Purpose
spseccfg - Displays host configuration information related to Security Services.
Syntax
spseccfg [-h | target_host]
Flags
Operands
Description
The spseccfg command obtains the DCE-hostname that was assigned when DCE was configured on the target host and the system partition name. It prints each name to standard output as a separate line.
Standard Output
The first line of output is the DCE-hostname, if DCE is installed and configured, otherwise an empty line.
If the host is an SP node, the second line of output is the system partition name. If the host is the control workstation, It is the default system partition name. Otherwise, for an independent workstation, it is the (short) local hostname.
Standard Error
Output consists of error messages, when the command cannot complete successfully.
Exit Values
Implementation Specifics
This command is part of the IBM Parallel System Support Programs (PSSP) Licensed Program (LP) (file set ssp.clients).
Prerequisite Information
The chapters on security in the PSSP: Administration Guide.
Location
/usr/lpp/ssp/bin/spseccfg
Examples
$spseccfg hosts/sp3.xyz.com sp3
$spseccfg 120.14.89.10 hosts/p16n9 p16part3
Purpose
spsetauth - Sets the authentication methods to be installed on the control workstation and in the partition.
Syntax
Flags
Operands
|Are a set of authentication methods to be set in the system |partition object in the System Data Repository (SDR). Specifies an |available authentication method. When you specify multiple |authentication methods, they must be specified in the order shown, which is |the order of precedence in their use by remote commands.
|You must specify at least one of the following authentication |methods or none. none can only be specified with the |-d flag. A secure remote command must be enabled before |you select none.
Description
This command only runs on the control workstation and is used per system partition. The -i flag updates or sets the auth_install attribute in the SDR. This defines the set of authentication capabilities for the node. Standard AIX is assumed since this is part of base AIX. |The -i flag does not allow the none |option.
The -d flag updates or sets the auth_root_rcmd attribute in the SDR. This defines which |authorization methods are used for root access to remote commands. |Both the -i and -d flags check that |the methods selected do not conflict with authentication methods enabled or |used in the system. Once the values are verified, checked, and updated in the SDR, the appropriate authentication files are created or copied via updauthfiles.
|If -d dce is selected, both config_spsec and |create_keyfiles must be run before running |spsetauth.
|If the -d flag is selected, the none option |is allowed. The none option cannot be combined with any other |authentication method.
If std is selected, it is set last as an authentication or authorization method. If dce is selected, it is set first to ensure a proper priority of methods.
Standard Output
Log file created in /var/adm/SPlogs/auth_install/log
Exit Values
Errors must be corrected and the command executed again before proceeding to any further configuration or installation steps.
Security
You must have root privilege and write access to the SDR to run this command.
Location
/usr/lpp/ssp/bin/spsetauth
Related Information
Commands: updauthfiles
Examples
/usr/lpp/ssp/bin/spsetauth -i -p par_1 k4
/usr/lpp/ssp/bin/spsetauth -d -p par_2 dce k4 std
|/usr/lpp/ssp/bin/spsetauth -d -p par_2 none
Purpose
spsitenv - Enters configuration parameters used by SP installation and system management scripts into the System Data Repository (SDR).
Syntax
Flags
You must ensure that the AIX level on the LP source (indicated by the cw_lppsource_name) matches the AIX level installed on your control workstation.
Specify true if the code is to be installed. Specify false if the code is not to be installed. The initial value is true.
The initial value is the host name of the control workstation.
To use an Internet NTP time server, your control workstation must be connected to the Internet. Specify ntp_config=internet and specify the full host name of an Internet time server with the ntp_server parameter.
To cause the control workstation and file servers to generate a consensus time based on their own date settings, specify ntp_config=consensus and specify ntp_server=''.
If you do not want to run NTP on the SP, specify ntp_config=none and ntp_server=''.
The initial value of ntp_config is consensus and the initial value of ntp_server is ''. If ntp_config is specified as either timemaster or internet, the ntp_server value must be a valid host name.
This field is meaningful only if usermgmt_config=true.
Specify remove_image=true if the images are to be removed.
Specify remove_image=false if the images are not to be removed.
The initial value is false.
The initial value of SDR_ASCII_only is true. |
The initial value is false.
Specify usermgmt=true if you want to have the SP User Management scripts in the Security & Users SMIT menu. Specify usermgmt=false to remove the scripts from the SMIT menu.
The initial value is true.
Operands
None.
Description
Use this command during installation of the SP or at a later time to identify SP configuration parameters in use at your location.
You can use the System Management Interface Tool (SMIT) to run the spsitenv command. To use SMIT, enter:
smit enter_data
and select the Site Environment Information option.
You cannot use SMIT if you are using AFS authentication services.
Security
You must have root privilege and write access to the SDR to run this command.
This command should be run only on the control workstation.
Location
/usr/lpp/ssp/bin/spsitenv
Examples
spsitenv ntp_config=consensus filecoll_config=true
|spsitenv restrict_root_rcmd=true | rcmd_pgm=secrshell | dsh_remote_cmd=/bin/ssh | remote_copy_cmd=/bin/scp
Purpose
spsvrmgr - Controls software level and state of the supervisor applications.
Syntax
Flags
Action checks include:
If rc is specified with the -q flag, the command will issue a return code indicating whether any of the hardware requires action. A return code of 0 indicates that no action is required. A return code of 2 indicates that at least one supervisor was found that required action.
If msg is specified with the -q flag, the command will issue a message indicating whether any of the hardware requires action. In this case, a return code of 0 is issued unless an error condition occurs.
If status is specified with the -r flag, the status is listed for all of the installed supervisors that support microcode download.
If action is specified with the -r flag, the status is listed for all of the installed supervisors that support microcode download and that also require an action.
In both cases, Status includes:
If status is specified with the -m flag, the status is listed for all of the installed supervisors that support microcode download.
If action is specified with the -m flag, the status is listed for all of the installed supervisors that support microcode download and that also require an action.
In both cases, Status includes:
| Attention |
|---|
|
In most cases, the -u flag started processes which will power off the target slots for the duration of the update. |
Operands
Description
The design of the SP supervisor control system divides the microcode used in the frame supervisor, node supervisor, and switch supervisor into the following two types:
The spsvrmgr command controls the software level and state of the supervisor applications that reside on the SP supervisor hardware.
Normally, commands are only sent to the hardware components in the current system partition. A system partition contains only processing nodes. The switches and the frames themselves are not contained in any system partition. To access hardware components not in the current system partition or to any frame or switch, use the -G flag.
The slot_spec option is interpreted as slot ID specifications. A slot ID specification names one or more slots in one or more SP frames and has either of two forms:
fidlist:sidlist or nodlist
where:
The first form specifies frame numbers and slot numbers. The second form specifies node numbers. An fval is a frame number or a range of frame numbers of the form a-b. An sval is a slot number from the set 0 through 17 or a range of slot numbers of the form a-b . An nval is a node number or a range of node numbers of the form a-b.
The relationship of node numbers to frame and slot numbers is shown in the following formula:
node_number = ((frame_number - 1) x 16) + slot_number
Refer to the hmcmds command for examples of the slot_spec.
Optionally, slot ID specifications can be provided in a file rather than as command flags. The file must contain one specification per line. The command requires that slot ID specifications be provided. If the command is to be sent to all SP hardware, the keyword all must be provided in lieu of the slot_spec option. However, the all keyword can only be specified if the -G flag is specified.
Files
The media that is the repository for the application microcode files is the /spdata/sys1/ucode directory structure.
Exit Values
Security
Microcode Download Mode: To execute the spsvrmgr command, you must be authorized to access the Hardware Monitor subsystem and must be granted Microcode Update permission, or VFOP permission depending on the SP Trusted Service in use, for the hardware objects (frames, slots) specified in the command. Commands sent to hardware objects for which the user does not have Microcode Update permission are ignored.
Microcode Query Mode: To execute the spsvrmgr command, you must be authorized to access the Hardware Monitor subsystem and must be granted Monitor permission for the hardware objects (frames, slots) specified in the command. State information is not returned for hardware objects for which the user does not have Monitor permission.
Restrictions
IBM suggests that you use this command through the RS/6000 SP Supervisor Manager option of the System Management Interface Tool (SMIT).
To access this command using SMIT, enter:
smit
and select the RS/6000 SP System Management option, then the RS/6000 SP Supervisor Manager option.
A list of options that correspond to the spsvrmgr command flags will be presented for selection.
You can also directly access this list of options using the following SMIT fast-path command:
smit supervisor
Implementation Specifics
The spsvrmgr command only interacts with SP supervisor hardware that supports the ability to download application microcode. Commands sent to slots that do not support this ability are ignored.
Location
/usr/lpp/ssp/bin/spsvrmgr
Related Information
Commands: hmcmds, hmdceobj, hmmon
Files: /spdata/sys1/spmon/hmdceacls, /spdata/sys1/spmon/hmacls
Refer to the "Installing and configuring a new RS/6000 system" chapter in PSSP: Installation and Migration Guide.
Examples
spsvrmgr -G -q msg all
You should receive output similar to the following:
spsvrmgr: At least one occurrence of supervisor hardware was found to
require attention.
Enter "smit supervisor" for installation options.
spsvrmgr -G -q rc all echo $?
Example usage in a script:
spsvrmgr -G -q rc all
if [[ $? = 2 ]]
then
echo "*** Attention*** One or more supervisors require action."
echo "Enter \"smit supervisor\" for installation options."
fi
spsvrmgr -G -r status 2:0-17
You should receive report output similar to the following:
spsvrmgr: Frame Slot Supervisor Media Installed Required
State Versions Version Action
_____ ____ __________ ____________ ____________ ____________
2 1 Active u_10.3a.0609 u_10.3a.060b None
u_10.3a.060a
u_10.3a.060b
____ __________ ____________ ____________ ____________
5 Active u_10.3a.0609 u_10.3a.060b None
u_10.3a.060a
u_10.3a.060b
____ __________ ____________ ____________ ____________
9 Active u_10.1a.0609 u_10.1a.060b None
u_10.1a.060a
u_10.1a.060b
____ __________ ____________ ____________ ____________
13 Active u_10.3a.0609 u_10.3a.060b None
u_10.3a.060a
u_10.3a.060b
spsvrmgr -G -r status all
You should receive matrix output similar to the following:
spsvrmgr: Frame Slots
_____ _______________________________________________
1 00 01 05 09 13 17
(Action) - - - - - -
_____ _______________________________________________
2 01 05 09 13
(Action) + + + -
Action Codes:
+ -- Required
- -- Not Required
spsvrmgr -G -r action 1:0-17
You should receive report output similar to the following:
spsvrmgr: Frame Slot Supervisor Media Installed Required
State Versions Version Action
_____ ____ __________ ____________ ____________ ____________
1 1 Active u_10.3a.0609 u_10.3a.060a Upgrade
u_10.3a.060a
u_10.3a.060b
____ __________ ____________ ____________ ____________
5 Inactive u_10.3a.0609 u_10.3a.060b Reboot
u_10.3a.060a
u_10.3a.060b
____ __________ ____________ ____________ ____________
9 Inactive u_10.1a.0609 u_10.1a.060b Reboot
u_10.1a.060a
u_10.1a.060b
spsvrmgr -u 1:1
You should receive installation output similar to the following:
spsvrmgr: Dispatched "microcode" process [24831] for frame 1 slot 1.
Process will take approximately 12 minutes to complete.
spsvrmgr: Process [24831] for frame 1 slot 1 completed successfully.
spsvrmgr -u 1:5,9
You should receive installation output similar to the following:
spsvrmgr: Dispatched "boot_supervisor" process [27956]
for frame 1 slot 5.
Process will take less than a minute to complete.
spsvrmgr: Dispatched "boot_supervisor" process [23606]
for frame 1 slot 9.
Process will take less than a minute to complete.
spsvrmgr: Process [27956] for frame 1 slot 5 completed successfully.
spsvrmgr: Process [23606] for frame 1 slot 9 completed successfully.
Purpose
spswplane - Configures the number of switch planes for use on the SP system.
Syntax
spswplane [-h] [-p planes] [-d]
Flags
Description
The spswplane command specifies the number of switch planes in the SP system. The command is executed during installation of the SP, and records the requested switch planes number in the System Data Repository (SDR). A check is made of this input value against existing SDR information to verify its validity. The command can also be used after installation to change the number of switch planes in the system, and to display the existing number of switch planes. This command must be run after |spadaptrs has been executed to add SP Ethernet |administrative local area network (LAN) adapters to your nodes and after spadaptrs has been run to set up the proper |SP switch adapters for all nodes for all switch planes.
Standard Output
All informational messages generated are written to standard output (stdout). All error messages are written to standard output.
Standard Error
Output consists of error messages, when the command cannot complete successfully.
Exit Values
Security
You must have root privilege or be a member of the AIX system group to run this command.
You must have write access to the SDR to run this command.
Restrictions
This command can only be executed on the control workstation.
Implementation Specifics
This command is part of the IBM Parallel System Support Programs (PSSP) Licensed Program (LP) ssp.basic file set.
Location
/usr/lpp/ssp/bin/spswplane
Examples
|spswplane -p 2
|spswplane -d
Purpose
spsyspar - Directly invokes the System Partitioning Aid Perspective graphical user interface (GUI).
Syntax
Flags
Operands
None.
Description
Use this command to launch the System Partitioning Aid window of the SP Perspectives GUI. |The spsyspar command is not valid on a system with an SP |Switch2 switch or on a switchless clustered enterprise server |system.
The System Partitioning Aid Perspective is used to view and manage the current system partitioning configuration. This tool can also be used to generate new configurations.
When the command is invoked, preferences which define the look and layout of the System Partitioning Aid window are prioritized in the following order:
|Files
|The users preferences are read from and saved to |$HOME/.spsyspar(User Profile Name). The System |Preferences are read from and saved to |/usr/lpp/ssp/perspectives/profiles/$LANG/.spsyspar(System Profile |name). If a new system partitioning configuration is created, the |following files are created under the layout directory: |layout.desc, nodes.syspar and a system |partition directory for each system partition in the layout. For each |system partition directory, a node list file and topology file are |created.
Security
You must have write access to the SDR to run this command.
Implementation Specifics
This command is part of the IBM Parallel System Support Programs (PSSP) Licensed Program (LP).
Prerequisite Information
For information on using the System Partitioning Aid Perspective and SP Perspectives, see the online help and the "Using SP Perspectives" chapter in the PSSP: Administration Guide.
Refer to the "Managing system partitions" chapter in PSSP: Administration Guide for additional information on the System Partitioning Aid.
See also Appendix A, "The System Partitioning Aid - A Brief Tutorial" in IBM RS/6000 SP: Planning, Volume 2, Control Workstation and Software Environment.
Location
/usr/lpp/ssp/bin/spsyspar
|Related Information
|You can also access the System Partitioning Aid Perspective by using the SP |Perspectives Launch Pad. The perspectives command invokes |the Launch Pad. Other Perspectives windows may be launched by invoking |the following commands: spevent, sphardware , and |spvsd. The sysparaid command provides a command |line interface into the System Partitioning Aid.
Examples
spsyspar
spsyspar -backgroundColor pink
Purpose
sptgtprin - Displays the target principal name for a service on an SP host.
Syntax
sptgtprin [-h | default-service-name [target-host]]
Flags
Operands
Description
The sptgtprin command displays the DCE principal name of the instance of the specified service that runs on a particular SP host. The operand target-host must be a network interface on an SP node or the control workstation. If no host is specified, the principal name is that used by the service on the local host.
Principal names have the form product/DCE-hostname/service, where DCE-hostname is the qualifier that distinguishes the particular instance of the service that runs on the target host.
For services that have multiple instances on the same host, each serving a single system partition, the name displayed by this command is not the true principal name. These service principals are qualified by partition name rather than DCE-hostname. For such services (that have the "p" attribute in the spsec_defaults file), you can construct the true principal name by replacing the DCE-hostname qualifier with the applicable Syspar name.
Standard Output
Output consists of one line containing the DCE principal name, when successful.
Standard Error
Output consists of error messages, when the command cannot complete successfully.
Exit Values
Implementation Specifics
This command is part of the IBM Parallel System Support Programs (PSSP) Licensed Program (LP) (file set ssp.clients).
Prerequisite Information
The chapters on security in PSSP: Administration Guide.
Location
/usr/lpp/ssp/bin/sptgtprin
Examples
Displaying the DCE principal name used by the Hardware Monitor daemon that runs on the control workstation, whose hostname is spcw.xyz.com, and whose DCE_hostname is spcw:
$sptgtprin ssp/hardmon spcw.xyz.com ssp/spcw/hardmon
Purpose
spunmirrorvg - Initiates unmirroring on a node or a set of nodes.
Syntax
spunmirrorvg {start_frame start_slot {node_count | rest} | -l node_list}
Flags
Operands
Description
The spunmirrorvg command uses information found in the Volume_Group object to initiate unmirroring on a node or a list of nodes. If the number of desired copies is already achieved (the number of copies of a volume group equals the "copies" attribute in the Volume_Group object) the command exits. If the number is not yet achieved, spunmirrorvg will invoke the AIX unmirror command to reduce the number of copies. If unmirrorvg is successful, the volume group is reduced by any physical volumes that are part of the volume group, that are not listed in the pv_list attribute. If there are non-empty logical volumes on the physical volumes, the volume group will not be reduced by the physical volume. If reducing the volume group is unsuccessful, the command exits with an error. Quorum is set based on the value of the "quorum" attribute for the volume group in the Volume_Group object. If the state of quorum changes, a message is sent that the node requires rebooting. spunmirrorvg also issues the bosboot command to rebuild the bootable image, and the bootlist command, to remove any physical volumes from the bootlist that no longer contain bootable logical volumes.
|Environment Variables
|PSSP 3.4 provides the ability to run commands using secure remote |command and secure remote copy methods.
|To determine whether you are using either AIX rsh or rcp |or the secure remote command and copy method, the following environment |variables are used. |If no environment variables are set, the defaults are |/bin/rsh and /bin/rcp.
|You must be careful to keep these environment variables consistent. |If setting the variables, all three should be set. The DSH_REMOTE_CMD |and REMOTE_COPY_CMD executables should be kept consistent with the choice of |the remote command method in RCMD_PGM: |
|For example, if you want to run spunmirrorvg using a secure remote |method, enter:
|export RCMD_PGM=secrshell |export DSH_REMOTE_CMD=/bin/ssh |export REMOTE_COPY_CMD=/bin/scp
Exit Values
Security
|You must have root privilege and a valid Kerberos ticket to run this |command, or be running with the AIX remote commands enabled.
Files
Log file created on node which contains AIX error messages if an error occurs during unmirroring: /var/adm/SPlogs/sysman/unmirror.out
Implementation Specifics
This command is part of the IBM Parallel System Support Programs (PSSP) Licensed Program (LP).
Location
/usr/lpp/ssp/bin/spunmirrorvg
Related Information
Commands: spchvgobj, spmirrorvg
Examples
spunmirrorvg -l 1
spunmirrorvg -l 1,2,3
Purpose
spverify_config - Verifies the active system partition configuration information for the SP system.
Syntax
spverify_config
Flags
None.
Operands
None.
Description
The spverify_config command is valid only on systems with no switch or with an SP switch. |The command is not valid on a system with an SP Switch2 switch or on |a switchless clustered enterprise server system.
This command is run by the spapply_config command after the System Data Repository (SDR) is updated. It can also be run by an administrator to verify that the SDR information is consistent (such as, after a system outage or a problem with the SDR). (This verification is only performed on a system which was partitioned beyond the initial single partition created at initial installation.)
Exit Values
Security
You must have root privilege to run this command.
Location
/usr/lpp/ssp/bin/spverify_config
Related Information
Commands: spapply_config, spcustomize_syspar, spdisplay_config
Files: nodelist, topology
Examples
To verify that the information in the SDR matches the customization information previously supplied by the user, enter:
spverify_config
Purpose
spvsd - Directly launches the IBM Virtual Shared Disk Perspective graphical user interface (GUI).
Syntax
Flags
Operands
None.
Description
Use this command to launch the IBM Virtual Shared Disk Perspective. This Perspective allows the user to view and control the IBM Virtual Shared Disk subsystem.
By default, when the window is brought up, it displays:
The IBM VSDs or IBM HSDs pane must be added for viewing.
The current system partition is indicated by a lightning bolt in the control workstation and system partitions pane. The Nodes pane displays all nodes in the current system partition. Other panes display virtual shared disks and hashed shared disks. You can control which panes are displayed by using the Add Pane and Delete Pane tool bar icons.
When the command is invoked, preferences that define the look and layout of the spvsd window are prioritized in the following order:
Files
The Users Preferences are read from and saved to $HOME/.spvsd(User Profile Name). The System Preferences are read from and saved to /usr/lpp/ssp/perspectives/profiles/$LANG/.spvsd(System Profile name).
The spvsd application resource file: /usr/lpp/ssp/perspectives/app-defaults/$LANG/Spvsd.
Security
Any user can run the spvsd command, although many actions in the VSD perspective require specific access to SP subsystems. The access depends on the type of security mechanism your SP system is using.
The minimum user requirements is Event Manager access in at least one partition. If this criteria is not met, the VSD perspective displays a message and exits. See the chapter on security in PSSP: Administration Guide for more information.
The following access is required to have complete use of the VSD perspective:
Implementation Specifics
This command is part of the IBM Parallel System Support Programs (PSSP) Licensed Program (LP).
Prerequisite Information
For information on using the IBM Virtual Shared Disk Perspective and SP Perspectives, see the online help and the "Using SP Perspectives" chapter in PSSP: Administration Guide. For information about the IBM Virtual Shared Disk subsystem, see PSSP: Managing Shared Disks.
Location
/usr/lpp/ssp/bin/spvsd
|Related Information
|You can access the IBM Virtual Shared Disk Perspective by using the SP |Perspectives Launch Pad. The perspectives command invokes |the Launch Pad. Other Perspectives windows may be launched by invoking |the following commands: spevent, sphardware, and |spsyspar.
|PSSP: Managing Shared Disks
Examples
spvsd
spvsd -fontBold
Purpose
st_clean_table - Forces the unload of the job switch resource table for a specified window on the specified node.
Syntax
st_clean_table {-h | -? | node_name} [ -w window_id] [ -a adapter] [-k]
Flags
Operands
Description
Use this command to override user ID (uid) checking and to unload the job switch resource table window on the node specified. The JSRT Services should be used for non-reserved windows.
Normal unloading of the job switch resource table by the swtbl_unload_table API checks that the user ID (uid) of the unload matches the uid specified during the load. The st_clean_table command ignores this check and allows the administrator to unload the window from a node. It is intended to be used for error recovery and not for normal unloading. Use this command when a parallel job has left a process in use and the window did not unload with the swtbl_unload_table API. If -k is not specified and a job is using the switch table, the unload will not be performed. The default window is defined within the st_client.h file. A single job switch resource table may contain more than one window. This command needs to be issued for every window within the table. Use the st_status command to obtain the current state of the windows. Additional error and information may be found in the /var/adm/SPlogs/st/st_log file. Additional debug information will be recorded in the log by setting the SWTBLAPIERRORMSGS environment variable to yes.
Files
Standard Output
After the job switch resource table window is successfully unloaded, the status should be ST_SWITCH_NOT_LOADED.
Exit Values
Security
You must have appropriate access to the switch table to run this command.
If DCE security checking is being used, you must have the DCE credentials of the switchtbld-clean group in order to run this command. If DCE security checking is not being used, you must have root privilege to run this command.
Location
/usr/lpp/ssp/bin/st_clean_table
Related Information
See the chgcss command for information about RESERVED windows.
Commands: st_status
Examples
To stop the process currently using window 1 on adapter css0, and unload the window from k10n10, enter:
st_clean_table -w 1 -a css0 -k k10n10
This produces the result:
Node k10N10 adapter css0 window 1 has been unloaded