl –server 10.0.0.42 -c info -p 161 -t 10.0.0.10@161/public,10.0.0.17@161/public
CIM:
vicfg-snmp -server 10.0.0.42 -y indications

IPMI:
vicfg-snmp -server 10.0.0.42 -y sensors

10.0.0.42 — esx host
161 – port (udp)
10.0.0.10/10.0.0.17 target (HP SIM etc.)
info – my community string

Enable snmp
vicfg-snmp.pl –server 10.0.0.42 -E

Se configuration agin.
vicfg-snmp.pl –server 10.0.0.42 -s

test with snmpwalk:
SnmpWalk.exe -r:10.0.0.42 -c:info

Update:
On a ESXi5.1 and newer, use esxcfg-snmp.pl isted of vicfg-snmp.pl

Backup ESXi configuration on host

Vcli
http://www.vmware.com/support/developer/vcli/

Enter:
C:\Program Files\VMware\VMware vSphere CLI\bin

viccfg-cfgbackup.pl –server esxhost/IP –username root –password securepass -s c:\tmp\hostbackup.bak

Get-VM | Get-Snapshot | select vm, name, sizemb, created
or with grafical view:
Get-VM | Get-Snapshot | select vm, name, sizemb, created | Out-gridview

If you are using iscsi and have an fileserver, it is important that fileservices starts after the iscisi is of and running.
This specifik command soves this issue:

sc.exe config lanmanserver depand= msisci
(the space before msisci has to be there)

This works only with ESX3 and ESX4
Power down the VM
Add a line to the .vmx configuration
—
workingDir = “/vmfs/volumes/4e804054-a8b90408-d7d4-001e0b6dd2ce/vm-snapshots”
—
KB from VMware

You are using ESXpress and try to change the configuration from the console using ‘phd’.
This error pops up trying to save the configuration: “The esxpress gui is being used, make your changes there”.
The ESXpress software thinks it is controlled by the virtual phd appliance.
If you are not using that anymore, this can be disabled in the configuration on the host:
/etc/phd/esxpress.cfg
Change to ‘no’
—
# Global Quorum Configs
PHD_Q_ENABLE=’No’
#PHD_Q_ENABLE=Yes

Add portgroups and vlans
esxcfg-vswitch -A VLAN30 vSwitch1
esxcfg-vswitch -v 30 -p VLAN30 vSwitch1

Create VLAN script

vswitch AND portgroup needs to support MTU 9000 for optimal iscsi performance.

esxcfg-vswitch -l
esxcfg-vmknic -l

Change MTU on vSwitch
esxcfg-vswitch -m 9000 vSwitch1

Add vmk with MTU 9000 support
esxcfg-vswitch -A ISCSI vSwitch1
esxcfg-vmknic -a -i 172.16.0.32 -n 255.255.255.0 -m 9000 ISCSI

Jumbo frames MTU 9000 test to an iscsi target
vmkping 172.16.0.10 -s 9000

Save the output of this to a file:

esxcfg-vswitch -l
esxcfg-vmknic -l

Or make a backup of this file:
/etc/vmware/esx.conf

ESVA is a pre-built and easily configured email scanning Virtual Appliance (ESVA) that runs on VMware ESX Server. http://www.global-domination.org/ESVA.php

The central components are Clam antivirus and spam assassin.

After the basic setup you might want to customize some thing that cannot changed in the wizard or GUI.

Change the amount of cashed mails:

– $days_to_keep = 180; in /etc/cron.daily/clean.quarantine

– define(QUARANTINE_DAYS_TO_KEEP, 180); in /var/www/html/conf.php

– INTERVAL 180 DAY in /usr/local/bin/mailwatch/tools/db_clean.php

/etc/cron.daily/clean.quarantine

$disabled = 0;

$days_to_keep   = 14;

The default signature:

/etc/MailScanner/rules

– sig.html.rules

– sig.text.rules

Blocked filetypes:

/etc/MailScanner/filename.rules.conf

Change the max message size:

In webmin – postfix – “General resource control”.

An example is to add a zero.

Max size of a message: 102400000

Max size of a mailbox: 512000000

Or in /etc/postfix/main.cf: message_size_limit = 102400000

For 100 MB

Remove the “notify for SPAM”.

In the file: /etc/MailScanner/MailScanner.conf

Remove notify in the line:  Spam Actions = store notify

Disable Graylisting for some IP’s
/etc/sqlgrey/clients_fqdn_whitlist.local
/etc/sqlgrey/clients_ip_whitelist.local
/etc/init.d/sqlgrey restart

Remove the “MailScanner has detected a possible fraud attempt from…”:

Highlight Phishing Fraud = no

Remove the opportunity to read the emails in the Webinterface:

Edit /var/www/html/detail.php

Go the end and change the “view email” link.

// echo ”  <TD><A HREF=\”viewmail.php……………..”</A></TD>\n”;

echo ” <TD>…</TD>\n”;

Default SPAM score:

/etc/MailScanner/MailScanner.conf

Required SpamAssassin Score = 5

Remove Inline HTML Signature

In the file: /etc/MailScanner/MailScanner.conf

# Add the “Inline HTML Signature” or “Inline Text Signature” to the end

# of uninfected messages?

# This can also be the filename of a ruleset.

Sign Clean Messages = no

Auto Reply – Out of office

Treat Invalid Watermarks With No Sender as Spam = 2

Script in the email

Allow Script Tags = disarm

Or yes/no

Office 2010 Fileformats:

Microsoft Office 2007/2010 documents (.docx, .xlsx etc) seem to be archived XML documents and MailScanner does not like that by default.

The solution is to put this in filename.rules.conf

allow   \.xml\.rel$             –       –

allow   \.rel$                  –       –

allow   \.docx$                 –       –

allow   \.xlsx$                 –       –

allow   \.xml\d*\.rel$          –       –

allow   \.x\d+\.rel$            –       –

allow   \.bin$                  –       –

allow   \.wmf$                  –       –

allow   \.dat$                  –       –

Put this just above the “# Deny all other double file extensions..” line

allow   .doc$                   –       –

allow   .xls$                   –       –

And in MailScanner.conf change Maximum Archive Depth to 3

Maximum Archive Depth = 3

This makes MailScanner recognize the Office 2007/2010.

Disable Fuzzyocr:

Rename /etc/mail/spamassassin/FuzzyOcr.cf to something else.

Restart Mailscanner

Disable SPAM and or AV scan

/etc/MailScanner/MailScanner.conf

Spam Checks = no

Use SpamAssassin = no

Virus Scanning = no

—

In MailScanner.conf
Spam Checks = /etc/MailScanner/rules/spam.check.rules

In spam.check.rules:
FromOrTo:     domain.com      no
FromOrTo:       default   yes

Enable Remote ssh login

/etc/ssh/sshd_config

PermitRootLogin yes

Restart sshd

If running virtual, ESVA might loose time

Make a file in: /etc/cron.daily

—

#!/bin/sh

#

/usr/sbin/ntpdate 195.184.96.2

date +”%D %r `echo Cron completed`” >> /var/log/cron_job.log

—

chmod +x ntp.cron

Remember RAM!

Do you see this error in the maillog:

“too big for available disk space in /var/spool/MailScanner/incoming, skipping it”

Mailscanner is using this directory temporality to unpack files before scanning.

By default ESVA have 1024 MB of RAM. Half of that size is used to the RAM-based filesystem.

Maybe 512 MB for unpacking is to small.

See FSTAB and change the size here

tmpfs /dev/shm tmpfs defaults,size=1024m

The easy way (if you have RAM enough), is to just give ESVA more RAM.

Allow EXE in zipped attachments

/etc/MailScanner/archives.filename.rules.conf

allow \.exe$ Windows/DOS Executable

/etc/MailScanner/archives.filetype.rules.conf

#deny executable No executables

Remember to update resolv.conf

If this file does not contain a IP of an vallid DNS, you might get this error in the log: “Recipient address rejected: Domain not found”

This is an exaple with openDNS

/etc/resolv.conf

search localdom.local

nameserver 208.67.222.222

Block destination email address
/etc/postfix/recipient_access
Example:
refund_of_tax@testdom.com REJECT
skatdk@testdom.com REJECT

postmap /etc/postfix/recipient_access

Remember to add the file to postfix’s Main.cf:
Example:
smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination, reject_non_fqdn_recipient, reject_unknown_recipient_domain, check_policy_service inet:127.0.0.1:2501, check_recipient_access hash:/etc/postfix/recipient_access

Show ClamAV version
/usr/sbin/clamd -V

Remove mails from queue
List queue: mailq
Remove specific email: postsuper -d -3EFE828621

Exchange – Duplicate deliver
If you release a message that already have been delivered, it will not end up in the mailbox.
You can see what email that have “hit” this rule/functionality in the “EMC –> email tracking or powershell
Get-MessageTrackingLog -EventId DUPLICATEDELIVER

Block email baced on subject – postfix
main.cf
header_checks = regexp:/etc/postfix/header_checks

header_checks
/^Subject: Spam subject/ DISCARD

Restart postfix

Block email baced on subject – Mailscanner
/etc/MailScanner/mcp
Eksample:
header P2 Subject =~ /new Message/i
describe P2 Banned Subject
score P2 10

header P3 Subject =~ /new2 for you/i
describe P3 Banned Subject
score P3 10

Disable ahbl.org
/var/lib/spamassassin/3.004000/updates_spamassassin_org/20_dnsbl_tests.cf
# another domain-based blacklist
#header DNS_FROM_AHBL_RHSBL eval:check_rbl_envfrom(‘ahbl’, ‘rhsbl.ahbl.org.’)
#describe DNS_FROM_AHBL_RHSBL Envelope sender listed in dnsbl.ahbl.org
#tflags DNS_FROM_AHBL_RHSBL net
#reuse DNS_FROM_AHBL_RHSBL

Throttling too many connections from new source
edit:
/etc/sqlgrey/sqlgrey.conf
connect_src_throttle = 5
0 = Disable

/etc/init.d/sqlgrey restart

Allow password protected ZIP from one or more email/domains
Allow Password-Protected Archives = no
to:
Allow Password-Protected Archives = %rules-dir%/pp.archives.rules
pp.archives.rules:
FromOrTo: test@mydomain.com yes
FromOrTo: mydomain2.com yes
FromOrTo: default no

MailScanner restart

For a lot of reasons you could lose the connection to your ESX host. Now it cannot be configurated with the use of virtual center until this has been recreated.

esxcfg-nics -l
Gives an list of your physical nics

esxcfg-vswitch -l
esxcfg-vswitch -l > textfile.txt
Gives an list of your virtual switch configuration. If you “pipe” it to a textfile it can be easily readed.

esxcfg-vswitch -L vmnic6 vSwitch0
In this example a physical nic is added to a vSwitch.

The connection has now been recreated

You lost connection to the ESX 3,5 host using the vmware infrastructure client.
Now you want to restart the management agent to get it up and running again.
But for some reason the command “service mgmt-vmware restart” does not complete.
Restarting the host and its local running virtual servers is not an option, so what do you do.

Try this:
service pegasus stop
service mgmt-vmware stop
These commands may take some minutes.

ps -e f |grep vmware-watchdog
ps -e f |grep mgmt

Kill all processes you find:
kill -9 processid

Start the services (wait two minuets):
service mgmt-vmware start; sleep 1; service pegasus start

If it does not work try this instead:
service pegasus stop; service mgmt-vmware stop; sleep 30; service mgmt-vmware start; service pegasus start

—
service network restart.
—

vmware has a KB about this issue regerding:
mgmt-vmware restart script might not finish restarting the hostd
mgmt-vmware restart script does not finish restart the hostd.
The script gets stuck when stopping the service.
The SSH session to the ESX host becomes unresponsive.

KB ID: 1005566

If you migrade VM’s from ESX2,5 to ESX3,5 you have to upgrade the virtual hardware.
If this process hangs it could have something to do with the old virtual hardware.

A mounted floppy image on the old server could course the problem when upgrading the virtual hardware on the new host. The upgrade process can not be cancelled in the GUI so what do you do?

First, stop the hanged job by restarting this two services:

service vmware-vpxa restart
service mgmt-vmware restart

Then remove the VM from the inventory.

Edit the VM’s configuration by hand:
Set the floppy to false
floppy0.present = “false”

Disable other floppy properties
# floppy0.startConnected = “false”
# floppy0.fileName = “/div/vmscsi-1.2.0.4.flp”

Now re-add the VM to the inventory

Try to upgrade the virtual hardware now, it should work now.

How to avoid this to happen in the first place:
On the old ESX2,5 remember to remove floppydrives BEFORE migrating the VM to a new ESX3,5.

nano /etc/ssh/sshd_config
Change the line: “PermitRootLogin no” to: “PermitRootLogin yes“

Restart the sshd server:
/etc/init.d/sshd restart

apt-get install binutils cpp gcc make psmisc linux-headers-$(uname -r)
mount /dev/cdrom /mnt/
tar -C /tmp -zxvf /mnt/VMwareTools-xxx.tar.gz
umount /mnt
cd /tmp/vmware-tools-distrib ./vmware-install.pl
reboot

You are working with trust between two windows domains and gets this error.

Are you using vmware… ? yes, keep on reading.

This error does not occur on physical hardware but on a virtualized environment and only in vmware. The problem is the vmware driver  hgfs.sys. This driver handles the “vmware shared folders”.

To resole this disable vmware shared folders. It can be done thug regedit. Se the image below. Just change the “start” key value to 4. The path is:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hgfs

For more information about this issue See this blog here