Table of Contents
AIX Service Update Management Assistant (SUMA)
Suma act as automatic download server for AIX packages
Firewall - proxy config for download
Here you'll find the IP address for downloading
https://www.ibm.com/support/pages/node/6573219
NOTE
- IP addresses for the esupport.ibm.com server are changed from the 2023 version of the esupport.ibm.com server.
- Add firewall rules for all new IP addresses. However, do not change or remove the existing firewall rules.
- The port numbers of the fix distribution website can be either 80 for HTTP or 443 for HTTPS.
IBM registration
Requirements
If Suma cannot identify proper entitlement for the server, then you need to go to the ESS website, login and go to “My Entitled Software” to download the required software from the website.
If you cannot see the required product, you may need to register using the “Register IBM Customer Number” option.
Else report this directly to the FixCentral/SUMA entitlement team via the FixCentral website using the blue “Contact and feedback” button at the right side of the screen.
The country code suma must be register for the machine serial where suma is hosted !
Suma config
Prerequisites: packages required for SUMA
[root@aix01]/# lslpp -Lc bos.ecc_client:bos.ecc_client.rte:7.3.2.0: : :C: :Electronic Customer Care Runtime : : : : : : :0:0:/:2345 bos.suma:bos.suma:7.3.2.1: : :C: :Service Update Management Assistant (SUMA) : : : : : : :0:0:/:2419 bos.esagent:bos.esagent:7.3.2.1: : :C: :Electronic Service Agent : : : : : : :0:0:/:2419
[root@aix01]/# /usr/ecc/bin/config_conn_path -c 'PRIMARY' -y 'HTTP_PROXY' -t 'YES' -a '10.10.10.10' -x '8443' ########################################################### Testing HTTP Proxy Service Configuration Performing HTTP Proxy Connectivity Test ... SUCCESS [root@aix01]/# /usr/ecc/bin/config_conn_path -d 'PRIMARY' #type:ttyport:modem_type:primary_location:secondary_location:prefix:host:port:userid HTTP_PROXY::::::10.10.10.10:8443:
Test connection using Electronic Service Agent
[root@aix01]/# /usr/esa/bin/verifyConnectivity -tw Performing Connectivity Verification Test success Edge_Bulk_Data_1 esupport.ibm.com 129.42.56.189 443 success Edge_Bulk_Data_2 esupport.ibm.com 129.42.54.189 443 success Edge_Bulk_Data_3 esupport.ibm.com 129.42.60.189 443 success Edge_Bulk_Data_4 esupport.ibm.com 2620:0:6c2:200:129:42:60:189 443 success Edge_Bulk_Data_5 esupport.ibm.com 2620:0:6c4:200:129:42:54:189 443 success Edge_Bulk_Data_6 esupport.ibm.com 2620:0:6c0:200:129:42:56:189 443 success Edge_Fix_Repository_1 esupport.ibm.com 129.42.56.189 80 success Edge_Fix_Repository_2 esupport.ibm.com 129.42.54.189 80 success Edge_Fix_Repository_3 esupport.ibm.com 129.42.60.189 80 success Edge_Fix_Repository_4 esupport.ibm.com 2620:0:6c2:200:129:42:60:189 80 success Edge_Fix_Repository_5 esupport.ibm.com 2620:0:6c4:200:129:42:54:189 80 success Edge_Fix_Repository_6 esupport.ibm.com 2620:0:6c0:200:129:42:56:189 80 12 successes 0 failures Connectivity Verification Test Results: succeeded
[root@aix01]/# suma -c -a DOWNLOAD_PROTOCOL=https [root@aix01]/# suma -c -a FRAMEWORK=ECC [root@aix01]/# cat /var/suma/data/config.suma DOWNLOAD_PROTOCOL = https FRAMEWORK = ECC LOGFILE_VERBOSE = 4 COUNTRY_CODE = DE [root@aix01]/# suma -c -a DOWNLOAD_PROTOCOL=https [root@aix01]/# suma -c FIXSERVER_PROTOCOL=https DOWNLOAD_PROTOCOL=https DL_TIMEOUT_SEC=180 DL_RETRY=1 HTTP_PROXY= HTTPS_PROXY= USE_FIPS_PROVIDER=no CHECK_CERTIFICATE_REVOCATION=no SCREEN_VERBOSE=LVL_INFO NOTIFY_VERBOSE=LVL_INFO LOGFILE_VERBOSE=LVL_VERBOSE MAXLOGSIZE_MB=1 REMOVE_CONFLICTING_UPDATES=yes REMOVE_DUP_BASE_LEVELS=yes REMOVE_SUPERSEDE=yes TMPDIR=/var/suma/tmp WEB_IDENTITY_FILE= FRAMEWORK=ECC [root@aix01]/# suma -D DisplayName= Action=Download RqType=Latest RqName= Repeats=y DLTarget=/usr/sys/inst.images NotifyEmail=root FilterDir=/usr/sys/inst.images FilterML=7300-02 MaxDLSize=-1 Extend=y MaxFSSize=-1
Change the localization (country code)
# echo "COUNTRY_CODE = DE" >> /var/suma/data/config.suma # export SUMA_COUNTRY_CODE=DE"
Unfortunately, the attributes HTTP_PROXY and HTTPS_PROXY are no longer supported by SUMA. This is also documented in the SUMA manual page!
The SUMA command shares the proxy connectivity settings with the Electronic Service Agent.
Test Downloading
[root@aix01]/# suma -x -a Action=Preview -a RqType=Latest
[root@aix01]/# suma -x -a RqType=SP -a Action=Download -a FilterML=7200-05 -a RqName=7200-05-04-2220 -a DLTarget=/suma/tmp
Examples:
# suma -x -a Action=Metadata -a RqType=Latest -a FilterML=7100-02 -a DLTarget=/export/eznim/SUMA # suma -x -a DisplayName=Test -a Action=Preview -a RqType=Latest
Action: Preview, Download, Clean, Metadata
RqType: TL, PTF, SP, Latest
RqType for Metadata: TL, SP, Latest
DLTarget: Contains the directory location where the downloaded files are stored.
Debug
suma -l suma -c -a LOGFILE_VERBOSE=LVL_DEBUG suma -c suma -D /usr/esa/bin/verifyConnectivity -tw /usr/ecc/bin/config_service_proxy -d /usr/ecc/bin/config_conn_path -d 'PRIMARY' /usr/ecc/bin/config_conn_path -d 'SECONDARY' /usr/ecc/bin/config_conn_path -d 'TERTIARY'
[root@aix01]/# /usr/sbin/suma -x -a RqType=SP -a Action=Download -a RqName=7200-02-01-1732 -a FilterML=7200-02 -a DLTarget=/tmp -a DisplayName="Download request for oslevel 7200-02-01-1732"
We will use the following two commands for this example case
[root@aix01]/# /usr/sbin/suma -x -a Action=Preview -a RqType=Latest -a FilterML=7200-02 -a DisplayName="Preview Latest 72 TL2 Download Request" -a DLTarget=/tmp [root@aix01]/# /usr/sbin/suma -x -a Action=Metadata -a RqType=Latest -a FilterML=7200-02 -a DisplayName="Actual Latest 72 TL2 Download Request" -a DLTarget=/tmp
http://gibsonnet.net/blog/dwarchive/AIX%20SUMA%20in%202018%20(Chris%27s%20AIX%20Blog).html
Errors
Proxy troubles
SUMA was integrated with IBM Cloud Service since AIX 7.3 TL2, it's changed to use the FRAMEWORK CHCC ( Call-Home Connect Cloud )
Suma using CHCC doesn't support use of proxy server.It was solved by setting the framework to ECC as mentioned earlier as below :
# suma -c -a FRAMEWORK=ECC
Java in suma
By default SUMA requires Java7, so change the version to Java8
[root@aix01]/var/spool/cron/crontabs# suma -x -a RqType=SP -a Action=Download -a FilterML=7200-05 -a RqName=7200-05-04-2220 -a DLTarget=/suma/tmp Exception in thread "main" java.lang.UnsupportedClassVersionError: JVMCFRE003 bad major version; class=ECCWrapper, offset=6
Change Java version
# vi /usr/suma/bin/suma
find the following variable:
# Global Variables
#########################################################
######################
my $JAVA = "/usr/java7_64/jre/bin/java";
if (! -e $JAVA) {
find_java();
}
change it to:
# Global Variables
#########################################################
######################
my $JAVA = "/usr/java8_64/jre/bin/java";
if (! -e $JAVA) {
find_java();
}
Then SUMA starts working as expected.
The script use find_java, that list java fileset as follow : /usr/java7/jre/bin/java /usr/java7/bin/java /usr/java7_64/jre/bin/java /usr/java7_64/bin/java /usr/java8_64/jre/bin/java /usr/java8_64/bin/java
It takes the first that is executable it select java 7 and errors out.
Problem summary
suma failed because of Java 7 is selected instead of Java 8
Problem conclusion
Change the default java search path to Java 8
Java in ECC
[root@suma001p] /root> /usr/ecc/bin/config_conn_path -c 'PRIMARY' -y 'HTTP_PROXY' -t 'YES' -a '10.10.10.10' -x '2233' ########################################################### Testing HTTP Proxy Service Configuration Performing HTTP Proxy Connectivity Test ... open2: exec of /usr/java6/jre/bin/java -Djava.net.preferIPv6Addresses=true -cp :/usr/ecc/lib/CITProvider.jar:/usr/ecc/lib/com.ibm.ws.webservices.thinclient_8.5.0.jar:/usr/ecc/lib/commons-codec-1.3.jar:/usr/ecc/lib/commons-httpclient-3.1.jar:/usr/ecc/lib/commons-logging-1.1.jar:/usr/ecc/lib/CommonServices.jar:/usr/ecc/lib/commonutils.jar:/usr/ecc/lib/ConnectivityServices.jar:/usr/ecc/lib/depcheck.jar:/usr/ecc/lib/ESAUtilities_1.0.0.jar:/usr/ecc/lib/ibmxmlcrypto.jar:/usr/ecc/lib/InventoryCollectionClient.jar:/usr/ecc/lib/InventoryServices.jar:/usr/ecc/lib/invtool.jar:/usr/ecc/lib/ProblemReportingServices.jar:/usr/ecc/lib/Protocol.jar:/usr/ecc/lib/ResourceCaching.jar:/usr/ecc/lib/ResourceCollection.jar:/usr/ecc/lib/ResourceCollectionClient.jar:/usr/ecc/lib/ResourceCollectionService.jar:/usr/ecc/lib/sblim-cim-client2.jar:/usr/ecc/lib/scheduler.jar:/usr/ecc/lib/StatusServices.jar:/usr/ecc/lib/SysMgmtCore.jar:/usr/ecc/lib/SystemContext.jar:/usr/ecc/lib/TQserrano-3.27.18c.jar:/usr/ecc/lib/uim.jar:/usr/ecc/lib/UimCim.jar:/usr/ecc/lib/uimengine.jar:/usr/ecc/lib/uimfilerepository.jar:/usr/ecc/lib/UIMPLRTProvider.jar:/usr/ecc/lib/UIMProviderCore.jar:/usr/ecc/lib/uimutil.jar:/usr/ecc/lib/UpdateServices.jar:/usr/ecc/lib/xmldsig.jar:/usr/ecc/lib/xmlstream.jar com.ibm.esa.activation.ConnectivityServiceTest testProxyConnection 10.10.10.10 2233 failed: No such file or directory at /usr/ecc/lib/ECC/Utils.pm line 136.
vi /usr/ecc/lib/ECC/Utils.pm
...
sub getJava() {
if ( -d "/usr/java8_64" && -d "/usr/java8_64/bin" ) {
return Definitions::JAVA8_64
}
elsif ( -d "/usr/java7" && -d "/usr/java7/bin" ) {
return Definitions::JAVA7
}
else {
return Definitions::JAVA6
}
}
Serial number
0500-059 Entitlement is required to download
if there is an error message, it can be a maintenance contract topic
