The most common way to configure the HMC for TrueSight Capacity Optimization (TSCO) data collection is via the $BEST1_HOME/bgs/scripts/configure_openssh configuration script. This command will do all the necessary configuration to allow a key based login on the HMC to allow the bgsphyspartcollect binary to gather data from the HMC without specifying a password.

The configure_openssh script is, by far, the easiest way to configure the Perform product to collect data from the HMC. Information regarding the implementation of HMC data collection on an AIX machine with hardware partitions is documented in the Support for AIX Partitions section of the BMC Truesight Capacity Optimization (TSCO) Capacity Agent documentation.

It is also possible to do everything the configure_openssh script would do manually on the command line. Those steps are listed in Manually configuring the AIX environment section of the documentation.

The bgsphyspartcollect command uses its own SSH configuration file from the /usr/adm/best1_V.V.VV/local/setup/.ssh directory. This is also where the id_rsa and id_rsa.pub files that are used to identify the user are created by the configure_openssh script. If you wanted to use an existing HMC account then I believe you'd need to manually create the id_rsa and id_rsa.pub files with the keys for that user. Assuming the HMC already has that user's public key in its authorized_keys file the bgsphypartcollect binary should be able to connect to the HMC without a password at that point.

Q: How can a different HMC account name be used for Perform's HMC data collection?

The default HMC user account is called 'hmcviewer'. To use a different account name it is necessary to create a $BEST1_HOME/local/setup/Collect.cfg file that overrides the default username.

--- Begin $BEST1_HOME/local/setup/Collect.cfg ---
BEGIN_CONFIG
  BEGIN_SYSTEM_COLLECT
    BEGIN_HARDWARE_PARTITION
      ENABLE = "TRUE"
      BEGIN_HMC
#        HMC_NAME = "hmcconsole"
        HMC_USER_NAME = "mysshuser"
#        HMC_MANAGED_SYSTEM = "Server-9113-550-SN109663D"
      END_HMC
    END_HARDWARE_PARTITION
  END_SYSTEM_COLLECT
END_CONFIG
--- End $BEST1_HOME/local/setup/Collect.cfg ---

The above Collect.cfg file would use the 'mysshuser' account instead of the 'hmcviewer' default user. The HMC_NAME and HMC_MANAGED_SYSTEM entries are commented out so the bgsphyspartcollect would continue to automatically determine those parameters.  Having the HMC_MANAGED_SYSTEM configuration override parameters commented out is almost always the correct configuration since that will always be automatically detected correctly on the machine.  Typically the HMC_NAME will also be commented out in the configuration as that can be automaticaly detected but there are environments (particularly if you want to force the backup HMC to be queried) where it is approriate to specific a specific HMC hostname or IP address.

Q: How does the configure_openssh script configure the HMC for Perform data collection?

The purpose of the configure_openssh script is to create the necessary user account on the HMC and configure it for key based ssh login authentication. The account created on the HMC is granted to lowest access level of the 5 types of accounts available ('viewer' access). When the configure_openssh script is executed it will prompt for the password of the 'hmcroot' user on the HMC. This is the root equivalent account on the HMC and is the account used to create and configure the new 'hmcviewer' user used by Perform data collection.

Once the 'hmcviewer' account has been created and configured that is the account that the 'bgsphyspartcollect' binary will use to access the HMC and collect the data that is populated into the 'Physical Partition Configuration' metric group.

Q: How should HMC data collection be configured to collect data from both the primary and backup HMC for a frame?

The Perform collector can only be configured to collect data from a single HMC so if you wanted to have data collection configured for both the primary HMC and the backup HMC it would be necessary to configure one machine to collect data from the primary HMC and another to collect data from the backup HMC. In that case you'd probably want to run the configure_openssh command on each machine and specify the '-H [HMC]' flag when you run the script to specify which HMC to configure the LPAR to connect to. Since the primary HMC and the backup HMC should have the exact same data when both are available there will be no problem with one LPAR collecting data from the primary HMC and the other collecting it from the backup HMC. Analyze will pick data from one machine to use for the whole frame (or at least all LPARs processed together in that run) and if data isn't available on one for the period it will pick the other machine.

Q: What is the easiest way to configure multiple machines in the frame to connect to the HMC?

You can either re-run the configure_openssh script on each separate LPAR or you can copy the $BEST1_HOME/local/setup/.ssh directory from a working LPAR n the frame to the new LPAR. If you copy the .ssh directory then both machines will be using the same ssh key which might be somewhat easier to manage in a large environment.

Q: What is the best practice methodology to configure an AIX partition to collect data from the HMC if the user account has already been created on the HMC?

The configure_openssh script support several different flags that control the behavior of the script.

For example, if the user account to be used for access to the HMC already exists on the HMC the following command can be run to configure that account:
  $BEST1_HOME/bgs/scripts/configure_openssh -u [username] -s

Where [username] is the username of the existing HMC account.

That command will attempt to configure an already existing account on the HMC.  The command will prompt for the password for that already existing again (it will not be necessary to provide the hscroot user password).

When using an existing account it is possible for the configure_openssh script to encounter site specific configuration problems (For example, if permissions of the $HOME/.ssh directory are locked down on the HMC for the user) and in those cases it may be necessary for Technical Support to review the $BEST1_HOME/bgs/log/[hostname]-configure_openssh.log file to understand why the script failed.

Regardless of how one sets up the account, the verification steps described in the product documentation are correct and should be executed to validate that the access is working as expected.

Q: What is the best practice methodology to configure an AIX partition to collect data from the HMC if the user account has already been created on the HMC and a public/private key pair is already available for that user?

If the user account already exists and the public/private key pair is already available that allows access to that user the process would be to get a copy of the key from the HMC Administrators and copy then into some directory on the LPAR being configured to access the HMC.  Then add the '-d' flag to the configure_openssh command and it will look for the keyfile in that directory (rather than creating a new public/private key pair).  So, it is going to check the specified directory for an "id_rsa" or "id_dsa" file (by default 'rsa' keys are used but that can be changed via the '-t dsa' flag to configure_openssh) and if it finds it that will be the key copied to the $BEST1_HOME/local/setup/.ssh directory (rather than creating a new key).

So, if the account has already been configured for a keyfile based login then the configure_openssh won't even need to communicate with the HMC during the configuration phase.

Assuming the 'id_rsa' keyfile has been copied to the $HOME/myuser_key directory and the 'myuser' user has already been configured to accept key-based login using this key the command to run would be:

  $BEST1_HOME/bgs/scripts/configure_openssh -u myuser -d $HOME/myuser_key -s